mirror of
https://github.com/open-webui/open-webui.git
synced 2026-10-15 04:18:18 +00:00
7fc979f95b
* fix: skip embedded HTML parts in docx preview The docx preview no longer renders altChunk parts, so an embedded HTML sub-document is omitted from the rendered output instead of being handed to the renderer. * fix: restrict docx preview link targets to safe schemes The docx preview kept whatever link target the document supplied, so a document could point a link at any scheme the browser understands. After rendering, a link target is now kept only when it resolves to http, https, mailto or tel. Anything else has its target removed and the link renders as plain text. Targets resolve against the page URL, so internal bookmark links and relative targets are unaffected, while an empty target, which the renderer emits for a hyperlink with no external relationship, is dropped instead of reloading the app. DOMPurify was not used because running it over the rendered document would strip the renderer's own markup and styling, so the check stays limited to link targets. Links using file: or Office application schemes no longer resolve. |
||
|---|---|---|
| .. | ||
| RichTextInput | ||
| Tags | ||
| Valves | ||
| AccessButton.svelte | ||
| Badge.svelte | ||
| Banner.svelte | ||
| ChatList.svelte | ||
| Checkbox.svelte | ||
| CodeEditor.svelte | ||
| CodeEditorModal.svelte | ||
| Collapsible.svelte | ||
| ConfirmDialog.svelte | ||
| DocxPreview.svelte | ||
| DragGhost.svelte | ||
| Drawer.svelte | ||
| Dropdown.svelte | ||
| DropdownMenu.svelte | ||
| DropdownOptions.svelte | ||
| DropdownSub.svelte | ||
| Emoji.svelte | ||
| EmojiPicker.svelte | ||
| ExperimentalBadge.svelte | ||
| FileItem.svelte | ||
| FileItemModal.svelte | ||
| Folder.svelte | ||
| FullHeightIframe.svelte | ||
| HotkeyHint.svelte | ||
| Image.svelte | ||
| ImagePreview.svelte | ||
| InputModal.svelte | ||
| InterfaceSettings.svelte | ||
| LanguageModeSelect.svelte | ||
| Loader.svelte | ||
| LocalizedField.svelte | ||
| Marquee.svelte | ||
| MobileSwipePanel.svelte | ||
| Modal.svelte | ||
| MultiSelect.svelte | ||
| NativeSelect.svelte | ||
| Overlay.svelte | ||
| Pagination.svelte | ||
| PanzoomContainer.svelte | ||
| PdfPagesPreview.svelte | ||
| PDFViewer.svelte | ||
| PptxPreview.svelte | ||
| ResizableSidePanel.svelte | ||
| RichTextInput.svelte | ||
| Select.svelte | ||
| Selector.svelte | ||
| SensitiveInput.svelte | ||
| SettingsSelect.svelte | ||
| Sidebar.svelte | ||
| SlideShow.svelte | ||
| Spinner.svelte | ||
| SplitCreateButton.svelte | ||
| SVGPanZoom.svelte | ||
| Switch.svelte | ||
| Tags.svelte | ||
| Textarea.svelte | ||
| ToolCallDisplay.svelte | ||
| Tooltip.svelte | ||
| TranslationTable.svelte | ||
| Valves.svelte | ||