Release v2.7.0

2026-08-14 13:36:47 +01:00
parent 30f5ed11b8
commit e7ec276317
28 changed files with 872 additions and 198 deletions
@@ -7,7 +7,7 @@
    <link rel="icon" type="image/png" href="/assets/favicon.png" />
    <link rel="stylesheet" href="/assets/adminlte/bootstrap-icons/css/bootstrap-icons.min.css" />
    <link rel="stylesheet" href="/assets/vendor/animate.css/animate.min.css" />
-    <link rel="stylesheet" href="/assets/css/player.css?v=36" />
+    <link rel="stylesheet" href="/assets/css/player.css?v=37" />
    {{{STYLESHEETS}}}
  </head>
  <body class="{{BODY_CLASS}}">
@@ -4,7 +4,7 @@ body {
  width: 100%;
  height: 100%;
  overflow: hidden;
-  background: #111;
+  background: #0a0a0a;
  color: #fff;
  font-family: Arial, sans-serif;
 }
@@ -43,7 +43,7 @@ body.thumbnail-preview .player-offline-banner {
  display: flex;
  align-items: center;
  justify-content: center;
-  background: #111;
+  background: #0a0a0a;
  position: relative;
 }

@@ -294,15 +294,6 @@ body.screen-blackout #app {
  display: block;
 }

-.slide img,
-.slide video,
-.slide iframe {
-  width: 100%;
-  height: 100%;
-  object-fit: contain;
-  border: 0;
-}
-
 .body {
  position: absolute;
  left: 5%;
@@ -334,7 +334,7 @@ function setPlayerCanvasDimensions(canvasWidth, canvasHeight) {
  document.documentElement.style.setProperty('--player-canvas-height', height + 'px');
 }

-const ALLOWED_RICH_TEXT_TAGS = ['a', 'b', 'blockquote', 'br', 'code', 'div', 'em', 'figure', 'figcaption', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'li', 'ol', 'p', 'pre', 'span', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'th', 'thead', 'tr', 'u', 'ul'];
+const ALLOWED_RICH_TEXT_TAGS = ['a', 'b', 'blockquote', 'br', 'code', 'col', 'colgroup', 'div', 'em', 'figure', 'figcaption', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'img', 'li', 'ol', 'p', 'pre', 'span', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'th', 'thead', 'tr', 'u', 'ul'];

 function sanitizeRichTextAttributes(tagName, attrText) {
  const allowedAttributes = {
@@ -349,14 +349,19 @@ function sanitizeRichTextAttributes(tagName, attrText) {
    h4: ['class', 'style'],
    h5: ['class', 'style'],
    h6: ['class', 'style'],
+    img: ['src', 'alt', 'title', 'width', 'height', 'class', 'style', 'loading', 'decoding'],
+    col: ['class', 'style', 'span', 'width'],
+    colgroup: ['class', 'style', 'span'],
    li: ['class', 'style'],
    ol: ['class', 'style', 'start'],
    p: ['class', 'style'],
    pre: ['class', 'style'],
    span: ['class', 'style'],
    table: ['class', 'style'],
+    tbody: ['class', 'style'],
    td: ['class', 'style', 'colspan', 'rowspan'],
    th: ['class', 'style', 'colspan', 'rowspan', 'scope'],
+    thead: ['class', 'style'],
    tr: ['class', 'style'],
    ul: ['class', 'style']
  };
@@ -365,6 +370,14 @@ function sanitizeRichTextAttributes(tagName, attrText) {
    return '';
  }

+  if (tagName === 'img') {
+    const srcMatch = String(attrText || '').match(/\bsrc\s*=\s*("([^"]*)"|'([^']*)'|([^\s"'>/=`]+))/i);
+    const srcValue = srcMatch ? String(srcMatch[2] !== undefined ? srcMatch[2] : srcMatch[3] !== undefined ? srcMatch[3] : srcMatch[4] !== undefined ? srcMatch[4] : '').trim() : '';
+    if (!srcValue || !/^(?:https?:\/\/|\/media\/|\/assets\/|\/[^/]|data:image\/)/i.test(srcValue)) {
+      return '';
+    }
+  }
+
  const attrs = [];
  String(attrText || '').replace(/([a-zA-Z0-9:-]+)(?:\s*=\s*("([^"]*)"|'([^']*)'|([^\s"'>/=`]+)))?/g, (_full, key, _valuePart, doubleQuoted, singleQuoted, bareValue) => {
    const lowerKey = String(key || '').toLowerCase();
@@ -1,6 +1,7 @@
 // Time/date region rendering and live updates.

