Release 2.7.3

CHANGELOG.md

@@ -2,6 +2,61 @@
 
 All notable changes to this project will be documented in this file.
 
+## 2.7.3 - 2026-08-15
+
+### Changed
+
+- The slide image cropper now warns that SVG and GIF files will be rasterized if they are edited, and it keeps the original file only when the full image remains selected.
+- The slide image upload flow now accepts PNG, JPG, GIF, WebP, and SVG images, while the WYSIWYG image uploader now matches that same allowlist.
+- TIFF is no longer accepted by the WYSIWYG image uploader.
+
+### Fixed
+
+- The player now preserves quoted custom font-family values from rich text content, so fonts with spaces such as Old London render correctly on screens.
+
+## 2.7.2 - 2026-08-14
+
+### Fixed
+
+- HTML and webpage region previews now normalize object-shaped content before rendering, so the player, thumbnails, and popup preview show the intended iframe content instead of leaking raw objects.
+- HTML and webpage preview iframes now size explicitly to the full region bounds in the player, thumbnails, and popup preview.
+
+## 2.7.1 - 2026-08-14
+
+### Changed
+
+- The player page now supports keyboard navigation with arrow keys to move between slides.
+
+## 2.7.0 - 2026-08-14
+
+### Added
+
+- The WYSIWYG editor now supports adding small images.
+
+### Changed
+
+- The WYSIWYG image insertion flow also received a small code cleanup to simplify the related helper logic.
+- The default table formatting has been applied.
+- Timetable regions now use the renamed helpers end to end in the editor and player, including timezone-aware rendering for timetable entry placeholders.
+
+## 2.6.27 - 2026-08-14
+
+### Fixed
+
+- Scheduled task intervals now display the most appropriate exact unit, such as seconds, minutes, hours, or days, while keeping the sort order numeric.
+
+## 2.6.26 - 2026-08-10
+
+### Changed
+
+- API sources and RSS feeds now accept hours as an update interval unit, and the list and background task scheduling paths now format and convert that unit correctly.
+
+## 2.6.25 - 2026-08-10
+
+### Fixed
+
+- Screen group edit now keeps the slug locked after creation, so existing screen group URLs remain stable.
+
 ## 2.6.24 - 2026-08-10
 
 ### Fixed

build/package.player.json

@@ -1,6 +1,6 @@
 {
   "name": "pulse-signage-player",
-  "version": "2.6.24",
+  "version": "2.7.3",
   "private": false,
   "description": "Pulse Signage player application bundle",
   "main": "src/common.js",

build/package.web.json

@@ -1,6 +1,6 @@
 {
   "name": "pulse-signage-web",
-  "version": "2.6.24",
+  "version": "2.7.3",
   "private": false,
   "description": "Pulse Signage web and bridge application bundle",
   "main": "src/common.js",

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "pulse-signage",
-  "version": "2.6.15",
+  "version": "2.7.3",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "pulse-signage",
-      "version": "2.6.15",
+      "version": "2.7.3",
       "dependencies": {
         "@sparticuz/chromium": "^137.0.0",
         "animate.css": "^4.1.1",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "pulse-signage",
-  "version": "2.6.24",
+  "version": "2.7.3",
   "private": false,
   "description": "Pulse Signage application with MySQL and media storage",
   "repository": {

src/data/api-sources.js

@@ -11,7 +11,10 @@ const ITEMS_PATH_MAX_LENGTH = 255;
 
 function normalizeUpdateIntervalUnit(value) {
   const unit = String(value || '').trim().toLowerCase();
-  return unit === 'seconds' ? 'seconds' : 'minutes';
+  if (unit === 'seconds' || unit === 'minutes' || unit === 'hours') {
+    return unit;
+  }
+  return 'minutes';
 }
 
 function normalizeAuthMethod(value) {

src/data/rss-feeds.js

@@ -9,7 +9,10 @@ const URL_MAX_LENGTH = 1024;
 
 function normalizeUpdateIntervalUnit(value) {
   const unit = String(value || '').trim().toLowerCase();
-  return unit === 'seconds' ? 'seconds' : 'minutes';
+  if (unit === 'seconds' || unit === 'minutes' || unit === 'hours') {
+    return unit;
+  }
+  return 'minutes';
 }
 
 async function fetchRssFeedsData(pool) {

src/data/slides.js

@@ -6,27 +6,90 @@ const { parseJsonSafe, validateMaxLength } = require('./utils');
 const TITLE_MAX_LENGTH = 255;
 const { buildQrCodeContent } = require('./qr-code');
 
-const ALLOWED_RICH_TEXT_TAGS = ['b', 'strong', 'i', 'em', 'u', 'br', 'p', 'div', 'ul', 'ol', 'li'];
 const DEFAULT_FONT_SIZE = 32;
 
+const ALLOWED_RICH_TEXT_TAGS = ['a', 'b', 'blockquote', 'br', 'code', 'div', 'em', 'figure', 'figcaption', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'img', 'li', 'ol', 'p', 'pre', 'span', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'th', 'thead', 'tr', 'u', 'ul'];
+
+function sanitizeRichTextAttributes(tagName, attrText) {
+  const allowedAttributes = {
+    a: ['href', 'title', 'target', 'rel', 'class', 'style'],
+    blockquote: ['class', 'style'],
+    div: ['class', 'style'],
+    figure: ['class', 'style'],
+    figcaption: ['class', 'style'],
+    h1: ['class', 'style'],
+    h2: ['class', 'style'],
+    h3: ['class', 'style'],
+    h4: ['class', 'style'],
+    h5: ['class', 'style'],
+    h6: ['class', 'style'],
+    img: ['src', 'alt', 'title', 'width', 'height', 'class', 'style', 'loading', 'decoding'],
+    li: ['class', 'style'],
+    ol: ['class', 'style', 'start'],
+    p: ['class', 'style'],
+    pre: ['class', 'style'],
+    span: ['class', 'style'],
+    table: ['class', 'style'],
+    td: ['class', 'style', 'colspan', 'rowspan'],
+    th: ['class', 'style', 'colspan', 'rowspan', 'scope'],
+    tr: ['class', 'style'],
+    ul: ['class', 'style']
+  };
+  const allowed = allowedAttributes[tagName] || [];
+  if (!allowed.length) {
+    return '';
+  }
+
+  const attrs = [];
+  String(attrText || '').replace(/([a-zA-Z0-9:-]+)(?:\s*=\s*("([^"]*)"|'([^']*)'|([^\s"'>/=`]+)))?/g, (_full, key, _valuePart, doubleQuoted, singleQuoted, bareValue) => {
+    const lowerKey = String(key || '').toLowerCase();
+    if (!allowed.includes(lowerKey)) {
+      return '';
+    }
+
+    const value = doubleQuoted !== undefined ? doubleQuoted : singleQuoted !== undefined ? singleQuoted : bareValue !== undefined ? bareValue : '';
+    if (lowerKey === 'href' && /^(?:\s*javascript:|\s*data:)/i.test(String(value || ''))) {
+      return '';
+    }
+    if (lowerKey === 'style' && /(?:expression\s*\(|javascript:|url\s*\()/i.test(String(value || ''))) {
+      return '';
+    }
+    if (lowerKey === 'target') {
+      const targetValue = String(value || '').trim();
+      if (targetValue === '_blank') {
+        attrs.push(' target="_blank"');
+        if (!attrs.includes(' rel="noreferrer noopener"')) {
+          attrs.push(' rel="noreferrer noopener"');
+        }
+        return '';
+      }
+    }
+    attrs.push(' ' + lowerKey + '="' + String(value || '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;').replace(/'/g, '&#39;') + '"');
+    return '';
+  });
+
+  return attrs.join('');
+}
+
 function sanitizeRichText(html) {
   let output = String(html || '');
   output = output.replace(/<script[\s\S]*?<\/script>/gi, '');
   output = output.replace(/<style[\s\S]*?<\/style>/gi, '');
   return output.replace(/<[^>]+>/g, (tag) => {
-    const match = tag.match(/^<\s*(\/?)\s*([a-z0-9]+)(?:\s[^>]*)?>$/i);
+    const match = tag.match(/^<\s*(\/?)\s*([a-z0-9]+)([\s\S]*?)(\/?)>$/i);
     if (!match) {
       return '';
     }
     const closing = Boolean(match[1]);
     const name = String(match[2] || '').toLowerCase();
+    const attrText = String(match[3] || '');
     if (!ALLOWED_RICH_TEXT_TAGS.includes(name)) {
       return '';
     }
-    if (name === 'br') {
+    if (closing) {
-      return '<br>';
+      return `</${name}>`;
     }
-    return closing ? `</${name}>` : `<${name}>`;
+    return `<${name}${sanitizeRichTextAttributes(name, attrText)}>`;
   });
 }
 
@@ -430,7 +493,7 @@ async function buildTemplateContent(pool, template, body, filesByField, existing
       const style = getTextRegionStyle(body, region, existingContent);
       content[region.region_key] = {
         type: 'text',
-        value: stripEditorOnlyMarkup(normalizeEditorMarkup(submitted === undefined ? current : String(submitted || ''))),
+        value: sanitizeRichText(stripEditorOnlyMarkup(normalizeEditorMarkup(submitted === undefined ? current : String(submitted || '')))),
         font_family: style.font_family,
         font_size: style.font_size,
         font_color: style.font_color

src/player/player-page.template.html

@@ -7,7 +7,7 @@
     <link rel="icon" type="image/png" href="/assets/favicon.png" />
     <link rel="stylesheet" href="/assets/adminlte/bootstrap-icons/css/bootstrap-icons.min.css" />
     <link rel="stylesheet" href="/assets/vendor/animate.css/animate.min.css" />
-    <link rel="stylesheet" href="/assets/css/player.css?v=36" />
+    <link rel="stylesheet" href="/assets/css/player.css?v=37" />
     {{{STYLESHEETS}}}
   </head>
   <body class="{{BODY_CLASS}}">

src/player/public/css/player.css

@@ -4,7 +4,7 @@ body {
   width: 100%;
   height: 100%;
   overflow: hidden;
-  background: #111;
+  background: #0a0a0a;
   color: #fff;
   font-family: Arial, sans-serif;
 }
@@ -43,7 +43,7 @@ body.thumbnail-preview .player-offline-banner {
   display: flex;
   align-items: center;
   justify-content: center;
-  background: #111;
+  background: #0a0a0a;
   position: relative;
 }
 
@@ -294,15 +294,6 @@ body.screen-blackout #app {
   display: block;
 }
 
-.slide img,
-.slide video,
-.slide iframe {
-  width: 100%;
-  height: 100%;
-  object-fit: contain;
-  border: 0;
-}
-
 .body {
   position: absolute;
   left: 5%;

src/player/public/js/player-page-commands.js

@@ -427,6 +427,42 @@ function normalizeBoolean(value) {
   return null;
 }
 
+function isEditableTarget(target) {
+  if (!target) {
+    return false;
+  }
+
+  if (target.isContentEditable) {
+    return true;
+  }
+
+  var tagName = String(target.tagName || '').toUpperCase();
+  return ['INPUT', 'TEXTAREA', 'SELECT', 'OPTION'].indexOf(tagName) !== -1;
+}
+
+function handlePlayerKeydown(event) {
+  if (!event || event.defaultPrevented || event.altKey || event.ctrlKey || event.metaKey) {
+    return;
+  }
+
+  if (isEditableTarget(event.target)) {
+    return;
+  }
+
+  if (event.key === 'ArrowLeft') {
+    event.preventDefault();
+    navigateSlides(-1);
+    return;
+  }
+
+  if (event.key === 'ArrowRight') {
+    event.preventDefault();
+    navigateSlides(1);
+  }
+}
+
+window.addEventListener('keydown', handlePlayerKeydown);
+
 // Move to the previous or next active slide.
 function navigateSlides(offset) {
   const manualSlides = getCurrentActiveSlides();

src/player/public/js/player-page-playback.js

@@ -189,6 +189,15 @@ function refresh() {
       const nextActiveSlides = getActiveSlidesFrom(nextSlides);
       const nextFadeBetweenSlides = Boolean(data && data.playlist && data.playlist.fade_between_slides);
       const nextSkipUnavailableRtmp = Boolean(data && data.playlist && data.playlist.skip_unavailable_rtmp);
+      if (window.initialData && typeof window.initialData === 'object') {
+        window.initialData.screen = data.screen || window.initialData.screen || null;
+        window.initialData.playlist = data.playlist || null;
+        window.initialData.slides = nextSlides;
+        window.initialData.rssFeeds = Array.isArray(data.rssFeeds) ? data.rssFeeds : [];
+        window.initialData.apiSources = Array.isArray(data.apiSources) ? data.apiSources : [];
+        window.initialData.timetableGroups = Array.isArray(data.timetableGroups) ? data.timetableGroups : [];
+        window.initialData.revision = nextSignature;
+      }
       savePlaylistSnapshot({
         slides: nextSlides,
         signature: nextSignature,

src/player/public/js/player-page-rendering.js

@@ -4,6 +4,14 @@ function sanitizeFontFamily(value) {
   return String(value || '').replace(/[^a-zA-Z0-9 ,\"-]/g, '').trim();
 }
 
+function normalizeStyleAttributeValue(value) {
+  return String(value || '')
+    .replace(/"/g, '"')
+    .replace(/'/g, "'")
+    .replace(/"/g, '"')
+    .replace(/'/g, "'");
+}
+
 // Clamp font size to the supported range.
 function sanitizeFontSize(value) {
   return Math.max(8, Number(value || 0) || 24);
@@ -334,7 +342,7 @@ function setPlayerCanvasDimensions(canvasWidth, canvasHeight) {
   document.documentElement.style.setProperty('--player-canvas-height', height + 'px');
 }
 
-const ALLOWED_RICH_TEXT_TAGS = ['a', 'b', 'blockquote', 'br', 'code', 'div', 'em', 'figure', 'figcaption', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'li', 'ol', 'p', 'pre', 'span', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'th', 'thead', 'tr', 'u', 'ul'];
+const ALLOWED_RICH_TEXT_TAGS = ['a', 'b', 'blockquote', 'br', 'code', 'col', 'colgroup', 'div', 'em', 'figure', 'figcaption', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'img', 'li', 'ol', 'p', 'pre', 'span', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'th', 'thead', 'tr', 'u', 'ul'];
 
 function sanitizeRichTextAttributes(tagName, attrText) {
   const allowedAttributes = {
@@ -349,14 +357,19 @@ function sanitizeRichTextAttributes(tagName, attrText) {
     h4: ['class', 'style'],
     h5: ['class', 'style'],
     h6: ['class', 'style'],
+    img: ['src', 'alt', 'title', 'width', 'height', 'class', 'style', 'loading', 'decoding'],
+    col: ['class', 'style', 'span', 'width'],
+    colgroup: ['class', 'style', 'span'],
     li: ['class', 'style'],
     ol: ['class', 'style', 'start'],
     p: ['class', 'style'],
     pre: ['class', 'style'],
     span: ['class', 'style'],
     table: ['class', 'style'],
+    tbody: ['class', 'style'],
     td: ['class', 'style', 'colspan', 'rowspan'],
     th: ['class', 'style', 'colspan', 'rowspan', 'scope'],
+    thead: ['class', 'style'],
     tr: ['class', 'style'],
     ul: ['class', 'style']
   };
@@ -365,6 +378,14 @@ function sanitizeRichTextAttributes(tagName, attrText) {
     return '';
   }
 
+  if (tagName === 'img') {
+    const srcMatch = String(attrText || '').match(/\bsrc\s*=\s*("([^"]*)"|'([^']*)'|([^\s"'>/=`]+))/i);
+    const srcValue = srcMatch ? String(srcMatch[2] !== undefined ? srcMatch[2] : srcMatch[3] !== undefined ? srcMatch[3] : srcMatch[4] !== undefined ? srcMatch[4] : '').trim() : '';
+    if (!srcValue || !/^(?:https?:\/\/|\/media\/|\/assets\/|\/[^/]|data:image\/)/i.test(srcValue)) {
+      return '';
+    }
+  }
+
   const attrs = [];
   String(attrText || '').replace(/([a-zA-Z0-9:-]+)(?:\s*=\s*("([^"]*)"|'([^']*)'|([^\s"'>/=`]+)))?/g, (_full, key, _valuePart, doubleQuoted, singleQuoted, bareValue) => {
     const lowerKey = String(key || '').toLowerCase();
@@ -388,7 +409,7 @@ function sanitizeRichTextAttributes(tagName, attrText) {
         return '';
       }
     }
-    attrs.push(' ' + lowerKey + '="' + escapeHtml(value) + '"');
+    attrs.push(' ' + lowerKey + '="' + escapeHtml(lowerKey === 'style' ? normalizeStyleAttributeValue(value) : value) + '"');
     return '';
   });
 

src/player/regions/html.js

@@ -2,16 +2,49 @@
 
 var registry = window.pulsePlayerRegionTypes;
 
+function normalizeRenderableValue(value) {
+  if (value && typeof value === 'object') {
+    if (value.value !== undefined) {
+      return normalizeRenderableValue(value.value);
+    }
+    if (value.text !== undefined) {
+      return normalizeRenderableValue(value.text);
+    }
+    if (value.html !== undefined) {
+      return normalizeRenderableValue(value.html);
+    }
+    if (value.content !== undefined) {
+      return normalizeRenderableValue(value.content);
+    }
+    return '';
+  }
+
+  return String(value === undefined || value === null ? '' : value);
+}
+
+function buildHtmlDocument(html) {
+  var raw = String(html || '').trim();
+  if (!raw) {
+    return '';
+  }
+
+  if (/^<!doctype\b/i.test(raw) || /^<html\b/i.test(raw)) {
+    return raw;
+  }
+
+  return '<!doctype html><html><head><style>html,body{margin:0;width:100%;height:100%;overflow:hidden;background:transparent;}</style></head><body>' + raw + '</body></html>';
+}
+
 function renderHtmlRegionContent(value) {
-  var html = String(value || '').trim();
+  var html = normalizeRenderableValue(value).trim();
   if (!html) {
     return '';
   }
-  return '<iframe class="template-region-html-frame" sandbox="" scrolling="no" srcdoc="<!doctype html><html><head><style>html,body{margin:0;width:100%;height:100%;overflow:hidden;background:transparent;}</style></head><body>' + escapeHtml(html) + '</body></html>" title="HTML region" loading="eager"></iframe>';
+  return '<iframe class="template-region-html-frame" sandbox="" scrolling="no" srcdoc="' + escapeHtml(buildHtmlDocument(html)) + '" title="HTML region" loading="eager" style="width:100%;height:100%;border:0;display:block;background:transparent;overflow:hidden;"></iframe>';
 }
 
 function renderHtmlRegion(region, regionContent) {
-  return '<div class="template-region html" style="' + region.baseStyle + '">' + renderHtmlRegionContent(regionContent.value || '') + '</div>';
+  return '<div class="template-region html" style="' + region.baseStyle + '">' + renderHtmlRegionContent(regionContent && regionContent.value !== undefined ? regionContent.value : '') + '</div>';
 }
 
 registry.register('html', {

src/player/regions/time-date.js

@@ -1,6 +1,7 @@
 // Time/date region rendering and live updates.
 
