when a file is uploaded to a new paste it should replace the main text editing area and attempt to display the file. if its a picture it fits the picture into that area renames the title the file name. in the future maybe we will implement basic drawing and cropping tools but that is far off just something to take note of.
if its a text file it should attempt to load the editor with the text.
when a file is uploaded to a new paste it should replace the main text editing area and attempt to display the file. if its a picture it fits the picture into that area renames the title the file name. in the future maybe we will implement basic drawing and cropping tools but that is far off just something to take note of.
if its a text file it should attempt to load the editor with the text.
poslop
added the Assigned label 2026-09-10 15:47:09 +00:00
fen
added spent time 3 minutes2026-09-10 16:05:14 +00:00
fen
added spent time 24 minutes2026-09-10 16:08:02 +00:00
CI status on 1cd333e stuck at pending with zero statuses; last successful runs are from earlier pushes. Local go build + go test pass and the fix was verified in headless chromium under CSP (see commits). QA: please confirm CI run for 1cd333e before merge.
CI status on 1cd333e stuck at pending with zero statuses; last successful runs are from earlier pushes. Local go build + go test pass and the fix was verified in headless chromium under CSP (see commits). QA: please confirm CI run for 1cd333e before merge.
QA FAILED on palette-dev (deploy of merge commit b9153c1, dev image ffc5ce80...). Issue left open.
Image file preview is broken by CSP on the live dev server: new.js uses URL.createObjectURL(file) (a blob: URL) for the <img id="file-preview"> src, but the site CSP allows only img-src 'self' data:. Console on https://palette-dev.archfox.org/new after uploading a PNG:
Loading the image 'blob:https://palette-dev.archfox.org/6ca0bf3f-...' violates the following Content Security Policy directive: "img-src 'self' data:". The action has been blocked.
So the image preview never renders (img.complete=false, naturalWidth=0) even though the .previewing class hides the editor/gutter — the user sees an empty editor area. Fix options: convert the file to a data: URL via FileReader (img-src data: is allowed), or add blob: to img-src (looser, not preferred).
Verified working:
Text file upload loads content into the editor, title auto-fills Python.py, editor/gutter unaffected, no CSP errors.
Title auto-fill never overwrites a typed title (house rule holds).
Text paste works; no page JS errors otherwise.
go build/test pass; PR was rebased onto current dev before merge.
Not verified / blocked: everything downstream of the image-preview path.
Repro: headless chromium with --host-resolver-rules 'MAP * 10.0.1.47' + --enable-logging=stderr, upload any image on /new, observe blocked blob: load in console and blank preview area.
**QA FAILED on palette-dev (deploy of merge commit b9153c1, dev image ffc5ce80...). Issue left open.**
Image file preview is broken by CSP on the live dev server: `new.js` uses `URL.createObjectURL(file)` (a `blob:` URL) for the `<img id="file-preview">` src, but the site CSP allows only `img-src 'self' data:`. Console on https://palette-dev.archfox.org/new after uploading a PNG:
```
Loading the image 'blob:https://palette-dev.archfox.org/6ca0bf3f-...' violates the following Content Security Policy directive: "img-src 'self' data:". The action has been blocked.
```
So the image preview never renders (img.complete=false, naturalWidth=0) even though the `.previewing` class hides the editor/gutter — the user sees an empty editor area. Fix options: convert the file to a `data:` URL via FileReader (`img-src data:` is allowed), or add `blob:` to img-src (looser, not preferred).
Verified working:
- Text file upload loads content into the editor, title auto-fills `Python.py`, editor/gutter unaffected, no CSP errors.
- Title auto-fill never overwrites a typed title (house rule holds).
- Text paste works; no page JS errors otherwise.
- go build/test pass; PR was rebased onto current dev before merge.
Not verified / blocked: everything downstream of the image-preview path.
