@hostlink/nuxt-light 1.64.0 → 1.64.2

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "light",
   "configKey": "light",
-  "version": "1.64.0",
+  "version": "1.64.2",
   "builder": {
     "@nuxt/module-builder": "1.0.2",
     "unbuild": "3.6.1"

package/dist/runtime/components/L/System/Setting/security.d.vue.ts

@@ -12,7 +12,7 @@ export type LSystemSettingSecurityProps = {
     password_expiration: string;
     password_expiration_duration: string;
     concurrent_login_disabled: string;
-    web_authn_enabled?: string;
+    webauthn_enabled?: string;
 };
 declare const __VLS_export: import("vue").DefineComponent<LSystemSettingSecurityProps, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {
     submit: (...args: any[]) => void;
@@ -32,6 +32,7 @@ declare const __VLS_export: import("vue").DefineComponent<LSystemSettingSecurity
     password_expiration: string;
     password_expiration_duration: string;
     concurrent_login_disabled: string;
+    webauthn_enabled: string;
 }, {}, {}, {}, string, import("vue").ComponentProvideOptions, false, {}, any>;
 declare const _default: typeof __VLS_export;
 export default _default;

package/dist/runtime/components/L/System/Setting/security.vue

@@ -14,7 +14,7 @@ defineProps({
   password_expiration: { type: String, required: true, default: "0" },
   password_expiration_duration: { type: String, required: true, default: "90" },
   concurrent_login_disabled: { type: String, required: true, default: "0" },
-  web_authn_enabled: { type: String, required: false }
+  webauthn_enabled: { type: String, required: false, default: "1" }
 });
 </script>
 

package/dist/runtime/components/L/System/Setting/security.vue.d.ts

@@ -12,7 +12,7 @@ export type LSystemSettingSecurityProps = {
     password_expiration: string;
     password_expiration_duration: string;
     concurrent_login_disabled: string;
-    web_authn_enabled?: string;
+    webauthn_enabled?: string;
 };
 declare const __VLS_export: import("vue").DefineComponent<LSystemSettingSecurityProps, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {
     submit: (...args: any[]) => void;
@@ -32,6 +32,7 @@ declare const __VLS_export: import("vue").DefineComponent<LSystemSettingSecurity
     password_expiration: string;
     password_expiration_duration: string;
     concurrent_login_disabled: string;
+    webauthn_enabled: string;
 }, {}, {}, {}, string, import("vue").ComponentProvideOptions, false, {}, any>;
 declare const _default: typeof __VLS_export;
 export default _default;

package/dist/runtime/components/l-editor.vue

@@ -1,6 +1,7 @@
 <script setup>
 import { computed, ref, useAttrs } from "vue";
 import { useQuasar } from "quasar";
+import { sanitizeHtml } from "../composables/sanitizeHtml";
 const $q = useQuasar();
 const editorRef = ref(null);
 const textColorRef = ref(null);
@@ -10,6 +11,9 @@ const highlight = ref("#ffff00aa");
 const foreColor = ref("#000000");
 const tableRows = ref(3);
 const tableCols = ref(3);
+const onEditorBlur = () => {
+  emit("update:modelValue", sanitizeHtml(props.modelValue));
+};
 const TextColorCMD = ((cmd, name) => {
   const edit = editorRef.value;
   textColorRef.value.hide();
@@ -182,7 +186,7 @@ const newFonts = {
 </script>
 
 <template>
-    <q-editor v-model="localValue" ref="editorRef" v-bind="attrs">
+    <q-editor v-model="localValue" ref="editorRef" v-bind="attrs" @blur="onEditorBlur">
         <template v-slot:textColor>
             <q-btn-dropdown dense no-caps ref="textColorRef" no-wrap unelevated color="white" text-color="default"
                 label="Text Color" icon="sym_o_format_color_text" size="sm">

package/dist/runtime/composables/sanitizeHtml.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Sanitize HTML to prevent XSS attacks
+ * Use this before rendering user-generated content with v-html
+ *
+ * @example
+ * <div v-html="sanitizeHtml(userContent)" />
+ */
+export declare const sanitizeHtml: (html: string) => string;
+export default sanitizeHtml;

package/dist/runtime/composables/sanitizeHtml.js

@@ -0,0 +1,80 @@
+import DOMPurify from "dompurify";
+const purifyConfig = {
+  ALLOWED_TAGS: [
+    "p",
+    "br",
+    "span",
+    "div",
+    "a",
+    "b",
+    "i",
+    "u",
+    "s",
+    "strong",
+    "em",
+    "strike",
+    "h1",
+    "h2",
+    "h3",
+    "h4",
+    "h5",
+    "h6",
+    "ul",
+    "ol",
+    "li",
+    "blockquote",
+    "pre",
+    "code",
+    "table",
+    "thead",
+    "tbody",
+    "tr",
+    "th",
+    "td",
+    "img",
+    "hr",
+    "sub",
+    "sup",
+    "font"
+  ],
+  ALLOWED_ATTR: [
+    "href",
+    "target",
+    "rel",
+    "src",
+    "alt",
+    "title",
+    "width",
+    "height",
+    "style",
+    "class",
+    "id",
+    "border",
+    "cellpadding",
+    "cellspacing",
+    "colspan",
+    "rowspan",
+    "align",
+    "valign",
+    "color",
+    "size",
+    "face"
+  ],
+  ALLOW_DATA_ATTR: false,
+  FORBID_TAGS: ["script", "style", "iframe", "object", "embed", "form", "input", "button"],
+  FORBID_ATTR: ["onerror", "onload", "onclick", "onmouseover", "onfocus", "onblur", "onchange", "onsubmit"]
+};
+let hookAdded = false;
+if (!hookAdded && typeof window !== "undefined") {
+  DOMPurify.addHook("uponSanitizeAttribute", (node, data) => {
+    if (data.attrName.startsWith("on")) {
+      data.keepAttr = false;
+    }
+  });
+  hookAdded = true;
+}
+export const sanitizeHtml = (html) => {
+  if (!html) return "";
+  return DOMPurify.sanitize(html, purifyConfig);
+};
+export default sanitizeHtml;

package/dist/runtime/pages/System/database/process.vue

@@ -33,7 +33,7 @@ onUnmounted(() => {
 
 <template>
     <l-page title="System Database Process">
-        <q-table :rows="data?.database?.processList || []" hide-bottom v-bind="$light.styles.table" :loading="loading">
+        <q-table :rows="data?.database?.processList || []" v-bind="$light.styles.table" :loading="loading">
             <template #top-left>
                 <q-btn label="Reload" outline color="primary" icon="sym_o_refresh" @click="refresh"></q-btn>
             </template>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hostlink/nuxt-light",
-  "version": "1.64.0",
+  "version": "1.64.2",
   "description": "HostLink Nuxt Light Framework",
   "repository": {
     "type": "git",
@@ -40,6 +40,7 @@
     "axios": "^1.12.2",
     "defu": "^6.1.4",
     "diff2html": "^3.4.47",
+    "dompurify": "^3.3.1",
     "formkit-quasar": "^0.0.15",
     "json-to-graphql-query": "^2.3.0",
     "nuxt-quasar-ui": "^3.0.0",