Fix custom CSS injection on auth frontend pages

[Himura2la]

Fixes #262

Summary by CodeRabbit

• Nuove funzionalità
  • Aggiunto il supporto per applicare CSS personalizzato alle pagine di accesso, registrazione, recupero e reimpostazione della password.
  • Il CSS configurato viene visualizzato solo quando presente e viene normalizzato prima dell’applicazione.
  • Estesa l’applicazione degli stili personalizzati anche al layout frontend.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 9bdce992-2b9a-4af2-8bc6-ba2658240a40

📥 Commits

Reviewing files that changed from the base of the PR and between 221f018 and 2cb0be5.

📒 Files selected for processing (7)

• app/Views/auth/forgot-password.php
• app/Views/auth/login.php
• app/Views/auth/partials/custom-css.php
• app/Views/auth/register.php
• app/Views/auth/register_success.php
• app/Views/auth/reset-password.php
• app/Views/frontend/layout.php

---

📝 Walkthrough

Walkthrough

Il CSS personalizzato viene gestito da una partial condivisa, che legge e normalizza la configurazione prima del rendering condizionale. La partial è inclusa nelle pagine di autenticazione e nel layout frontend.

Changes

CSS personalizzato condiviso

Layer / File(s)	Summary
Partial per il CSS personalizzato app/Views/auth/partials/custom-css.php	Legge advanced.custom_header_css, normalizza il valore e rende il CSS in un tag <style> solo se non vuoto.
Inclusione nelle viste app/Views/auth/*.php, app/Views/frontend/layout.php	Le pagine di autenticazione includono la partial; il layout frontend sostituisce la precedente logica inline con la stessa inclusione.

Estimated code review effort: 2 (Simple) | ~10 minuti

Suggested reviewers: fabiodalez-dev

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	Il titolo descrive correttamente il fix dell’iniezione del CSS personalizzato nelle pagine auth/frontend, incluso /register.
Linked Issues check	✅ Passed	La partial ora legge advanced.custom_header_css e viene inclusa nel layout/register, quindi il CSS configurato arriva su /register.
Out of Scope Changes check	✅ Passed	Le modifiche aggiuntive restano nelle pagine auth/frontend e supportano lo stesso flusso di CSS personalizzato, senza scope estraneo.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[fabiodalez-dev]

I've reimplemented this in #273 and am closing this PR in its favour — the feature itself (custom CSS reaching the auth pages) is a good call and #273 keeps it, with credit to you.

The reason I didn't merge this branch directly: it emits the CSS through ContentSanitizer::normalizeExternalAssets(), which only normalizes external font URLs. It does not strip a </style><script>…</script> sequence, so a stored advanced.custom_header_css value could break out of the <style> context and run JavaScript. An earlier fix moved the app to ContentSanitizer::sanitizeCustomCss() (which strips <style>/<script> and HTML comment markers) at both save and render; this branch is based on the pre-fix tree, so merging it would have undone that — and exposed it on the unauthenticated login/register pages.

#273 uses sanitizeCustomCss() in a shared partial, includes it on all five auth views, and refactors frontend/layout.php onto the same partial (no duplicate block). I verified with an injected </style><script> payload that it renders as inert CSS text while legitimate CSS still applies on /register.

If you want to hide the #255 registration fields, once #273 ships your CSS in Settings → Advanced → Custom CSS will apply on /register.