nodebb-plugin-pdf-secure 1.2.23 → 1.2.26

package/lib/controllers.js

@@ -45,12 +45,8 @@ Controllers.servePdfBinary = async function (req, res) {
 	}
 
 	try {
-		let pdfBuffer;
-		if (data.isPremium) {
-			pdfBuffer = await pdfHandler.getFullPdf(data.file);
-		} else {
-			pdfBuffer = await pdfHandler.getSinglePagePdf(data.file);
-		}
+		// Always send full PDF - page restriction is handled client-side
+		const pdfBuffer = await pdfHandler.getFullPdf(data.file);
 
 		// Apply partial XOR encryption with dynamic key from nonce
 		const encodedBuffer = partialXorEncode(pdfBuffer, data.xorKey);

package/library.js

@@ -78,20 +78,24 @@ plugin.init = async (params) => {
 			return res.status(500).send('Viewer not available');
 		}
 
-		// Check if user is Premium (admins/global mods always premium)
+		// Check if user is Premium or Lite (admins/global mods always premium)
 		let isPremium = false;
+		let isLite = false;
 		if (req.uid) {
-			const [isAdmin, isGlobalMod, isPremiumMember] = await Promise.all([
+			const [isAdmin, isGlobalMod, isPremiumMember, isLiteMember] = await Promise.all([
 				groups.isMember(req.uid, 'administrators'),
 				groups.isMember(req.uid, 'Global Moderators'),
 				groups.isMember(req.uid, 'Premium'),
+				groups.isMember(req.uid, 'Lite'),
 			]);
 			isPremium = isAdmin || isGlobalMod || isPremiumMember;
+			// Lite: full PDF access but restricted UI (no annotations, sidebar, etc.)
+			isLite = !isPremium && isLiteMember;
 		}
 
-		// Always send full PDF (client-side premium gating)
-		// isPremium flag is sent to client for UI control only
-		const nonceData = nonceStore.generate(req.uid || 0, safeName, true);
+		// Lite users get full PDF like premium (for nonce/server-side PDF data)
+		const hasFullAccess = isPremium || isLite;
+		const nonceData = nonceStore.generate(req.uid || 0, safeName, hasFullAccess);
 
 		// Serve the viewer template with comprehensive security headers
 		res.set({
@@ -121,7 +125,8 @@ plugin.init = async (params) => {
 						csrfToken: ${JSON.stringify(req.csrfToken ? req.csrfToken() : '')},
 						nonce: ${JSON.stringify(nonceData.nonce)},
 						dk: ${JSON.stringify(nonceData.xorKey)},
-						isPremium: ${JSON.stringify(isPremium)}
+						isPremium: ${JSON.stringify(isPremium)},
+						isLite: ${JSON.stringify(isLite)}
 					};
 				</script>
 			</head>`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nodebb-plugin-pdf-secure",
-  "version": "1.2.23",
+  "version": "1.2.26",
   "description": "Secure PDF viewer plugin for NodeBB - prevents downloading, enables canvas-only rendering with Premium group support",
   "main": "library.js",
   "repository": {

package/static/templates/admin/plugins/pdf-secure.tpl

@@ -14,7 +14,13 @@
 					<div class="mb-3">
 						<label class="form-label" for="premiumGroup">Premium Group Name</label>
 						<input type="text" id="premiumGroup" name="premiumGroup" title="Premium Group Name" class="form-control" placeholder="Premium" value="Premium">
-						<div class="form-text">Users in this group can view full PDFs. Others can only see the first page.</div>
+						<div class="form-text">Users in this group can view full PDFs with all tools. Others can only see the first page.</div>
+					</div>
+
+					<div class="mb-3">
+						<label class="form-label" for="liteGroup">Lite Group Name</label>
+						<input type="text" id="liteGroup" name="liteGroup" title="Lite Group Name" class="form-control" placeholder="Lite" value="Lite">
+						<div class="form-text">Users in this group can view full PDFs but only with zoom and fullscreen. No annotations, sidebar, or other tools.</div>
 					</div>
 
