Hanif Koh f8e531f07b Escape Project Metadata in the Project Page and Restrict Accessory Opening ...

The Project page rendered the model and profile name, author, description
and accessory file names from the 3MF as live HTML. Names, authors and file
names are now set as text, and the file list is built from DOM nodes with
bound click handlers instead of concatenated markup. Descriptions can
legitimately carry rich-text HTML, so they are rebuilt from an inert
DOMParser document, keeping only plain formatting tags, http(s) links and
http(s) images, with every other attribute dropped.

Opening an accessory from the page now only launches regular files that
lie inside the project's extracted auxiliary directory. The containment
check is a new libslic3r helper, is_absolute_path_within_root, built on
is_path_within_root so symlinks leading out of the root are rejected too.

2026-09-29 23:50:10 +08:00

..

css

Match button styles on whole UI and fixes for button class (#11233)

2025-12-18 12:14:56 +00:00

img

Color & Icon fixes / improvements (#9773)

2025-07-17 15:26:55 +08:00

index.html

fix: Home start shows Prepare or a blank window, and Prepare opens slowly (#15878)

2026-09-26 14:23:52 -03:00

model.css

UI fixes / improvements (#12513)

2026-05-16 01:12:30 +08:00

model.js

Escape Project Metadata in the Project Page and Restrict Accessory Opening

2026-09-29 23:50:10 +08:00

test.js

FIX: fix the model name display issue under project page

2023-10-10 14:19:23 +08:00