 var registry = window.pulsePlayerRegionTypes;
+var placeholderUtils = window.placeholderUtils || {};
 var DEFAULT_FORMAT = '{{hh}}:{{mm}}';
 var DEFAULT_STYLE = {
   font_family: 'Arial',
@@ -9,15 +10,6 @@ var DEFAULT_STYLE = {
 };
 var timeDateFormatterCache = Object.create(null);
 
-function escapeHtml(value) {
-  return String(value === undefined || value === null ? '' : value)
-    .replace(/&/g, '&')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;')
-    .replace(/'/g, '&#39;');
-}
-
 function sanitizeTagAttributes(tagName, attrText) {
   var allowedAttributes = {
     a: ['href', 'title', 'target', 'rel', 'class', 'style'],
@@ -133,7 +125,7 @@ function resolveTimeZone(value) {
   }
 }
 
-function getFormatter(key, options) {
+function getTimeDateFormatter(key, options) {
   if (!timeDateFormatterCache[key]) {
     timeDateFormatterCache[key] = new Intl.DateTimeFormat('en-GB', options);
   }
@@ -141,10 +133,10 @@ function getFormatter(key, options) {
   return timeDateFormatterCache[key];
 }
 
-function getFormattedParts(timeZone, date) {
+function getTimeDateFormattedParts(timeZone, date) {
   var targetDate = date instanceof Date ? date : new Date();
   var resolvedTimeZone = resolveTimeZone(timeZone);
-  var numericParts = getFormatter('numeric:' + resolvedTimeZone, {
+  var numericParts = getTimeDateFormatter('numeric:' + resolvedTimeZone, {
     timeZone: resolvedTimeZone,
     hour12: false,
     hour: '2-digit',
@@ -154,29 +146,29 @@ function getFormattedParts(timeZone, date) {
     month: '2-digit',
     year: 'numeric'
   }).formatToParts(targetDate);
-  var weekdayLong = getFormatter('weekday-long:' + resolvedTimeZone, {
+  var weekdayLong = getTimeDateFormatter('weekday-long:' + resolvedTimeZone, {
     timeZone: resolvedTimeZone,
     weekday: 'long'
   }).formatToParts(targetDate);
-  var weekdayShort = getFormatter('weekday-short:' + resolvedTimeZone, {
+  var weekdayShort = getTimeDateFormatter('weekday-short:' + resolvedTimeZone, {
     timeZone: resolvedTimeZone,
     weekday: 'short'
   }).formatToParts(targetDate);
-  var monthLong = getFormatter('month-long:' + resolvedTimeZone, {
+  var monthLong = getTimeDateFormatter('month-long:' + resolvedTimeZone, {
     timeZone: resolvedTimeZone,
     month: 'long'
   }).formatToParts(targetDate);
-  var monthShort = getFormatter('month-short:' + resolvedTimeZone, {
+  var monthShort = getTimeDateFormatter('month-short:' + resolvedTimeZone, {
     timeZone: resolvedTimeZone,
     month: 'short'
   }).formatToParts(targetDate);
-  var ampm = getFormatter('ampm:' + resolvedTimeZone, {
+  var ampm = getTimeDateFormatter('ampm:' + resolvedTimeZone, {
     timeZone: resolvedTimeZone,
     hour12: true,
     hour: '2-digit',
     minute: '2-digit'
   }).formatToParts(targetDate);
-  var timezoneShort = getFormatter('tz-short:' + resolvedTimeZone, {
+  var timezoneShort = getTimeDateFormatter('tz-short:' + resolvedTimeZone, {
     timeZone: resolvedTimeZone,
     timeZoneName: 'short'
   }).formatToParts(targetDate);
@@ -220,20 +212,21 @@ function getFormattedParts(timeZone, date) {
   };
 }
 
-function resolveTimeDatePlaceholder(values, expression) {
+function resolveTimeDateTemplatePlaceholder(values, expression) {
-  if (typeof placeholderUtils.resolvePlaceholderExpression === 'function' && typeof placeholderUtils.formatPlaceholderValue === 'function') {
+  var currentPlaceholderUtils = window.placeholderUtils || placeholderUtils || {};
-    return placeholderUtils.formatPlaceholderValue(placeholderUtils.resolvePlaceholderExpression(values, expression));
+  if (typeof currentPlaceholderUtils.resolvePlaceholderExpression === 'function' && typeof currentPlaceholderUtils.formatPlaceholderValue === 'function') {
+    return currentPlaceholderUtils.formatPlaceholderValue(currentPlaceholderUtils.resolvePlaceholderExpression(values, expression));
   }
 
   var parsed = String(expression || '').trim();
   return Object.prototype.hasOwnProperty.call(values, parsed) ? values[parsed] : '';
 }
 
-function renderTemplate(format, timeZone, date) {
+function renderTimeDateTemplate(format, timeZone, date) {
   var template = String(format || '').trim() || DEFAULT_FORMAT;
-  var values = getFormattedParts(timeZone, date);
+  var values = getTimeDateFormattedParts(timeZone, date);
   return template.replace(/\{\{\s*([a-zA-Z0-9_.()\-]+)\s*\}\}/g, function (_match, key) {
-    return String(resolveTimeDatePlaceholder(values, key, { timeZone: timeZone }) || '');
+    return String(resolveTimeDateTemplatePlaceholder(values, key, { timeZone: timeZone }) || '');
   });
 }
 
@@ -257,7 +250,7 @@ function renderTimeDateRegion(region, regionContent) {
   var fontSize = style.font_size ? 'font-size:' + Math.max(1, Math.round(Number(style.font_size))) + 'px;' : '';
   var fontColor = style.font_color ? 'color:' + escapeHtml(style.font_color) + ';' : '';
   var contentStyle = 'width:' + region.pixelWidth + 'px;height:' + region.pixelHeight + 'px;transform:scale(' + region.canvasScale + ');transform-origin:top left;' + (fontFamily ? fontFamily : '') + fontSize + fontColor + 'white-space:pre-wrap;line-height:1.1;';
-  var renderedText = renderTemplate(format, timeZone, new Date());
+  var renderedText = renderTimeDateTemplate(format, timeZone, new Date());
   return '<div class="template-region time-date" data-time-date-format="' + escapeHtml(format) + '" data-time-date-timezone="' + escapeHtml(timeZone) + '" style="' + region.baseStyle + '"><div class="template-region-text-scale" style="' + contentStyle + '">' + renderEditorJsContent(renderedText) + '</div></div>';
 }
 
@@ -273,7 +266,7 @@ function updateTimeDateRegion(element) {
     return;
   }
 
-  scaleWrapper.innerHTML = renderEditorJsContent(renderTemplate(format, timeZone, new Date()));
+  scaleWrapper.innerHTML = renderEditorJsContent(renderTimeDateTemplate(format, timeZone, new Date()));
 }
 
 function scheduleTimeDateRegionUpdate(element) {

src/player/regions/timetable.js

@@ -2,101 +2,6 @@
 
 var registry = window.pulsePlayerRegionTypes;
 
-function escapeHtml(value) {
-  return String(value === undefined || value === null ? '' : value)
-    .replace(/&/g, '&')
-    .replace(/</g, '&lt;')
-    .replace(/>/g, '&gt;')
-    .replace(/"/g, '&quot;')
-    .replace(/'/g, '&#39;');
-}
-
-function sanitizeRichTextAttributes(tagName, attrText) {
-  var allowedAttributes = {
-    a: ['href', 'title', 'target', 'rel', 'class', 'style'],
-    blockquote: ['class', 'style'],
-    col: ['class', 'style', 'span', 'width'],
-    colgroup: ['class', 'style', 'span'],
-    div: ['class', 'style'],
-    figure: ['class', 'style'],
-    figcaption: ['class', 'style'],
-    h1: ['class', 'style'],
-    h2: ['class', 'style'],
-    h3: ['class', 'style'],
-    h4: ['class', 'style'],
-    h5: ['class', 'style'],
-    h6: ['class', 'style'],
-    li: ['class', 'style'],
-    ol: ['class', 'style', 'start'],
-    p: ['class', 'style'],
-    pre: ['class', 'style'],
-    span: ['class', 'style'],
-    table: ['class', 'style'],
-    tbody: ['class', 'style'],
-    td: ['class', 'style', 'colspan', 'rowspan'],
-    th: ['class', 'style', 'colspan', 'rowspan', 'scope'],
-    thead: ['class', 'style'],
-    tr: ['class', 'style'],
-    ul: ['class', 'style']
-  };
-  var allowed = allowedAttributes[tagName] || [];
-  if (!allowed.length) {
-    return '';
-  }
-
-  var attrs = [];
-  String(attrText || '').replace(/([a-zA-Z0-9:-]+)(?:\s*=\s*("([^"]*)"|'([^']*)'|([^\s"'>/=`]+)))?/g, function (_full, key, _valuePart, doubleQuoted, singleQuoted, bareValue) {
-    var lowerKey = String(key || '').toLowerCase();
-    if (allowed.indexOf(lowerKey) === -1) {
-      return '';
-    }
-
-    var value = doubleQuoted !== undefined ? doubleQuoted : singleQuoted !== undefined ? singleQuoted : bareValue !== undefined ? bareValue : '';
-    if (lowerKey === 'href' && /^(?:\s*javascript:|\s*data:)/i.test(String(value || ''))) {
-      return '';
-    }
-    if (lowerKey === 'style' && /(?:expression\s*\(|javascript:|url\s*\()/i.test(String(value || ''))) {
-      return '';
-    }
-    if (lowerKey === 'target') {
-      var targetValue = String(value || '').trim();
-      if (targetValue === '_blank') {
-        attrs.push(' target="_blank"');
-        if (attrs.indexOf(' rel="noreferrer noopener"') === -1) {
-          attrs.push(' rel="noreferrer noopener"');
-        }
-        return '';
-      }
-    }
-    attrs.push(' ' + lowerKey + '="' + escapeHtml(value) + '"');
-    return '';
-  });
-
-  return attrs.join('');
-}
-
-function sanitizeRichText(html) {
-  var output = String(html || '');
-  output = output.replace(/<script[\s\S]*?<\/script>/gi, '');
-  output = output.replace(/<style[\s\S]*?<\/style>/gi, '');
-  return output.replace(/<[^>]+>/g, function (tag) {
-    var match = tag.match(/^<\s*(\/?)\s*([a-z0-9]+)([\s\S]*?)(\/?)>$/i);
-    if (!match) {
-      return '';
-    }
-    var closing = Boolean(match[1]);
-    var name = String(match[2] || '').toLowerCase();
-    var allowed = ['a', 'b', 'blockquote', 'br', 'code', 'col', 'colgroup', 'div', 'em', 'figure', 'figcaption', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'li', 'ol', 'p', 'pre', 'span', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'th', 'thead', 'tr', 'u', 'ul'];
-    if (allowed.indexOf(name) === -1) {
-      return '';
-    }
-    if (closing) {
-      return '</' + name + '>';
-    }
-    return '<' + name + sanitizeRichTextAttributes(name, String(match[3] || '')) + '>';
-  });
-}
-
 function substituteTimetableVariables(html, entry) {
   var source = String(html || '');
   return source.replace(/\{\{\s*([^{}]+?)\s*\}\}/g, function (_match, expression) {

src/player/regions/webpage.js

@@ -2,12 +2,38 @@
 
 var registry = window.pulsePlayerRegionTypes;
 
+function normalizeRenderableValue(value) {
+  if (value && typeof value === 'object') {
+    if (value.value !== undefined) {
+      return normalizeRenderableValue(value.value);
+    }
+    if (value.text !== undefined) {
+      return normalizeRenderableValue(value.text);
+    }
+    if (value.url !== undefined) {
+      return normalizeRenderableValue(value.url);
+    }
+    if (value.href !== undefined) {
+      return normalizeRenderableValue(value.href);
+    }
+    if (value.src !== undefined) {
+      return normalizeRenderableValue(value.src);
+    }
+    if (value.content !== undefined) {
+      return normalizeRenderableValue(value.content);
+    }
+    return '';
+  }
+
+  return String(value === undefined || value === null ? '' : value);
+}
+
 function renderWebpageRegion(region, regionContent) {
-  var url = String(regionContent.value || '').trim();
+  var url = normalizeRenderableValue(regionContent && regionContent.value !== undefined ? regionContent.value : '').trim();
   if (!url) {
     return '';
   }
-  return '<div class="template-region webpage" style="' + region.baseStyle + '"><iframe src="' + escapeHtml(url) + '" title="' + escapeHtml(region.label) + '" loading="eager" referrerpolicy="no-referrer" scrolling="no"></iframe></div>';
+  return '<div class="template-region webpage" style="' + region.baseStyle + '"><iframe src="' + escapeHtml(url) + '" title="' + escapeHtml(region.label) + '" loading="eager" referrerpolicy="no-referrer" scrolling="no" style="width:100%;height:100%;border:0;display:block;background:#fff;overflow:hidden;"></iframe></div>';
 }
 
 registry.register('webpage', {

src/player/render-helpers.js

@@ -25,6 +25,14 @@ function escapeHtml(value) {
     .replace(/'/g, ''');
 }
 
+function normalizeStyleAttributeValue(value) {
+  return String(value || '')
+    .replace(/"/g, '"')
+    .replace(/'/g, "'")
+    .replace(/"/g, '"')
+    .replace(/'/g, "'");
+}
+
 function sanitizeFontFamily(value) {
   return String(value || '').replace(/[^a-zA-Z0-9 ,"-]/g, '').trim();
 }
@@ -41,7 +49,7 @@ function sanitizeTextColor(value, fallback) {
   return fallback || '#000000';
 }
 
-const ALLOWED_RICH_TEXT_TAGS = ['a', 'b', 'blockquote', 'br', 'code', 'div', 'em', 'figure', 'figcaption', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'li', 'ol', 'p', 'pre', 'span', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'th', 'thead', 'tr', 'u', 'ul'];
+const ALLOWED_RICH_TEXT_TAGS = ['a', 'b', 'blockquote', 'br', 'code', 'col', 'colgroup', 'div', 'em', 'figure', 'figcaption', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'img', 'li', 'ol', 'p', 'pre', 'span', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'th', 'thead', 'tr', 'u', 'ul'];
 
 function sanitizeRichTextAttributes(tagName, attrText) {
   const allowedAttributes = {
@@ -56,6 +64,9 @@ function sanitizeRichTextAttributes(tagName, attrText) {
     h4: ['class', 'style'],
     h5: ['class', 'style'],
     h6: ['class', 'style'],
+    img: ['src', 'alt', 'title', 'width', 'height', 'class', 'style', 'loading', 'decoding'],
+    col: ['class', 'style', 'span', 'width'],
+    colgroup: ['class', 'style', 'span'],
     li: ['class', 'style'],
     ol: ['class', 'style', 'start'],
     p: ['class', 'style'],
@@ -72,6 +83,14 @@ function sanitizeRichTextAttributes(tagName, attrText) {
     return '';
   }
 
+  if (tagName === 'img') {
+    const srcMatch = String(attrText || '').match(/\bsrc\s*=\s*("([^"]*)"|'([^']*)'|([^\s"'>/=`]+))/i);
+    const srcValue = srcMatch ? String(srcMatch[2] !== undefined ? srcMatch[2] : srcMatch[3] !== undefined ? srcMatch[3] : srcMatch[4] !== undefined ? srcMatch[4] : '').trim() : '';
+    if (!srcValue || !/^(?:https?:\/\/|\/media\/|\/assets\/|\/[^/]|data:image\/)/i.test(srcValue)) {
+      return '';
+    }
+  }
+
   const attrs = [];
   String(attrText || '').replace(/([a-zA-Z0-9:-]+)(?:\s*=\s*("([^"]*)"|'([^']*)'|([^\s"'>/=`]+)))?/g, (_full, key, _valuePart, doubleQuoted, singleQuoted, bareValue) => {
     const lowerKey = String(key || '').toLowerCase();
@@ -95,7 +114,7 @@ function sanitizeRichTextAttributes(tagName, attrText) {
         return '';
       }
     }
-    attrs.push(' ' + lowerKey + '="' + escapeHtml(value) + '"');
+    attrs.push(' ' + lowerKey + '="' + escapeHtml(lowerKey === 'style' ? normalizeStyleAttributeValue(value) : value) + '"');
     return '';
   });
 
@@ -268,12 +287,45 @@ function renderEditorJsContent(value) {
   return wrapRichTextParagraph(sanitizeRichText(raw));
 }
 
+function buildHtmlDocument(html) {
+  const raw = String(html || '').trim();
+  if (!raw) {
+    return '';
+  }
+
+  if (/^<!doctype\b/i.test(raw) || /^<html\b/i.test(raw)) {
+    return raw;
+  }
+
+  return '<!doctype html><html><head><style>html,body{margin:0;width:100%;height:100%;overflow:hidden;background:transparent;}</style></head><body>' + raw + '</body></html>';
+}
+
 function renderHtmlRegionContent(value) {
-  const html = String(value || '').trim();
+  const html = normalizeRenderableValue(value).trim();
   if (!html) {
     return '<div class="template-region-placeholder">HTML</div>';
   }
-  return '<iframe class="template-region-html-frame" sandbox="" srcdoc="' + escapeHtml(html) + '" title="HTML region" loading="eager"></iframe>';
+  return '<iframe class="template-region-html-frame" sandbox="" srcdoc="' + escapeHtml(buildHtmlDocument(html)) + '" title="HTML region" loading="eager" style="width:100%;height:100%;border:0;display:block;background:transparent;overflow:hidden;"></iframe>';
+}
+
+function normalizeRenderableValue(value) {
+  if (value && typeof value === 'object') {
+    if (value.value !== undefined) {
+      return normalizeRenderableValue(value.value);
+    }
+    if (value.text !== undefined) {
+      return normalizeRenderableValue(value.text);
+    }
+    if (value.html !== undefined) {
+      return normalizeRenderableValue(value.html);
+    }
+    if (value.content !== undefined) {
+      return normalizeRenderableValue(value.content);
+    }
+    return '';
+  }
+
+  return String(value === undefined || value === null ? '' : value);
 }
 
 function fitCanvasSize(canvasWidth, canvasHeight, maxWidth, maxHeight) {

src/web/lib/background-tasks/queue.js

@@ -19,6 +19,9 @@ function normalizeIntervalMs(value, unit) {
   if (normalizedUnit === 'seconds') {
     return numericValue * 1000;
   }
+  if (normalizedUnit === 'hours') {
+    return numericValue * 60 * 60 * 1000;
+  }
   return numericValue * 60 * 1000;
 }
 

src/web/lib/media/font-library.js

@@ -30,6 +30,43 @@ function normalizeText(value) {
   return String(value || '').replace(/\s+/g, ' ').trim();
 }
 
