@meith/web 0.33.0 → 0.33.1

package/app/admin/system/page.tsx

@@ -53,7 +53,7 @@ export default async function AdminSystemPage() {
     )
   }
 
-  const { mail, scheduler, volumes } = view
+  const { mail, scheduler, volumes, legacyPasswordHashes } = view
 
   return (
     <PanelPage
@@ -252,6 +252,20 @@ export default async function AdminSystemPage() {
         </ul>
       </section>
 
+      {legacyPasswordHashes > 0 && (
+        <section className={PANEL_CARD}>
+          <h2 className="font-heading text-lg font-semibold">
+            {translator.t('adminSystem.legacyPasswords')}
+          </h2>
+          <p className="text-sm">
+            {translator.t('adminSystem.legacyPasswordsCount', { count: legacyPasswordHashes })}
+          </p>
+          <p className="text-sm text-muted-foreground">
+            {translator.t('adminSystem.legacyPasswordsHint')}
+          </p>
+        </section>
+      )}
+
       <section className={PANEL_CARD}>
         <h2 className="font-heading text-lg font-semibold">
           {translator.t('adminSystem.migrations')}

package/app/redirect/page.tsx

@@ -15,12 +15,13 @@ export async function generateMetadata(): Promise<Metadata> {
 export default async function RedirectPage({
   searchParams,
 }: {
-  searchParams: Promise<{ to?: string; message?: string }>
+  searchParams: Promise<{ to?: string; m?: string }>
 }) {
-  const { to, message } = await searchParams
+  const { to, m } = await searchParams
+  const translator = await getTranslator()
   const filtered = await filterView(
     'view.redirect-notice',
-    buildRedirectNotice(to, message),
+    buildRedirectNotice(to, m, translator),
     viewerRef(await getActor()),
   )
   const notice = { ...filtered, targetHref: localHref(filtered.targetHref) }
@@ -36,7 +37,7 @@ export default async function RedirectPage({
       >
         <RedirectNotice
           {...notice}
-          copy={slotCopy(await currentTheme(), 'RedirectNotice', await getTranslator())}
+          copy={slotCopy(await currentTheme(), 'RedirectNotice', translator)}
         />
       </main>
     </>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@meith/web",
-  "version": "0.33.0",
+  "version": "0.33.1",
   "description": "The board itself: the Next.js app, and the forum-web bin that materializes it into an external board workspace.",
   "license": "MIT",
   "repository": {
@@ -43,54 +43,54 @@
     "react-dom": "19.2.8",
     "tailwindcss": "^4.3.3",
     "typescript": "7.0.2",
-    "@meith/accounts": "0.33.0",
-    "@meith/admin": "0.33.0",
-    "@meith/antispam": "0.33.0",
-    "@meith/api": "0.33.0",
-    "@meith/attachments": "0.33.0",
-    "@meith/authorization": "0.33.0",
-    "@meith/avatars": "0.33.0",
-    "@meith/board-digest": "0.33.0",
-    "@meith/core": "0.33.0",
-    "@meith/db": "0.33.0",
-    "@meith/demo": "0.33.0",
-    "@meith/drafts": "0.33.0",
-    "@meith/drivers": "0.33.0",
-    "@meith/events": "0.33.0",
-    "@meith/forums": "0.33.0",
-    "@meith/groups": "0.33.0",
-    "@meith/i18n": "0.33.0",
-    "@meith/import": "0.33.0",
-    "@meith/install": "0.33.0",
-    "@meith/mail": "0.33.0",
-    "@meith/markdown": "0.33.0",
-    "@meith/marketplace": "0.33.0",
-    "@meith/messages": "0.33.0",
-    "@meith/moderation": "0.33.0",
-    "@meith/notifications": "0.33.0",
-    "@meith/plugin-calendar": "0.33.0",
-    "@meith/plugin-dues": "0.33.0",
-    "@meith/plugin-kit": "0.33.0",
-    "@meith/polls": "0.33.0",
-    "@meith/posts": "0.33.0",
-    "@meith/profile-fields": "0.33.0",
-    "@meith/relations": "0.33.0",
-    "@meith/reputation": "0.33.0",
-    "@meith/runtime": "0.33.0",
-    "@meith/search": "0.33.0",
-    "@meith/settings": "0.33.0",
-    "@meith/signatures": "0.33.0",
-    "@meith/subscriptions": "0.33.0",
-    "@meith/tasks": "0.33.0",
-    "@meith/theme-clubhouse": "0.33.0",
-    "@meith/theme-default": "0.33.0",
-    "@meith/theme-kit": "0.33.0",
-    "@meith/theme-midnight": "0.33.0",
-    "@meith/theme-phasebook": "0.33.0",
-    "@meith/theme-raidframe": "0.33.0",
-    "@meith/threads": "0.33.0",
-    "@meith/ui": "0.33.0",
-    "@meith/upgrade": "0.33.0"
+    "@meith/accounts": "0.33.1",
+    "@meith/admin": "0.33.1",
+    "@meith/antispam": "0.33.1",
+    "@meith/api": "0.33.1",
+    "@meith/attachments": "0.33.1",
+    "@meith/authorization": "0.33.1",
+    "@meith/avatars": "0.33.1",
+    "@meith/board-digest": "0.33.1",
+    "@meith/core": "0.33.1",
+    "@meith/db": "0.33.1",
+    "@meith/demo": "0.33.1",
+    "@meith/drafts": "0.33.1",
+    "@meith/drivers": "0.33.1",
+    "@meith/events": "0.33.1",
+    "@meith/forums": "0.33.1",
+    "@meith/groups": "0.33.1",
+    "@meith/i18n": "0.33.1",
+    "@meith/import": "0.33.1",
+    "@meith/install": "0.33.1",
+    "@meith/mail": "0.33.1",
+    "@meith/markdown": "0.33.1",
+    "@meith/marketplace": "0.33.1",
+    "@meith/messages": "0.33.1",
+    "@meith/moderation": "0.33.1",
+    "@meith/notifications": "0.33.1",
+    "@meith/plugin-calendar": "0.33.1",
+    "@meith/plugin-dues": "0.33.1",
+    "@meith/plugin-kit": "0.33.1",
+    "@meith/polls": "0.33.1",
+    "@meith/posts": "0.33.1",
+    "@meith/profile-fields": "0.33.1",
+    "@meith/relations": "0.33.1",
+    "@meith/reputation": "0.33.1",
+    "@meith/runtime": "0.33.1",
+    "@meith/search": "0.33.1",
+    "@meith/settings": "0.33.1",
+    "@meith/signatures": "0.33.1",
+    "@meith/subscriptions": "0.33.1",
+    "@meith/tasks": "0.33.1",
+    "@meith/theme-clubhouse": "0.33.1",
+    "@meith/theme-default": "0.33.1",
+    "@meith/theme-kit": "0.33.1",
+    "@meith/theme-midnight": "0.33.1",
+    "@meith/theme-phasebook": "0.33.1",
+    "@meith/theme-raidframe": "0.33.1",
+    "@meith/threads": "0.33.1",
+    "@meith/ui": "0.33.1",
+    "@meith/upgrade": "0.33.1"
   },
   "scripts": {
     "dev": "next dev",