 var registry = window.pulsePlayerRegionTypes;
+var placeholderUtils = window.placeholderUtils || {};
 var DEFAULT_FORMAT = '{{hh}}:{{mm}}';
 var DEFAULT_STYLE = {
  font_family: 'Arial',
@@ -9,15 +10,6 @@ var DEFAULT_STYLE = {
 };
 var timeDateFormatterCache = Object.create(null);

-function escapeHtml(value) {
-  return String(value === undefined || value === null ? '' : value)
-    .replace(/&/g, '&amp;')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;')
-    .replace(/'/g, '&#39;');
-}
-
 function sanitizeTagAttributes(tagName, attrText) {
  var allowedAttributes = {
    a: ['href', 'title', 'target', 'rel', 'class', 'style'],
@@ -133,7 +125,7 @@ function resolveTimeZone(value) {
  }
 }

-function getFormatter(key, options) {
+function getTimeDateFormatter(key, options) {
  if (!timeDateFormatterCache[key]) {
    timeDateFormatterCache[key] = new Intl.DateTimeFormat('en-GB', options);
  }
@@ -141,10 +133,10 @@ function getFormatter(key, options) {
  return timeDateFormatterCache[key];
 }

-function getFormattedParts(timeZone, date) {
+function getTimeDateFormattedParts(timeZone, date) {
  var targetDate = date instanceof Date ? date : new Date();
  var resolvedTimeZone = resolveTimeZone(timeZone);
-  var numericParts = getFormatter('numeric:' + resolvedTimeZone, {
+  var numericParts = getTimeDateFormatter('numeric:' + resolvedTimeZone, {
    timeZone: resolvedTimeZone,
    hour12: false,
    hour: '2-digit',
@@ -154,29 +146,29 @@ function getFormattedParts(timeZone, date) {
    month: '2-digit',
    year: 'numeric'
  }).formatToParts(targetDate);
-  var weekdayLong = getFormatter('weekday-long:' + resolvedTimeZone, {
+  var weekdayLong = getTimeDateFormatter('weekday-long:' + resolvedTimeZone, {
    timeZone: resolvedTimeZone,
    weekday: 'long'
  }).formatToParts(targetDate);
-  var weekdayShort = getFormatter('weekday-short:' + resolvedTimeZone, {
+  var weekdayShort = getTimeDateFormatter('weekday-short:' + resolvedTimeZone, {
    timeZone: resolvedTimeZone,
    weekday: 'short'
  }).formatToParts(targetDate);
-  var monthLong = getFormatter('month-long:' + resolvedTimeZone, {
+  var monthLong = getTimeDateFormatter('month-long:' + resolvedTimeZone, {
    timeZone: resolvedTimeZone,
    month: 'long'
  }).formatToParts(targetDate);
-  var monthShort = getFormatter('month-short:' + resolvedTimeZone, {
+  var monthShort = getTimeDateFormatter('month-short:' + resolvedTimeZone, {
    timeZone: resolvedTimeZone,
    month: 'short'
  }).formatToParts(targetDate);
-  var ampm = getFormatter('ampm:' + resolvedTimeZone, {
+  var ampm = getTimeDateFormatter('ampm:' + resolvedTimeZone, {
    timeZone: resolvedTimeZone,
    hour12: true,
    hour: '2-digit',
    minute: '2-digit'
  }).formatToParts(targetDate);
-  var timezoneShort = getFormatter('tz-short:' + resolvedTimeZone, {
+  var timezoneShort = getTimeDateFormatter('tz-short:' + resolvedTimeZone, {
    timeZone: resolvedTimeZone,
    timeZoneName: 'short'
  }).formatToParts(targetDate);
@@ -220,20 +212,21 @@ function getFormattedParts(timeZone, date) {
  };
 }

-function resolveTimeDatePlaceholder(values, expression) {
-  if (typeof placeholderUtils.resolvePlaceholderExpression === 'function' && typeof placeholderUtils.formatPlaceholderValue === 'function') {
-    return placeholderUtils.formatPlaceholderValue(placeholderUtils.resolvePlaceholderExpression(values, expression));
+function resolveTimeDateTemplatePlaceholder(values, expression) {
+  var currentPlaceholderUtils = window.placeholderUtils || placeholderUtils || {};
+  if (typeof currentPlaceholderUtils.resolvePlaceholderExpression === 'function' && typeof currentPlaceholderUtils.formatPlaceholderValue === 'function') {
+    return currentPlaceholderUtils.formatPlaceholderValue(currentPlaceholderUtils.resolvePlaceholderExpression(values, expression));
  }

  var parsed = String(expression || '').trim();
  return Object.prototype.hasOwnProperty.call(values, parsed) ? values[parsed] : '';
 }

