* Revert "Sanitize field content in editor"
This reverts commit 1c156905f8.
* Use CSP to block inline JS content in editor
This blocks inline scripts, scripts in the media folder, and
handlers like onclick in the editor. This is nicer than the previous
solution - it doesn't make any permanent changes, and leaves other
content like SVGs alone. Thanks to Nil Admirari for the suggestion.
* Sanitize field content in editor
The editor already strips script tags from fields, but was allowing
through Javascript in things like onclick handlers. We block this now,
as the editor context has access to internal APIs that we don't want to
expose to untrusted third-party code.
* Require an auth token for API access
We were previously inspecting the referrer, but that is spoofable,
and doesn't guard against other processes on the machine.
To accomplish this, we use a request interceptor to automatically
add an auth token to webviews with the right context. Some related
changes were required:
- We avoid storing _page, which was leading to leaks & warning on exit
- At webview creation (or set_kind() invocation), we assign either
an authenticated or unauthenticated web profile.
- Some of our screens initialize the AnkiWebView when calling, e.g.,
aqt.forms.stats.Ui_Dialog(). They then immediately call .set_kind().
This reveals a race condition in our DOM handling code: the webview
initialization creates an empty page with the injected script, which
causes a domDone signal to be sent back. This signal arrives after
we've created another page with .set_kind(), causing our code to think
the DOM is ready when it's not. Then when we try to inject the dynamic
styling, we get an error, as the DOM is not ready yet. In the absence
of better solutions, I've added a hack to set_kind() to deal with this
for now.
* Provide AnkiWebPage init defaults for existing add-on callers
* Inject bridge script when profile set-up skipped
Some add-ons fully override AnkiWebPage.__init__ and thus depend on _setupBridge injecting the JS bridge script.
With this change we account for these cases, while giving add-ons the opportunity to look for solutions that do not require overriding AnkiWebPage.__init__ completely.
* Add some missed pages/endpoints (thanks to iamllama)
* Avoid sending API key for remote resources
Thanks to Abdo for the report
---------
Co-authored-by: Aristotelis P <201596065+aps-amboss@users.noreply.github.com>
* replace use of deprecated createClassComponent with mount
* bump esbuild-svelte from 0.8.1 to 0.9.2
* mathjax-element.ts -> mathjax-element.svelte.ts
* move caret after tick
Apparently no font size should be lower than 12px, see https://www.boia.org/blog/accessibility-tips-let-users-control-font-size.
With the current 55%, I get a computed font size of 8.25px though. Considering the text shows the helpful message "Press Enter to accept, Shift+Enter for new line.", I think we should add a minimum font size.
* expose get_image_occlusion_fields
* fix create copy for io
* revert current impl
* passthru original note id when creating copy
* add IOCloningMode
* fix create copy for io
* Update to stable Svelte 5 release
This causes a bunch of warnings to be omitted:
ts/routes/graphs/RangeBox.svelte:52:18
Warn: Properties of objects and arrays are not reactive unless in runes mode. Changes to this property will not cause the reactive statement to update (svelte)
break;
case RevlogRange.All:
$days = 0;
They are triggered on enum references, and it appears to be a bug.
May need to report it to Svelte?
* Deps update
* Silence spurious errors + fix a real one
https://github.com/sveltejs/svelte/issues/13811
* Update to Svelte 5
* Fix `<tr> is invalid inside <table>`
* Update sveltekit-svg to match svelte version
Fixes deck options failing to load, and a bunch of warnings with
./yarn dev
* Fix graph tooltips
* Fix editor loading
* Fix MathJax editor not loading
* Formatting
* Fix new formatting errors
* Merge remote-tracking branch 'origin/main' into svelte5
* Remove slot inside EditorToolbar
I think this is just stray code left over from a refactor, but I'm
not 100% sure.
Fixes
Error: Object literal may only specify known properties, and 'children' does not exist in type '{ size: number; wrap: boolean; api?: Partial<EditorToolbarAPI> | undefined; }'. (ts)
<div class="note-editor">
<EditorToolbar {size} {wrap} api={toolbar}>
<slot slot="notetypeButtons" name="notetypeButtons" />
* Fix component typing error
* Comment out svelte/internal exports, so editor loads
* Fix image occlusions in editor
* Revert "Remove slot inside EditorToolbar"
This reverts commit b3095e07ac,
which prevented the Preview button from showing in the browser.
This will break our tests again.
* Update vite
* Disable routes/tmp for now
* Fix references issue in routes/tmp
* Update amd64 docker container to Debian 11
This bumps the minimum required glibc to 2.29, which is 2019
Ubuntu/Fedora, and 2021 Debian.
Also remove the unused download of ninja
* Update to latest dprint
Unblocked by the glibc upgrade
* Add keyboard shortcuts for empty cards and toggle mask on image occlusion
- add shortcut for empty cards
- add shortcut for toggle mask
- set tooltips with shortcuts
use unused shortcut for empty cards
* remove unnecessary shortcut added in main.py
* change empty cards shortcut and try to fix CI error in CONTRIBUTORS
* change shortcut for empty cards for universal support
* Add sveltekit-svg plugin to fix svg icon styling
Closes#3127.