+function quoteFontFamilyToken(token) {
+  const normalizedToken = normalizeText(token);
+  if (!normalizedToken) {
+    return '';
+  }
+
+  if (normalizedToken === 'inherit' || /^[a-zA-Z0-9_-]+$/.test(normalizedToken)) {
+    return normalizedToken;
+  }
+
+  return `'${normalizedToken.replace(/\\/g, '\\\\').replace(/'/g, "\\'")}'`;
+}
+
+function normalizeFontFamilyFormat(format) {
+  return String(format || '')
+    .split(',')
+    .map(quoteFontFamilyToken)
+    .filter(Boolean)
+    .join(',');
+}
+
+function normalizeFontFamilyFormatEntry(entry) {
+  const value = String(entry || '').trim();
+  if (!value) {
+    return '';
+  }
+
+  const separatorIndex = value.indexOf('=');
+  if (separatorIndex === -1) {
+    return `${value}=${normalizeFontFamilyFormat(value)}`;
+  }
+
+  const label = value.slice(0, separatorIndex).trim();
+  const format = value.slice(separatorIndex + 1).trim();
+  return `${label}=${normalizeFontFamilyFormat(format || label)}`;
+}
+
 function resolveMediaRoot(mediaRootOrUploadDir) {
   const resolved = path.resolve(String(mediaRootOrUploadDir || '').trim());
   return path.basename(resolved) === 'uploads' ? path.dirname(resolved) : resolved;
@@ -119,22 +156,19 @@ function buildFontFaceRule(entry) {
 
 function buildFontStylesheet(fonts) {
   const rules = (Array.isArray(fonts) ? fonts : [])
-    .filter(function (font) {
-      return font && font.enabled !== false;
-    })
     .map(buildFontFaceRule)
     .filter(Boolean);
   return rules.length ? `/* Managed fonts */\n\n${rules.join('\n\n')}\n` : '/* Managed fonts */\n';
 }
 
 function buildFontFamilyFormats(fonts) {
-  const formatEntries = Array.from(new Set(DEFAULT_FONT_FAMILY_FORMATS.concat((Array.isArray(fonts) ? fonts : [])
+  const formatEntries = Array.from(new Set(DEFAULT_FONT_FAMILY_FORMATS.map(normalizeFontFamilyFormatEntry).concat((Array.isArray(fonts) ? fonts : [])
     .filter(function (font) {
       return font && font.enabled !== false && normalizeText(font.family || font.name);
     })
     .map(function (font) {
       const family = normalizeText(font.family || font.name);
-      return `${family}=${family}`;
+      return `${family}=${normalizeFontFamilyFormat(family)}`;
     }))))
     .sort(function (left, right) {
       const leftLabel = String(left || '').split('=')[0];
@@ -344,7 +378,7 @@ function collectFontLibrarySyncOperations(mediaRootOrUploadDir) {
     }
 
     operations.push({
-      type: font.enabled === false ? 'delete' : 'put',
+      type: 'put',
       uploadPath: `/media/${FONT_LIBRARY_DIR_NAME}/${font.fileName}`
     });
   });
@@ -363,7 +397,10 @@ module.exports = {
   collectFontLibraryDirectoryUploadPaths: collectFontLibraryDirectoryUploadPaths,
   collectFontLibrarySyncOperations: collectFontLibrarySyncOperations,
   getFontStylesheetHref: getFontStylesheetHref,
+  buildFontStylesheet: buildFontStylesheet,
   buildFontFamilyFormats: buildFontFamilyFormats,
+  normalizeFontFamilyFormat: normalizeFontFamilyFormat,
+  normalizeFontFamilyFormatEntry: normalizeFontFamilyFormatEntry,
   isSupportedFontUpload: isSupportedFontUpload,
   getFontLibraryDir: getFontLibraryDir,
   getFontManifestPath: getFontManifestPath,

src/web/lib/media/slide-thumbnail-preview.js

@@ -30,6 +30,35 @@ function resolveAssetUrl(baseUrl, value) {
   return normalizedBaseUrl + '/' + raw.replace(/^\/+/, '');
 }
 
+function normalizeRenderableValue(value) {
+  if (value && typeof value === 'object') {
+    if (value.value !== undefined) {
+      return normalizeRenderableValue(value.value);
+    }
+    if (value.text !== undefined) {
+      return normalizeRenderableValue(value.text);
+    }
+    if (value.html !== undefined) {
+      return normalizeRenderableValue(value.html);
+    }
+    if (value.url !== undefined) {
+      return normalizeRenderableValue(value.url);
+    }
+    if (value.href !== undefined) {
+      return normalizeRenderableValue(value.href);
+    }
+    if (value.src !== undefined) {
+      return normalizeRenderableValue(value.src);
+    }
+    if (value.content !== undefined) {
+      return normalizeRenderableValue(value.content);
+    }
+    return '';
+  }
+
+  return String(value === undefined || value === null ? '' : value);
+}
+
 function getThumbnailCanvasSize(slide) {
   const template = slide && slide.template ? slide.template : null;
   return {
@@ -53,7 +82,16 @@ function buildThumbnailRegionStyle(region, canvasWidth, canvasHeight) {
 }
 
 function hasVisibleContent(html) {
-  return Boolean(String(html || '').replace(/<[^>]+>/g, '').trim());
+  var raw = String(html || '').trim();
+  if (!raw) {
+    return false;
+  }
+
+  if (/<img\b/i.test(raw)) {
+    return true;
+  }
+
+  return Boolean(raw.replace(/<[^>]+>/g, '').trim());
 }
 
 function buildTextRegionMarkup(region, regionContent) {
@@ -70,7 +108,7 @@ function buildTextRegionMarkup(region, regionContent) {
 
 function buildRegionInnerHtml(region, regionContent, baseUrl) {
   const regionType = String(regionContent.type || region.region_type || 'text').trim().toLowerCase();
-  const rawValue = regionContent && regionContent.value !== undefined ? regionContent.value : '';
+  const rawValue = normalizeRenderableValue(regionContent && regionContent.value !== undefined ? regionContent.value : '');
 
   if (regionType === 'image') {
     const src = resolveAssetUrl(baseUrl, rawValue);
@@ -89,7 +127,7 @@ function buildRegionInnerHtml(region, regionContent, baseUrl) {
   if (regionType === 'webpage') {
     const src = resolveAssetUrl(baseUrl, rawValue);
     return src
-      ? '<div class="slide-preview-region slide-preview-webpage-region" style="' + region.baseStyle + '"><iframe src="' + escapeHtml(src) + '" title="' + escapeHtml(region.label || region.region_key || 'webpage') + '" loading="eager" referrerpolicy="no-referrer" scrolling="no"></iframe></div>'
+      ? '<div class="slide-preview-region slide-preview-webpage-region" style="' + region.baseStyle + '"><iframe src="' + escapeHtml(src) + '" title="' + escapeHtml(region.label || region.region_key || 'webpage') + '" loading="eager" referrerpolicy="no-referrer" scrolling="no" style="width:100%;height:100%;border:0;display:block;background:#fff;overflow:hidden;"></iframe></div>'
       : '';
   }
 
@@ -105,7 +143,7 @@ function buildRegionInnerHtml(region, regionContent, baseUrl) {
   if (regionType === 'html') {
     const html = String(rawValue || '').trim();
     return html
-      ? '<div class="slide-preview-region slide-preview-html-region" style="' + region.baseStyle + '"><iframe sandbox="" srcdoc="<!doctype html><html><head><style>html,body{margin:0;width:100%;height:100%;overflow:hidden;background:transparent;}</style></head><body>' + escapeHtml(html) + '</body></html>" title="' + escapeHtml(region.label || region.region_key || 'html') + '" loading="eager" scrolling="no"></iframe></div>'
+      ? '<div class="slide-preview-region slide-preview-html-region" style="' + region.baseStyle + '"><iframe sandbox="" allowtransparency="true" srcdoc="' + escapeHtml('<!doctype html><html><head><style>html,body{margin:0;width:100%;height:100%;overflow:hidden;background:transparent;}</style></head><body>' + html + '</body></html>') + '" title="' + escapeHtml(region.label || region.region_key || 'html') + '" loading="eager" scrolling="no" style="width:100%;height:100%;border:0;display:block;background:transparent;overflow:hidden;"></iframe></div>'
       : '';
   }
 

src/web/lib/media/slide-thumbnails.js

@@ -52,6 +52,35 @@ function resolveAssetUrl(baseUrl, value) {
   return normalizedBaseUrl + '/' + raw.replace(/^\/+/, '');
 }
 
+function normalizeRenderableValue(value) {
+  if (value && typeof value === 'object') {
+    if (value.value !== undefined) {
+      return normalizeRenderableValue(value.value);
+    }
+    if (value.text !== undefined) {
+      return normalizeRenderableValue(value.text);
+    }
+    if (value.html !== undefined) {
+      return normalizeRenderableValue(value.html);
+    }
+    if (value.url !== undefined) {
+      return normalizeRenderableValue(value.url);
+    }
+    if (value.href !== undefined) {
+      return normalizeRenderableValue(value.href);
+    }
+    if (value.src !== undefined) {
+      return normalizeRenderableValue(value.src);
+    }
+    if (value.content !== undefined) {
+      return normalizeRenderableValue(value.content);
+    }
+    return '';
+  }
+
+  return String(value === undefined || value === null ? '' : value);
+}
+
 function getCanvasSize(slide) {
   const template = slide && slide.template ? slide.template : null;
   return {
@@ -83,7 +112,16 @@ function buildThumbnailRegionStyle(region, canvasWidth, canvasHeight) {
 }
 
 function hasVisibleContent(html) {
-  return Boolean(String(html || '').replace(/<[^>]+>/g, '').trim());
+  var raw = String(html || '').trim();
+  if (!raw) {
+    return false;
+  }
+
+  if (/<img\b/i.test(raw)) {
+    return true;
+  }
+
+  return Boolean(raw.replace(/<[^>]+>/g, '').trim());
 }
 
 function buildTextRegionMarkup(region, regionContent) {
@@ -100,7 +138,7 @@ function buildTextRegionMarkup(region, regionContent) {
 
 function buildRegionInnerHtml(region, regionContent, baseUrl) {
   const regionType = String(regionContent.type || region.region_type || 'text').trim().toLowerCase();
-  const rawValue = regionContent && regionContent.value !== undefined ? regionContent.value : '';
+  const rawValue = normalizeRenderableValue(regionContent && regionContent.value !== undefined ? regionContent.value : '');
 
   if (regionType === 'image') {
     const src = resolveAssetUrl(baseUrl, rawValue);
@@ -119,7 +157,7 @@ function buildRegionInnerHtml(region, regionContent, baseUrl) {
   if (regionType === 'webpage') {
     const src = resolveAssetUrl(baseUrl, rawValue);
     return src
-      ? '<div class="slide-preview-region slide-preview-webpage-region" style="' + region.baseStyle + '"><iframe src="' + escapeHtml(src) + '" title="' + escapeHtml(region.label || region.region_key || 'webpage') + '" loading="eager" referrerpolicy="no-referrer" scrolling="no"></iframe></div>'
+      ? '<div class="slide-preview-region slide-preview-webpage-region" style="' + region.baseStyle + '"><iframe src="' + escapeHtml(src) + '" title="' + escapeHtml(region.label || region.region_key || 'webpage') + '" loading="eager" referrerpolicy="no-referrer" scrolling="no" style="width:100%;height:100%;border:0;display:block;background:#fff;overflow:hidden;"></iframe></div>'
       : '';
   }
 
@@ -135,7 +173,7 @@ function buildRegionInnerHtml(region, regionContent, baseUrl) {
   if (regionType === 'html') {
     const html = String(rawValue || '').trim();
     return html
-      ? '<div class="slide-preview-region slide-preview-html-region" style="' + region.baseStyle + '"><iframe sandbox="" srcdoc="<!doctype html><html><head><style>html,body{margin:0;width:100%;height:100%;overflow:hidden;background:transparent;}</style></head><body>' + escapeHtml(html) + '</body></html>" title="' + escapeHtml(region.label || region.region_key || 'html') + '" loading="eager" scrolling="no"></iframe></div>'
+      ? '<div class="slide-preview-region slide-preview-html-region" style="' + region.baseStyle + '"><iframe sandbox="" allowtransparency="true" srcdoc="' + escapeHtml('<!doctype html><html><head><style>html,body{margin:0;width:100%;height:100%;overflow:hidden;background:transparent;}</style></head><body>' + html + '</body></html>') + '" title="' + escapeHtml(region.label || region.region_key || 'html') + '" loading="eager" scrolling="no" style="width:100%;height:100%;border:0;display:block;background:transparent;overflow:hidden;"></iframe></div>'
       : '';
   }
 

src/web/public/css/theme-custom.css

@@ -1652,6 +1652,31 @@ html[data-bs-theme='dark'] .template-field-card .tox .tox-collection {
   background: var(--bs-body-bg);
 }
 
+.slide-image-cropper-frame.is-loading > :not(.slide-image-cropper-loading-overlay) {
+  opacity: 0.22;
+  filter: saturate(0.8);
+}
+
+.slide-image-cropper-loading-overlay {
+  position: absolute;
+  inset: 0;
+  z-index: 3;
+  display: none;
+  align-items: center;
+  justify-content: center;
+  background: rgba(var(--bs-body-bg-rgb, 255, 255, 255), 0.72);
+  backdrop-filter: blur(1px);
+}
+
+.slide-image-cropper-frame.is-loading .slide-image-cropper-loading-overlay {
+  display: flex;
+}
+
+.slide-image-cropper-loading-spinner {
+  width: 2.5rem;
+  height: 2.5rem;
+}
+
 .slide-image-cropper-frame img {
   display: block;
   max-width: 100%;
@@ -1689,6 +1714,10 @@ html[data-bs-theme='dark'] .template-field-card .tox .tox-collection {
   white-space: nowrap;
 }
 
+#slide-image-cropper-status:empty {
+  display: none;
+}
+
 .slide-image-region-preview-box {
   display: grid;
   gap: 0;
@@ -2139,10 +2168,21 @@ html[data-bs-theme='dark'] .template-field-card .tox .tox-collection {
 .template-field-actions {
   display: inline-flex;
   align-items: center;
+  flex-wrap: wrap;
+  justify-content: flex-end;
   gap: 0.5rem;
   margin-left: auto;
 }
 
+.template-editor-size-controls {
+  flex-shrink: 0;
+}
+
+.template-editor-size-controls .btn {
+  min-width: 2rem;
+  padding-inline: 0.45rem;
+}
+
 .template-field-head strong {
   font-size: 0.95rem;
   min-width: 0;
@@ -2221,6 +2261,14 @@ html[data-bs-theme='dark'] .template-field-card .tox .tox-collection {
   min-width: 0;
 }
 
+.template-field-card .editor-holder[data-editor-height] {
+  overflow: hidden;
+}
+
+.template-field-card .editor-holder .tox.tox-tinymce {
+  height: 100% !important;
+}
+
 .announcement-color-preview {
   display: flex;
   align-items: center;

src/web/public/js/admin/admin-page.js

@@ -423,19 +423,6 @@
         return true;
       }
 
-      if (submitterValue === 'close' || submitterValue === 'new') {
-        var redirectUrl = submitterValue === 'close'
-          ? String(response.url || form.dataset.asyncSaveCloseUrl || window.location.href)
-          : String(response.url || form.dataset.asyncSaveNewUrl || window.location.href);
-        window.location.replace(redirectUrl);
-        return true;
-      }
-
-      if (form.dataset && form.dataset.asyncSaveNewRedirect === 'response-url') {
-        window.location.replace(String(response.url || form.dataset.asyncSaveNewUrl || window.location.href));
-        return true;
-      }
-
       var responseText = await response.text();
       var responseDocument = null;
       try {
@@ -456,6 +443,19 @@
 
       clearFormDirty(form);
 
+      if (submitterValue === 'close' || submitterValue === 'new') {
+        var redirectUrl = submitterValue === 'close'
+          ? String(response.url || form.dataset.asyncSaveCloseUrl || window.location.href)
+          : String(response.url || form.dataset.asyncSaveNewUrl || window.location.href);
+        window.location.replace(redirectUrl);
+        return true;
+      }
+
+      if (form.dataset && form.dataset.asyncSaveNewRedirect === 'response-url') {
+        window.location.replace(String(response.url || form.dataset.asyncSaveNewUrl || window.location.href));
+        return true;
+      }
+
       var successMessage = typeof settings.getSuccessMessage === 'function'
         ? settings.getSuccessMessage({
             form: form,
@@ -539,6 +539,39 @@
       return true;
     }
 
+    function updateFontToggleRow(form) {
+      if (!form) {
+        return false;
+      }
+
+      var row = form.closest ? form.closest('tr[data-font-toggle-row]') : null;
+      if (!row) {
+        return false;
+      }
+
+      var enabledInput = form.querySelector('input[name="enabled"]');
+      var toggleButton = form.querySelector('button[type="submit"]');
+      var statusBadge = row.querySelector('[data-font-status-badge]');
+      var isCurrentlyEnabled = String(row.getAttribute('data-font-enabled') || '').trim() === 'true';
+      var willEnable = !isCurrentlyEnabled;
+
+      if (enabledInput) {
+        enabledInput.value = isCurrentlyEnabled ? '0' : '1';
+      }
+
+      if (toggleButton) {
+        toggleButton.textContent = willEnable ? 'Disable' : 'Enable';
+      }
+
+      if (statusBadge) {
+        statusBadge.className = statusBadge.className.replace(/text-bg-(success|secondary)/g, willEnable ? 'text-bg-success' : 'text-bg-secondary');
+        statusBadge.textContent = willEnable ? 'Enabled' : 'Disabled';
+      }
+
+      row.setAttribute('data-font-enabled', willEnable ? 'true' : 'false');
+      return true;
+    }
+
     document.addEventListener('submit', function (event) {
       var form = event.target;
       if (!form || !form.hasAttribute || !form.hasAttribute('data-async-command')) {
@@ -584,6 +617,15 @@
         body: body.toString(),
         credentials: 'same-origin'
       }).then(function (response) {
+        if (!response || Number(response.status) >= 400) {
+          return;
+        }
+
+        if (/^\/settings\/fonts\/[^/]+\/toggle$/.test(actionPath)) {
+          updateFontToggleRow(form);
+          return;
+        }
+
         if (shouldReloadAfterSuccess && response && response.ok) {
           window.location.reload();
           return;

src/web/public/js/regions/region-utils.js

@@ -28,11 +28,19 @@
       var name = String(match[2] || '').toLowerCase();
       var attrText = String(match[3] || '');
       var selfClosing = Boolean(match[4]) || name === 'br' || name === 'hr';
-      var allowed = ['a', 'b', 'blockquote', 'br', 'code', 'div', 'em', 'figure', 'figcaption', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'li', 'ol', 'p', 'pre', 'span', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'th', 'thead', 'tr', 'u', 'ul'];
+      var allowed = ['a', 'b', 'blockquote', 'br', 'code', 'col', 'colgroup', 'div', 'em', 'figure', 'figcaption', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'img', 'li', 'ol', 'p', 'pre', 'span', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'th', 'thead', 'tr', 'u', 'ul'];
       if (allowed.indexOf(name) === -1) {
         return '';
       }
 