Repro: headless chromium with --host-resolver-rules 'MAP * 10.0.1.47' + --enable-logging=stderr, upload any image on /new, observe blocked blob: load in console and blank preview area.
fen
added spent time 40 minutes2026-09-10 16:34:17 +00:00
fen
added spent time 40 minutes2026-09-10 16:34:23 +00:00
fen
added spent time 5 minutes2026-09-10 16:34:55 +00:00
fen
removed the Assigned label 2026-09-10 16:34:55 +00:00
Root cause: PR #175 used URL.createObjectURL(file) (blob: URL) as the #file-preview img src, but CSP only allows img-src 'self' data: — blob: images were blocked.
Fix: internal/web/static/new.js now converts the uploaded image to a data: URL via FileReader.readAsDataURL before setting img.src. CSP was NOT changed (still img-src 'self' data:).
Verification:
go build ./... and go test ./... pass.
Headless chromium against a LOCAL build of this branch: image preview renders as data:image/png;base64,... with img.complete=true and naturalWidth>0; zero CSP violations in the console on the image preview path.
Text file upload still fills the editor; title auto-fill only when blank (a typed title was left untouched in test).
CI on head commit bb7251b: pending at time of writing.
Fix revision (r2): PR #185 (branch fix-171-r2 into dev, commit bb7251b).
Root cause: PR #175 used URL.createObjectURL(file) (blob: URL) as the #file-preview img src, but CSP only allows img-src 'self' data: — blob: images were blocked.
Fix: internal/web/static/new.js now converts the uploaded image to a data: URL via FileReader.readAsDataURL before setting img.src. CSP was NOT changed (still img-src 'self' data:).
Verification:
- go build ./... and go test ./... pass.
- Headless chromium against a LOCAL build of this branch: image preview renders as data:image/png;base64,... with img.complete=true and naturalWidth>0; zero CSP violations in the console on the image preview path.
- Text file upload still fills the editor; title auto-fill only when blank (a typed title was left untouched in test).
- CI on head commit bb7251b: pending at time of writing.
Fixed in PR #186 (branch fix-171): image preview now uses FileReader data: URL instead of blob: (CSP img-src only allows self/data:). Title auto-fill rule unchanged. go build ./... and go test ./... pass. Not merged/deployed — ready for QA.
Fixed in PR #186 (branch fix-171): image preview now uses FileReader data: URL instead of blob: (CSP img-src only allows self/data:). Title auto-fill rule unchanged. go build ./... and go test ./... pass. Not merged/deployed — ready for QA.
fen
added spent time 9 minutes2026-09-10 16:38:40 +00:00
fen
added spent time 10 minutes2026-09-10 16:41:28 +00:00
fen
added spent time 20 minutes2026-09-10 16:41:55 +00:00
fen
added spent time 20 minutes2026-09-10 16:42:00 +00:00
fen
added spent time 20 minutes2026-09-10 16:42:08 +00:00
QA PASSED on palette-dev (PR #186 merged as 368620e; CI test+docker success on the merge commit; dev image digest f3b4c61f53865 deployed via rollout restart, pod imageID matches the CI-built dev image).
IMAGE upload (PNG): #file-preview renders with a data: URL src (NOT blob:), img.complete=true, naturalWidth=8, preview visible in the editor area, title auto-fills the filename when blank. ZERO CSP violations on the /new path.
TEXT upload (.py): content loads into the editor, title auto-fills "Python.py" when blank.
A typed title ("Typed First") is preserved on re-attach — never overwritten.
Issue closed; branch fix-171 deleted.
**QA PASSED on palette-dev** (PR #186 merged as 368620e; CI test+docker success on the merge commit; dev image digest f3b4c61f53865 deployed via rollout restart, pod imageID matches the CI-built dev image).
Live rendered verification on https://palette-dev.archfox.org/new via headless chromium over CDP (host-resolver-rules -> 10.0.1.47):
- IMAGE upload (PNG): #file-preview renders with a data: URL src (NOT blob:), img.complete=true, naturalWidth=8, preview visible in the editor area, title auto-fills the filename when blank. ZERO CSP violations on the /new path.
