Files
dashcaddy/status/js
Sami 9a0abc02d1 Fix remaining frontend security issues (3 medium, 2 low)
- Escape user-input port number in app-selector innerHTML
- Replace inline onclick with addEventListener in backup history (HTML entity decode bypass)
- Add Content-Security-Policy meta tag with script hash
- Replace document.write with textContent for footer year
- Filter __proto__/constructor/prototype in Object.assign calls

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-07 02:06:55 -08:00
..
2026-03-05 02:26:12 -08:00
2026-03-05 02:26:12 -08:00
2026-03-05 02:26:12 -08:00
2026-03-05 02:26:12 -08:00
2026-03-05 02:26:12 -08:00
2026-03-05 02:26:12 -08:00
2026-03-05 02:26:12 -08:00
2026-03-05 02:26:12 -08:00
2026-03-05 02:26:12 -08:00
2026-03-05 02:26:12 -08:00

DashCaddy Onboarding System

This directory contains the JavaScript modules for the user onboarding tooltip system.

Files

  • onboarding.js - Main entry point, initializes the onboarding system
  • tour-manager.js - Orchestrates the onboarding flow and manages tour state
  • progress-tracker.js - Manages persistent storage of user progress
  • tooltip-definitions.js - Defines all tooltip content and positioning
  • dns-template-selector.js - Presents DNS server template options
  • theme-adapter.js - Ensures tooltips match the current dashboard theme

Load Order

The scripts are loaded in the following order (as defined in status/index.html):

  1. progress-tracker.js
  2. theme-adapter.js
  3. tooltip-definitions.js
  4. dns-template-selector.js
  5. tour-manager.js
  6. onboarding.js (main initialization)

Dependencies

Integration

The onboarding system integrates with:

  • Dashboard theme system (via CSS variables)
  • App template selector (for DNS server deployment)
  • Local storage (for progress persistence)

Development

Each module is wrapped in an IIFE (Immediately Invoked Function Expression) to avoid global namespace pollution. Modules communicate through well-defined interfaces and the window object where necessary.