4 Commits

Include renames

Author	SHA1	Message	Date
fen	1cd333e1e6	use data: URI for image preview: CSP img-src only allows self+data, blob: would be blocked (#171)	2026-09-10 11:19:01 -05:00
fen	e23ca6e8d1	file upload preview in editor on /new (#171) ... - images render fitted into the editor area (object-fit contain), editor hidden - text files load content into the editor; title placeholder convention (Python.py, Text.txt fallback) - title auto-fills only when blank; never overwrites a typed title - external JS + CSS classes only, CSP-safe (no inline styles/scripts)	2026-09-10 11:08:02 -05:00
fen	0787871f2b	Fix #163: remove dead iscan/createCan path breaking /new Create	2026-09-10 09:33:49 -05:00
fen	7a74ff3e74	Fix #139: drop unsafe-inline from script-src and style-src (#139) ... - Move all inline <script> blocks (layout head/theme, topbar dark toggle, foot, paste, new, history, mine, settings, admin, unlock) to external files under internal/web/static/. Page data reaches scripts via data-* attributes (data-paste-id, data-default-dark) instead of template vars. - Replace inline onclick handlers (copy, delete, stats toggle) with addEventListener wiring. - Convert inline style="" attributes to CSS utility classes; swatch colors are now set via CSSOM/DOM APIs instead of innerHTML strings. - script-src/style-src are now plain 'self'; img-src data: stays for the SVG data-URI backgrounds. Verified with headless chromium: zero CSP violations on all pages in dark and light presets, theme swatches, admin lock, tables and paste view render correctly.	2026-09-10 09:08:17 -05:00