Skip to content

v1.1.0

Choose a tag to compare

View all tags
@karl-bullock karl-bullock released this 28 May 01:09
· 18 commits to main since this release
v1.1.0
e5b0f0f

HTML widget for fof/forum-widgets-core — v1.1.0

Security

  • Output is sanitised — the admin-supplied HTML is passed through DOMPurify (bundled into the build) before display, stripping <script> tags, event-handler attributes, javascript: URLs and unsafe elements such as <iframe>.

Changed

  • Content is loaded on demand — the widget body is fetched from a small API endpoint when the widget renders, instead of being serialised into every forum page's payload.
  • Rebuilt on fof's Widget base class (the documented widget pattern).
  • Added a proper build toolchain (webpack + TypeScript); source lives in js/src/.
  • composer.json: requires PHP ^8.3 (matches Flarum core) and pins fof/forum-widgets-core to ^2.0.0-beta.3.

⚠️ Upgrade note

The HTML body is now sanitised (previously rendered as-is). <script>, event handlers, javascript: URLs and <iframe> embeds will be stripped. If you relied on an iframe embed, let us know and a curated allowlist can be added.

i18n

  • All admin settings strings (labels, help text, and the title placeholder) are translatable.
Assets 2
Loading