Archive/screentinker
1
0
Fork 0
mirror of https://github.com/screentinker/screentinker.git synced 2026-08-13 13:53:12 -06:00
Code Issues Actions 5 Packages Projects Releases Wiki Activity

fix(dashboard): make the "Reload now" update toast actually clickable (#229)

Browse source 
The "Dashboard updated. Reload now" toast (fired when /api/version's hash changes
after a deploy) used `href="javascript:location.reload()"`. The dashboard CSP is
`script-src 'self'` with no 'unsafe-inline', which blocks `javascript:` URIs — so
the link was dead: clicking it did nothing but log a CSP violation. Users had to
hard-refresh manually.

Build the link and attach a real click listener (first-party script, CSP-clean)
instead of the inline javascript: href. No behaviour change beyond the link now
working; text unchanged.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
screentinker 2026-07-24 16:41:18 -05:00 committed by GitHub
parent df7ecd6881
commit d82b65059c
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 13 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
frontend/js/app.js
View file

@ -619,7 +619,19 @@ async function checkVersion() {
if (toast) {
const notice = document.createElement('div');
notice.className = 'toast info';
notice.innerHTML = '<span>Dashboard updated. <a href="javascript:location.reload()" style="color:var(--accent);text-decoration:underline;font-weight:600">Reload now</a></span>';
const span = document.createElement('span');
span.textContent = 'Dashboard updated. ';
const link = document.createElement('a');
link.textContent = 'Reload now';
link.href = '#';
link.style.cssText = 'color:var(--accent);text-decoration:underline;font-weight:600';
// The dashboard CSP is `script-src 'self'` (no 'unsafe-inline'), which blocks
// `javascript:` URIs — so the old `href="javascript:location.reload()"` link was dead
// (click did nothing, only a CSP console warning). Use a real click listener, which
// runs as first-party script and is CSP-clean.
link.addEventListener('click', (e) => { e.preventDefault(); location.reload(); });
span.appendChild(link);
notice.appendChild(span);
toast.appendChild(notice);
}
}