package/src/components/admin/theme-forms.tsx

@@ -507,7 +507,7 @@ export function ThemeEditorForm({
             <p className="text-xs text-muted-foreground">
               {fromCopy(copy, 'adminTheme.validated.blurb')}
             </p>
-            <style dangerouslySetInnerHTML={{ __html: state.preview }} />
+            <style>{state.preview}</style>
             <ValidatedSample copy={copy} />
           </section>
         )}

package/src/server/image-upload.ts

@@ -46,6 +46,31 @@ export function sniff(bytes: Uint8Array): ImageFormat | null {
   return null
 }
 
+const DANGEROUS_TAG = /<\s*(script|foreignobject|iframe|embed|object|set|animate\w*)\b/i
+const EVENT_HANDLER_OR_SCRIPT_SCHEME = /\son\w+\s*=|javascript:|vbscript:/i
+const REFERENCING_TAG = /<\s*(use|image|feimage)\b([^>]*)>/gi
+const HREF_ATTRIBUTE = /(?:xlink:href|href)\s*=\s*(\x22|\x27)([\s\S]*?)\1/i
+
+function decodeEntities(value: string): string {
+  return value.replace(/&(#\d+|#x[0-9a-f]+|amp|lt|gt|quot|apos);/gi, (match, entity: string) => {
+    if (entity.startsWith('#')) {
+      const isHex = entity[1] === 'x' || entity[1] === 'X'
+      const code = Number.parseInt(entity.slice(isHex ? 2 : 1), isHex ? 16 : 10)
+      return Number.isFinite(code) ? String.fromCodePoint(code) : match
+    }
+    const named: Record<string, string> = { amp: '&', lt: '<', gt: '>', quot: '"', apos: "'" }
+    return named[entity.toLowerCase()] ?? match
+  })
+}
+
+function hasExternalReference(decoded: string): boolean {
+  for (const match of decoded.matchAll(REFERENCING_TAG)) {
+    const href = HREF_ATTRIBUTE.exec(match[2] ?? '')?.[2]?.trim()
+    if (href !== undefined && href !== '' && !href.startsWith('#')) return true
+  }
+  return false
+}
+
 function isSvg(bytes: Uint8Array): boolean {
   const decoder = new TextDecoder('utf-8', { fatal: false })
   const head = decoder
@@ -56,9 +81,14 @@ function isSvg(bytes: Uint8Array): boolean {
   const looksSvg = head.startsWith('<svg') || /^<\?xml[\s\S]{0,512}?<svg/i.test(head)
   if (!looksSvg) return false
 