 					<div class="form-check form-switch mb-3">

package/static/viewer-app.js

@@ -200,6 +200,50 @@
         viewerEl.appendChild(overlay);
     }
 
+    // ============================================
+    // LITE MODE: Hide all tools except fullscreen and zoom
+    // Lite users can view full PDF but cannot use annotations,
+    // sidebar, rotate, sepia, overflow menu, etc.
+    // ============================================
+    function applyLiteMode() {
+        // Hide sidebar button (İçindekiler)
+        const sidebarBtn = document.getElementById('sidebarBtn');
+        if (sidebarBtn) sidebarBtn.style.display = 'none';
+
+        // Close sidebar if open
+        const sidebarEl = document.getElementById('sidebar');
+        if (sidebarEl) sidebarEl.classList.remove('open');
+
+        // Hide entire annotation tools group (highlight, draw, eraser, select, undo/redo, text, shapes)
+        const annotationGroup = document.querySelector('#toolbar > .toolbarGroup:nth-child(3)');
+        if (annotationGroup) annotationGroup.style.display = 'none';
+
+        // In the zoom/utility group, hide everything except zoomIn and zoomOut
+        const keepIds = new Set(['zoomIn', 'zoomOut']);
+        const utilityGroup = document.querySelector('#toolbar > .toolbarGroup:nth-child(5)');
+        if (utilityGroup) {
+            Array.from(utilityGroup.children).forEach(function (child) {
+                if (!keepIds.has(child.id)) {
+                    child.style.display = 'none';
+                }
+            });
+        }
+
+        // Hide bottom toolbar annotation tools (mobile), keep only fullscreen button
+        const bottomToolbarInner = document.getElementById('bottomToolbarInner');
+        if (bottomToolbarInner) bottomToolbarInner.style.display = 'none';
+
+        // Hide all top-level separators between groups
+        document.querySelectorAll('#toolbar > .separator').forEach(function (sep) {
+            sep.style.display = 'none';
+        });
+
+        // Hide page info (Lite users don't need page input)
+        // Actually keep page info for navigation awareness
+
+        console.log('[PDF-Secure] Lite mode applied - restricted toolbar');
+    }
+
     // ============================================
     // PREMIUM INTEGRITY: Periodic Check (2s interval)
     // Hides pages 2+, recreates overlay if removed, forces page 1
@@ -342,8 +386,8 @@
                     pdfBuffer = encodedBuffer;
                 }
 
-                // Send buffer to parent for caching (premium only - non-premium must not leak decoded buffer)
-                if (_cfg.isPremium !== false && window.parent && window.parent !== window) {
+                // Send buffer to parent for caching (premium/lite only - non-premium must not leak decoded buffer)
+                if ((_cfg.isPremium !== false || _cfg.isLite) && window.parent && window.parent !== window) {
                     // Clone buffer for parent (we keep original)
                     const bufferCopy = pdfBuffer.slice(0);
                     window.parent.postMessage({
@@ -360,7 +404,7 @@
             await loadPDFFromBuffer(pdfBuffer);
 
             // Premium Gate: Client-side page restriction for non-premium users
-            if (config.isPremium === false && pdfDoc && pdfDoc.numPages > 1) {
+            if (config.isPremium === false && !config.isLite && pdfDoc && pdfDoc.numPages > 1) {
                 premiumInfo = Object.freeze({ isPremium: false, totalPages: pdfDoc.numPages });
                 showPremiumLockOverlay(pdfDoc.numPages);
                 startPeriodicCheck();
@@ -369,6 +413,11 @@
                 premiumInfo = Object.freeze({ isPremium: true, totalPages: pdfDoc ? pdfDoc.numPages : 1 });
             }
 
+            // Lite Mode: Hide all tools except fullscreen and zoom
+            if (config.isLite) {
+                applyLiteMode();
+            }
+
             // Step 5: Moved to pagerendered event for proper timing
 
             // Step 6: Security - clear references to prevent extraction
@@ -653,27 +702,43 @@
 