+      if (name === 'img') {
+        var srcMatch = String(attrText || '').match(/\bsrc\s*=\s*("([^"]*)"|'([^']*)'|([^\s"'>/=`]+))/i);
+        var srcValue = srcMatch ? String(srcMatch[2] !== undefined ? srcMatch[2] : srcMatch[3] !== undefined ? srcMatch[3] : srcMatch[4] !== undefined ? srcMatch[4] : '').trim() : '';
+        if (!srcValue || !/^(?:https?:\/\/|\/media\/|\/assets\/|\/[^/]|data:image\/)/i.test(srcValue)) {
+          return '';
+        }
+      }
+
       if (closing) {
         return '</' + name + '>';
       }
@@ -42,7 +50,100 @@
   }
 
   function sanitizeRichText(html) {
-    return sanitizePreviewHtml(html);
+    var output = String(html || '');
+    output = output.replace(/<script[\s\S]*?<\/script>/gi, '');
+    output = output.replace(/<style[\s\S]*?<\/style>/gi, '');
+    return output.replace(/<[^>]+>/g, function (tag) {
+      var match = tag.match(/^<\s*(\/?)\s*([a-z0-9]+)([\s\S]*?)(\/?)>$/i);
+      if (!match) {
+        return '';
+      }
+
+      var closing = Boolean(match[1]);
+      var name = String(match[2] || '').toLowerCase();
+      var attrText = String(match[3] || '');
+      var allowed = ['a', 'b', 'blockquote', 'br', 'code', 'col', 'colgroup', 'div', 'em', 'figure', 'figcaption', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'hr', 'i', 'img', 'li', 'ol', 'p', 'pre', 'span', 'strong', 'sub', 'sup', 'table', 'tbody', 'td', 'th', 'thead', 'tr', 'u', 'ul'];
+      if (allowed.indexOf(name) === -1) {
+        return '';
+      }
+
+      if (closing) {
+        return '</' + name + '>';
+      }
+
+      return '<' + name + sanitizeRichTextAttributes(name, attrText) + '>';
+    });
+  }
+
+  function sanitizeRichTextAttributes(tagName, attrText) {
+    var allowedAttributes = {
+      a: ['href', 'title', 'target', 'rel', 'class', 'style'],
+      blockquote: ['class', 'style'],
+      div: ['class', 'style'],
+      figure: ['class', 'style'],
+      figcaption: ['class', 'style'],
+      h1: ['class', 'style'],
+      h2: ['class', 'style'],
+      h3: ['class', 'style'],
+      h4: ['class', 'style'],
+      h5: ['class', 'style'],
+      h6: ['class', 'style'],
+      img: ['src', 'alt', 'title', 'width', 'height', 'class', 'style', 'loading', 'decoding'],
+      col: ['class', 'style', 'span', 'width'],
+      colgroup: ['class', 'style', 'span'],
+      li: ['class', 'style'],
+      ol: ['class', 'style', 'start'],
+      p: ['class', 'style'],
+      pre: ['class', 'style'],
+      span: ['class', 'style'],
+      table: ['class', 'style'],
+      td: ['class', 'style', 'colspan', 'rowspan'],
+      th: ['class', 'style', 'colspan', 'rowspan', 'scope'],
+      tr: ['class', 'style'],
+      ul: ['class', 'style']
+    };
+    var allowed = allowedAttributes[tagName] || [];
+    if (!allowed.length) {
+      return '';
+    }
+
+    if (tagName === 'img') {
+      var srcMatch = String(attrText || '').match(/\bsrc\s*=\s*("([^"]*)"|'([^']*)'|([^\s"'>/=`]+))/i);
+      var srcValue = srcMatch ? String(srcMatch[2] !== undefined ? srcMatch[2] : srcMatch[3] !== undefined ? srcMatch[3] : srcMatch[4] !== undefined ? srcMatch[4] : '').trim() : '';
+      if (!srcValue || !/^(?:https?:\/\/|\/media\/|\/assets\/|\/[^/]|data:image\/)/i.test(srcValue)) {
+        return '';
+      }
+    }
+
+    var attrs = [];
+    String(attrText || '').replace(/([a-zA-Z0-9:-]+)(?:\s*=\s*("([^"]*)"|'([^']*)'|([^\s"'>/=`]+)))?/g, function (_full, key, _valuePart, doubleQuoted, singleQuoted, bareValue) {
+      var lowerKey = String(key || '').toLowerCase();
+      if (allowed.indexOf(lowerKey) === -1) {
+        return '';
+      }
+
+      var value = doubleQuoted !== undefined ? doubleQuoted : singleQuoted !== undefined ? singleQuoted : bareValue !== undefined ? bareValue : '';
+      if (lowerKey === 'href' && /^(?:\s*javascript:|\s*data:)/i.test(String(value || ''))) {
+        return '';
+      }
+      if (lowerKey === 'style' && /(?:expression\s*\(|javascript:|url\s*\()/i.test(String(value || ''))) {
+        return '';
+      }
+      if (lowerKey === 'target') {
+        var targetValue = String(value || '').trim();
+        if (targetValue === '_blank') {
+          attrs.push(' target="_blank"');
+          if (attrs.indexOf(' rel="noreferrer noopener"') === -1) {
+            attrs.push(' rel="noreferrer noopener"');
+          }
+          return '';
+        }
+      }
+      attrs.push(' ' + lowerKey + '="' + escapeHtml(value) + '"');
+      return '';
+    });
+
+    return attrs.join('');
   }
 
   function sanitizeTagAttributes(tagName, attrText) {
@@ -64,6 +165,7 @@
       pre: ['class', 'style'],
       span: ['class', 'style'],
       table: ['class', 'style'],
+      img: ['src', 'alt', 'title', 'width', 'height', 'class', 'style', 'loading', 'decoding'],
       td: ['class', 'style', 'colspan', 'rowspan'],
       th: ['class', 'style', 'colspan', 'rowspan', 'scope'],
       tr: ['class', 'style'],
@@ -844,6 +946,7 @@
     escapeHtml: escapeHtml,
     sanitizePreviewHtml: sanitizePreviewHtml,
     sanitizeRichText: sanitizeRichText,
+    sanitizeRichTextAttributes: sanitizeRichTextAttributes,
     sanitizeFontFamily: sanitizeFontFamily,
     sanitizeTextColor: sanitizeTextColor,
     normalizeAcceptList: normalizeAcceptList,

src/web/public/js/regions/type/api.js

@@ -9,8 +9,8 @@
     return utils.escapeHtml ? utils.escapeHtml(value) : String(value === undefined || value === null ? '' : value);
   }
 
-  function sanitizeRichText(html) {
+  function sanitizePreviewHtml(html) {
-    return utils.sanitizeRichText ? utils.sanitizeRichText(html) : escapeHtml(html);
+    return utils.sanitizePreviewHtml ? utils.sanitizePreviewHtml(html) : escapeHtml(html);
   }
 
   function sanitizeFontFamily(value) {
@@ -128,7 +128,7 @@
       summary.push('<h3>' + escapeHtml(title) + '</h3>');
     }
     if (description) {
-      summary.push('<div>' + sanitizeRichText(description) + '</div>');
+      summary.push('<div>' + sanitizePreviewHtml(description) + '</div>');
     }
     if (!summary.length) {
       return '';
@@ -183,7 +183,7 @@
     if (!body) {
       return '';
     }
-    var renderedBody = sanitizeRichText(body);
+    var renderedBody = sanitizePreviewHtml(body);
     return renderedBody ? '<div class="template-region api" style="width:100%;height:100%;overflow:hidden;font-family:' + escapeHtml(fontFamily) + ';font-size:' + fontSize + 'px;color:' + escapeHtml(fontColor) + ';"><div class="template-region-text-scale" style="width:100%;height:100%;overflow:hidden;">' + renderedBody + '</div></div>' : '';
   }
 
@@ -207,6 +207,12 @@
           '</div>' +
         '</div>' +
         '<div class="card-body p-3 d-grid gap-3 pb-0">' +
+          '<div class="d-flex justify-content-end">' +
+            '<div class="btn-group btn-group-sm template-editor-size-controls" role="group" aria-label="Editor size controls">' +
+              '<button type="button" class="btn btn-outline-secondary" data-editor-size-action="decrease" aria-label="Decrease editor size">-</button>' +
+              '<button type="button" class="btn btn-outline-secondary" data-editor-size-action="increase" aria-label="Increase editor size">+</button>' +
+            '</div>' +
+          '</div>' +
           '<div class="editor-holder" data-region-id="' + region.id + '">' +
             '<textarea class="editor-source" rows="10">' + escapeHtml(current.value !== undefined ? current.value : '') + '</textarea>' +
           '</div>' +

src/web/public/js/regions/type/html.js

@@ -8,13 +8,49 @@
     return utils.escapeHtml ? utils.escapeHtml(value) : String(value === undefined || value === null ? '' : value);
   }
 
-  function renderPreview(value) {
+  function normalizePreviewValue(value) {
-    var content = value && typeof value === 'object' && value.value !== undefined ? value : null;
+    if (value && typeof value === 'object') {
-    var html = String(content ? content.value : value || '').trim();
+      if (value.value !== undefined) {
+        return normalizePreviewValue(value.value);
+      }
+      if (value.text !== undefined) {
+        return normalizePreviewValue(value.text);
+      }
+      if (value.html !== undefined) {
+        return normalizePreviewValue(value.html);
+      }
+      if (value.content !== undefined) {
+        return normalizePreviewValue(value.content);
+      }
+      return '';
+    }
+
+    return String(value === undefined || value === null ? '' : value);
+  }
+
+  function buildHtmlDocument(html) {
+    var raw = String(html || '').trim();
+    if (!raw) {
+      return '';
+    }
+
+    if (/^<!doctype\b/i.test(raw) || /^<html\b/i.test(raw)) {
+      return raw;
+    }
+
+    return '<!doctype html><html><head><style>html,body{margin:0;width:100%;height:100%;overflow:hidden;background:transparent;}</style></head><body>' + raw + '</body></html>';
+  }
+
+  function renderPreview(region, value) {
+    var html = normalizePreviewValue(value !== undefined ? value : region).trim();
     if (!html) {
       return '<div class="slide-preview-placeholder">HTML</div>';
     }
-    return '<iframe class="slide-preview-html-frame" sandbox="" scrolling="no" srcdoc="<!doctype html><html><head><style>html,body{margin:0;width:100%;height:100%;overflow:hidden;background:transparent;}</style></head><body>' + escapeHtml(html) + '</body></html>" title="HTML preview" loading="eager" style="width:100%;height:100%;border:0;display:block;background:transparent;overflow:hidden;"></iframe>';
+    if (/^<!doctype\b/i.test(html) || /^<html\b/i.test(html)) {
+      return '<iframe class="slide-preview-html-frame" sandbox="" allowtransparency="true" scrolling="no" srcdoc="' + escapeHtml(buildHtmlDocument(html)) + '" title="HTML preview" loading="eager" style="width:100%;height:100%;border:0;display:block;background:transparent;overflow:hidden;"></iframe>';
+    }
+
+    return '<div class="slide-preview-html-frame" style="width:100%;height:100%;overflow:hidden;background:transparent;">' + html + '</div>';
   }
 
   function renderEditorCard(context) {

src/web/public/js/regions/type/image.js

@@ -32,8 +32,8 @@
     var regionRatio = String(context.regionRatio || '1:1');
     var uploadConfig = context.uploadConfig || {};
     var uploadMaxLabel = String(uploadConfig.limitLabel || context.uploadMaxLabel || '100 MB');
-    var uploadAccept = Array.isArray(uploadConfig.accept) ? uploadConfig.accept.join(', ') : String(uploadConfig.accept || 'image/png, image/jpeg, image/gif, image/webp');
+    var uploadAccept = Array.isArray(uploadConfig.accept) ? uploadConfig.accept.join(', ') : String(uploadConfig.accept || 'image/png, image/jpeg, image/gif, image/webp, image/svg+xml');
-    var uploadHelpText = String(uploadConfig.helpText || 'PNG, JPG, GIF, or WebP');
+    var uploadHelpText = String(uploadConfig.helpText || 'PNG, JPG, GIF, WebP, or SVG');
     return registry.renderEditorCardShell({
       region: region,
       headerActions: '<span class="chip">Image</span>',
@@ -81,10 +81,10 @@
       current: String(context.current || ''),
       regionRatio: String(context.regionRatio || '1:1'),
       uploadConfig: {
-        accept: Array.isArray(defaultConfig.accept) ? defaultConfig.accept : ['image/png', 'image/jpeg', 'image/gif', 'image/webp'],
+        accept: Array.isArray(defaultConfig.accept) ? defaultConfig.accept : ['image/png', 'image/jpeg', 'image/gif', 'image/webp', 'image/svg+xml'],
         limitBytes: defaultConfig.limitBytes,
         limitLabel: defaultConfig.limitLabel || context.uploadMaxLabel || '100 MB',
-        helpText: defaultConfig.helpText || 'PNG, JPG, GIF, or WebP'
+        helpText: defaultConfig.helpText || 'PNG, JPG, GIF, WebP, or SVG'
       },
       uploadMaxLabel: context.uploadMaxLabel || '100 MB'
     };
@@ -107,11 +107,11 @@
     }
 
     var uploadConfig = context.uploadConfig || {};
-    var accept = uploadConfig.accept || ['image/png', 'image/jpeg', 'image/gif', 'image/webp'];
+    var accept = uploadConfig.accept || ['image/png', 'image/jpeg', 'image/gif', 'image/webp', 'image/svg+xml'];
     var limitBytes = Number(uploadConfig.limitBytes || 100 * 1024 * 1024);
 
     if (!utils.fileMatchesAccept || !utils.fileMatchesAccept(context.file, accept)) {
-      showUploadWarning('This image region accepts PNG, JPG, GIF, or WebP files.');
+      showUploadWarning('This image region accepts PNG, JPG, GIF, WebP, or SVG files.');
       return false;
     }
 
@@ -132,10 +132,10 @@
       var defaultConfig = context && context.defaultConfig ? context.defaultConfig : {};
 
       return {
-        accept: ['image/png', 'image/jpeg', 'image/gif', 'image/webp'],
+        accept: ['image/png', 'image/jpeg', 'image/gif', 'image/webp', 'image/svg+xml'],
         limitBytes: defaultConfig.limitBytes,
         limitLabel: defaultConfig.limitLabel,
-        helpText: 'PNG, JPG, GIF, or WebP'
+        helpText: 'PNG, JPG, GIF, WebP, or SVG'
       };
     },
     renderPreview: renderPreview,

src/web/public/js/regions/type/rss.js

@@ -17,10 +17,6 @@
     return utils.sanitizePreviewHtml ? utils.sanitizePreviewHtml(html) : escapeHtml(html);
   }
 
-  function sanitizeRichText(html) {
-    return utils.sanitizeRichText ? utils.sanitizeRichText(html) : sanitizePreviewHtml(html);
-  }
-
   function sanitizeFontFamily(value) {
     return utils.sanitizeFontFamily ? utils.sanitizeFontFamily(value) : String(value || '').trim();
   }
@@ -198,7 +194,7 @@
         summaryParts.push('<h3>' + escapeHtml(item.title) + '</h3>');
       }
       if (item.description) {
-        summaryParts.push('<div>' + sanitizeRichText(item.description) + '</div>');
+        summaryParts.push('<div>' + sanitizePreviewHtml(item.description) + '</div>');
       }
       body = summaryParts.join('');
     }
@@ -206,7 +202,7 @@
     if (!body) {
       return '';
     }
-    var renderedBody = sanitizeRichText(body);
+    var renderedBody = sanitizePreviewHtml(body);
     return renderedBody ? '<div class="template-region rss" style="width:100%;height:100%;overflow:hidden;font-family:' + escapeHtml(fontFamily) + ';font-size:' + fontSize + 'px;color:' + escapeHtml(fontColor) + ';"><div class="template-region-text-scale" style="width:100%;height:100%;overflow:hidden;">' + renderedBody + '</div></div>' : '';
   }
 
@@ -226,6 +222,12 @@
           '</div>' +
         '</div>' +
         '<div class="card-body p-3 d-grid gap-3 pb-0">' +
+          '<div class="d-flex justify-content-end">' +
+            '<div class="btn-group btn-group-sm template-editor-size-controls" role="group" aria-label="Editor size controls">' +
+              '<button type="button" class="btn btn-outline-secondary" data-editor-size-action="decrease" aria-label="Decrease editor size">-</button>' +
+              '<button type="button" class="btn btn-outline-secondary" data-editor-size-action="increase" aria-label="Increase editor size">+</button>' +
+            '</div>' +
+          '</div>' +
           '<div class="editor-holder" data-region-id="' + region.id + '">' +
             '<textarea class="editor-source" rows="10">' + escapeHtml(current.value !== undefined ? current.value : '') + '</textarea>' +
           '</div>' +

src/web/public/js/regions/type/text.js

@@ -54,7 +54,13 @@
             '<span class="chip">Text</span>' +
           '</div>' +
         '</div>' +
-        '<div class="card-body p-3 d-grid">' +
+        '<div class="card-body p-3 d-grid gap-2">' +
+          '<div class="d-flex justify-content-end">' +
+            '<div class="btn-group btn-group-sm template-editor-size-controls" role="group" aria-label="Editor size controls">' +
+              '<button type="button" class="btn btn-outline-secondary" data-editor-size-action="decrease" aria-label="Decrease editor size">-</button>' +
+              '<button type="button" class="btn btn-outline-secondary" data-editor-size-action="increase" aria-label="Increase editor size">+</button>' +
+            '</div>' +
+          '</div>' +
           '<div class="editor-holder" data-region-id="' + region.id + '">' +
               '<textarea class="editor-source" rows="10">' + escapeHtml(current) + '</textarea>' +
           '</div>' +

src/web/public/js/regions/type/time-date.js

@@ -302,6 +302,12 @@
           '</div>' +
         '</div>' +
         '<div class="card-body p-3 d-grid gap-3">' +
+          '<div class="d-flex justify-content-end">' +
+            '<div class="btn-group btn-group-sm template-editor-size-controls" role="group" aria-label="Editor size controls">' +
+              '<button type="button" class="btn btn-outline-secondary" data-editor-size-action="decrease" aria-label="Decrease editor size">-</button>' +
+              '<button type="button" class="btn btn-outline-secondary" data-editor-size-action="increase" aria-label="Increase editor size">+</button>' +
+            '</div>' +
+          '</div>' +
           '<div class="editor-holder" data-region-id="' + region.id + '">' +
             '<textarea id="region_time_date_text_' + region.id + '" class="editor-source form-control" rows="4" name="region_text_' + region.id + '">' + escapeHtml(value) + '</textarea>' +
           '</div>' +

src/web/public/js/regions/type/timetable.js

@@ -15,10 +15,6 @@
     return utils.escapeHtml ? utils.escapeHtml(value) : String(value === undefined || value === null ? '' : value);
   }
 