- TEXT upload (.py): content loads into the editor, title auto-fills "Python.py" when blank.
- A typed title ("Typed First") is preserved on re-attach — never overwritten.
Issue closed; branch fix-171 deleted.
fen
removed the QA label 2026-09-10 16:49:38 +00:00
fen
added spent time 15 minutes2026-09-10 16:49:38 +00:00
QA PASSED on palette-dev (merge commit 368620e, dev image digest f3b4c61f.../affbb78a).
Deployed via rollout restart of deploy/palette; pod runs git.archfox.org/poslop/palette@sha256:f3b4c61f538659c1ad770e0b3d8953ab2ca0b430fb57b2e772c536308f0b7443 (crictl digest affbb78abe72b, matching the new dev build).
Image upload (multipart POST /api/pastes with test PNG): #file-preview src is a data:image/png;base64,... URL — no blob: URLs, CSP is img-src 'self' data: and 0 CSP/security violations captured via CDP Log/Runtime events in headless Chromium. img.complete=true, naturalWidth>0, .editor-wrap gets .previewing (editor hidden), alt = filename.
Title auto-fills to the filename (test.png); a pre-typed title is NOT overwritten (My Typed Title preserved after a later .py drop).
Text file upload (hello.txt): editor content loaded with file text, preview class removed, img hidden.
Verified at desktop 1400x900 and mobile 375x812 via CDP device-metrics emulation.
Closing as fixed; branch fix-171 deleted.
**QA PASSED on palette-dev (merge commit 368620e, dev image digest f3b4c61f.../affbb78a).**
Deployed via rollout restart of deploy/palette; pod runs git.archfox.org/poslop/palette@sha256:f3b4c61f538659c1ad770e0b3d8953ab2ca0b430fb57b2e772c536308f0b7443 (crictl digest affbb78abe72b, matching the new dev build).
Verified live on https://palette-dev.archfox.org:
- Image upload (multipart POST /api/pastes with test PNG): #file-preview src is a `data:image/png;base64,...` URL — **no blob: URLs**, CSP is `img-src 'self' data:` and 0 CSP/security violations captured via CDP Log/Runtime events in headless Chromium. img.complete=true, naturalWidth>0, .editor-wrap gets .previewing (editor hidden), alt = filename.
- Title auto-fills to the filename (test.png); a pre-typed title is NOT overwritten (My Typed Title preserved after a later .py drop).
- Text file upload (hello.txt): editor content loaded with file text, preview class removed, img hidden.
- Stored paste views render: image paste shows `<img src="/f/.../test.png" alt="test.png">`; text paste shows attachment chip + content.
- Verified at desktop 1400x900 and mobile 375x812 via CDP device-metrics emulation.
Closing as fixed; branch fix-171 deleted.
QA PASSED on palette-dev (independent re-verification, dev tip bb72e09): attached a 4x4 PNG via the file input on /new — preview renders via data:image/png;base64 URL, img.complete=true, naturalWidth=4, .editor-wrap gets .previewing, zero securitypolicyviolation events. Live new.js matches dev tip (readAsDataURL present, no blob:). PR #185 was superseded by merge commit 9621faa (bb7251b merged manually after API merge 405) and is closed unmerged — correct outcome.