     // Overflow menu toggle
     document.getElementById('overflowBtn').onclick = (e) => toggleDropdown(overflowDropdown, e);
-    overflowDropdown.onclick = (e) => e.stopPropagation();
+    overflowDropdown.addEventListener('click', (e) => e.stopPropagation());
+    overflowDropdown.addEventListener('pointerup', (e) => e.stopPropagation());
+
+    // Overflow menu actions — use both click + pointerup for reliable tablet/touch support
+    function attachOverflowAction(id, action) {
+        const el = document.getElementById(id);
+        let fired = false;
+        function run() {
+            if (fired) return;
+            fired = true;
+            requestAnimationFrame(() => { fired = false; });
+            action();
+        }
+        el.addEventListener('click', run);
+        el.addEventListener('pointerup', (e) => {
+            if (e.pointerType === 'touch' || e.pointerType === 'pen') run();
+        });
+    }
 
-    // Overflow menu actions
-    document.getElementById('overflowRotateLeft').onclick = () => {
+    attachOverflowAction('overflowRotateLeft', () => {
         rotatePage(-90);
         closeAllDropdowns();
-    };
-    document.getElementById('overflowRotateRight').onclick = () => {
+    });
+    attachOverflowAction('overflowRotateRight', () => {
         rotatePage(90);
         closeAllDropdowns();
-    };
-    document.getElementById('overflowSepia').onclick = () => {
+    });
+    attachOverflowAction('overflowSepia', () => {
         document.getElementById('sepiaBtn').click();
         document.getElementById('overflowSepia').classList.toggle('active',
             document.getElementById('sepiaBtn').classList.contains('active'));
         closeAllDropdowns();
-    };
-    document.getElementById('overflowFullscreen').onclick = () => {
+    });
+    attachOverflowAction('overflowFullscreen', () => {
         toggleFullscreen();
         closeAllDropdowns();
-    };
+    });
 
     // Close dropdowns when clicking outside
     document.addEventListener('click', (e) => {
@@ -2393,46 +2458,51 @@
         if (e.target.tagName === 'INPUT' || e.target.contentEditable === 'true') return;
 
         const key = e.key.toLowerCase();
+        const isLiteMode = _cfg && _cfg.isLite;
 
-        // Tool shortcuts
-        if (key === 'h') { setTool('highlight'); e.preventDefault(); }
-        if (key === 'p') { setTool('pen'); e.preventDefault(); }
-        if (key === 'e') { setTool('eraser'); e.preventDefault(); }
-        if (key === 't') { setTool('text'); e.preventDefault(); }
-        if (key === 'r') { setTool('shape'); e.preventDefault(); }
-        if (key === 'v') { setTool('select'); e.preventDefault(); }
+        // Fullscreen shortcut (always allowed)
         if (key === 'f') { toggleFullscreen(); e.preventDefault(); }
 
-        // Delete selected annotation(s)
-        if ((key === 'delete' || key === 'backspace') && (selectedAnnotation || multiSelectedAnnotations.length > 0)) {
+        // Tool shortcuts (blocked in Lite mode)
+        if (!isLiteMode) {
+            if (key === 'h') { setTool('highlight'); e.preventDefault(); }
+            if (key === 'p') { setTool('pen'); e.preventDefault(); }
+            if (key === 'e') { setTool('eraser'); e.preventDefault(); }
+            if (key === 't') { setTool('text'); e.preventDefault(); }
+            if (key === 'r') { setTool('shape'); e.preventDefault(); }
+            if (key === 'v') { setTool('select'); e.preventDefault(); }
+        }
+
+        // Delete selected annotation(s) (blocked in Lite mode)
+        if (!isLiteMode && (key === 'delete' || key === 'backspace') && (selectedAnnotation || multiSelectedAnnotations.length > 0)) {
             deleteSelectedAnnotation();
             e.preventDefault();
         }
 
