Holefully solve #27 by voiding html form submit action

ftracker/notifier.py

@@ -1,4 +1,5 @@
 import json
+import copy
 from slugify import slugify
 from threading import Thread, Event
 from datetime import datetime, timedelta
@@ -33,7 +34,7 @@ class Notifier(Thread):
 
 		ps = ps[0]
 
-		print("Sending notification", arrival, ps)
+		print("Sending notification", arrival, ps, self.vapid_creds)
 
 		subscription = ps['sub']
 		notification = {
@@ -41,13 +42,15 @@ class Notifier(Thread):
 			'body': "You didn't sign out of ftracker yet",
 			'arr': arrival
 		}
+		privkey = self.vapid_creds['private_key']
+		claims = copy.copy(self.vapid_creds['claims'])
 
 		try:
 			webpush(
 				subscription,
 				json.dumps(notification),
-				vapid_private_key = self.vapid_creds['private_key'],
+				vapid_private_key = privkey,
-				vapid_claims = self.vapid_creds['claims']
+				vapid_claims = claims
 			)
 			print("Notification sent")
 			return None

web/index.html

@@ -36,24 +36,23 @@
 			document.write(qp.action ? (qp.action + "<br>Room " + qp.room) : 'FTracker<br>V1.1')
 		</script></h1>
 		<div id="startpage">
-			This is a web app to track which people
+			This is a web app to track which people were in the same rooms at
-			were in the same rooms at which times in order to backtrace
+			which times in order to backtrace potential viral infections.<br><br>
-			potential viral infections.<br><br>
+			If you've reached this page that either means your're testing
-			If you've reached this page that either means your're
+			things or something has gone quite wrong with the URL.<br>
-			testing things or something has gone quite wrong with the\
-			URL.<br>
 			In the former case: Yay it works! In the latter you should
 			probably contact an admin or a dev nearby :(<br><br>
 			Here are a few links for testing:<br>
 			<a href="/view">View Data</a>,
 			<a href="/QRgen">Door Sign Generator</a>,
 			<a href="/?arrival=42">Test Arrival</a>,
-			<a href="/?departure=42">Test Departure</a><br><br>
+			<a href="/?departure=42">Test Departure</a>,
+			<a href="javascript:localStorage.removeItem('pushsub')">Reset Push Subscription</a><br><br>
 			&copy; 2020 made by <a target="_blank" href="mailto:&#111;&#46;&#119;&#105;&#110;&#107;&#101;&#108;&#115;&#64;&#102;&#97;&#115;&#116;&#116;&#117;&#98;&#101;&#46;&#100;&#101;">Oskar</a>
 			for <a target="_blank" href="//fasttube.de">FaSTTUBe</a>.<br>
 			For source code & licensing see <a href="//git.fasttube.de/FaSTTUBe/ftracker">git repo</a>
 		</div>
-		<form id="mainform" style="display: none">
+		<form id="mainform" action="javascript:void(0);" style="display: none">
 			<label>
 				Full Name:<br>
 				<input type="text" name="name" id="name" placeholder="John Doe" required>

web/main.js

@@ -6,10 +6,17 @@ if (qp.action) {
 	mform.style.display = 'block'
 }
 
-// Prefill the name field if it was successfully entered before
+// Get the name field if it was successfully entered before
 var savedName = localStorage.getItem('name')
-if (savedName && qp)
+if (qp && qp.name) {
+	// Forced Admin checkout - prefill qp name and auto-agree
+	document.getElementById('name').value = qp.name.replace(/-/g, ' ').toUpperCase();
+	document.getElementById('agree').checked = true
+	document.getElementById('agree').parentElement.style.display = 'none'
+} else if (savedName && qp) {
+	// Prefill the client's locally saved name
 	document.getElementById('name').value = savedName
+}
 
 // 2nd script, server API communication
 var name, datetime, agreed, tested
@@ -261,16 +268,18 @@ function registerPush(name, pushServerPublicKey) {
 		}).then(function(subscription) {
 			console.log("User is subscribed:", subscription);
 
+			var jsonSub = JSON.stringify({
+				name: name,
+				sub: subscription
+			});
+
 			fetch('/pushsubscribe', {
 				method: "POST",
 				headers: {"Content-Type": "application/json"},
-				body: JSON.stringify({
+				body: jsonSub
-					name: name,
-					sub: subscription
-				})
 			}).then(function(res) {
 				if (res.ok)
-					localStorage.setItem('pushsub', subscription);
+					localStorage.setItem('pushsub', jsonSub);
 			});
 		});
 	});

web/view.js

@@ -88,6 +88,14 @@ function exportCSV() {
 
 }
 
+function offerUserCheckout(event) {
+
+	var name = event.target.getAttribute('data-name')
+	var room = event.target.textContent
+	window.open(`/?departure=${room}&edittime=1&name=${name}`, '_blank').focus();
+
+}
+
 function renderData() {
 
 	if (data == null) {
@@ -165,8 +173,11 @@ function renderData() {
 			if (entry.tested)
 				block.classList.add('tested') // = 3G
 
-			if (dur > 60 * 24)
+			if (dur > 60 * 24) {
 				block.classList.add('implausible')
+				block.setAttribute('data-name', name)
+				block.addEventListener('click', offerUserCheckout);
+			}
 
 			row.appendChild(block)