poslop/palette
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Release v0.4.0: dev -> main #251

Merged
fen merged 138 commits from dev into main 2026-09-17 15:35:21 +00:00
Conversation 0 Commits 138 Files Changed 56
+12 -5
1 changed files with 12 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit bb7251bd25 - Show all commits
internal/web/static/new.js
+8 -1
View File
@@ -258,12 +258,19 @@ async function showFileInEditor(file) {
const wrap = document.querySelector('.editor-wrap'); const wrap = document.querySelector('.editor-wrap');
const img = $('file-preview'); const img = $('file-preview');
if (IMAGE_RE.test(file.type)) { if (IMAGE_RE.test(file.type)) {
// CSP-safe: img-src only allows 'self' data:, so use a data: URL
// (FileReader.readAsDataURL) instead of blob: object URLs. #171
if (previewURL) URL.revokeObjectURL(previewURL); if (previewURL) URL.revokeObjectURL(previewURL);
previewURL = URL.createObjectURL(file); previewURL = null;
const reader = new FileReader();
reader.onload = () => {
previewURL = reader.result;
img.src = previewURL; img.src = previewURL;
img.alt = file.name; img.alt = file.name;
wrap.classList.add('previewing'); wrap.classList.add('previewing');
img.classList.remove('hidden'); img.classList.remove('hidden');
};
reader.readAsDataURL(file);
return; return;
} }
wrap.classList.remove('previewing'); wrap.classList.remove('previewing');