-        // Undo/Redo
-        if ((e.ctrlKey || e.metaKey) && key === 'z' && !e.shiftKey) {
+        // Undo/Redo (blocked in Lite mode)
+        if (!isLiteMode && (e.ctrlKey || e.metaKey) && key === 'z' && !e.shiftKey) {
             performUndo();
             e.preventDefault();
             return;
         }
-        if ((e.ctrlKey || e.metaKey) && (key === 'y' || (key === 'z' && e.shiftKey))) {
+        if (!isLiteMode && (e.ctrlKey || e.metaKey) && (key === 'y' || (key === 'z' && e.shiftKey))) {
             performRedo();
             e.preventDefault();
             return;
         }
 
-        // Copy/Paste annotations
-        if ((e.ctrlKey || e.metaKey) && key === 'c' && selectedAnnotation) {
+        // Copy/Paste annotations (blocked in Lite mode)
+        if (!isLiteMode && (e.ctrlKey || e.metaKey) && key === 'c' && selectedAnnotation) {
             copySelectedAnnotation();
             e.preventDefault();
         }
-        if ((e.ctrlKey || e.metaKey) && key === 'v' && copiedAnnotation) {
+        if (!isLiteMode && (e.ctrlKey || e.metaKey) && key === 'v' && copiedAnnotation) {
             pasteAnnotation();
             e.preventDefault();
         }
 
-        // Navigation
-        if (key === 's') {
+        // Sidebar toggle (blocked in Lite mode)
+        if (!isLiteMode && key === 's') {
             document.getElementById('sidebarBtn').click();
             e.preventDefault();
         }

package/static/viewer.css

@@ -115,6 +115,7 @@ body {
     align-items: center;
     justify-content: center;
     transition: background 0.1s;
+    touch-action: manipulation;
 }
 
 .toolbarBtn:hover {
@@ -426,8 +427,12 @@ body {
     border-radius: 6px;
     font-size: 14px;
     white-space: nowrap;
+    touch-action: manipulation;
+    -webkit-tap-highlight-color: rgba(255, 255, 255, 0.1);
+    user-select: none;
+    -webkit-user-select: none;
 }
-.overflowItem:hover { background: var(--bg-tertiary); }
+.overflowItem:hover, .overflowItem:active { background: var(--bg-tertiary); }
 .overflowItem svg { width: 20px; height: 20px; fill: currentColor; flex-shrink: 0; }
 .overflowItem.active { color: var(--accent); }
 .overflowDivider { height: 1px; background: var(--border-color); margin: 6px 0; }
@@ -436,13 +441,12 @@ body {
 #overflowWrapper { display: flex; }
 .overflowSep { display: block; }
 
-/* Hide rotate, sepia and their separators (children 3-8 of view group) */
+/* Hide rotate, sepia and their separators (children 3-7 of view group) */
 .toolbarGroup:nth-child(5) > :nth-child(3),
 .toolbarGroup:nth-child(5) > :nth-child(4),
 .toolbarGroup:nth-child(5) > :nth-child(5),
 .toolbarGroup:nth-child(5) > :nth-child(6),
-.toolbarGroup:nth-child(5) > :nth-child(7),
-.toolbarGroup:nth-child(5) > :nth-child(8) { display: none !important; }
+.toolbarGroup:nth-child(5) > :nth-child(7) { display: none !important; }
 
 /* Shape Grid */
 .shapeGrid {

package/static/viewer.html

@@ -132,6 +132,7 @@
             align-items: center;
             justify-content: center;
             transition: background 0.1s;
+            touch-action: manipulation;
         }
 
         .toolbarBtn:hover {
@@ -455,9 +456,14 @@
             border-radius: 6px;
             font-size: 14px;
             white-space: nowrap;
+            touch-action: manipulation;
+            -webkit-tap-highlight-color: rgba(255, 255, 255, 0.1);
+            user-select: none;
+            -webkit-user-select: none;
         }
 
-        .overflowItem:hover {
+        .overflowItem:hover,
+        .overflowItem:active {
             background: var(--bg-tertiary);
         }
 