-  function sanitizeRichText(html) {
-    return utils.sanitizeRichText ? utils.sanitizeRichText(html) : escapeHtml(html);
-  }
-
   function getDefaultStyle() {
     return {
       font_family: DEFAULT_STYLE.font_family,
@@ -269,6 +265,12 @@
           '<div class="template-field-actions"><span class="chip">Timetable</span></div>' +
         '</div>' +
         '<div class="card-body p-3 d-grid gap-3">' +
+          '<div class="d-flex justify-content-end">' +
+            '<div class="btn-group btn-group-sm template-editor-size-controls" role="group" aria-label="Editor size controls">' +
+              '<button type="button" class="btn btn-outline-secondary" data-editor-size-action="decrease" aria-label="Decrease editor size">-</button>' +
+              '<button type="button" class="btn btn-outline-secondary" data-editor-size-action="increase" aria-label="Increase editor size">+</button>' +
+            '</div>' +
+          '</div>' +
           '<div class="editor-holder" data-region-id="' + region.id + '">' +
             '<textarea class="editor-source" rows="10">' + escapeHtml(currentValue) + '</textarea>' +
             '<input type="hidden" name="region_text_' + region.id + '" value="' + escapeHtml(currentValue) + '" />' +
@@ -417,7 +419,7 @@
       return '<div class="slide-preview-region timetable" style="width:100%;height:100%;overflow:hidden;' + (style.font_family ? 'font-family:' + escapeHtml(style.font_family) + ';' : '') + (style.font_size ? 'font-size:' + Math.max(1, Math.round(Number(style.font_size))) + 'px;' : '') + (style.font_color ? 'color:' + escapeHtml(style.font_color) + ';' : '') + '">' + entries.map(function (entry, index) {
       var entryDate = entry && (entry.start_datetime || entry.end_datetime || entry.date || entry.time || '');
       var timezoneValues = getTimezoneValues(group, entryDate);
-      return '<div class="timetable-region-entry" data-timetable-entry-index="' + index + '">' + sanitizeRichText(renderTemplate(value, Object.assign({}, entry || {}, {
+      return '<div class="timetable-region-entry" data-timetable-entry-index="' + index + '">' + (utils.sanitizeRichText ? utils.sanitizeRichText(renderTemplate(value, Object.assign({}, entry || {}, {
         start: entry && entry.start_datetime !== undefined ? entry.start_datetime : '',
         end: entry && entry.end_datetime !== undefined ? entry.end_datetime : '',
         tz: timezoneValues.tz,
@@ -426,7 +428,16 @@
         group: group || {},
         entries: entries,
         index: index + 1
-      }))) + '</div>';
+      }))) : escapeHtml(renderTemplate(value, Object.assign({}, entry || {}, {
+        start: entry && entry.start_datetime !== undefined ? entry.start_datetime : '',
+        end: entry && entry.end_datetime !== undefined ? entry.end_datetime : '',
+        tz: timezoneValues.tz,
+        tz_long: timezoneValues.tz_long,
+        timeZone: timezoneValues.tz_long,
+        group: group || {},
+        entries: entries,
+        index: index + 1
+      })))) + '</div>';
     }).join('') + '</div>';
   }
 

src/web/public/js/regions/type/webpage.js

@@ -8,9 +8,34 @@
     return utils.escapeHtml ? utils.escapeHtml(value) : String(value === undefined || value === null ? '' : value);
   }
 
-  function renderPreview(value) {
+  function normalizePreviewValue(value) {
-    var content = value && typeof value === 'object' && value.value !== undefined ? value : null;
+    if (value && typeof value === 'object') {
-    var src = String(content ? content.value : value || '').trim();
+      if (value.value !== undefined) {
+        return normalizePreviewValue(value.value);
+      }
+      if (value.text !== undefined) {
+        return normalizePreviewValue(value.text);
+      }
+      if (value.url !== undefined) {
+        return normalizePreviewValue(value.url);
+      }
+      if (value.href !== undefined) {
+        return normalizePreviewValue(value.href);
+      }
+      if (value.src !== undefined) {
+        return normalizePreviewValue(value.src);
+      }
+      if (value.content !== undefined) {
+        return normalizePreviewValue(value.content);
+      }
+      return '';
+    }
+
+    return String(value === undefined || value === null ? '' : value);
+  }
+
+  function renderPreview(region, value) {
+    var src = normalizePreviewValue(value !== undefined ? value : region).trim();
     if (!src) {
       return '<div class="slide-preview-placeholder">Webpage</div>';
     }
@@ -24,7 +49,10 @@
       region: region,
       headerActions: '<span class="chip">Webpage</span>',
       bodyHtml: '' +
-        '<input type="url" name="region_webpage_' + region.id + '" class="form-control" value="' + escapeHtml(current) + '" placeholder="https://example.com" />'
+        '<div class="input-group flex-nowrap">' +
+          '<input type="url" name="region_webpage_' + region.id + '" class="form-control" value="' + escapeHtml(current) + '" placeholder="https://example.com" />' +
+          '<button type="button" class="btn btn-outline-secondary text-nowrap" data-webpage-preview-update data-region-id="' + region.id + '">Update</button>' +
+        '</div>'
     });
   }
 

src/web/public/js/slides/slide-form-editor.js

@@ -8,9 +8,25 @@ export function createSlideFormEditorController(options) {
   var fontStylesheetHref = String(settings.fontStylesheetHref || '').trim();
   var defaultEditorFontFamily = 'Arial, Helvetica, sans-serif';
   var editorInstances = new Map();
+  var editorHeights = new Map();
+  var editorSizeControlsBound = false;
   var getRegionTypeModule = typeof settings.getRegionTypeModule === 'function' ? settings.getRegionTypeModule : function () {
     return null;
   };
+  var imageUploadUrl = String(settings.imageUploadUrl || '/slides/uploads').trim() || '/slides/uploads';
+  var imageUploadMaxBytes = Math.max(1, Number(settings.imageUploadMaxBytes || 2 * 1024 * 1024));
+  var imageUploadLimitLabel = String(settings.imageUploadLimitLabel || '').trim() || Math.max(1, Math.round(imageUploadMaxBytes / (1024 * 1024))) + ' MB';
+  var imageUploadContext = String(settings.imageUploadContext || 'wysiwyg').trim() || 'wysiwyg';
+  var imageUploadAllowedExtensions = ['png', 'jpg', 'jpeg', 'gif', 'webp', 'svg'];
+  var imageUploadAllowedMimeTypes = ['image/png', 'image/jpeg', 'image/gif', 'image/webp', 'image/svg+xml'];
+  var imageUploadFileTypes = imageUploadAllowedExtensions.join(',');
+  var wysiwygEditorHeightStep = Math.max(1, Number(settings.wysiwygEditorHeightStep || 80));
+  var wysiwygEditorHeightMin = Math.max(1, Number(settings.wysiwygEditorHeightMin || 240));
+  var wysiwygEditorHeightMax = Math.max(wysiwygEditorHeightMin, Number(settings.wysiwygEditorHeightMax || 960));
+  var wysiwygEditorHeightDefault = Math.max(wysiwygEditorHeightMin, Number(settings.wysiwygEditorHeightDefault || 360));
+  var editorImageUploadPaths = new Set();
+  var committedEditorImageUploadPaths = new Set();
+  var pendingEditorImageUploadCleanupPaths = new Set();
   var getEditorBackgroundColor = typeof settings.getEditorBackgroundColor === 'function' ? settings.getEditorBackgroundColor : function () {
     return '#111111';
   };
@@ -29,6 +45,10 @@ export function createSlideFormEditorController(options) {
       return true;
     }
 
+    if (/<img\b/i.test(raw)) {
+      return false;
+    }
+
     var stripped = raw
       .replace(/<\s*br\s*\/?>/gi, '')
       .replace(/<p[^>]*>(?:\s|&nbsp;|<br\s*\/?>)*<\/p>/gi, '')
@@ -50,6 +70,99 @@ export function createSlideFormEditorController(options) {
     return '';
   }
 
+  function normalizeEditorHeightValue(value) {
+    var numericValue = Number(value);
+    if (!Number.isFinite(numericValue) || numericValue <= 0) {
+      numericValue = wysiwygEditorHeightDefault;
+    }
+
+    return Math.min(wysiwygEditorHeightMax, Math.max(wysiwygEditorHeightMin, Math.round(numericValue)));
+  }
+
+  function getEditorHolder(regionId) {
+    if (!templateFields) {
+      return null;
+    }
+
+    return templateFields.querySelector('.editor-holder[data-region-id="' + regionId + '"]');
+  }
+
+  function getEditorHeight(regionId) {
+    var key = String(regionId || '');
+    var storedHeight = editorHeights.get(key);
+    if (storedHeight !== undefined && storedHeight !== null) {
+      return normalizeEditorHeightValue(storedHeight);
+    }
+
+    var holder = getEditorHolder(key);
+    var holderHeight = holder && holder.dataset ? holder.dataset.editorHeight : '';
+    var normalizedHeight = normalizeEditorHeightValue(holderHeight || wysiwygEditorHeightDefault);
+    editorHeights.set(key, normalizedHeight);
+    return normalizedHeight;
+  }
+
+  function applyEditorHeight(regionId, height, options) {
+    var key = String(regionId || '');
+    var normalizedHeight = normalizeEditorHeightValue(height);
+    var holder = getEditorHolder(key);
+    var editor = editorInstances.get(key);
+    var container = editor && typeof editor.getContainer === 'function' ? editor.getContainer() : null;
+    var shouldRequestPreview = !(options && options.silent);
+
+    editorHeights.set(key, normalizedHeight);
+
+    if (holder) {
+      holder.dataset.editorHeight = String(normalizedHeight);
+      holder.style.height = normalizedHeight + 'px';
+      holder.style.minHeight = normalizedHeight + 'px';
+    }
+
+    if (container) {
+      container.style.height = normalizedHeight + 'px';
+      container.style.minHeight = normalizedHeight + 'px';
+    }
+
+    if (editor && typeof editor.dispatch === 'function') {
+      editor.dispatch('ResizeEditor');
+    }
+
+    if (shouldRequestPreview) {
+      requestPreviewRender();
+    }
+  }
+
+  function adjustEditorHeight(regionId, delta) {
+    applyEditorHeight(regionId, getEditorHeight(regionId) + Number(delta || 0));
+  }
+
+  function bindEditorSizeControls() {
+    if (editorSizeControlsBound || !templateFields) {
+      return;
+    }
+
+    editorSizeControlsBound = true;
+    templateFields.addEventListener('click', function (event) {
+      var button = event.target && typeof event.target.closest === 'function' ? event.target.closest('[data-editor-size-action]') : null;
+      if (!button) {
+        return;
+      }
+
+      var action = String(button.getAttribute('data-editor-size-action') || '').trim();
+      if (action !== 'increase' && action !== 'decrease') {
+        return;
+      }
+
+      var card = typeof button.closest === 'function' ? button.closest('[data-region-id]') : null;
+      var regionId = card ? card.getAttribute('data-region-id') : '';
+      if (!regionId) {
+        return;
+      }
+
+      event.preventDefault();
+      adjustEditorHeight(regionId, action === 'increase' ? wysiwygEditorHeightStep : -wysiwygEditorHeightStep);
+    });
+  }
+
   function getEditorHiddenInput(regionId) {
     if (!templateFields) {
       return null;
@@ -209,6 +322,191 @@ export function createSlideFormEditorController(options) {
       : themeAssets.contentCss;
   }
 
+  function normalizeUploadPath(value) {
+    return String(value || '').trim();
+  }
+
+  function collectEditorImageUploadPaths(html) {
+    var matches = String(html || '').match(/\/media\/uploads\/[^^\s"'<>]+/g);
+    return matches ? Array.from(new Set(matches.map(normalizeUploadPath).filter(Boolean))) : [];
+  }
+
+  function collectCurrentEditorImageUploadPaths() {
+    var currentPaths = new Set();
+
+    editorInstances.forEach(function (editor, regionId) {
+      var hidden = getEditorHiddenInput(regionId);
+      var sourceElm = editor && editor.targetElm ? editor.targetElm : null;
+      var fallbackContent = hidden && hidden.value !== undefined ? hidden.value : (sourceElm && sourceElm.value !== undefined ? sourceElm.value : '');
+      collectEditorImageUploadPaths(getEditorContentSafely(editor, fallbackContent)).forEach(function (path) {
+        currentPaths.add(path);
+      });
+    });
+
+    return currentPaths;
+  }
+
+  function getImageUploadCleanupPaths() {
+    var currentPaths = collectCurrentEditorImageUploadPaths();
+    return Array.from(editorImageUploadPaths).filter(function (path) {
+      return !currentPaths.has(path);
+    });
+  }
+
+  function getCommittedImageUploadCleanupPaths() {
+    var currentPaths = collectCurrentEditorImageUploadPaths();
+    return Array.from(committedEditorImageUploadPaths).filter(function (path) {
+      return !currentPaths.has(path);
+    });
+  }
+
+  function getPendingImageUploadPaths() {
+    return Array.from(editorImageUploadPaths).filter(function (path) {
+      return !committedEditorImageUploadPaths.has(path);
+    });
+  }
+
+  function queueImageUploadCleanupPaths(paths) {
+    Array.from(new Set((paths || []).map(normalizeUploadPath).filter(Boolean))).forEach(function (path) {
+      pendingEditorImageUploadCleanupPaths.add(path);
+    });
+  }
+
+  function getPendingImageUploadCleanupPaths() {
+    var currentPaths = collectCurrentEditorImageUploadPaths();
+    return Array.from(pendingEditorImageUploadCleanupPaths).filter(function (path) {
+      return !currentPaths.has(path);
+    });
+  }
+
+  function markImageUploadsCommitted() {
+    committedEditorImageUploadPaths = collectCurrentEditorImageUploadPaths();
+  }
+
+  function getAllImageUploadPaths() {
+    return Array.from(editorImageUploadPaths);
+  }
+
+  function clearImageUploadPaths() {
+    editorImageUploadPaths.clear();
+    committedEditorImageUploadPaths.clear();
+    pendingEditorImageUploadCleanupPaths.clear();
+  }
+
+  function getFileExtension(fileName) {
+    var match = String(fileName || '').toLowerCase().match(/\.([a-z0-9]+)$/);
+    return match ? String(match[1] || '') : '';
+  }
+
+  function getImageUploadValidationMessage(blobInfo) {
+    var blob = blobInfo && typeof blobInfo.blob === 'function' ? blobInfo.blob() : null;
+    var fileName = blobInfo && typeof blobInfo.filename === 'function' ? String(blobInfo.filename() || '') : '';
+    var mimeType = blob && blob.type ? String(blob.type || '').trim().toLowerCase() : '';
+    var extension = getFileExtension(fileName);
+
+    if (!blob) {
+      return 'No image file was provided.';
+    }
+
+    if (Number(blob.size || 0) > imageUploadMaxBytes) {
+      return 'Image must be ' + imageUploadLimitLabel + ' or smaller. Larger images should use the dedicated Image region.';
+    }
+
+    if (mimeType && imageUploadAllowedMimeTypes.indexOf(mimeType) === -1) {
+      return 'This editor accepts PNG, JPG, GIF, WebP, or SVG images.';
+    }
+
+    if (!mimeType && extension && imageUploadAllowedExtensions.indexOf(extension) === -1) {
+      return 'This editor accepts PNG, JPG, GIF, WebP, or SVG images.';
+    }
+
+    if (!mimeType && !extension) {
+      return 'This editor accepts PNG, JPG, GIF, WebP, or SVG images.';
+    }
+
+    return '';
+  }
+
+  function uploadEditorImage(blobInfo, progress) {
+    var validationError = getImageUploadValidationMessage(blobInfo);
+    if (validationError) {
+      return Promise.reject(new Error(validationError));
+    }
+
+    return new Promise(function (resolve, reject) {
+      var xhr = new XMLHttpRequest();
+      var formData = new FormData();
+      var blob = blobInfo.blob();
+      var fileName = typeof blobInfo.filename === 'function' ? String(blobInfo.filename() || 'image') : 'image';
+
+      formData.append('file', blob, fileName);
+
+      xhr.open('POST', imageUploadUrl, true);
+      xhr.responseType = 'text';
+      xhr.withCredentials = true;
+      xhr.setRequestHeader('X-Requested-With', 'XMLHttpRequest');
+      xhr.setRequestHeader('Accept', 'application/json, text/plain, */*');
+      xhr.setRequestHeader('X-Upload-Context', imageUploadContext);
+
+      xhr.upload.onprogress = function (event) {
+        if (!progress) {
+          return;
+        }
+
+        if (!event || !event.lengthComputable || !event.total) {
+          progress(0);
+          return;
+        }
+
+        progress(Math.round((event.loaded / event.total) * 100));
+      };
+
+      xhr.onload = function () {
+        var responseText = String(xhr.responseText || '');
+        if (xhr.status < 200 || xhr.status >= 300) {
+          reject(new Error(responseText || 'Unable to upload image.'));
+          return;
+        }
+
+        if (responseText.trim().toLowerCase().indexOf('<!doctype html') === 0 || responseText.toLowerCase().indexOf('<html') !== -1) {
+          reject(new Error('Upload redirected to an HTML page. Please sign in again and retry.'));
+          return;
+        }
+
+        var payload = {};
+        try {
+          payload = JSON.parse(responseText || '{}') || {};
+        } catch (_error) {
+          reject(new Error('Unable to parse the upload response.'));
+          return;
+        }
+
+        if (!payload.path) {
+          reject(new Error('Unable to upload image.'));
+          return;
+        }
+
+        if (progress) {
+          progress(100);
+        }
+
+        editorImageUploadPaths.add(String(payload.path || '').trim());
+
+        resolve(String(payload.path || ''));
+      };
+
+      xhr.onerror = function () {
+        reject(new Error('Unable to upload image.'));
+      };
+
+      xhr.ontimeout = function () {
+        reject(new Error('Upload timed out. Please try again.'));
+      };
+
+      xhr.send(formData);
+    });
+  }
+
   function attachEditorEvents(regionId, editor) {
     var hidden = getEditorHiddenInput(regionId);
     var source = editor && editor.targetElm ? editor.targetElm : null;
@@ -271,6 +569,8 @@ export function createSlideFormEditorController(options) {
       source.id = 'slide-editor-region-' + regionId;
     }
 
