From ee10a7e480da8ad828f2e28b4578e7d093709a62 Mon Sep 17 00:00:00 2001
From: DungTT <dungtt@phenikaa-x.com>
Date: Fri, 3 Apr 2026 09:06:38 +0700
Subject: [PATCH] sercurity

---
 public/js/app.js | 42 ++++++++++++++++++++++++------------------
 1 file changed, 24 insertions(+), 18 deletions(-)

diff --git a/public/js/app.js b/public/js/app.js
index 44c8b55..6615b8d 100644
--- a/public/js/app.js
+++ b/public/js/app.js
@@ -596,6 +596,17 @@ class AccountManager {
                                 <tbody class="divide-y divide-slate-100 accounts-table-body">
                                     ${pageInfo.data.map(acc => {
                                         const isOwnAccount = acc.UserId == currentUserId;
+                                        const actionContent = isOwnAccount
+                                            ? `<button class="p-1.5 text-slate-400 transition-colors view-account hover:text-slate-600" data-account-id="${acc.AccountId}" title="View Details">
+                                                    <span class="material-symbols-outlined text-lg">info</span>
+                                                </button>
+                                                <button class="p-1.5 text-slate-400 transition-colors edit-account hover:text-primary" data-account-id="${acc.AccountId}" title="Edit">
+                                                    <span class="material-symbols-outlined text-lg">edit</span>
+                                                </button>
+                                                <button class="p-1.5 text-slate-400 transition-colors delete-account hover:text-error" data-account-id="${acc.AccountId}" title="Delete">
+                                                    <span class="material-symbols-outlined text-lg">delete</span>
+                                                </button>`
+                                            : '<span class="text-slate-400 text-xs">-</span>';
                                         return `
                                         <tr class="hover:bg-slate-50/80 transition-colors group account-row" data-account-id="${acc.AccountId}" data-user-id="${acc.UserId}">
                                             <td class="px-4 py-3 text-sm font-medium text-slate-900">${acc.Username || acc.FullName || '-'}</td>
@@ -605,15 +616,7 @@ class AccountManager {
                                                 <span class="px-2 py-1 bg-blue-100 text-blue-700 rounded text-xs font-semibold">${acc.AppName || '-'}</span>
                                             </td>
                                             <td class="px-4 py-3 text-right">
-                                                <button class="p-1.5 text-slate-400 transition-colors view-account ${isOwnAccount ? 'hover:text-slate-600' : 'opacity-50 cursor-not-allowed'}" data-account-id="${acc.AccountId}" ${isOwnAccount ? '' : 'disabled'} title="${isOwnAccount ? 'View Details' : 'Can only view own accounts'}">
-                                                    <span class="material-symbols-outlined text-lg">info</span>
-                                                </button>
-                                                <button class="p-1.5 text-slate-400 transition-colors edit-account ${isOwnAccount ? 'hover:text-primary' : 'opacity-50 cursor-not-allowed'}" data-account-id="${acc.AccountId}" ${isOwnAccount ? '' : 'disabled'} title="${isOwnAccount ? 'Edit' : 'Can only edit own accounts'}">
-                                                    <span class="material-symbols-outlined text-lg">edit</span>
-                                                </button>
-                                                <button class="p-1.5 text-slate-400 transition-colors delete-account ${isOwnAccount ? 'hover:text-error' : 'opacity-50 cursor-not-allowed'}" data-account-id="${acc.AccountId}" ${isOwnAccount ? '' : 'disabled'} title="${isOwnAccount ? 'Delete' : 'Can only delete own accounts'}">
-                                                    <span class="material-symbols-outlined text-lg">delete</span>
-                                                </button>
+                                                ${actionContent}
                                             </td>
                                         </tr>
                                     `;
@@ -775,6 +778,17 @@ class AccountManager {
         this.accountPage = pageInfo.current;
         tbody.innerHTML = pageInfo.data.map(acc => {
             const isOwnAccount = acc.UserId == currentUserId;
+            const actionContent = isOwnAccount
+                ? `<button class="p-1.5 text-slate-400 transition-colors view-account hover:text-slate-600" data-account-id="${acc.AccountId}" title="View Details">
+                        <span class="material-symbols-outlined text-lg">info</span>
+                    </button>
+                    <button class="p-1.5 text-slate-400 transition-colors edit-account hover:text-primary" data-account-id="${acc.AccountId}" title="Edit">
+                        <span class="material-symbols-outlined text-lg">edit</span>
+                    </button>
+                    <button class="p-1.5 text-slate-400 transition-colors delete-account hover:text-error" data-account-id="${acc.AccountId}" title="Delete">
+                        <span class="material-symbols-outlined text-lg">delete</span>
+                    </button>`
+                : '<span class="text-slate-400 text-xs">-</span>';
             return `
             <tr class="hover:bg-slate-50/80 transition-colors group account-row" data-account-id="${acc.AccountId}" data-user-id="${acc.UserId}">
                 <td class="px-4 py-3 text-sm font-medium text-slate-900">${acc.Username || acc.FullName || '-'}</td>
@@ -784,15 +798,7 @@ class AccountManager {
                     <span class="px-2 py-1 bg-blue-100 text-blue-700 rounded text-xs font-semibold">${acc.AppName || '-'}</span>
                 </td>
                 <td class="px-4 py-3 text-right">
-                    <button class="p-1.5 text-slate-400 transition-colors view-account ${isOwnAccount ? 'hover:text-slate-600' : 'opacity-50 cursor-not-allowed'}" data-account-id="${acc.AccountId}" ${isOwnAccount ? '' : 'disabled'} title="${isOwnAccount ? 'View Details' : 'Can only view own accounts'}">
-                        <span class="material-symbols-outlined text-lg">info</span>
-                    </button>
-                    <button class="p-1.5 text-slate-400 transition-colors edit-account ${isOwnAccount ? 'hover:text-primary' : 'opacity-50 cursor-not-allowed'}" data-account-id="${acc.AccountId}" ${isOwnAccount ? '' : 'disabled'} title="${isOwnAccount ? 'Edit' : 'Can only edit own accounts'}">
-                        <span class="material-symbols-outlined text-lg">edit</span>
-                    </button>
-                    <button class="p-1.5 text-slate-400 transition-colors delete-account ${isOwnAccount ? 'hover:text-error' : 'opacity-50 cursor-not-allowed'}" data-account-id="${acc.AccountId}" ${isOwnAccount ? '' : 'disabled'} title="${isOwnAccount ? 'Delete' : 'Can only delete own accounts'}">
-                        <span class="material-symbols-outlined text-lg">delete</span>
-                    </button>
+                    ${actionContent}
                 </td>
             </tr>
         `;