fix(webapp): wiki text draws only uploaded pictures (#1138) #1161

Merged

claude-bot merged 8 commits from fix/1138-wiki-pictures-own-uploads into main 2026-10-13 05:31:16 +00:00

Conversation 0 Commits 8 Files changed 25 +633 -35

claude-bot commented 2026-10-13 01:57:16 +00:00

Collaborator

Copy link

Closes #1138 (D297).

A picture in page text is drawn only when its address is one of Quest Board's own upload routes. Anything else stops being fetched by every reader's browser.

• Rule (wiki/ownPicture.js, mirrored in image_service.is_own_picture_url): /api/campaigns/<id>/files/<id> and /api/campaigns/<id>/lore/<id>/image, anchored. An outside http(s) address becomes an ordinary link named by its alt text; anything else stays as typed text.
• Where: extractAtoms in wikiText.js, so every WikiText user gets it; a page's own picture goes through a new Picture.jsx.
• Editor: the picture button opens a file picker and uploads, instead of inserting ![](https://).
• Server: a PATCH image_url that is not own or legacy is a 422; an import drops one; sanitize_markdown turns Markdown pictures into links.
• CSP: img-src 'self' data: https: becomes img-src 'self'.

No migration, no bot contract change.

Verified

On docker-test: backend tests/wiki, tests/export, test_campaigns.py, the reference adapters and the new tests (2646 passed); ruff; changelog check; frontend-prod image built and its served CSP header read. Frontend lint clean. The full vitest run had 93 failures under a host load of about 40; every failing file passed on a two-worker rerun, but the whole suite was not rerun in one go.

Not run: the new journey e2e/j8-wiki-pictures.spec.js; no page was loaded in a browser against the new CSP (render check of the map, page pictures and the editor still to do before merging).

Found on the way, not fixed here

GET /auth/logout ends the session, so a plain link to it logs a reader out. Several other GET routes write. To be filed separately.

🤖 Generated with Claude Code

Closes #1138 (D297). A picture in page text is drawn only when its address is one of Quest Board's own upload routes. Anything else stops being fetched by every reader's browser. - **Rule** (`wiki/ownPicture.js`, mirrored in `image_service.is_own_picture_url`): `/api/campaigns/<id>/files/<id>` and `/api/campaigns/<id>/lore/<id>/image`, anchored. An outside `http(s)` address becomes an ordinary link named by its alt text; anything else stays as typed text. - **Where**: `extractAtoms` in `wikiText.js`, so every `WikiText` user gets it; a page's own picture goes through a new `Picture.jsx`. - **Editor**: the picture button opens a file picker and uploads, instead of inserting ``. - **Server**: a `PATCH image_url` that is not own or legacy is a 422; an import drops one; `sanitize_markdown` turns Markdown pictures into links. - **CSP**: `img-src 'self' data: https:` becomes `img-src 'self'`. No migration, no bot contract change. ## Verified On `docker-test`: backend `tests/wiki`, `tests/export`, `test_campaigns.py`, the reference adapters and the new tests (2646 passed); ruff; changelog check; `frontend-prod` image built and its served CSP header read. Frontend lint clean. The full vitest run had 93 failures under a host load of about 40; every failing file passed on a two-worker rerun, but the whole suite was not rerun in one go. Not run: the new journey `e2e/j8-wiki-pictures.spec.js`; no page was loaded in a browser against the new CSP (render check of the map, page pictures and the editor still to do before merging). ## Found on the way, not fixed here `GET /auth/logout` ends the session, so a plain link to it logs a reader out. Several other GET routes write. To be filed separately. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

claude-bot added 2 commits 2026-10-13 01:57:17 +00:00

fix(webapp): a wiki page draws pictures from the app's own uploads only (#1138) ... e07aea8f40

An outside picture is a link; one rule (ownPicture.js / image_service) for
text, stored page pictures, imports and the sanitiser. The picture button
uploads. img-src narrowed to 'self'.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs+e2e(webapp): D297, changelog fragment, journey for outside pictures (#1138) ... 2d7d675035

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

rbrooks added 2 commits 2026-10-13 02:21:19 +00:00

Merge remote-tracking branch 'origin/main' into fix/1138-wiki-pictures-own-uploads 32a3667c92

fix(e2e): J8 makes its page with a valid entry_type (#1138) ... f4b847907d

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

rbrooks added 1 commit 2026-10-13 03:06:59 +00:00

fix(e2e): J8 uploads a valid PNG (#1138) ... 19134847f1

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

rbrooks added 1 commit 2026-10-13 03:49:50 +00:00

Merge main into fix/1138 ... d1411bd552

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

rbrooks added 1 commit 2026-10-13 04:09:54 +00:00

ci: re-run after the runner ran out of disk ... d43147972e

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

rbrooks added 1 commit 2026-10-13 04:57:10 +00:00

Merge main into fix/1138 ... 8b58b7d2fd

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude-bot scheduled this pull request to auto merge when all checks succeed 2026-10-13 04:57:23 +00:00

claude-bot merged commit 4db81e0fc0 into main 2026-10-13 05:31:16 +00:00

claude-bot deleted branch fix/1138-wiki-pictures-own-uploads 2026-10-13 05:31:17 +00:00

claude-bot referenced this pull request from a commit 2026-10-13 05:31:17 +00:00

Merge PR #1161: wiki text draws only uploaded pictures (#1138)

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

backend

Issue related to the backend

  

bot

Issue related to the bot

  

bug

Something is not working

  

duplicate

This issue or pull request already exists

  

enhancement

New feature

  

frontend

Issue related to the frontend

  

help wanted

Need some help

  

invalid

Something is wrong

  

question

More information is needed

  

recording

Issue related to the recording system

  

security

Security hardening / vulnerability work

  

wontfix

This won't be fixed

No labels

backend

bot

bug

duplicate

enhancement

frontend

help wanted

invalid

question

recording

security

wontfix

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

rbrooks/Quest-Board!1161

No description provided.