@@ -487,13 +493,12 @@
             display: block;
         }
 
-        /* Hide rotate, sepia and their separators (children 3-8 of view group) */
+        /* Hide rotate, sepia and their separators (children 3-7 of view group) */
         .toolbarGroup:nth-child(5)> :nth-child(3),
         .toolbarGroup:nth-child(5)> :nth-child(4),
         .toolbarGroup:nth-child(5)> :nth-child(5),
         .toolbarGroup:nth-child(5)> :nth-child(6),
-        .toolbarGroup:nth-child(5)> :nth-child(7),
-        .toolbarGroup:nth-child(5)> :nth-child(8) {
+        .toolbarGroup:nth-child(5)> :nth-child(7) {
             display: none !important;
         }
 
@@ -1687,6 +1692,13 @@
                     <path d="M3 4h18v2H3V4zm0 7h18v2H3v-2zm0 7h18v2H3v-2z" />
                 </svg>
             </button>
+
+            <!-- Fullscreen Toggle -->
+            <button class="toolbarBtn" id="fullscreenBtn" data-tooltip="Tam Ekran (F)">
+                <svg viewBox="0 0 24 24" id="fullscreenIcon">
+                    <path d="M7 14H5v5h5v-2H7v-3zm-2-4h2V7h3V5H5v5zm12 7h-3v2h5v-5h-2v3zM14 5v2h3v3h2V5h-5z" />
+                </svg>
+            </button>
         </div>
 
 
@@ -1952,15 +1964,6 @@
                 </svg>
             </button>
 
-            <div class="separator"></div>
-
-            <!-- Fullscreen Toggle -->
-            <button class="toolbarBtn" id="fullscreenBtn" data-tooltip="Tam Ekran (F)">
-                <svg viewBox="0 0 24 24" id="fullscreenIcon">
-                    <path d="M7 14H5v5h5v-2H7v-3zm-2-4h2V7h3V5H5v5zm12 7h-3v2h5v-5h-2v3zM14 5v2h3v3h2V5h-5z" />
-                </svg>
-            </button>
-
             <div class="separator overflowSep"></div>
 
             <div class="toolbarBtnWithDropdown" id="overflowWrapper">
@@ -2259,7 +2262,7 @@
             }
 
             function resetOverlayCSS(overlay) {
-                if (!isOverlayTampered(overlay)) return; // Skip if already correct (prevents observer loop)
+                if (!isOverlayTampered(overlay)) return;
                 overlay.style.cssText = 'position:absolute;top:0;left:0;right:0;bottom:0;display:flex;z-index:15;opacity:1;visibility:visible;pointer-events:auto;';
             }
 
@@ -2268,15 +2271,12 @@
                 pages.forEach(function (page) {
                     var pageNum = parseInt(page.dataset.pageNumber || '0', 10);
                     if (pageNum > 1) {
-                        // Ensure page is visible (undo any old display:none)
                         if (page.style.display === 'none') {
                             page.style.display = '';
                         }
                         injectPageLock(page);
-                        // CSS integrity: reset overlay styles in case of tampering
                         var existing = page.querySelector('.page-lock-overlay');
                         if (existing) resetOverlayCSS(existing);
-                        // Ensure blur class is present
                         if (!page.classList.contains('page-locked-blur')) {
                             page.classList.add('page-locked-blur');
                         }
@@ -2323,13 +2323,11 @@
                     for (var i = 0; i < mutations.length; i++) {
                         var target = mutations[i].target;
                         if (!target || !target.classList) continue;
-                        // Overlay CSS tampered - reset only if values actually differ
                         if (target.classList.contains('page-lock-overlay')) {
                             if (isOverlayTampered(target)) {
                                 resetOverlayCSS(target);
                             }
                         }
-                        // Blur class removed from locked page - re-add it
                         if (target.classList.contains('page') && !target.classList.contains('page-locked-blur')) {
                             var pageNum = parseInt(target.dataset.pageNumber || '0', 10);
                             if (pageNum > 1) {
@@ -2340,6 +2338,47 @@
                 }).observe(viewerEl, { subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
             }
 
