poslop/palette
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases 2 Wiki Activity
215 Commits 3 Branches 8 Tags
5fdb34a059b8d26c3d1459d9752a1f00476b02b0
Commit Graph
5 Commits
Author SHA1 Message Date
fen 6c1bfaf15e Fix #184: file upload replaces the main editing area on /new
CI / test (pull_request) Successful in 48s
Details
CI / docker (pull_request) Skipped
Details 
Image files render fitted into the editor area (editor and gutter
hidden); the title auto-fills with the file name. Text files always
load their content into the editor, replacing any text already there,
instead of only filling an empty editor. Title auto-fill still only
applies when the title is blank; a typed title is never overwritten.
Drawing and cropping tools are noted in the issue as possible future
work and are intentionally not implemented here.
 2026-09-10 11:54:59 -05:00
fen f947415b23 fix #171: use FileReader data: URL for image preview (CSP blocks blob:)
CI / test (pull_request) Successful in 39s
Details
CI / docker (pull_request) Skipped
Details
2026-09-10 11:38:22 -05:00
fen 51685f8667 file upload preview in editor on /new (#171) 
- images render fitted into the editor area (object-fit contain), editor hidden
- text files load content into the editor; title placeholder convention (Python.py, Text.txt fallback)
- title auto-fills only when blank; never overwrites a typed title
- external JS + CSS classes only, CSP-safe (no inline styles/scripts)
 2026-09-10 11:12:41 -05:00
fen 0787871f2b Fix #163: remove dead iscan/createCan path breaking /new Create
CI / test (pull_request) Successful in 31s
Details
CI / docker (pull_request) Skipped
Details
2026-09-10 09:33:49 -05:00
fen 7a74ff3e74 Fix #139: drop unsafe-inline from script-src and style-src (#139)
CI / test (pull_request) Successful in 30s
Details
CI / docker (pull_request) Skipped
Details 
- Move all inline <script> blocks (layout head/theme, topbar dark toggle,
  foot, paste, new, history, mine, settings, admin, unlock) to external
  files under internal/web/static/. Page data reaches scripts via data-*
  attributes (data-paste-id, data-default-dark) instead of template vars.
- Replace inline onclick handlers (copy, delete, stats toggle) with
  addEventListener wiring.
- Convert inline style="" attributes to CSS utility classes; swatch
  colors are now set via CSSOM/DOM APIs instead of innerHTML strings.
- script-src/style-src are now plain 'self'; img-src data: stays for the
  SVG data-URI backgrounds. Verified with headless chromium: zero CSP
  violations on all pages in dark and light presets, theme swatches,
  admin lock, tables and paste view render correctly.
 2026-09-10 09:08:17 -05:00