Repository navigation
[BUG]: Manage Members search inputs do nothing because CSP blocks inline oninput #7283
Description
🐞 Bug Summary
The search inputs in the Manage Members modal do nothing. Typing in "Search users by name or email…" sends no request, so an admin cannot find users to add to a team from the Admin UI.
The cause is Content Security Policy. admin.py renders the inputs with inline oninput="…" attributes. The default CSP sets script-src-attr 'none', so the browser blocks every inline handler.
🧩 Affected Component
-
mcpgateway- UI (admin panel)
🔁 Steps to Reproduce
- Start the gateway with default settings and
MCPGATEWAY_UI_ENABLED=true. - Log in to
/adminas the platform admin. - Create a team under Teams.
- Click Manage Members on the team.
- Type
ain "Search users by name or email…".
🤔 Expected Behavior
After the debounce delay, the modal requests /admin/teams/{team_id}/non-members/partial and lists the matching users with checkboxes.
📓 Logs / Error Output
Browser console when typing in the input:
Executing inline event handler violates the following Content Security Policy directive 'script-src-attr 'none''.
Either the 'unsafe-inline' keyword, a hash ('sha256-...'), or a nonce ('nonce-...') is required to enable inline execution.
The network tab shows no request to non-members/partial.
🧠 Environment Info
| Key | Value |
|---|---|
| Version or commit | release/1.1.0 at 42a06c9e9 (PR #7264). The same code is on main at a211ab7d8. |
| Runtime | Python 3.13, uvicorn, default CSP |
| Platform / OS | Chrome 155 on Windows, gateway on WSL2 |
| Container | none |
🧩 Additional Context
Affected markup in mcpgateway/admin.py on main:
| Line | Handler | Effect |
|---|---|---|
| 6303 | oninput="Admin.debouncedMemberSearch('{team.id}', this.value)" |
"Search members…" filter is dead |
| 6328 | oninput="Admin.debouncedNonMemberSearch('{team.id}', this.value)" |
"Add Users" search is dead |
| 8416, 8422 | oninput="Admin.validatePasswordRequirements(); …" |
Password checks in the user edit modal are dead |
mcpgateway/admin_ui/eventDelegation.js already supports data-action-input. Note that it passes the input value as the first argument only when no data-arg* attribute is set. The search handlers need both the team ID and the input value, so they need a small adapter that reads event.target.value.
PR #7264 applies the same conversion to the team edit modal (onchange to data-action-change, onclick to data-action-click). The inputs above remain.
Workaround: add members with POST /v1/teams/{team_id}/members.
Activity
fix(ui): use delegated event handlers for search and password inputs …