+            // ============================================
+            // LITE MODE: Hide all tools except fullscreen and zoom
+            // Lite users can view full PDF but cannot use annotations,
+            // sidebar, rotate, sepia, overflow menu, etc.
+            // ============================================
+            function applyLiteMode() {
+                // Hide sidebar button
+                var sidebarBtn = document.getElementById('sidebarBtn');
+                if (sidebarBtn) sidebarBtn.style.display = 'none';
+
+                // Close sidebar if open
+                var sidebarEl = document.getElementById('sidebar');
+                if (sidebarEl) sidebarEl.classList.remove('open');
+
+                // Hide entire annotation tools group (highlight, draw, eraser, select, undo/redo, text, shapes)
+                var annotationGroup = document.querySelector('#toolbar > .toolbarGroup:nth-child(3)');
+                if (annotationGroup) annotationGroup.style.display = 'none';
+
+                // In the zoom/utility group, hide everything except zoomIn and zoomOut
+                var keepIds = new Set(['zoomIn', 'zoomOut']);
+                var utilityGroup = document.querySelector('#toolbar > .toolbarGroup:nth-child(5)');
+                if (utilityGroup) {
+                    Array.from(utilityGroup.children).forEach(function (child) {
+                        if (!keepIds.has(child.id)) {
+                            child.style.display = 'none';
+                        }
+                    });
+                }
+
+                // Hide bottom toolbar annotation tools (mobile), keep only fullscreen button
+                var bottomToolbarInner = document.getElementById('bottomToolbarInner');
+                if (bottomToolbarInner) bottomToolbarInner.style.display = 'none';
+
+                // Hide all top-level separators between groups
+                document.querySelectorAll('#toolbar > .separator').forEach(function (sep) {
+                    sep.style.display = 'none';
+                });
+
+                console.log('[PDF-Secure] Lite mode applied - restricted toolbar');
+            }
+
             // Auto-load PDF if config is present (injected by NodeBB plugin)
             async function autoLoadSecurePDF() {
                 if (!_cfg || !_cfg.filename) {
@@ -2420,7 +2459,7 @@
                         }
 
                         // Send buffer to parent for caching (premium only - non-premium must not leak decoded buffer)
-                        if (_cfg.isPremium !== false && window.parent && window.parent !== window) {
+                        if ((_cfg.isPremium !== false || _cfg.isLite) && window.parent && window.parent !== window) {
                             // Clone buffer for parent (we keep original)
                             const bufferCopy = pdfBuffer.slice(0);
                             window.parent.postMessage({
@@ -2436,8 +2475,8 @@
                     // Step 4: Load into viewer
                     await loadPDFFromBuffer(pdfBuffer);
 
-                    // Premium Gate: Client-side page restriction for non-premium users
-                    if (config.isPremium === false && pdfDoc && pdfDoc.numPages > 1) {
+                    // Premium Gate: Client-side page restriction for non-premium, non-lite users
+                    if (config.isPremium === false && !config.isLite && pdfDoc && pdfDoc.numPages > 1) {
                         premiumInfo = Object.freeze({ isPremium: false, totalPages: pdfDoc.numPages });
                         applyPageLocks();
                         startPeriodicCheck();
@@ -2446,6 +2485,11 @@
                         premiumInfo = Object.freeze({ isPremium: true, totalPages: pdfDoc ? pdfDoc.numPages : 1 });
                     }
 
+                    // Lite Mode: Full PDF access but restricted toolbar
+                    if (config.isLite) {
+                        applyLiteMode();
+                    }
+
                     // Step 5: Moved to pagerendered event for proper timing
 
                     // Step 6: Security - clear references to prevent extraction
@@ -2657,16 +2701,25 @@
             // Swipe-to-dismiss controller (declared before closeAllDropdowns which references it)
             let swipeAbortController = null;
 
