hearthforge

← Back to log@ 97defc1

CSP fixes

AuthorKonata <konata@posteo.jp>
Date
Commit97defc1e42a6d383b3facea353c6e64464b1690b
Parent0e6d7d0
3 files changed, 15 insertions(+), 11 deletions(-)
▾Mpublic/assets/app.js
+10@ 97defc1@ master
@@ -10,6 +10,16 @@ document.querySelectorAll("[data-confirm]").forEach((el) => {
});
});
// Toggle visibility of a target element based on a checkbox:
// <input type="checkbox" data-toggle-target="some-id">
document.querySelectorAll("[data-toggle-target]").forEach((cb) => {
const target = document.getElementById(cb.dataset.toggleTarget);
if (!target) return;
cb.addEventListener("change", () => {
target.style.display = cb.checked ? "" : "none";
});
});
// Paste-to-upload: paste an image anywhere on the settings page to fill the avatar input
document.addEventListener("paste", (e) => {
const input = document.querySelector('input[name="avatar"]');
▾Msrc/app.ts
+4-2@ 97defc1@ master
@@ -17,12 +17,14 @@ import { syncStartup } from "./services/repoSync.ts";
const CSP = [
"default-src 'self'",
"script-src 'self'",
"script-src 'self' 'wasm-unsafe-eval'",
"style-src 'self' 'unsafe-inline'",
"img-src 'self'",
"img-src 'self' blob: data:",
"connect-src 'self'",
"worker-src blob:",
"frame-ancestors 'none'",
"form-action 'self'",
"base-uri 'self'",
"object-src 'none'",
].join("; ");
▾Msrc/views/releases/NewRelease.tsx
+1-9@ 97defc1@ master
@@ -61,6 +61,7 @@ export function NewRelease({ user, repo, error, values }: NewReleaseProps) {
name="create_tag"
value="on"
checked={showTagFields}
data-toggle-target="tag-fields-group"
/>
<span>Create a git tag for this release</span>
</label>
@@ -163,15 +164,6 @@ export function NewRelease({ user, repo, error, values }: NewReleaseProps) {
</form>
</div>
</div>
<script>{`
(function() {
var cb = document.getElementById('create_tag');
var group = document.getElementById('tag-fields-group');
cb.addEventListener('change', function() {
group.style.display = cb.checked ? '' : 'none';
});
})();
`}</script>
</Layout>
);
}