rugk
7e8a3a60ec
Merge remote-tracking branch 'origin/master' into js/removeJQuery
2026-07-11 17:34:27 +00:00
El RIDO
3035d6e5d3
incrementing version
2026-07-11 10:19:40 +02:00
El RIDO
bd63b434c9
Merge remote-tracking branch 'upstream/master' into advisory-fix-1
2026-07-11 10:11:29 +02:00
El RIDO
a364596586
Merge branch 'master' into newtab-sanitize
2026-07-11 10:04:14 +02:00
Ribas160
233e3e2399
Merge remote-tracking branch 'upstream/master' into os-copy-hotkey
...
# Conflicts:
# i18n/zh.json
# lib/Configuration.php
2026-06-19 20:03:38 +03:00
Ribas160
2219039a0a
feat: add i18n keys for Cmd and Ctrl keyboard labels
2026-06-19 19:58:29 +03:00
rugk
f56c0d1f3b
chore: remove not required manual centering of bootstrap dialogs
2026-06-16 14:14:33 +00:00
rugk
e70acfb50b
style: fix another JSDoc error
2026-06-16 13:56:50 +00:00
rugk
54d3d00339
chore: remove nmot requires SRI hash for Bootstrap 3
2026-06-16 11:44:19 +00:00
rugk
df04d3692e
chore: remove jQuery library
2026-06-16 11:38:56 +00:00
rugk
47b246914a
fix: regenerate SRI hashes
2026-06-16 08:01:48 +00:00
El RIDO
164c839c39
insert only base path in JSON API responses, without GET parameters
2026-06-15 23:12:52 +02:00
rugk
55639c70fb
Merge branch 'master' into js/removeJQuery
...
# Conflicts:
# js/privatebin.js
# js/test/CopyToClipboard.js
# lib/Configuration.php
2026-06-15 18:45:59 +02:00
rugk
13cbb2069e
style: fix line ending at JS file
2026-06-14 16:25:16 +02:00
rugk
7f1f40853e
fix: prevent browsers from rendering unsafe attachments like HTML in a new tab
...
We do not want to santitize them with DOMPurify, as an attached file should
be returned exactly as it has been attached by the creator. And sharing HTML files
is IMHO a legitimate use case.
However, opening these in a new tab can result in (JS) code execution.
Yet again, opening a "bigger" preview for some file types like images or videos
is also a valid use case, which also should not be broken. That's why this is not done
in alll cases, but some mime type filtering still exists.
I also looked into whether a blocklist (for HTML and SVG) would make sense, but really
you cannot possibly define an exhausive list of "unsafe" mime types: https://security.stackexchange.com/a/167853/91425
That's why I use a quite strict allowlist approach here.
I skimmed https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/MIME_types/Common_types
for what could be common use cases/mime types, people _may_ actually want to get
rendered and this is the result.
Thus I am quite confident this patch does not introduce such a big "breaking change"
(in UI behaviour), but people best do not notice it.
2026-06-13 22:01:35 +02:00
El RIDO
fa4e25efe6
Merge pull request #1802 from slegarraga/fix/modal-focus-accessibility
...
Fix: Focus modals when opened for accessibility
2026-06-10 19:38:03 +02:00
Ribas160
ec2d230d1b
refactor: deduplicate OS-specific hotkey detection into a shared helper
2026-05-29 15:43:41 +03:00
Ribas160
5d946c52a7
feat: Show OS-specific copy hotkey hint
2026-05-27 00:28:32 +03:00
Ribas160
f0e5001982
fix: cast statusCode to int before strict comparison
2026-05-25 23:34:57 +03:00
“Sebastian
11d62b6cd4
fix(a11y): focus modals on open and update privatebin.js SRI
...
- Load-confirm modal: focus primary action on show
- Email-confirm modal: focus UTC button on show (safer default)
- Update SRI for js/privatebin.js in Configuration.php
Fixes #1801
2026-05-22 16:33:14 -04:00
Ribas160
848d80a3b2
Merge remote-tracking branch 'upstream/master' into copy_button_is_hidden
...
