Replaces URL.createObjectURL (blob:) with FileReader.readAsDataURL (data:) in internal/web/static/new.js so the image preview passes img-src 'self' data: CSP. CSP unchanged.
Verified locally (go build/test pass; headless chromium against local build): image preview loads via data: URL with img.complete=true and zero CSP violations; text upload fills editor; title auto-fills only when blank (typed title never overwritten).
Replaces URL.createObjectURL (blob:) with FileReader.readAsDataURL (data:) in internal/web/static/new.js so the image preview passes img-src 'self' data: CSP. CSP unchanged.
Verified locally (go build/test pass; headless chromium against local build): image preview loads via data: URL with img.complete=true and zero CSP violations; text upload fills editor; title auto-fills only when blank (typed title never overwritten).
QA note: this PR (r2, bb7251b) is superseded and will not be merged. The same fix is already contained in dev (commit 9621faa0 'Merge fix-171-r2 into dev'), PR #186 carried the equivalent FileReader data:-URL change and was merged (368620e) with a QA pass recorded on issue #171, which is closed. Verified on the live dev build (bb72e09) during the #184 QA pass: image preview renders via data: URL on /new with zero CSP violations. Closing as superseded.
QA note: this PR (r2, bb7251b) is superseded and will not be merged. The same fix is already contained in dev (commit 9621faa0 'Merge fix-171-r2 into dev'), PR #186 carried the equivalent FileReader data:-URL change and was merged (368620e) with a QA pass recorded on issue #171, which is closed. Verified on the live dev build (bb72e09) during the #184 QA pass: image preview renders via data: URL on /new with zero CSP violations. Closing as superseded.
QA PASS (rendered verification on palette-dev, headless chromium against https://palette-dev.archfox.org/new after deploy of merge commit 9621faa, CI test+docker both success):\n- Image preview: #file-preview renders with data:image/png;base64,... src, img.complete=true, naturalWidth/Height=2, .editor-wrap previewing class applied.\n- CSP violations in console/log: 0. Served CSP header unchanged: img-src 'self' data:.\n- Text file upload fills editor content.\n- Title auto-fill: typed title preserved on subsequent attach; blank title autofilled from filename.\n- Merge: PR had a conflict with dev (r1 #186 touched the same block); merged locally --no-ff into dev (9621faa), taking dev's new.js for the conflict (functionally equivalent, already data:-URL, revokeObjectURL cleanup retained). CI green on merge commit.\n- Deployed to palette-dev (rollout complete, image git.archfox.org/poslop/palette:dev current). Issue closed, branch fix-171-r2 deleted.
QA PASS (rendered verification on palette-dev, headless chromium against https://palette-dev.archfox.org/new after deploy of merge commit 9621faa, CI test+docker both success):\n- Image preview: #file-preview renders with data:image/png;base64,... src, img.complete=true, naturalWidth/Height=2, .editor-wrap previewing class applied.\n- CSP violations in console/log: 0. Served CSP header unchanged: img-src 'self' data:.\n- Text file upload fills editor content.\n- Title auto-fill: typed title preserved on subsequent attach; blank title autofilled from filename.\n- Merge: PR had a conflict with dev (r1 #186 touched the same block); merged locally --no-ff into dev (9621faa), taking dev's new.js for the conflict (functionally equivalent, already data:-URL, revokeObjectURL cleanup retained). CI green on merge commit.\n- Deployed to palette-dev (rollout complete, image git.archfox.org/poslop/palette:dev current). Issue closed, branch fix-171-r2 deleted.
Pull request closed
This pull request cannot be reopened because the branch was deleted.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Replaces URL.createObjectURL (blob:) with FileReader.readAsDataURL (data:) in internal/web/static/new.js so the image preview passes img-src 'self' data: CSP. CSP unchanged.
Verified locally (go build/test pass; headless chromium against local build): image preview loads via data: URL with img.complete=true and zero CSP violations; text upload fills editor; title auto-fills only when blank (typed title never overwritten).
QA note: this PR (r2,
bb7251b) is superseded and will not be merged. The same fix is already contained in dev (commit9621faa0'Merge fix-171-r2 into dev'), PR #186 carried the equivalent FileReader data:-URL change and was merged (368620e) with a QA pass recorded on issue #171, which is closed. Verified on the live dev build (bb72e09) during the #184 QA pass: image preview renders via data: URL on /new with zero CSP violations. Closing as superseded.QA PASS (rendered verification on palette-dev, headless chromium against https://palette-dev.archfox.org/new after deploy of merge commit
9621faa, CI test+docker both success):\n- Image preview: #file-preview renders with data:image/png;base64,... src, img.complete=true, naturalWidth/Height=2, .editor-wrap previewing class applied.\n- CSP violations in console/log: 0. Served CSP header unchanged: img-src 'self' data:.\n- Text file upload fills editor content.\n- Title auto-fill: typed title preserved on subsequent attach; blank title autofilled from filename.\n- Merge: PR had a conflict with dev (r1 #186 touched the same block); merged locally --no-ff into dev (9621faa), taking dev's new.js for the conflict (functionally equivalent, already data:-URL, revokeObjectURL cleanup retained). CI green on merge commit.\n- Deployed to palette-dev (rollout complete, image git.archfox.org/poslop/palette:dev current). Issue closed, branch fix-171-r2 deleted.Pull request closed