-  if (/<script|<foreignObject|\son\w+\s*=|javascript:/i.test(decoder.decode(bytes))) {
+  const decoded = decodeEntities(decoder.decode(bytes))
+
+  if (DANGEROUS_TAG.test(decoded) || EVENT_HANDLER_OR_SCRIPT_SCHEME.test(decoded)) {
     throw new ValidationError(msg('error.app.svg-contains-script-event-handler'))
   }
+  if (hasExternalReference(decoded)) {
+    throw new ValidationError(msg('error.app.svg-contains-external-reference'))
+  }
   return true
 }
 

package/src/server/system-admin.ts

@@ -50,6 +50,7 @@ export interface SystemHealthView {
   readonly recount: readonly RecountStateRow[]
   readonly volumes: BoardVolumes
   readonly prunableSessions: number
+  readonly legacyPasswordHashes: number
 }
 
 export async function buildSystemHealthView(now: Date): Promise<SystemHealthView | null> {
@@ -57,15 +58,17 @@ export async function buildSystemHealthView(now: Date): Promise<SystemHealthView
   if (repository === null) return null
 
   const maintenance = new PostgresMaintenanceRepository(getDb())
-  const [tasks, runs, recount, volumes, prunableSessions, searchIndex, mail] = await Promise.all([
-    repository.taskHealth(),
-    repository.recentRuns(20),
-    repository.recountState(),
-    repository.volumes(),
-    maintenance.countPrunableSessions(now),
-    new PostgresSearchRepository(getDb()).indexProgress(),
-    assessMailReadiness(),
-  ])
+  const [tasks, runs, recount, volumes, prunableSessions, searchIndex, mail, legacyPasswordHashes] =
+    await Promise.all([
+      repository.taskHealth(),
+      repository.recentRuns(20),
+      repository.recountState(),
+      repository.volumes(),
+      maintenance.countPrunableSessions(now),
+      new PostgresSearchRepository(getDb()).indexProgress(),
+      assessMailReadiness(),
+      repository.legacyPasswordHashes(),
+    ])
 
   const scheduler = assessScheduler(tasks, now)
   const taskMessages = new Map(
@@ -86,5 +89,6 @@ export async function buildSystemHealthView(now: Date): Promise<SystemHealthView
     recount,
     volumes,
     prunableSessions,
+    legacyPasswordHashes,
   }
 }

package/src/server/upgrade-notice.ts

@@ -16,7 +16,7 @@ import { planUpgrade, type UpgradeState, upgradeNotice } from '@meith/upgrade'
 
 import { activeDefinitions } from './plugin-host'
 
-export const CODE_VERSION = '0.33.0'
+export const CODE_VERSION = '0.33.1'
 
 export interface UpgradeApplied {
   readonly plugins: readonly string[]

package/src/view/redirect-notice.ts

@@ -1,7 +1,19 @@
+import type { Translator } from '@meith/i18n'
 import type { RedirectNoticeModel } from '@meith/theme-kit'
 
+import { untranslated } from './time'
+
 export const REDIRECT_DELAY_SECONDS = 2
 
+const DEFAULT_MESSAGE_KEY = 'redirectNotice.continuing'
+
+const REDIRECT_MESSAGE_KEYS: Readonly<Record<string, string>> = {
+  continuing: DEFAULT_MESSAGE_KEY,
+  'signed-out': 'redirectNotice.signedOut',
+  saved: 'redirectNotice.saved',
+  posted: 'redirectNotice.posted',
+}
+
 export function localHref(value: string | undefined): string {
   if (value === undefined || !value.startsWith('/')) return '/'
   const origin = 'https://forum.invalid'
@@ -11,11 +23,16 @@ export function localHref(value: string | undefined): string {
 
 export function buildRedirectNotice(
   target: string | undefined,
-  message: string | undefined,
+  messageKey: string | undefined,
+  t: Translator = untranslated(),
 ): RedirectNoticeModel {
+  const key =
+    (messageKey !== undefined ? REDIRECT_MESSAGE_KEYS[messageKey] : undefined) ??
+    DEFAULT_MESSAGE_KEY
+
   return {
     targetHref: localHref(target),
-    message: message?.trim() || 'Continuing…',
+    message: t.t(key),
     delaySeconds: REDIRECT_DELAY_SECONDS,
   }
 }