# Conflicts:
# lib/Configuration.php
2026-05-21 13:01:29 +03:00
Ribas160
abab1e9ec7
chore: update SRI
2026-05-16 12:35:32 +03:00
Ribas160
23e718e137
Merge remote-tracking branch 'upstream/master' into bug_in_attachment_functionality
...
# Conflicts:
# lib/Configuration.php
2026-05-16 12:26:09 +03:00
Ribas160
ca23d88cd9
Merge remote-tracking branch 'upstream/master' into copy_button_is_hidden
...
# Conflicts:
# lib/Configuration.php
2026-05-16 12:22:20 +03:00
El RIDO
72c64dac2c
remove redundant array
...
redundant, since .map always returns an array
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Array/map#return_value
Co-authored-by: Mikhail Romanov <42250412+Ribas160@users.noreply.github.com>
2026-05-16 08:42:31 +02:00
Ribas160
6d1d8da4a4
fix: state corruption after removing attachment
2026-05-15 15:33:52 +03:00
Ribas160
5bbe713b9c
fix: move copy to clipboard button outside of prettymessage block
2026-05-15 13:28:34 +03:00
El RIDO
a4bad44334
update dev dependencies, address ESlint error
...
null coalescing operator is only available as of ES2020, if we make it an array an or might do
2026-05-14 14:43:51 +02:00
rugk
9d2e34f472
Merge branch 'master' into js/removeJQuery
2026-05-07 11:56:54 +02:00
El RIDO
14c8b2fa25
fix syntaxhighlighting format, requires non-strict DOMpurify
...
the strict settings removed the pre-tags, lists, etc. that are used by the prettify library to format source code
2026-05-03 08:49:43 +02:00
El RIDO
89e80d419d
incrementing version
2026-05-03 08:10:16 +02:00
El RIDO
ebadfe43ec
chore: fix typo, update SRI hash and docs
2026-04-29 22:07:50 +02:00
El RIDO
e24614169d
Merge branch 'master' into zlib-1.3.2
2026-04-29 07:09:23 +02:00
El RIDO
a455c962d5
update DOMpurify library from 3.4.0 to 3.4.1
2026-04-23 07:15:03 +02:00
El RIDO
67baf8cca4
update DOMpurify library from 3.3.2 to 3.4.0
2026-04-18 09:28:58 +02:00
El RIDO
20bb19e5b4
Merge branch 'master' into zlib-1.3.2
2026-04-13 20:22:46 +02:00
mirek-vl
1a5fa93f2f
Remove X-XSS-Protection from Controller.php
2026-04-11 12:57:54 +02:00
rugk
c37a7c61e9
refactor: remove head query in raw HTML
2026-04-07 10:43:57 +00:00
El RIDO
fbfe87d993
avoid mjs for now, inject map, Buffer is node-only
2026-04-04 10:22:10 +02:00
El RIDO
2439d76a0a
apply StyleCI recommendation
2026-04-03 18:38:34 +02:00
El RIDO
43a729b1f9
updating zlib to 1.3.2
2026-04-03 18:15:54 +02:00
rugk
a96508afa5
fix(discussionViewer): fix "Open comment" button
2026-03-29 14:43:50 +00:00
rugk
2472ae0941
chore: update SRI hash
2026-03-26 10:34:40 +00:00
El RIDO
604e61beaa
update DOMpurify library from 3.3.0 to 3.3.2
2026-03-07 09:00:06 +01:00
rugk
1cc811644f
docs: improve JSDoc
2026-02-23 16:00:31 +00:00
rugk
30f80d055b
wipfix: fix JS syntax errors
2026-02-23 15:54:56 +00:00
rugk
5dab2392b9
Merge branch 'master' into xss/jsImprove
2026-02-23 16:48:21 +01:00
Stephan Kristyn
5d22847ef1
ES6 Compat code broke everything. Reverting. E2E testing wth multiple files works
2026-02-12 13:48:49 +01:00
Stephan Kristyn
cfea0fb20e
Now leaving styling to customer if he wants the filename and filesize as a hyperlink or outside the hyperlink
2026-02-11 19:03:34 +01:00
Stephan Kristyn
9ab16674aa
Adding Bootstrap Classname to dynamically created child element
2026-02-10 18:22:17 +01:00
