Ship CSRF-drift + markdown fixes to production #25

Merged
jared merged 5 commits from development into main 2026-07-15 16:54:01 -04:00
2 changed files with 14 additions and 6 deletions
Showing only changes of commit 53d3670c7f - Show all commits
+7 -2
View File
@@ -334,7 +334,10 @@ function buildTable(rows) {
// Apply markdown rendering to all elements with data-markdown attribute
function renderMarkdownElements() {
document.querySelectorAll('[data-markdown]:not([data-rendered])').forEach(element => {
const markdownText = element.getAttribute('data-markdown') || element.textContent;
// Trim so template indentation/whitespace in the element's text content
// doesn't get parsed as a leading code block (which breaks headings,
// tables, etc. and diverges from the live preview).
const markdownText = (element.getAttribute('data-markdown') || element.textContent).trim();
element.innerHTML = parseMarkdown(markdownText);
element.dataset.rendered = '1';
});
@@ -587,7 +590,9 @@ function processPlainTextComments() {
function renderMarkdownComments() {
document.querySelectorAll('.comment-text[data-markdown]:not([data-rendered])').forEach(el => {
el.classList.add('lt-markdown');
el.innerHTML = parseMarkdown(el.textContent);
// Trim template whitespace so the first line isn't parsed as an
// indented code block (matches the live-preview rendering).
el.innerHTML = parseMarkdown(el.textContent.trim());
el.dataset.rendered = '1';
});
}
+7 -4
View File
@@ -621,11 +621,14 @@ include __DIR__ . '/layout_header.php';
</div>
</div>
<div class="comment-text<?= $markdownEnabled ? ' lt-markdown' : '' ?>" id="comment-text-<?= $commentId ?>"
<?= $markdownEnabled ? 'data-markdown' : '' ?>>
<?= $markdownEnabled
<?= $markdownEnabled ? 'data-markdown' : '' ?>><?=
// Emit inline (no surrounding whitespace) so a markdown
// comment's text content isn't prefixed with template
// indentation, which would be parsed as a code block.
$markdownEnabled
? htmlspecialchars($comment['comment_text'])
: nl2br(htmlspecialchars($comment['comment_text'])) ?>
</div>
: nl2br(htmlspecialchars($comment['comment_text']))
?></div>
<textarea class="lt-input lt-textarea comment-edit-raw is-hidden"
id="comment-raw-<?= $commentId ?>"
aria-hidden="true"><?= htmlspecialchars($comment['comment_text']) ?></textarea>