-function renderTemplate(format, timeZone, date) {
+function renderTimeDateTemplate(format, timeZone, date) {
  var template = String(format || '').trim() || DEFAULT_FORMAT;
-  var values = getFormattedParts(timeZone, date);
+  var values = getTimeDateFormattedParts(timeZone, date);
  return template.replace(/\{\{\s*([a-zA-Z0-9_.()\-]+)\s*\}\}/g, function (_match, key) {
-    return String(resolveTimeDatePlaceholder(values, key, { timeZone: timeZone }) || '');
+    return String(resolveTimeDateTemplatePlaceholder(values, key, { timeZone: timeZone }) || '');
  });
 }

@@ -257,7 +250,7 @@ function renderTimeDateRegion(region, regionContent) {
  var fontSize = style.font_size ? 'font-size:' + Math.max(1, Math.round(Number(style.font_size))) + 'px;' : '';
  var fontColor = style.font_color ? 'color:' + escapeHtml(style.font_color) + ';' : '';
  var contentStyle = 'width:' + region.pixelWidth + 'px;height:' + region.pixelHeight + 'px;transform:scale(' + region.canvasScale + ');transform-origin:top left;' + (fontFamily ? fontFamily : '') + fontSize + fontColor + 'white-space:pre-wrap;line-height:1.1;';
-  var renderedText = renderTemplate(format, timeZone, new Date());
+  var renderedText = renderTimeDateTemplate(format, timeZone, new Date());
  return '<div class="template-region time-date" data-time-date-format="' + escapeHtml(format) + '" data-time-date-timezone="' + escapeHtml(timeZone) + '" style="' + region.baseStyle + '"><div class="template-region-text-scale" style="' + contentStyle + '">' + renderEditorJsContent(renderedText) + '</div></div>';
 }

@@ -273,7 +266,7 @@ function updateTimeDateRegion(element) {
    return;
  }

-  scaleWrapper.innerHTML = renderEditorJsContent(renderTemplate(format, timeZone, new Date()));
+  scaleWrapper.innerHTML = renderEditorJsContent(renderTimeDateTemplate(format, timeZone, new Date()));
 }

 function scheduleTimeDateRegionUpdate(element) {
@@ -2,101 +2,6 @@

 var registry = window.pulsePlayerRegionTypes;

