From 487d7956e9714abc11e930957f0682c8212bf669 Mon Sep 17 00:00:00 2001 From: durstann Date: Thu, 18 Jun 2026 12:50:20 -0700 Subject: [PATCH 1/5] Accessibility: Add lang and title to the brew render iframe. --- client/homebrew/brewRenderer/brewRenderer.jsx | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/client/homebrew/brewRenderer/brewRenderer.jsx b/client/homebrew/brewRenderer/brewRenderer.jsx index 24cf9306f..3e3dc55b8 100644 --- a/client/homebrew/brewRenderer/brewRenderer.jsx +++ b/client/homebrew/brewRenderer/brewRenderer.jsx @@ -28,7 +28,8 @@ const PAGE_HEIGHT = 1056; const TOOLBAR_STATE_KEY = 'HB_renderer_toolbarState'; const INITIAL_CONTENT = dedent` - + + Rendered Brew Content @@ -91,7 +92,7 @@ const BrewPage = (props)=>{ //v=====--------------------< Brew Renderer Component >-------------------=====v// let renderedPages = []; -let pageTemplates = []; +const pageTemplates = []; let rawPages = []; const BrewRenderer = (props)=>{ @@ -210,7 +211,7 @@ const BrewRenderer = (props)=>{ classes = [classes, injectedTags.classes].join(' ').trim(); attributes = injectedTags.attributes; if(global.enablev4) { - if (attributes && Object.hasOwn(attributes, 'hbtemplate')) { + if(attributes && Object.hasOwn(attributes, 'hbtemplate')) { pageTemplates[index] = attributes['hbtemplate']; } } @@ -220,7 +221,7 @@ const BrewRenderer = (props)=>{ if(!pageTemplates[index]) { for (let i=index;i>=0; i--) { // If one is found, add the template attribute - if (pageTemplates[i]) attributes['hbtemplate'] = pageTemplates[i]; + if(pageTemplates[i]) attributes['hbtemplate'] = pageTemplates[i]; } } } @@ -348,7 +349,7 @@ const BrewRenderer = (props)=>{ 0 ? state.visiblePages : [state.centerPage]} totalPages={rawPages.length} headerState={headerState} setHeaderState={setHeaderState}/> {/*render in iFrame so broken code doesn't crash the site.*/} - {emitClick();}} From 8c77da246cea4829ed8500fd3e581d35147ea439 Mon Sep 17 00:00:00 2001 From: durstann Date: Fri, 19 Jun 2026 14:37:55 -0700 Subject: [PATCH 2/5] Don't add lang tag to iframe content. It's not strictly necessary since the brew content will set it's own language later in the DOM. --- client/homebrew/brewRenderer/brewRenderer.jsx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/client/homebrew/brewRenderer/brewRenderer.jsx b/client/homebrew/brewRenderer/brewRenderer.jsx index 3e3dc55b8..7cc787c03 100644 --- a/client/homebrew/brewRenderer/brewRenderer.jsx +++ b/client/homebrew/brewRenderer/brewRenderer.jsx @@ -28,7 +28,7 @@ const PAGE_HEIGHT = 1056; const TOOLBAR_STATE_KEY = 'HB_renderer_toolbarState'; const INITIAL_CONTENT = dedent` - + Rendered Brew Content From 7bd0407e70d84c84fe3d55011abfe43b00d6b053 Mon Sep 17 00:00:00 2001 From: "G.Ambatte" Date: Sun, 21 Jun 2026 15:03:33 +1200 Subject: [PATCH 3/5] Change calculation of isDev --- server.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server.js b/server.js index db97336e2..a9da7c2ca 100644 --- a/server.js +++ b/server.js @@ -3,7 +3,7 @@ import createApp from './server/app.js'; import config from './server/config.js'; import { createServer as createViteServer } from 'vite'; -const isDev = process.env.NODE_ENV === 'local'; +const isDev = config.get('local_environments').includes(process.env.NODE_ENV); async function start() { let vite; From 5fa7b95e19384743a1db636c8f140a469d6c2b54 Mon Sep 17 00:00:00 2001 From: ReinaSweet Date: Sat, 18 Jul 2026 03:02:41 -0700 Subject: [PATCH 4/5] Add a sandbox property to the renderer iframe to prevent any script execution But still allow for print (via allow-modals), same-origin downloads, and top navigation (so that links work). --- client/homebrew/brewRenderer/brewRenderer.jsx | 1 + 1 file changed, 1 insertion(+) diff --git a/client/homebrew/brewRenderer/brewRenderer.jsx b/client/homebrew/brewRenderer/brewRenderer.jsx index 976f8c9c1..bc66fa9b5 100644 --- a/client/homebrew/brewRenderer/brewRenderer.jsx +++ b/client/homebrew/brewRenderer/brewRenderer.jsx @@ -352,6 +352,7 @@ const BrewRenderer = (props)=>{ style={{ width: '100%', height: '100%', visibility: state.visibility }} contentDidMount={frameDidMount} onClick={()=>{emitClick();}} + sandbox="allow-same-origin allow-modals allow-top-navigation" >
Date: Thu, 23 Jul 2026 18:57:01 -0700 Subject: [PATCH 5/5] Revert linter change --- client/homebrew/brewRenderer/brewRenderer.jsx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/client/homebrew/brewRenderer/brewRenderer.jsx b/client/homebrew/brewRenderer/brewRenderer.jsx index 7cc787c03..c9c514139 100644 --- a/client/homebrew/brewRenderer/brewRenderer.jsx +++ b/client/homebrew/brewRenderer/brewRenderer.jsx @@ -92,7 +92,7 @@ const BrewPage = (props)=>{ //v=====--------------------< Brew Renderer Component >-------------------=====v// let renderedPages = []; -const pageTemplates = []; +let pageTemplates = []; let rawPages = []; const BrewRenderer = (props)=>{