Site builder: security & data-loss hardening + unified asset picker + audit backlog #3

Merged
jknapp merged 61 commits from builder-hardening-2026-07 into main 2026-07-13 01:13:28 +00:00
Showing only changes of commit e1d381dc8a - Show all commits
+8 -2
View File
@@ -3,6 +3,7 @@ import { useEditor } from '@craftjs/core';
import { useEditorConfig } from '../../state/EditorConfigContext';
import { useWhpApi } from '../../hooks/useWhpApi';
import { usePages } from '../../state/PageContext';
import { useSiteDesign } from '../../state/SiteDesignContext';
import { DeviceMode } from '../../types';
import { TemplateModal } from './TemplateModal';
import { HeadCodeModal } from './HeadCodeModal';
@@ -22,6 +23,7 @@ export const TopBar: React.FC<TopBarProps> = ({ device, onDeviceChange }) => {
}));
const { save, publish, load } = useWhpApi();
const { headerPage, footerPage } = usePages();
const { design } = useSiteDesign();
const [saveStatus, setSaveStatus] = useState<'idle' | 'saving' | 'saved' | 'error'>('idle');
const [publishStatus, setPublishStatus] = useState<'idle' | 'publishing' | 'published' | 'error'>('idle');
@@ -189,13 +191,17 @@ export const TopBar: React.FC<TopBarProps> = ({ device, onDeviceChange }) => {
const result = exportToHtml(serialized, {
title: whpConfig?.siteName || 'Preview',
includeFonts: true,
headCode: design.headCode,
});
// Replace the body in the full document with our composed version
// Replace the body in the full document with our composed version.
// Use a function replacer -- a plain string replacer treats
// `$&`/`$1`/`$$` sequences in user content as replacement
// patterns, silently corrupting the output.
let html = result.html;
const bodyMatch = html.match(/<body[^>]*>([\s\S]*)<\/body>/i);
if (bodyMatch) {
html = html.replace(bodyMatch[1], composedBody);
html = html.replace(bodyMatch[1], () => composedBody);
}
// Make proxy URLs absolute so they work from the blob: context