+    applyEditorHeight(regionId, getEditorHeight(regionId), { silent: true });
+
     function registerInlineFormat(editor, formatName, styles) {
       editor.formatter.register(formatName, {
         inline: 'span',
@@ -305,16 +605,29 @@ export function createSlideFormEditorController(options) {
       menubar: false,
       branding: false,
       promotion: false,
+      relative_urls: false,
+      remove_script_host: false,
+      convert_urls: true,
       paste_data_images: false,
-      plugins: 'lists code advlist fullscreen table',
+      automatic_uploads: true,
-      toolbar: 'undo redo | fontfamily fontsizeinput | forecolor backcolor bold italic underlineformats removeformat | align lineheight indent outdent bullist numlist table chip | fullscreen',
+      images_file_types: imageUploadFileTypes,
+      images_upload_handler: uploadEditorImage,
+      plugins: 'lists code advlist fullscreen table image',
+      toolbar: 'undo redo | fontfamily fontsizeinput | forecolor backcolor bold italic underlineformats removeformat | align lineheight indent outdent bullist numlist table image chip | fullscreen',
       toolbar_mode: 'sliding',
       license_key: 'gpl',
+      height: getEditorHeight(regionId),
+      min_height: wysiwygEditorHeightMin,
+      table_default_attributes: {
+        border: '1',
+        cellpadding: '0',
+        cellspacing: '0'
+      },
       skin: themeAssets.skinName,
       skin_url: themeAssets.skinUrl,
       content_css: getContentCss(),
       body_class: themeAssets.bodyClass,
-      content_style: 'body { font-family: ' + defaultEditorFontFamily + '; font-size: 32px; line-height: 1.5; background-color: ' + getEditorBackgroundColorValue() + '; } p { margin: 1em 0; } p:first-child { margin-top: 0; } p:last-child { margin-bottom: 1em; } table { border-collapse: collapse; width: 100%; } td, th { border: 1px solid currentColor; padding: 0.35em 0.5em; vertical-align: top; } th { font-weight: 700; }' + (editorContentStyle ? ' ' + editorContentStyle : ''),
+      content_style: 'body { font-family: ' + defaultEditorFontFamily + '; font-size: 32px; line-height: 1.5; background-color: ' + getEditorBackgroundColorValue() + '; } p { margin: 1em 0; } p:first-child { margin-top: 0; } p:last-child { margin-bottom: 1em; } table { border-collapse: collapse; border-spacing: 0; width: 100%; } td, th { border: 1px solid currentColor; padding: 0; vertical-align: top; } th { font-weight: 700; }' + (editorContentStyle ? ' ' + editorContentStyle : ''),
       font_family_formats: getFontFamilyFormats(),
       font_size_input_default_unit: 'px',
       invalid_elements: 'a',
@@ -391,9 +704,11 @@ export function createSlideFormEditorController(options) {
       }
 
       editorInstances.set(regionId, editor);
+      applyEditorHeight(regionId, getEditorHeight(regionId), { silent: true });
       if (editor.targetElm) {
         editor.targetElm.value = editor.getContent({ format: 'html' });
       }
+      markImageUploadsCommitted();
       return editor;
     }).catch(function (error) {
       console.error('Failed to initialize TinyMCE.', error);
@@ -406,6 +721,7 @@ export function createSlideFormEditorController(options) {
       return Promise.resolve([]);
     }
 
+    bindEditorSizeControls();
     watchThemeChanges();
 
     var holders = Array.prototype.slice.call(templateFields.querySelectorAll('.editor-holder'));
@@ -431,7 +747,10 @@ export function createSlideFormEditorController(options) {
       return Promise.resolve();
     });
 
-    return Promise.all(saves);
+    return Promise.all(saves).then(function (results) {
+      getCommittedImageUploadCleanupPaths();
+      return results;
+    });
   }
 
   function destroyEditors() {
@@ -469,6 +788,14 @@ export function createSlideFormEditorController(options) {
   return {
     renderEditors: renderEditors,
     syncEditors: syncEditors,
+    getImageUploadCleanupPaths: getImageUploadCleanupPaths,
+    getCommittedImageUploadCleanupPaths: getCommittedImageUploadCleanupPaths,
+    getPendingImageUploadPaths: getPendingImageUploadPaths,
+    getPendingImageUploadCleanupPaths: getPendingImageUploadCleanupPaths,
+    getAllImageUploadPaths: getAllImageUploadPaths,
+    queueImageUploadCleanupPaths: queueImageUploadCleanupPaths,
+    markImageUploadsCommitted: markImageUploadsCommitted,
+    clearImageUploadPaths: clearImageUploadPaths,
     destroyEditors: function () {
       if (themeObserver) {
         themeObserver.disconnect();

src/web/public/js/slides/slide-form.js

@@ -41,6 +41,8 @@ import { createSlideFormPreviewHelpers } from '/assets/js/slides/slide-form-prev
   var uploadMaxLabel = '100 MB';
   var uploadVideoMaxBytes = 1024 * 1024 * 1024;
   var uploadVideoMaxLabel = '1 GB';
+  var wysiwygImageUploadMaxBytes = 2 * 1024 * 1024;
+  var wysiwygImageUploadLimitLabel = '2 MB';
   var videoDurationCache = Object.create(null);
   var previewRenderFrame = 0;
   var previewPopupWindow = null;
@@ -106,6 +108,9 @@ import { createSlideFormPreviewHelpers } from '/assets/js/slides/slide-form-prev
     defaultFontSize: DEFAULT_FONT_SIZE,
     fontFamilyFormats: slideEditorData.fontFamilyFormats || '',
     fontStylesheetHref: fontStylesheetHref,
+    imageUploadMaxBytes: wysiwygImageUploadMaxBytes,
+    imageUploadLimitLabel: wysiwygImageUploadLimitLabel,
+    imageUploadContext: 'wysiwyg',
     getRegionTypeModule: getRegionTypeModule,
     getEditorBackgroundColor: function () {
       var template = getTemplateById(templateSelect.value);
@@ -820,6 +825,16 @@ import { createSlideFormPreviewHelpers } from '/assets/js/slides/slide-form-prev
       });
     });
 
+    templateFields.querySelectorAll('input[type="url"][name^="region_webpage_"]').forEach(function (input) {
+      input.addEventListener('input', function () {
+        templateSelectorLock.markEdited();
+      });
+
+      input.addEventListener('change', function () {
+        templateSelectorLock.markEdited();
+      });
+    });
+
     if (existingTemplateId && hasExistingSlideContent()) {
       templateSelectorLock.arm();
       templateSelectorLock.markEdited();
@@ -875,18 +890,42 @@ import { createSlideFormPreviewHelpers } from '/assets/js/slides/slide-form-prev
 
   templateSelect.addEventListener('change', renderTemplate);
   templateFields.addEventListener('change', function () {
+    var webpageInput = event.target && typeof event.target.matches === 'function' && event.target.matches('input[type="url"][name^="region_webpage_"]');
+    if (webpageInput) {
+      templateSelectorLock.arm();
+      templateSelectorLock.markEdited();
+      return;
+    }
+
     templateSelectorLock.arm();
     templateSelectorLock.markEdited();
     requestPreviewRender();
   });
   templateFields.addEventListener('input', function () {
+    var webpageInput = event.target && typeof event.target.matches === 'function' && event.target.matches('input[type="url"][name^="region_webpage_"]');
+    if (webpageInput) {
+      templateSelectorLock.arm();
+      templateSelectorLock.markEdited();
+      return;
+    }
+
     templateSelectorLock.arm();
     templateSelectorLock.markEdited();
     requestPreviewRender();
   });
   templateFields.addEventListener('click', function (event) {
     var button = event.target && typeof event.target.closest === 'function' ? event.target.closest('[data-api-items-path-reset]') : null;
+    var webpageUpdateButton = event.target && typeof event.target.closest === 'function' ? event.target.closest('[data-webpage-preview-update]') : null;
     if (!button) {
+      if (!webpageUpdateButton) {
+        return;
+      }
+    }
+
+    if (webpageUpdateButton) {
+      templateSelectorLock.arm();
+      templateSelectorLock.markEdited();
+      requestPreviewRender();
       return;
     }
 
@@ -923,6 +962,12 @@ import { createSlideFormPreviewHelpers } from '/assets/js/slides/slide-form-prev
     if (regionMediaController) {
       regionMediaController.queueUploadCleanup(regionMediaController.getPendingUploadCleanupPaths());
     }
+    if (slideFormEditorController && typeof slideFormEditorController.getCommittedImageUploadCleanupPaths === 'function' && regionMediaController) {
+      regionMediaController.queueUploadCleanup(slideFormEditorController.getCommittedImageUploadCleanupPaths());
+    }
+    if (slideFormEditorController && typeof slideFormEditorController.getImageUploadCleanupPaths === 'function' && regionMediaController) {
+      regionMediaController.queueUploadCleanup(slideFormEditorController.getImageUploadCleanupPaths());
+    }
     if (previewPopupWindow && !previewPopupWindow.closed) {
       previewPopupWindow.close();
     }

src/web/public/js/slides/slide-image-cropper.js

@@ -14,6 +14,7 @@
   var currentInput = null;
   var currentFile = null;
   var currentObjectUrl = '';
+  var cropperFrame = modal.querySelector('.slide-image-cropper-frame');
   var flipX = 1;
   var flipY = 1;
   var currentAspectRatio = NaN;
@@ -40,6 +41,12 @@
     status.textContent = String(message || '');
   }
 
+  function setCropperLoading(loading) {
+    if (cropperFrame) {
+      cropperFrame.classList.toggle('is-loading', Boolean(loading));
+    }
+  }
+
   function showModal() {
     if (window.pulseModal && typeof window.pulseModal.show === 'function') {
       window.pulseModal.show(modal);
@@ -79,6 +86,7 @@
   function resetModalState() {
     destroyCropper();
     revokeObjectUrl();
+    setCropperLoading(false);
     currentInput = null;
     currentFile = null;
     flipX = 1;
@@ -118,6 +126,75 @@
     return width / height;
   }
 
+  function isSvgFile(file) {
+    if (!file) {
+      return false;
+    }
+
+    return String(file.type || '').toLowerCase() === 'image/svg+xml' || /\.svg$/i.test(String(file.name || ''));
+  }
+
+  function isGifFile(file) {
+    if (!file) {
+      return false;
+    }
+
+    return String(file.type || '').toLowerCase() === 'image/gif' || /\.gif$/i.test(String(file.name || ''));
+  }
+
+  function isSpecialRasterizationFile(file) {
+    return isSvgFile(file) || isGifFile(file);
+  }
+
+  function getSpecialFileWarning(file) {
+    if (isGifFile(file)) {
+      return 'GIF selected. If you crop, rotate, or flip this image, it will be rasterized and the animation will be lost. Leave the full image selected to keep the original GIF.';
+    }
+
+    return 'SVG selected. If you crop, rotate, or flip this image, it will be rasterized. Leave the full image selected to keep the original SVG.';
+  }
+
+  function isOriginalSpecialSelection() {
+    if (!cropper || !currentFile || !isSpecialRasterizationFile(currentFile) || typeof cropper.getData !== 'function' || typeof cropper.getImageData !== 'function') {
+      return false;
+    }
+
+    var cropData = cropper.getData(true) || {};
+    var imageData = cropper.getImageData() || {};
+    var width = Number(imageData.naturalWidth || 0);
+    var height = Number(imageData.naturalHeight || 0);
+
+    if (!Number.isFinite(width) || !Number.isFinite(height) || width <= 0 || height <= 0) {
+      return false;
+    }
+
+    return Math.abs(Number(cropData.x || 0)) < 0.5 &&
+      Math.abs(Number(cropData.y || 0)) < 0.5 &&
+      Math.abs(Number(cropData.width || 0) - width) < 0.5 &&
+      Math.abs(Number(cropData.height || 0) - height) < 0.5 &&
+      Math.abs(Number(cropData.rotate || 0)) < 0.5 &&
+      Number(cropData.scaleX || 1) === 1 &&
+      Number(cropData.scaleY || 1) === 1;
+  }
+
+  function getRasterizedFileName(sourceName) {
+    var name = String(sourceName || '').trim();
+
+    if (!name) {
+      return 'slide-region-image.png';
+    }
+
+    if (/\.svg$/i.test(name)) {
+      return name.replace(/\.svg$/i, '.png');
+    }
+
+    if (/\.[a-z0-9]+$/i.test(name)) {
+      return name.replace(/\.[a-z0-9]+$/i, '.png');
+    }
+
+    return name + '.png';
+  }
+
   function setActiveRatioButton(value) {
     var targetValue = ratioLabelForValue(value);
     modal.querySelectorAll('[data-slide-image-cropper-action="ratio"]').forEach(function (button) {
@@ -183,6 +260,8 @@
       zoomOnTouch: true,
       zoomOnWheel: true,
       ready: function () {
+        setCropperLoading(false);
+
         if (cropper && cropper.container) {
           cropper.container.style.width = '100%';
           cropper.container.style.height = '560px';
@@ -209,7 +288,10 @@
 
     setButtonState(false);
     setActiveRatioButton(currentAspectRatio === undefined ? 'free' : currentAspectRatio);
-    setStatus('Use the toolbar to crop, rotate, or flip the image before applying it.');
+
+    if (isSpecialRasterizationFile(currentFile)) {
+      setStatus(getSpecialFileWarning(currentFile));
+    }
   }
 
   function openEditor(input, file) {
@@ -220,8 +302,9 @@
     currentAspectRatio = 'free';
     currentRegionAspectRatio = parseAspectRatio(input && input.dataset && input.dataset.slideImageCropperRegionRatio);
     currentRegionAspectRatioLabel = String(input && input.dataset && input.dataset.slideImageCropperRegionRatioLabel || 'Region').trim() || 'Region';
+    setCropperLoading(true);
     setButtonState(true);
-    setStatus('Loading image editor...');
+    setStatus(isSpecialRasterizationFile(file) ? getSpecialFileWarning(file) : '');
 
     modal.querySelectorAll('[data-slide-image-cropper-action="ratio"][data-slide-image-cropper-ratio="region"]').forEach(function (button) {
       button.title = currentRegionAspectRatioLabel ? 'Region ratio ' + currentRegionAspectRatioLabel : 'Region ratio';
@@ -286,11 +369,62 @@
     hideModal();
   }
 
+  function finalizeCurrentSvgSelection() {
+    if (!currentFile) {
+      return;
+    }
+
+    if (isOriginalSpecialSelection()) {
+      finalizeCropFile(currentFile);
+      return;
+    }
+
+    setButtonState(true);
+    setStatus('Creating a rasterized image from the crop...');
+
+    var canvas = cropper && typeof cropper.getCroppedCanvas === 'function' ? cropper.getCroppedCanvas({
+      fillColor: 'transparent',
+      imageSmoothingEnabled: true,
+      imageSmoothingQuality: 'high'
+    }) : null;
+
+    if (!canvas) {
+      setStatus('Unable to create the cropped image.');
+      setButtonState(false);
+      return;
+    }
+
+    canvas.toBlob(function (blob) {
+      if (!blob) {
+        setStatus('Unable to create the cropped image.');
+        setButtonState(false);
+        return;
+      }
+
+      var finalFile = new File([blob], getRasterizedFileName(currentFile.name), {
+        lastModified: Date.now(),
+        type: blob.type || 'image/png'
+      });
+
+      finalizeCropFile(finalFile);
+    }, 'image/png');
+  }
+
   function commitCrop() {
     if (!currentInput || !currentFile) {
       return;
     }
 
+    if (isSpecialRasterizationFile(currentFile)) {
+      if (!cropper) {
+        finalizeCropFile(currentFile);
+        return;
+      }
+
+      finalizeCurrentSvgSelection();
+      return;
+    }
+
     if (!cropper) {
       finalizeCropFile(currentFile);
       return;
@@ -381,7 +515,7 @@
       return;
     }
 
-    if (!/^image\//i.test(file.type || '')) {
+    if (!/^image\//i.test(file.type || '') && !/\.svg$/i.test(String(file.name || ''))) {
       input.value = '';
       return;
     }

src/web/routes/admin/content.js

@@ -33,6 +33,7 @@ module.exports = function registerContentRoutes(app, deps) {
   const { buildDuplicateCanvasSizeName, buildDuplicateCanvasSize } = require('#src/web/routes/signage/canvas-sizes/duplicate');
 
   const LIST_PAGE_SIZE = 25;
+  const WYSIWYG_IMAGE_UPLOAD_MAX_BYTES = 2 * 1024 * 1024;
   const IMAGE_UPLOAD_MAX_BYTES = 100 * 1024 * 1024;
   const VIDEO_UPLOAD_MAX_BYTES = 1024 * 1024 * 1024;
 
@@ -104,24 +105,38 @@ module.exports = function registerContentRoutes(app, deps) {
     next(error);
   }
 
-  function getUploadedFileMediaType(file) {
+  function getUploadedFileMediaType(file, uploadContext) {
     const mimeType = String(file && file.mimetype || '').trim().toLowerCase();
     const extension = path.extname(String(file && file.originalname || '')).toLowerCase();
+    const isWysiwyg = String(uploadContext || '').trim().toLowerCase() === 'wysiwyg';
+
+    if (isWysiwyg && mimeType.indexOf('image/') !== 0 && ['.png', '.jpg', '.jpeg', '.gif', '.webp', '.svg'].indexOf(extension) === -1) {
+      return null;
+    }
+
     if (mimeType.indexOf('video/') === 0 || ['.mp4', '.webm', '.ogg', '.ogv', '.mov', '.avi', '.mkv'].indexOf(extension) !== -1) {
       return 'video';
     }
-    if (mimeType.indexOf('image/') === 0 || ['.png', '.jpg', '.jpeg', '.gif', '.webp', '.bmp', '.avif', '.tif', '.tiff'].indexOf(extension) !== -1) {
+    if (mimeType.indexOf('image/') === 0 || ['.png', '.jpg', '.jpeg', '.gif', '.webp', '.svg'].indexOf(extension) !== -1) {
       return 'image';
     }
     return null;
   }
 
-  function getUploadedFileLimitBytes(file) {
+  function getUploadedFileLimitBytes(file, uploadContext) {
-    return getUploadedFileMediaType(file) === 'video' ? VIDEO_UPLOAD_MAX_BYTES : IMAGE_UPLOAD_MAX_BYTES;
+    if (String(uploadContext || '').trim().toLowerCase() === 'wysiwyg') {
+      return WYSIWYG_IMAGE_UPLOAD_MAX_BYTES;
+    }
+
+    return getUploadedFileMediaType(file, uploadContext) === 'video' ? VIDEO_UPLOAD_MAX_BYTES : IMAGE_UPLOAD_MAX_BYTES;
   }
 
-  function getUploadedFileLimitLabel(file) {
+  function getUploadedFileLimitLabel(file, uploadContext) {
-    return getUploadedFileMediaType(file) === 'video' ? '1 GB' : '100 MB';
+    if (String(uploadContext || '').trim().toLowerCase() === 'wysiwyg') {
+      return '10 MB';
+    }
+
+    return getUploadedFileMediaType(file, uploadContext) === 'video' ? '1 GB' : '100 MB';
   }
 
   async function removeUploadedFile(file) {
@@ -137,11 +152,11 @@ module.exports = function registerContentRoutes(app, deps) {
     }
   }
 
-  async function validateUploadedFiles(files) {
+  async function validateUploadedFiles(files, uploadContext) {
     const list = Array.isArray(files) ? files.filter(Boolean) : [];
     for (let i = 0; i < list.length; i += 1) {
       const file = list[i];
-      const mediaType = getUploadedFileMediaType(file);
+      const mediaType = getUploadedFileMediaType(file, uploadContext);
       if (!mediaType) {
         await removeUploadedFile(file);
         const error = new Error('Unsupported upload type.');
@@ -150,9 +165,11 @@ module.exports = function registerContentRoutes(app, deps) {
         throw error;
       }
 
-      if (Number(file.size || 0) > getUploadedFileLimitBytes(file)) {
+      if (Number(file.size || 0) > getUploadedFileLimitBytes(file, uploadContext)) {
         await removeUploadedFile(file);
-        const error = new Error('File must be ' + getUploadedFileLimitLabel(file) + ' or smaller.');
+        const error = new Error(String(uploadContext || '').trim().toLowerCase() === 'wysiwyg'
+          ? 'Image must be 2 MB or smaller. Larger images should use the dedicated Image region.'
+          : 'File must be ' + getUploadedFileLimitLabel(file, uploadContext) + ' or smaller.');
         error.statusCode = 400;
         error.expose = true;
         throw error;
@@ -376,7 +393,9 @@ module.exports = function registerContentRoutes(app, deps) {
         return res.status(400).json({ error: 'No file was uploaded.' });
       }
 