* Unify svg icon usage
Moves all icons into ts/lib/components/icons.ts and uses a single component to render
them both with eslint and svelte-kit.
* Fix spinning revert icon not being centered
* Use svg earth icon for global label
* Add tooltip to global label icon
* Remove eslint-plugin-simple-import-sort
Imports are already sorted by dprint with conflicting rules.
* Update to latest Node LTS
* Add sveltekit
* Split tslib into separate @generated and @tslib components
SvelteKit's path aliases don't support multiple locations, so our old
approach of using @tslib to refer to both ts/lib and out/ts/lib will no
longer work. Instead, all generated sources and their includes are
placed in a separate out/ts/generated folder, and imported via @generated
instead. This also allows us to generate .ts files, instead of needing
to output separate .d.ts and .js files.
* Switch package.json to module type
* Avoid usage of baseUrl
Incompatible with SvelteKit
* Move sass into ts; use relative links
SvelteKit's default sass support doesn't allow overriding loadPaths
* jest->vitest, graphs example working with yarn dev
* most pages working in dev mode
* Some fixes after rebasing
* Fix/silence some svelte-check errors
* Get image-occlusion working with Fabric types
* Post-rebase lock changes
* Editor is now checked
* SvelteKit build integrated into ninja
* Use the new SvelteKit entrypoint for pages like congrats/deck options/etc
* Run eslint once for ts/**; fix some tests
* Fix a bunch of issues introduced when rebasing over latest main
* Run eslint fix
* Fix remaining eslint+pylint issues; tests now all pass
* Fix some issues with a clean build
* Latest bufbuild no longer requires @__PURE__ hack
* Add a few missed dependencies
* Add yarn.bat to fix Windows build
* Fix pages failing to show when ANKI_API_PORT not defined
* Fix svelte-check and vitest on Windows
* Set node path in ./yarn
* Move svelte-kit output to ts/.svelte-kit
Sadly, I couldn't figure out a way to store it in out/ if out/ is
a symlink, as it breaks module resolution when SvelteKit is run.
* Allow HMR inside Anki
* Skip SvelteKit build when HMR is defined
* Fix some post-rebase issues
I should have done a normal merge instead.
This reverts commit d6857f4ccd.
Rolling this back for now, as it may cause regressions. We can give it
another try at the start of the next beta-testing period.
* Preserve HTML formatting inside clozes
* Place caret after/inside cloze
To match the old behavior
* Fix clozing in mathjax
* Formatting
* Avoid .extractContents() and handle partially covered tags
* Exclude range end if endOffset == 0
* Remove unnecessary branches
* Use nodeIsElement
* Let extractContents() handle partially selected nodes
* Factor out common code in bold/italic/underline/sub/sup buttons
* Update exclusiveNames' states on click
* Update exclusiveNames' states on keyboard shortcut
* Add type to createEventDispatcher
* Fix image overlay not closing when clicking outside on Qt6.6
Use Event.composedPath() instead of obsolete Event.path
https://chromestatus.com/feature/5726124632965120
* remove unfinished polygon and remove selectable for shapes in polygon mode
* make group and polygon position remain inside canvas area
* click through transparent area in grouped object
* add some shortcuts for basic usages
* tools button icon in center & switch mode border
* fix load svg image
* basic rtl support, panzoom have issues in rtl mode
* better zoom option both in ltr and rtl
* handle zoom event in mask editor
* add h button to handle toggle mask
* add more mime type
* use capital M (shift+m) for toggle mask
* allow io shortcuts in mask editor only
* make other shapes also remain in canvas bound area
* better zoom implementation, zoom from center
add zoom to resize event listener
* add a border to corner to handle blend of control
* add refresh button to go to selection menu
* add tooltip to shortcuts and also add shortcut for other tools
* make opacity remain in same state when toggled on
* opacity for group/ungroup objects
* update shortcuts implementation
* Simplify handling of occlusion types in editor code
- Unify updateIONoteInEditMode(), setOcclusionFieldInner() and
setOcclusionField() into updateOcclusionsField()
- Don't use `includeInactive` property of Shape class in editor code
- Drop `isEditMode`
+
Update the occlusions field every time a mask or text is updated, not
only in editing mode but also in adding mode, so that IO cards can be
previewed correctly in the card layout screen
* Indicate current occlusion type in pop-up menu
https://forums.ankiweb.net/t/anki-23-10-beta-5-6/35677/46
* Fix a11y warnings in Toolbar.svelte
* Drop `occludeInactive` parameter from `MaskEditorAPI.getShapes()`
* Add simple mask editor add-on API
* Signal completed mask editor image loading to Python
* Add API methods for querying mask editor state, fix formatting
* Use event forwarding to propagate image loaded event
Should fix mobile support by moving all bridgeCommand calls to `NoteEditor.svelte`
* Add shape classes to mask editor API
---------
Co-authored-by: Glutanimate <glutanimate@users.noreply.github.com>
* Propagate editor UI state transitions to add-ons
* Also set initial Python state to EditorState.INITIAL
---------
Co-authored-by: Glutanimate <glutanimate@users.noreply.github.com>