+            // Track dropdown's original parent so we can return it after closing
+            const dropdownOriginalParents = new Map();
+
             function closeAllDropdowns() {
                 // Clean up swipe listeners
                 if (swipeAbortController) { swipeAbortController.abort(); swipeAbortController = null; }
-                // Reset inline transform and fixed positioning from dropdown
+                // Reset inline styles and move dropdowns back to original parents
                 [highlightDropdown, drawDropdown, shapesDropdown, overflowDropdown].forEach(dd => {
                     dd.style.transform = '';
                     dd.style.transition = '';
                     dd.style.position = '';
                     dd.style.top = '';
                     dd.style.left = '';
+                    // Return dropdown to its original parent if it was moved to body
+                    const origParent = dropdownOriginalParents.get(dd);
+                    if (origParent && dd.parentNode === document.body) {
+                        origParent.appendChild(dd);
+                    }
+                    dropdownOriginalParents.delete(dd);
                 });
                 highlightDropdown.classList.remove('visible');
                 drawDropdown.classList.remove('visible');
@@ -2687,13 +2740,16 @@
                         handle.className = 'bottomSheetHandle';
                         dropdown.insertBefore(handle, dropdown.firstChild);
                     }
+                    // Move dropdown to <body> to escape any parent stacking context / overflow clipping
+                    dropdownOriginalParents.set(dropdown, dropdown.parentNode);
+                    document.body.appendChild(dropdown);
                     dropdown.classList.add('visible');
                     if (useBottomSheet) {
                         // Show backdrop on mobile/tablet portrait
                         dropdownBackdrop.classList.add('visible');
                         setupBottomSheetSwipe(dropdown);
                     } else {
-                        // Desktop/tablet landscape: use fixed positioning to escape toolbar overflow clipping
+                        // Desktop/tablet landscape: position below the button
                         const wrapper = e.target.closest('.toolbarBtnWithDropdown');
                         if (wrapper) {
                             const rect = wrapper.getBoundingClientRect();
@@ -2761,27 +2817,45 @@
 
             // Overflow menu toggle
             document.getElementById('overflowBtn').onclick = (e) => toggleDropdown(overflowDropdown, e);
-            overflowDropdown.onclick = (e) => e.stopPropagation();
+            overflowDropdown.addEventListener('click', (e) => e.stopPropagation());
+            overflowDropdown.addEventListener('pointerup', (e) => e.stopPropagation());
+
+            // Overflow menu actions — use both click + pointerup for reliable tablet/touch support
+            // pointerup fires immediately on touch release (no 300ms delay).
+            // A guard flag prevents double-firing when both events reach the handler.
+            function attachOverflowAction(id, action) {
+                const el = document.getElementById(id);
+                let fired = false;
+                function run() {
+                    if (fired) return;
+                    fired = true;
+                    requestAnimationFrame(() => { fired = false; });
+                    action();
+                }
+                el.addEventListener('click', run);
+                el.addEventListener('pointerup', (e) => {
+                    if (e.pointerType === 'touch' || e.pointerType === 'pen') run();
+                });
+            }
 
-            // Overflow menu actions
-            document.getElementById('overflowRotateLeft').onclick = () => {
+            attachOverflowAction('overflowRotateLeft', () => {
                 rotatePage(-90);
                 closeAllDropdowns();
-            };
-            document.getElementById('overflowRotateRight').onclick = () => {
+            });
+            attachOverflowAction('overflowRotateRight', () => {
                 rotatePage(90);
                 closeAllDropdowns();
-            };
-            document.getElementById('overflowSepia').onclick = () => {
+            });
+            attachOverflowAction('overflowSepia', () => {
                 document.getElementById('sepiaBtn').click();
                 document.getElementById('overflowSepia').classList.toggle('active',
                     document.getElementById('sepiaBtn').classList.contains('active'));
                 closeAllDropdowns();
-            };
-            document.getElementById('overflowFullscreen').onclick = () => {
+            });
+            attachOverflowAction('overflowFullscreen', () => {
                 toggleFullscreen();
                 closeAllDropdowns();
-            };
+            });
 
             // Close dropdowns when clicking outside
             document.addEventListener('click', (e) => {