-      await validateUploadedFiles([req.file]);
+      const uploadContext = String(req.get('X-Upload-Context') || req.query.context || '').trim().toLowerCase();
+
+      await validateUploadedFiles([req.file], uploadContext);
 
       res.json({
         path: '/media/uploads/' + req.file.filename,

src/web/routes/admin/manage.js

@@ -26,10 +26,6 @@ module.exports = function registerManageRoutes(app, deps) {
     return text.slice(0, limit);
   }
 
-  function normalizeBaseUrl(value) {
-    return String(value || '').trim().replace(/\/$/, '');
-  }
-
   function normalizeExplicitPlayerBaseUrl(value) {
     return String(value || '').trim().replace(/\/$/, '');
   }
@@ -246,39 +242,24 @@ module.exports = function registerManageRoutes(app, deps) {
       if (await common.fetchDuplicateName(pool, 'd_screens', name, screen.id)) {
         return res.status(400).send('A screen with that name already exists.');
       }
-      const slugInput = typeof common.validateMaxLength === 'function'
-        ? common.validateMaxLength(req.body.slug || '', SCREEN_SLUG_MAX_LENGTH, 'Screen URL')
-        : readLimitedText(req.body.slug || '', 255);
       const playlistId = req.body.playlist_id ? Number(req.body.playlist_id) : null;
       const previousPlaylistId = screen.playlist_id;
-      const slug = await common.uniqueScreenSlug(pool, common.slugify(slugInput || name), screen.id);
+      const slug = String(screen.slug || '').trim();
       const previousSlug = String(screen.slug || '').trim();
       await pool.query('UPDATE d_screens SET name = ?, slug = ?, playlist_id = ?, modified_by = ? WHERE id = ?', [name, slug, playlistId, getAuditUserId(req), screen.id]);
       if (previousPlaylistId !== playlistId && previousSlug) {
         await notifyPlayerScreens([previousSlug], 'refresh');
       }
       if (previousSlug && previousSlug !== slug) {
-        const previousScreenTargets = await pool.query(
+        const previousConnections = await fetchLiveConnectionsForScreen(previousSlug);
-          `SELECT s.slug, s.player_id, p.public_base_url, p.internal_base_url
+        const redirectPayload = {
-           FROM d_screens s
+          command: 'redirect',
-           LEFT JOIN d_players p ON p.device_id = s.player_id
+          url: `/screen/${encodeURIComponent(slug)}`
-           WHERE s.slug = ?
+        };
-           LIMIT 1`,
+        if (previousConnections.length) {
-          [previousSlug]
+          await forwardPlayerCommandForConnections(previousSlug, previousConnections, redirectPayload);
-        );
-        const previousTargetRow = previousScreenTargets[0] && previousScreenTargets[0][0] || null;
-        const previousInternalBaseUrl = normalizeBaseUrl(previousTargetRow && previousTargetRow.internal_base_url) || '';
-        const previousPublicBaseUrl = normalizeBaseUrl(previousTargetRow && previousTargetRow.public_base_url) || '';
-        if (previousInternalBaseUrl && typeof forwardPlayerCommandToBaseUrl === 'function') {
-          await forwardPlayerCommandToBaseUrl(previousInternalBaseUrl, previousSlug, {
-            command: 'redirect',
-            url: previousPublicBaseUrl ? `${previousPublicBaseUrl}/screen/${encodeURIComponent(slug)}` : `/screen/${encodeURIComponent(slug)}`
-          });
         } else {
-          await forwardPlayerCommand(previousSlug, {
+          await forwardPlayerCommand(previousSlug, redirectPayload);
-            command: 'redirect',
-            url: previousPublicBaseUrl ? `${previousPublicBaseUrl}/screen/${encodeURIComponent(slug)}` : `/screen/${encodeURIComponent(slug)}`
-          });
         }
       }
       redirectAfterSave(req, res, '/screens?edit=' + screen.id, {

src/web/routes/data-sources/api-sources/list.js

@@ -13,10 +13,13 @@ function toIsoTimestamp(value) {
 
 function formatIntervalLabel(interval, unit) {
   const value = Math.max(1, Number(interval) || 0);
-  const normalizedUnit = String(unit || 'minutes').trim().toLowerCase() === 'seconds' ? 'seconds' : 'minutes';
+  const normalizedUnit = String(unit || 'minutes').trim().toLowerCase();
   if (normalizedUnit === 'seconds') {
     return value === 1 ? 'Every second' : `Every ${value} seconds`;
   }
+  if (normalizedUnit === 'hours') {
+    return value === 1 ? 'Every hour' : `Every ${value} hours`;
+  }
   return value === 1 ? 'Every minute' : `Every ${value} minutes`;
 }
 

src/web/routes/data-sources/api-sources/routes.js

@@ -105,7 +105,9 @@ module.exports = function registerApiSourceRoutes(app, deps) {
           itemsPath: apiSource.items_path || '',
           intervalLabel: apiSource.update_interval_unit === 'seconds'
             ? (Math.max(1, Number(apiSource.update_interval_value) || 0) === 1 ? 'Every second' : `Every ${Math.max(1, Number(apiSource.update_interval_value) || 0)} seconds`)
-            : (Math.max(1, Number(apiSource.update_interval_value) || 0) === 1 ? 'Every minute' : `Every ${Math.max(1, Number(apiSource.update_interval_value) || 0)} minutes`),
+            : apiSource.update_interval_unit === 'hours'
+              ? (Math.max(1, Number(apiSource.update_interval_value) || 0) === 1 ? 'Every hour' : `Every ${Math.max(1, Number(apiSource.update_interval_value) || 0)} hours`)
+              : (Math.max(1, Number(apiSource.update_interval_value) || 0) === 1 ? 'Every minute' : `Every ${Math.max(1, Number(apiSource.update_interval_value) || 0)} minutes`),
           lastPullLabel: apiSource.last_pulled_at ? formatDashboardDate(apiSource.last_pulled_at) : 'Never',
           lastPulledAtValue: apiSource.last_pulled_at ? new Date(apiSource.last_pulled_at).toISOString() : '',
           inUse: usageIds.has(Number(apiSource.id))

src/web/routes/data-sources/rss-feeds/list.js

@@ -4,10 +4,13 @@ const { renderView } = require('../../../view');
 
 function formatIntervalLabel(interval, unit) {
   const value = Math.max(1, Number(interval) || 0);
-  const normalizedUnit = String(unit || 'minutes').trim().toLowerCase() === 'seconds' ? 'seconds' : 'minutes';
+  const normalizedUnit = String(unit || 'minutes').trim().toLowerCase();
   if (normalizedUnit === 'seconds') {
     return value === 1 ? 'Every second' : `Every ${value} seconds`;
   }
+  if (normalizedUnit === 'hours') {
+    return value === 1 ? 'Every hour' : `Every ${value} hours`;
+  }
   return value === 1 ? 'Every minute' : `Every ${value} minutes`;
 }
 

src/web/routes/settings/background-tasks-page.js

@@ -17,6 +17,14 @@ const DATE_FILTER_FIELDS = {
 
 function formatIntervalLabel(intervalMs) {
   const value = Math.max(1, Number(intervalMs) || 0);
+  if (value % 86400000 === 0) {
+    const days = Math.max(1, value / 86400000);
+    return days === 1 ? 'Every day' : `Every ${days} days`;
+  }
+  if (value % 3600000 === 0) {
+    const hours = Math.max(1, value / 3600000);
+    return hours === 1 ? 'Every hour' : `Every ${hours} hours`;
+  }
   if (value % 60000 === 0) {
     const minutes = Math.max(1, value / 60000);
     return minutes === 1 ? 'Every minute' : `Every ${minutes} minutes`;

src/web/routes/settings/fonts.js

@@ -3,6 +3,10 @@
 const fs = require('fs');
 const { hasAnyPermission, PERMISSION_DENIED_MESSAGE } = require('#src/rbac');
 const fontLibrary = require('#src/web/lib/media/font-library');
+const { buildPagination } = require('../../lib/pagination');
+const { createSearchMatcher, getSearchQuery, getSortDirectionQuery, getSortQuery, parsePageNumber, sortRows } = require('../../lib/list-query');
+
+const LIST_PAGE_SIZE = 25;
 
 function normalizeFontFamilyName(value) {
   return String(value || '').replace(/\s+/g, ' ').trim().toLowerCase();
@@ -43,6 +47,48 @@ async function isFontUsed(pool, family) {
   return Number(rows && rows[0] && rows[0].match_count) > 0;
 }
 
+async function buildFontsPageData(pool, uploadDir, req, common) {
+  const library = fontLibrary.loadFontLibrary(uploadDir);
+  const usedFamilies = await fetchUsedFontFamilies(pool, library.fonts);
+  const search = common && typeof common.getSearchQuery === 'function' ? common.getSearchQuery(req) : getSearchQuery(req);
+  const sort = common && typeof common.getSortQuery === 'function' ? common.getSortQuery(req) : getSortQuery(req);
+  const direction = common && typeof common.getSortDirectionQuery === 'function' ? common.getSortDirectionQuery(req) : getSortDirectionQuery(req);
+  const searchableFonts = sortRows(library.fonts.map(function (font) {
+    const family = normalizeFontFamilyName(font.family || font.name);
+    return Object.assign({}, font, {
+      inUse: usedFamilies.has(family)
+    });
+  }), function (font) {
+    if (sort === 'file') {
+      return String(font && font.fileName || '').trim();
+    }
+    if (sort === 'format') {
+      return String(font && font.format || '').trim();
+    }
+    if (sort === 'status') {
+      return font && font.enabled ? 'Enabled' : 'Disabled';
+    }
+
+    return String(font && font.family || font && font.name || '').trim();
+  }, direction).filter(createSearchMatcher(search, [
+    'family',
+    'name',
+    'fileName',
+    'format',
+    function (font) {
+      return font && font.enabled ? 'enabled' : 'disabled';
+    }
+  ]));
+  const pagination = buildPagination(searchableFonts.length, parsePageNumber(req && req.query && req.query.page), 'page', { search: search, sort: sort, direction: direction }, LIST_PAGE_SIZE, 'fonts', 'Font pages');
+  const startIndex = (pagination.currentPage - 1) * LIST_PAGE_SIZE;
+
+  return {
+    fonts: searchableFonts.slice(startIndex, startIndex + LIST_PAGE_SIZE),
+    pagination: pagination,
+    stylesheetHref: library.stylesheetHref
+  };
+}
+
 function redirectToLogin(res, setAuthMessageCookie) {
   if (typeof setAuthMessageCookie === 'function') {
     setAuthMessageCookie(res, 'Please sign in to continue.');
@@ -71,6 +117,7 @@ function requireFontsAccess(setAuthMessageCookie) {
 
 module.exports = function registerFontRoutes(app, deps) {
   const pool = deps.pool;
+  const common = deps.common || {};
   const pages = deps.pages;
   const upload = deps.upload;
   const uploadDir = deps.uploadDir;
@@ -85,18 +132,8 @@ module.exports = function registerFontRoutes(app, deps) {
 
   app.get('/settings/fonts', requireFontsAccess(setAuthMessageCookie), async function (req, res, next) {
     try {
-      const library = fontLibrary.loadFontLibrary(uploadDir);
+      const data = await buildFontsPageData(pool, uploadDir, req, common);
-      const usedFamilies = await fetchUsedFontFamilies(pool, library.fonts);
+      res.send(pages.renderFontsPage(data, req.query.message ? String(req.query.message) : '', req.currentUser));
-      const fonts = library.fonts.map(function (font) {
-        const family = normalizeFontFamilyName(font.family || font.name);
-        return Object.assign({}, font, {
-          inUse: usedFamilies.has(family)
-        });
-      });
-      res.send(pages.renderFontsPage({
-        fonts: fonts,
-        stylesheetHref: library.stylesheetHref
-      }, req.query.message ? String(req.query.message) : '', req.currentUser));
     } catch (error) {
       next(error);
     }
@@ -132,19 +169,9 @@ module.exports = function registerFontRoutes(app, deps) {
       }
 
       if (error && /already exists/i.test(String(error.message || ''))) {
-        const library = fontLibrary.loadFontLibrary(uploadDir);
+        const data = await buildFontsPageData(pool, uploadDir, req, common);
-        const usedFamilies = await fetchUsedFontFamilies(pool, library.fonts);
-        const fonts = library.fonts.map(function (font) {
-          const family = normalizeFontFamilyName(font.family || font.name);
-          return Object.assign({}, font, {
-            inUse: usedFamilies.has(family)
-          });
-        });
 
-        return res.status(400).send(pages.renderFontsPage({
+        return res.status(400).send(pages.renderFontsPage(data, String(error.message || 'Font already exists.'), req.currentUser));
-          fonts: fonts,
-          stylesheetHref: library.stylesheetHref
-        }, String(error.message || 'Font already exists.'), req.currentUser));
       }
 
       next(error);

src/web/routes/settings/fonts/list.js

@@ -9,6 +9,7 @@ module.exports = function renderFontsPage(data, message, currentUser) {
     message: message,
     currentUser: currentUser || null,
     fonts: data.fonts || [],
+    pagination: data.pagination || null,
     stylesheetHref: data.stylesheetHref || ''
   });
 };

src/web/views/data-sources/api-sources/form.hbs

@@ -90,6 +90,7 @@
             <select id="api-source-interval-unit" name="update_interval_unit" class="form-select">
               <option value="seconds" {{#if (eq apiSource.updateIntervalUnit 'seconds')}}selected{{/if}}>Seconds</option>
               <option value="minutes" {{#if (eq apiSource.updateIntervalUnit 'minutes')}}selected{{/if}}>Minutes</option>
+              <option value="hours" {{#if (eq apiSource.updateIntervalUnit 'hours')}}selected{{/if}}>Hours</option>
             </select>
           </div>
         </div>

src/web/views/data-sources/rss-feeds/form.hbs

@@ -29,6 +29,7 @@
           <select id="rss-feed-interval-unit" name="update_interval_unit" class="form-select">
             <option value="seconds" {{#if (eq rssFeed.updateIntervalUnit 'seconds')}}selected{{/if}}>Seconds</option>
             <option value="minutes" {{#if (eq rssFeed.updateIntervalUnit 'minutes')}}selected{{/if}}>Minutes</option>
+            <option value="hours" {{#if (eq rssFeed.updateIntervalUnit 'hours')}}selected{{/if}}>Hours</option>
           </select>
         </div>
         <div class="col-12 col-md-4">

src/web/views/settings/fonts/list.hbs

@@ -5,82 +5,91 @@
   </div>
 </div>
 
-<div class="row g-3">
+<div class="card card-outline card-primary mb-4">
-  <div class="col-12 col-xl-4">
+  <div class="card-header">
-    <div class="card card-outline card-primary">
+    <h3 class="card-title">Upload font</h3>
-      <div class="card-header">
+  </div>
-        <h3 class="card-title">Upload font</h3>
+  <style>
-      </div>
+    .font-upload-form .invalid-feedback {
-      <form method="post" action="/settings/fonts" enctype="multipart/form-data">
+      display: none !important;
-        <div class="card-body d-flex flex-column gap-3 pb-0">
+    }
-          <div>
+  </style>
-            <label for="font-family" class="form-label">Font family name</label>
+  <form method="post" action="/settings/fonts" enctype="multipart/form-data" class="font-upload-form">
-            <input id="font-family" name="font_family" class="form-control" maxlength="128" data-limit-text-length placeholder="Acme Sans" required />
+    <div class="card-body">
-          </div>
+      <div class="row g-3 align-items-end">
-          <div>
+        <div class="col-12 col-lg-5">
-            <label for="font-file" class="form-label">Font file</label>
+        <input id="font-family" name="font_family" class="form-control" maxlength="128" data-limit-text-length placeholder="Acme Sans" required />
-            <input id="font-file" name="font_file" type="file" class="form-control" accept=".woff2,.woff,.ttf,.otf" required />
+        </div>
-          </div>
+        <div class="col-12 col-lg-5">
+        <input id="font-file" name="font_file" type="file" class="form-control" accept=".woff2,.woff,.ttf,.otf" aria-label="Font file" required />
+        </div>
+        <div class="col-12 col-lg-2 d-grid">
           <button type="submit" class="btn btn-primary">Upload font</button>
         </div>
-      </form>
+      </div>
+      <div class="text-muted small mt-3">Accepted formats: WOFF2, WOFF, TTF, and OTF.</div>
     </div>
-  </div>
+  </form>
+</div>
 
