naibaandcloudcode c9bed85a91 fix(security): guard external hrefs and refine CSRF/auth-loading handling ...

- Add safeExternalHref(): only render http(s) URLs as clickable hrefs,
  blocking attacker-controlled template metadata from becoming
  javascript:/data: links.
- Refine CSRF header attachment and auth-loading state in the fetcher,
  api-tokens client, useAuth, and settings route.

Co-authored-by: cloudcode <cloudcode@users.noreply.github.com>

2026-05-31 05:51:39 +00:00

..

fm.ts

feat: server transfer rotation

2026-05-25 10:15:24 +00:00

i18n.ts

Fix and update (#139)

2025-10-02 14:23:11 +08:00

inject.ts

fix: window.DisableAnimatedMan as boolean (#62)

2024-12-19 21:54:24 +08:00

public-note.ts

feat: enhance public notes functionality with flexible options (#141)

2025-10-09 09:35:13 +08:00

utils.ts

fix(security): guard external hrefs and refine CSRF/auth-loading handling

2026-05-31 05:51:39 +00:00