-function escapeHtml(value) {
-  return String(value === undefined || value === null ? '' : value)
-    .replace(/&/g, '&amp;')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;')
-    .replace(/'/g, '&#39;');
-}
-
-function sanitizeRichTextAttributes(tagName, attrText) {
-  var allowedAttributes = {
-    a: ['href', 'title', 'target', 'rel', 'class', 'style'],
-    blockquote: ['class', 'style'],
-    col: ['class', 'style', 'span', 'width'],
-    colgroup: ['class', 'style', 'span'],
-    div: ['class', 'style'],
-    figure: ['class', 'style'],
-    figcaption: ['class', 'style'],
-    h1: ['class', 'style'],
-    h2: ['class', 'style'],
-    h3: ['class', 'style'],
-    h4: ['class', 'style'],
-    h5: ['class', 'style'],
-    h6: ['class', 'style'],
-    li: ['class', 'style'],
-    ol: ['class', 'style', 'start'],
-    p: ['class', 'style'],
-    pre: ['class', 'style'],
-    span: ['class', 'style'],
-    table: ['class', 'style'],
-    tbody: ['class', 'style'],
-    td: ['class', 'style', 'colspan', 'rowspan'],
-    th: ['class', 'style', 'colspan', 'rowspan', 'scope'],
-    thead: ['class', 'style'],
-    tr: ['class', 'style'],
-    ul: ['class', 'style']
-  };
-  var allowed = allowedAttributes[tagName] || [];
-  if (!allowed.length) {
-    return '';
-  }
-
-  var attrs = [];
-  String(attrText || '').replace(/([a-zA-Z0-9:-]+)(?:\s*=\s*("([^"]*)"|'([^']*)'|([^\s"'>/=`]+)))?/g, function (_full, key, _valuePart, doubleQuoted, singleQuoted, bareValue) {
-    var lowerKey = String(key || '').toLowerCase();
-    if (allowed.indexOf(lowerKey) === -1) {
-      return '';
-    }
-
-    var value = doubleQuoted !== undefined ? doubleQuoted : singleQuoted !== undefined ? singleQuoted : bareValue !== undefined ? bareValue : '';
-    if (lowerKey === 'href' && /^(?:\s*javascript:|\s*data:)/i.test(String(value || ''))) {
-      return '';
-    }
-    if (lowerKey === 'style' && /(?:expression\s*\(|javascript:|url\s*\()/i.test(String(value || ''))) {
-      return '';
-    }
-    if (lowerKey === 'target') {
-      var targetValue = String(value || '').trim();
-      if (targetValue === '_blank') {
-        attrs.push(' target="_blank"');
-        if (attrs.indexOf(' rel="noreferrer noopener"') === -1) {
-          attrs.push(' rel="noreferrer noopener"');
-        }
-        return '';
-      }
-    }
-    attrs.push(' ' + lowerKey + '="' + escapeHtml(value) + '"');
-    return '';
-  });
-
-  return attrs.join('');
-}
-
-function sanitizeRichText(html) {
-  var output = String(html || '');
-  output = output.replace(/<script[\s\S]*?<\/script>/gi, '');
-  output = output.replace(/<style[\s\S]*?<\/style>/gi, '');
-  return output.replace(/<[^>]+>/g, function (tag) {
-    var match = tag.match(/^<\s*(\/?)\s*([a-z0-9]+)([\s\S]*?)(\/?)>$/i);
-    if (!match) {
-      return '';
-    }
-    var closing = Boolean(match[1]);
-    var name = String(match[2] || '').toLowerCase();
-    var allowed = ['a', 'b', 'blockquote', 'br', 'code', 'col', 'colgroup', 'div', 'em', 'figure', 'figcaption', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'li', 'ol', 'p', 'pre', 'span', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'th', 'thead', 'tr', 'u', 'ul'];
-    if (allowed.indexOf(name) === -1) {
-      return '';
-    }
-    if (closing) {
-      return '</' + name + '>';
-    }
-    return '<' + name + sanitizeRichTextAttributes(name, String(match[3] || '')) + '>';
-  });
-}
-
 function substituteTimetableVariables(html, entry) {
  var source = String(html || '');
  return source.replace(/\{\{\s*([^{}]+?)\s*\}\}/g, function (_match, expression) {
@@ -41,7 +41,7 @@ function sanitizeTextColor(value, fallback) {
  return fallback || '#000000';
 }

-const ALLOWED_RICH_TEXT_TAGS = ['a', 'b', 'blockquote', 'br', 'code', 'div', 'em', 'figure', 'figcaption', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'li', 'ol', 'p', 'pre', 'span', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'th', 'thead', 'tr', 'u', 'ul'];
+const ALLOWED_RICH_TEXT_TAGS = ['a', 'b', 'blockquote', 'br', 'code', 'col', 'colgroup', 'div', 'em', 'figure', 'figcaption', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'img', 'li', 'ol', 'p', 'pre', 'span', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'th', 'thead', 'tr', 'u', 'ul'];

 function sanitizeRichTextAttributes(tagName, attrText) {
  const allowedAttributes = {
@@ -56,6 +56,9 @@ function sanitizeRichTextAttributes(tagName, attrText) {
    h4: ['class', 'style'],
    h5: ['class', 'style'],
    h6: ['class', 'style'],
+    img: ['src', 'alt', 'title', 'width', 'height', 'class', 'style', 'loading', 'decoding'],
+    col: ['class', 'style', 'span', 'width'],
+    colgroup: ['class', 'style', 'span'],
    li: ['class', 'style'],
    ol: ['class', 'style', 'start'],
    p: ['class', 'style'],
@@ -72,6 +75,14 @@ function sanitizeRichTextAttributes(tagName, attrText) {
    return '';
  }

+  if (tagName === 'img') {
+    const srcMatch = String(attrText || '').match(/\bsrc\s*=\s*("([^"]*)"|'([^']*)'|([^\s"'>/=`]+))/i);
+    const srcValue = srcMatch ? String(srcMatch[2] !== undefined ? srcMatch[2] : srcMatch[3] !== undefined ? srcMatch[3] : srcMatch[4] !== undefined ? srcMatch[4] : '').trim() : '';
+    if (!srcValue || !/^(?:https?:\/\/|\/media\/|\/assets\/|\/[^/]|data:image\/)/i.test(srcValue)) {
+      return '';
+    }
+  }
+
  const attrs = [];
  String(attrText || '').replace(/([a-zA-Z0-9:-]+)(?:\s*=\s*("([^"]*)"|'([^']*)'|([^\s"'>/=`]+)))?/g, (_full, key, _valuePart, doubleQuoted, singleQuoted, bareValue) => {
    const lowerKey = String(key || '').toLowerCase();