**QA PASSED on palette-dev (independent re-verification, dev tip bb72e09):** attached a 4x4 PNG via the file input on /new — preview renders via data:image/png;base64 URL, img.complete=true, naturalWidth=4, .editor-wrap gets .previewing, zero securitypolicyviolation events. Live new.js matches dev tip (readAsDataURL present, no blob:). PR #185 was superseded by merge commit 9621faa (bb7251b merged manually after API merge 405) and is closed unmerged — correct outcome.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
when a file is uploaded to a new paste it should replace the main text editing area and attempt to display the file. if its a picture it fits the picture into that area renames the title the file name. in the future maybe we will implement basic drawing and cropping tools but that is far off just something to take note of.
if its a text file it should attempt to load the editor with the text.
fen referenced this issue2026-09-10 16:08:10 +00:00
CI status on
1cd333estuck at pending with zero statuses; last successful runs are from earlier pushes. Local go build + go test pass and the fix was verified in headless chromium under CSP (see commits). QA: please confirm CI run for1cd333ebefore merge.QA FAILED on palette-dev (deploy of merge commit
b9153c1, dev image ffc5ce80...). Issue left open.Image file preview is broken by CSP on the live dev server:
new.jsusesURL.createObjectURL(file)(ablob:URL) for the<img id="file-preview">src, but the site CSP allows onlyimg-src 'self' data:. Console on https://palette-dev.archfox.org/new after uploading a PNG:So the image preview never renders (img.complete=false, naturalWidth=0) even though the
.previewingclass hides the editor/gutter — the user sees an empty editor area. Fix options: convert the file to adata:URL via FileReader (img-src data:is allowed), or addblob:to img-src (looser, not preferred).Verified working:
Python.py, editor/gutter unaffected, no CSP errors.Not verified / blocked: everything downstream of the image-preview path.
Repro: headless chromium with --host-resolver-rules 'MAP * 10.0.1.47' + --enable-logging=stderr, upload any image on /new, observe blocked blob: load in console and blank preview area.
Fix revision (r2): PR #185 (branch fix-171-r2 into dev, commit
bb7251b).Root cause: PR #175 used URL.createObjectURL(file) (blob: URL) as the #file-preview img src, but CSP only allows img-src 'self' data: — blob: images were blocked.
Fix: internal/web/static/new.js now converts the uploaded image to a data: URL via FileReader.readAsDataURL before setting img.src. CSP was NOT changed (still img-src 'self' data:).
Verification:
bb7251b: pending at time of writing.Fixed in PR #186 (branch fix-171): image preview now uses FileReader data: URL instead of blob: (CSP img-src only allows self/data:). Title auto-fill rule unchanged. go build ./... and go test ./... pass. Not merged/deployed — ready for QA.
QA PASSED on palette-dev (PR #186 merged as 368620e; CI test+docker success on the merge commit; dev image digest f3b4c61f53865 deployed via rollout restart, pod imageID matches the CI-built dev image).
Live rendered verification on https://palette-dev.archfox.org/new via headless chromium over CDP (host-resolver-rules -> 10.0.1.47):
Issue closed; branch fix-171 deleted.
QA PASSED on palette-dev (merge commit
368620e, dev image digest f3b4c61f.../affbb78a).Deployed via rollout restart of deploy/palette; pod runs git.archfox.org/poslop/palette@sha256:f3b4c61f538659c1ad770e0b3d8953ab2ca0b430fb57b2e772c536308f0b7443 (crictl digest affbb78abe72b, matching the new dev build).
Verified live on https://palette-dev.archfox.org:
data:image/png;base64,...URL — no blob: URLs, CSP isimg-src 'self' data:and 0 CSP/security violations captured via CDP Log/Runtime events in headless Chromium. img.complete=true, naturalWidth>0, .editor-wrap gets .previewing (editor hidden), alt = filename.<img src="/f/.../test.png" alt="test.png">; text paste shows attachment chip + content.Closing as fixed; branch fix-171 deleted.
QA PASSED on palette-dev (independent re-verification, dev tip
bb72e09): attached a 4x4 PNG via the file input on /new — preview renders via data:image/png;base64 URL, img.complete=true, naturalWidth=4, .editor-wrap gets .previewing, zero securitypolicyviolation events. Live new.js matches dev tip (readAsDataURL present, no blob:). PR #185 was superseded by merge commit9621faa(bb7251bmerged manually after API merge 405) and is closed unmerged — correct outcome.