From 244edf90ac79983a1f5f338f74e8d43d0eb515e3 Mon Sep 17 00:00:00 2001
From: Josh Holtrop <jholtrop@gmail.com>
Date: Wed, 1 Apr 2026 13:06:06 -0400
Subject: [PATCH] Add asynchronous page content request

---
 assets/page.erb | 13 +++++++++++++
 cgi-bin/malp.rb | 13 +++++++++++++
 2 files changed, 26 insertions(+)

diff --git a/assets/page.erb b/assets/page.erb
index 05966d4..ca8ee20 100644
--- a/assets/page.erb
+++ b/assets/page.erb
@@ -144,6 +144,19 @@
   <h1><span><%= hostname %></span> status - MALP</h1>
 </header>
 
+<% if authenticated %>
+  <div id="content"></div>
+  <script>
+    fetch("?content", { credentials: "same-origin" })
+      .then(function(response) {
+        if (response.ok) return response.text();
+      })
+      .then(function(html) {
+        if (html) document.getElementById("content").innerHTML = html;
+      });
+  </script>
+<% end %>
+
 <% unless authenticated %>
   <div class="card">
     <div class="card-title">Sign In</div>
diff --git a/cgi-bin/malp.rb b/cgi-bin/malp.rb
index 3023c91..e789d52 100755
--- a/cgi-bin/malp.rb
+++ b/cgi-bin/malp.rb
@@ -79,6 +79,19 @@ if cgi.request_method == "POST" && !authenticated
   end
 end
 
+if cgi.params.key?("content")
+  if authenticated
+    cgi.out("type" => "text/html", "charset" => "UTF-8") do
+      "<p>Content placeholder</p>"
+    end
+  else
+    cgi.out("Status" => "403 Forbidden", "type" => "text/plain", "charset" => "UTF-8") do
+      "Forbidden"
+    end
+  end
+  exit
+end
+
 template = ERB.new(File.read(File.join(ASSETS_DIR, "page.erb")))
 
 out_params = { "type" => "text/html", "charset" => "UTF-8" }