-  <div class="col-12 col-xl-8">
+<div class="card card-outline card-primary" data-table-search-container data-table-pagination-card>
-    <div class="card card-outline card-primary">
+  <div class="card-header">
-      <div class="card-header">
+    <h3 class="card-title">Managed fonts</h3>
-        <h3 class="card-title">Managed fonts</h3>
+    <div class="card-tools d-flex flex-nowrap align-items-center gap-2">
-      </div>
+      <div class="input-group input-group-sm flex-shrink-1" style="width: min(14rem, 100%);">
-      <div class="table-responsive fonts-table-responsive">
+        <span class="input-group-text" aria-hidden="true"><i class="bi bi-search"></i></span>
-        <table class="table table-striped align-middle mb-0">
+        <input type="search" class="form-control" placeholder="Search fonts" aria-label="Search fonts" data-table-search />
-          <thead>
-            <tr>
-              <th>Family</th>
-              <th>File</th>
-              <th>Format</th>
-              <th>Status</th>
-              <th>Actions</th>
-            </tr>
-          </thead>
-          <tbody>
-            {{#if fonts.length}}
-              {{#each fonts}}
-                <tr>
-                  <td class="fw-semibold">{{family}}</td>
-                  <td class="text-break">{{fileName}}</td>
-                  <td>{{format}}</td>
-                  <td>
-                    {{#if enabled}}
-                      <span class="badge text-bg-success">Enabled</span>
-                    {{else}}
-                      <span class="badge text-bg-secondary">Disabled</span>
-                    {{/if}}
-                  </td>
-                  <td class="text-nowrap">
-                    <form method="post" action="/settings/fonts/{{id}}/toggle" class="d-inline">
-                      <input type="hidden" name="enabled" value="{{#if enabled}}0{{else}}1{{/if}}" />
-                      <button type="submit" class="btn btn-secondary btn-sm">{{#if enabled}}Disable{{else}}Enable{{/if}}</button>
-                    </form>
-                    <form method="post" action="/settings/fonts/{{id}}/delete" class="d-inline ms-1" data-confirm-message="Delete this font?">
-                      <input type="hidden" name="family" value="{{family}}" />
-                      {{#if inUse}}
-                        <button type="submit" class="btn btn-outline-danger btn-sm" {{#if inUse}}disabled{{/if}}>Delete</button>
-                      {{else}}
-                        <button type="submit" class="btn btn-danger btn-sm">Delete</button>
-                      {{/if}}
-                    </form>
-                  </td>
-                </tr>
-              {{/each}}
-            {{else}}
-              <tr>
-                <td colspan="5" class="empty">No managed fonts yet.</td>
-              </tr>
-            {{/if}}
-          </tbody>
-        </table>
       </div>
     </div>
   </div>
+  <div class="card-body table-responsive p-0">
+    <table class="table table-striped align-middle mb-0" data-table-searchable>
+      <thead>
+        <tr>
+          <th data-table-sort-key="family">Family</th>
+          <th data-table-sort-key="file">File</th>
+          <th data-table-sort-key="format">Format</th>
+          <th data-table-sort-key="status">Status</th>
+          <th>Actions</th>
+        </tr>
+      </thead>
+      <tbody>
+        {{#if fonts.length}}
+          {{#each fonts}}
+          <tr data-table-search-row data-font-toggle-row data-font-enabled="{{#if enabled}}true{{else}}false{{/if}}">
+              <td data-label="Family" class="fw-semibold">{{family}}</td>
+              <td data-label="File" class="text-break">{{fileName}}</td>
+              <td data-label="Format">{{format}}</td>
+              <td data-label="Status">
+                {{#if enabled}}
+                  <span class="badge text-bg-success" data-font-status-badge>Enabled</span>
+                {{else}}
+                  <span class="badge text-bg-secondary" data-font-status-badge>Disabled</span>
+                {{/if}}
+              </td>
+              <td data-label="Actions" class="text-nowrap">
+                <form method="post" action="/settings/fonts/{{id}}/toggle" class="d-inline" data-async-command>
+                  <input type="hidden" name="enabled" value="{{#if enabled}}0{{else}}1{{/if}}" />
+                  <button type="submit" class="btn btn-secondary btn-sm">{{#if enabled}}Disable{{else}}Enable{{/if}}</button>
+                </form>
+                <form method="post" action="/settings/fonts/{{id}}/delete" class="d-inline ms-1" data-confirm-message="Delete this font?">
+                  <input type="hidden" name="family" value="{{family}}" />
+                  {{#if inUse}}
+                    <button type="submit" class="btn btn-outline-danger btn-sm" disabled>Delete</button>
+                  {{else}}
+                    <button type="submit" class="btn btn-danger btn-sm">Delete</button>
+                  {{/if}}
+                </form>
+              </td>
+            </tr>
+          {{/each}}
+        {{else}}
+          <tr data-table-search-empty-default>
+            <td colspan="5" class="empty">No managed fonts yet.</td>
+          </tr>
+        {{/if}}
+      </tbody>
+    </table>
+  </div>
+  {{> table-pagination pagination=pagination basePath="/settings/fonts" alwaysShow=true}}
 </div>

src/web/views/signage/screens/form.hbs

@@ -20,7 +20,7 @@
             </div>
             <div class="col-12 col-md-6">
               <label for="screen-slug" class="form-label">Slug</label>
-              <input id="screen-slug" name="slug" class="form-control" value="{{screen.slug}}" maxlength="128" data-limit-text-length placeholder="front-desk-tv" />
+              <input id="screen-slug" name="slug" class="form-control" value="{{screen.slug}}" maxlength="128" data-limit-text-length placeholder="front-desk-tv" {{#if isEdit}}disabled aria-disabled="true" title="Slug cannot be changed after creation"{{/if}} />
             </div>
             <div class="col-12">
               <label for="screen-playlist" class="form-label">Playlist</label>

src/web/views/signage/slides/form.hbs

@@ -84,6 +84,11 @@
   <div class="modal-body d-grid gap-3">
     <div class="slide-image-cropper-frame">
       <img id="slide-image-cropper-image" alt="Selected image to crop" />
+      <div class="slide-image-cropper-loading-overlay" aria-hidden="true">
+        <div class="spinner-border text-primary slide-image-cropper-loading-spinner" role="status">
+          <span class="visually-hidden">Loading image editor</span>
+        </div>
+      </div>
     </div>
     <div class="btn-toolbar flex-wrap gap-2 slide-image-cropper-toolbar" role="toolbar" aria-label="Image editing controls">
       <div class="btn-group btn-group-sm" role="group" aria-label="Rotate">

src/web/views/signage/slides/popup-preview.hbs

@@ -28,6 +28,22 @@
     display: block;
   }
 
+  #popup-preview-canvas iframe {
+    width: 100%;
+    height: 100%;
+    border: 0;
+    display: block;
+    overflow: hidden;
+  }
+
+  #popup-preview-canvas .slide-preview-webpage-region iframe {
+    background: #fff;
+  }
+
+  #popup-preview-canvas .slide-preview-html-region iframe {
+    background: transparent;
+  }
+
   .slide-preview-text-content {
     line-height: 1.5;
   }

test/admin-page.test.js

@@ -8,4 +8,11 @@ test('async save errors keep validation failures as warning toasts', () => {
   assert.ok(adminPageScript.includes('function isWarningSaveError(error)'));
   assert.ok(adminPageScript.includes('error.status = response.status;'));
   assert.ok(adminPageScript.includes('var variant = isWarningSaveError(error) ? \'warning\' : \'danger\';'));
+});
+
+test('async save runs success hooks before redirecting close or new saves', () => {
+  assert.ok(adminPageScript.includes('var responseText = await response.text();'));
+  assert.ok(adminPageScript.includes('if (typeof settings.afterSuccess === \'function\')'));
+  assert.ok(adminPageScript.includes('clearFormDirty(form);'));
+  assert.ok(adminPageScript.includes("if (submitterValue === 'close' || submitterValue === 'new')"));
 });

test/background-tasks-page.test.js

@@ -91,4 +91,44 @@ test('background task pages opt into 24-hour timestamps, confirm clearing tasks,
   assert.match(queueDateSearchHtml, /Example task/);
   assert.match(scheduledHtml, /data-local-datetime-format="24h"/);
   assert.match(scheduledHtml, /Player:\s+Player Beta/);
+});
+
+test('scheduled task interval labels use the largest exact unit while sorting stays numeric', () => {
+  const scheduledHtml = renderBackgroundTasksScheduledPage(
+    {
+      recurringTasks: [
+        {
+          title: 'Hourly task',
+          key: 'hourly',
+          intervalMs: 7200000,
+          metadata: {}
+        },
+        {
+          title: 'Second task',
+          key: 'seconds',
+          intervalMs: 3000,
+          metadata: {}
+        },
+        {
+          title: 'Minute task',
+          key: 'minutes',
+          intervalMs: 60000,
+          metadata: {}
+        }
+      ],
+      sort: 'interval',
+      direction: 'asc',
+      summary: { counts: {}, total: 3, activeCount: 0, scheduledCount: 3 }
+    },
+    '',
+    {
+      permissions: ['scheduled-tasks.allow']
+    }
+  );
+
+  assert.match(scheduledHtml, /Every 3 seconds/);
+  assert.match(scheduledHtml, /Every minute/);
+  assert.match(scheduledHtml, /Every 2 hours/);
+  assert.ok(scheduledHtml.indexOf('Every 3 seconds') < scheduledHtml.indexOf('Every minute'));
+  assert.ok(scheduledHtml.indexOf('Every minute') < scheduledHtml.indexOf('Every 2 hours'));
 });

test/canvas-sizes.test.js

@@ -292,3 +292,127 @@ test('slide upload cleanup route removes unused uploads', async () => {
   assert.equal(cleanupCall.uploadDir, 'e:\\Projects Git\\pulse-signage\\media\\uploads');
   assert.deepEqual(cleanupCall.uploadPaths, ['/media/uploads/test-file.png']);
 });
+
+test('wysiwyg image uploads are capped below the dedicated image region limit', async () => {
+  const handlers = {};
+  const app = {
+    get(path, ...routeHandlers) {
+      handlers[path] = routeHandlers;
+    },
+    post(path, ...routeHandlers) {
+      handlers[path] = routeHandlers;
+    }
+  };
+
+  const deps = {
+    pool: {
+      async query() {
+        return [[]];
+      }
+    },
+    common: {
+      fetchTemplatesData: async () => ({}),
+      fetchRssFeedsData: async () => ({ rssFeeds: [] }),
+      fetchApiSourcesData: async () => ({ apiSources: [] }),
+      fetchTimetablesData: async () => ({ timetableGroups: [] }),
+      parseJsonSafe: () => null,
+      fetchRssFeedItemsByFeedId: async () => [],
+      normalizeRssFeedItem: (item) => item,
+      fetchSlidesPage: async () => ({}),
+      fetchSlideById: async () => null,
+      fetchTemplatesPage: async () => ({}),
+      fetchTemplateById: async () => null,
+      fetchCanvasSizesPage: async () => ({}),
+      fetchCanvasSizeById: async () => null,
+      getSearchQuery: () => '',
+      getSortQuery: () => '',
+      getSortDirectionQuery: () => 'asc',
+      fetchDuplicateName: async () => null,
+      buildCanvasSizePayload
+    },
+    pages: {
+      renderCanvasSizesPage() { return ''; },
+      renderCanvasSizeEditPage() { return ''; },
+      renderCanvasSizeAddPage() { return ''; },
+      renderSlideAddPage() { return ''; },
+      renderSlideEditPage() { return ''; },
+      renderTemplatesPage() { return ''; },
+      renderTemplateAddPage() { return ''; },
+      renderTemplateEditPage() { return ''; }
+    },
+    upload: {
+      any() {
+        return function (_req, _res, next) {
+          next();
+        };
+      },
+      single() {
+        return function (_req, _res, next) {
+          next();
+        };
+      }
+    },
+    setAuthMessageCookie() {},
+    fetchScreensBySlideId: async () => [],
+    fetchScreensByTemplateId: async () => [],
+    collectUploadReferencesFromSlide: () => [],
+    collectUploadReferencesFromTemplate: () => [],
+    collectUploadReferencesFromPayload: () => [],
+    removeUnusedUploadFiles: async () => {},
+    syncPlaylistUploadsOnChange: async () => {},
+    getAuditUserId: () => 1,
+    redirectAfterSave: () => {},
+    notifyPlayerScreens: async () => 0,
+    broadcastDashboardState: async () => {},
+    backgroundTaskQueue: { enqueueTask: async () => null },
+    getSlideDeleteBlockMessage: async () => '',
+    getTemplateDeleteBlockMessage: async () => '',
+    getCanvasSizeDeleteBlockMessage: async () => '',
+    requirePermission() {
+      return function (_req, _res, next) {
+        next();
+      };
+    },
+    hasAnyPermission: () => true,
+    uploadDir: 'e:\\Projects Git\\pulse-signage\\media\\uploads'
+  };
+
+  registerContentRoutes(app, deps);
+
+  const routeHandlers = handlers['/slides/uploads'];
+  assert.ok(Array.isArray(routeHandlers));
+
+  const req = {
+    file: {
+      filename: 'wysiwyg-large.png',
+      originalname: 'wysiwyg-large.png',
+      mimetype: 'image/png',
+      size: 11 * 1024 * 1024
+    },
+    get(headerName) {
+      return headerName === 'X-Upload-Context' ? 'wysiwyg' : '';
+    },
+    currentUser: { id: 1, permissions: ['slides.create'] }
+  };
+  const res = {
+    statusCode: 0,
+    body: '',
+    json(body) {
+      this.body = body;
+      return this;
+    },
+    status(code) {
+      this.statusCode = code;
+      return this;
+    }
+  };
+  let nextError = null;
+
+  await routeHandlers[2](req, res, (error) => {
+    nextError = error || null;
+  });
+
+  assert.ok(nextError);
+  assert.equal(nextError.statusCode, 400);
+  assert.equal(nextError.message, 'Image must be 2 MB or smaller. Larger images should use the dedicated Image region.');
+});

test/data-source-interval-units.test.js

@@ -0,0 +1,46 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const { buildApiSourcePayload } = require('../src/data/api-sources');
+const { buildRssFeedPayload } = require('../src/data/rss-feeds');
+const { normalizeIntervalMs } = require('../src/web/lib/background-tasks/queue');
+
+test('data source payloads accept hours as an update interval unit', () => {
+  const apiPayload = buildApiSourcePayload({
+    body: {
+      name: 'API source',
+      api_url: 'https://example.com/api',
+      update_interval_value: '2',
+      update_interval_unit: 'hours'
+    }
+  }, null);
+
+  const rssPayload = buildRssFeedPayload({
+    body: {
+      name: 'RSS feed',
+      feed_url: 'https://example.com/feed.xml',
+      update_interval_value: '3',
+      update_interval_unit: 'hours',
+      item_limit: '5'
+    }
+  }, null);
+
+  assert.equal(apiPayload.updateIntervalUnit, 'hours');
+  assert.equal(apiPayload.updateIntervalValue, 2);
+  assert.equal(rssPayload.updateIntervalUnit, 'hours');
+  assert.equal(rssPayload.updateIntervalValue, 3);
+});
+
+test('background task interval conversion supports hours', () => {
+  assert.equal(normalizeIntervalMs(2, 'hours'), 7_200_000);
+});
+
+test('data source forms expose hours as an interval option', () => {
+  const apiTemplate = fs.readFileSync(path.join(__dirname, '..', 'src', 'web', 'views', 'data-sources', 'api-sources', 'form.hbs'), 'utf8');
+  const rssTemplate = fs.readFileSync(path.join(__dirname, '..', 'src', 'web', 'views', 'data-sources', 'rss-feeds', 'form.hbs'), 'utf8');
+
+  assert.match(apiTemplate, /value="hours"[\s\S]*>Hours<\/option>/);
+  assert.match(rssTemplate, /value="hours"[\s\S]*>Hours<\/option>/);
+});

test/font-library.test.js

@@ -0,0 +1,52 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const {
+  buildFontFamilyFormats,
+  buildFontStylesheet,
+  collectFontLibrarySyncOperations
+} = require('../src/web/lib/media/font-library');
+
+test('buildFontFamilyFormats quotes multi-word font families for TinyMCE previews', () => {
+  const formats = buildFontFamilyFormats([
+    { family: 'Old London', enabled: true },
+    { family: 'My Custom Font', enabled: true }
+  ]);
+
+  assert.match(formats, /Old London='Old London'/);
+  assert.match(formats, /My Custom Font='My Custom Font'/);
+  assert.match(formats, /Times New Roman='Times New Roman',Times,serif/);
+  assert.match(formats, /Lucida Sans Unicode='Lucida Sans Unicode','Lucida Grande',sans-serif/);
+});
+
+test('buildFontStylesheet keeps disabled fonts available for rendering', () => {
+  const stylesheet = buildFontStylesheet([
+    { family: 'Enabled Font', fileName: 'enabled-font.ttf', format: 'truetype', enabled: true },
+    { family: 'Disabled Font', fileName: 'disabled-font.ttf', format: 'truetype', enabled: false }
+  ]);
+
+  assert.match(stylesheet, /Enabled Font/);
+  assert.match(stylesheet, /Disabled Font/);
+});
+
+test('collectFontLibrarySyncOperations keeps disabled fonts as puts', async () => {
+  const tempRoot = await fs.promises.mkdtemp(path.join(os.tmpdir(), 'pulse-font-library-'));
+  const fontDir = path.join(tempRoot, 'fonts');
+  await fs.promises.mkdir(fontDir, { recursive: true });
+  await fs.promises.writeFile(path.join(fontDir, 'fonts.json'), JSON.stringify([
+    { family: 'Enabled Font', fileName: 'enabled-font.ttf', enabled: true },
+    { family: 'Disabled Font', fileName: 'disabled-font.ttf', enabled: false }
+  ], null, 2));
+
+  const operations = collectFontLibrarySyncOperations(tempRoot);
+  const fontOps = operations.filter(function (operation) {
+    return String(operation.uploadPath || '').indexOf('/media/fonts/') === 0 && /\.ttf$/.test(String(operation.uploadPath || ''));
+  });
+
+  assert.deepEqual(fontOps.map(function (operation) {
+    return operation.type;
+  }), ['put', 'put']);
+});

test/fonts-routes.test.js

@@ -0,0 +1,226 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+
+require('../src/common');
+
+const fontLibrary = require('../src/web/lib/media/font-library');
+const registerFontRoutes = require('../src/web/routes/settings/fonts');
+const renderFontsPage = require('../src/web/routes/settings/fonts/list');
+
+function createHandlers() {
+  const handlers = {};
+  const app = {
+    get(path, ...routeHandlers) {
+      handlers[`GET ${path}`] = routeHandlers;
+    },
+    post(path, ...routeHandlers) {
+      handlers[`POST ${path}`] = routeHandlers;
+    }
+  };
+
+  return { app, handlers };
+}
+
+test('fonts route filters and paginates managed fonts', async () => {
+  const originalLoadFontLibrary = fontLibrary.loadFontLibrary;
+  const { app, handlers } = createHandlers();
+
+  fontLibrary.loadFontLibrary = function () {
+    return {
+      fonts: [
+        { id: 'alpha', family: 'Alpha Sans', fileName: 'alpha.woff2', format: 'woff2', enabled: true },
+        { id: 'beta', family: 'Beta Sans', fileName: 'beta.woff2', format: 'woff2', enabled: false },
+        { id: 'gamma', family: 'Gamma Sans', fileName: 'gamma.woff2', format: 'woff2', enabled: true }
+      ],
+      stylesheetHref: '/media/fonts/fonts.css'
+    };
+  };
+
+  try {
+    registerFontRoutes(app, {
+      pool: {
+        async query() {
+          return [[{ match_count: 0 }]];
+        }
+      },
+      common: {
+        getSearchQuery() {
+          return 'beta';
+        }
+      },
+      pages: {
+        renderFontsPage(data) {
+          return JSON.stringify(data);
+        }
+      },
+      upload: {
+        single() {
+          return function (_req, _res, next) {
+            next();
+          };
+        }
+      },
+      uploadDir: 'e:/Projects Git/pulse-signage/media',
+      backgroundTaskQueue: null,
+      setAuthMessageCookie() {}
+    });
+
+    const response = {
+      statusCode: 200,
+      body: null,
+      send(value) {
+        this.body = value;
+        return this;
+      }
+    };
+
+    await handlers['GET /settings/fonts'][1]({
+      query: {
+        page: '2'
+      },
+      currentUser: {
+        id: 1,
+        permissions: ['fonts.read']
+      }
+    }, response, function () {});
+
+    const rendered = JSON.parse(response.body);
+    assert.equal(rendered.fonts.length, 1);
+    assert.equal(rendered.fonts[0].id, 'beta');
+    assert.equal(rendered.pagination.currentPage, 1);
+    assert.equal(rendered.pagination.totalItems, 1);
+  } finally {
+    fontLibrary.loadFontLibrary = originalLoadFontLibrary;
+  }
+});
+
+test('fonts route sorts by format and status', async () => {
+  const originalLoadFontLibrary = fontLibrary.loadFontLibrary;
+  const { app, handlers } = createHandlers();
+
+  fontLibrary.loadFontLibrary = function () {
+    return {
+      fonts: [
+        { id: 'alpha', family: 'Alpha Sans', fileName: 'alpha.woff2', format: 'woff2', enabled: true },
+        { id: 'beta', family: 'Beta Sans', fileName: 'beta.otf', format: 'opentype', enabled: false },
+        { id: 'gamma', family: 'Gamma Sans', fileName: 'gamma.ttf', format: 'truetype', enabled: true }
+      ],
+      stylesheetHref: '/media/fonts/fonts.css'
+    };
+  };
+
+  try {
+    registerFontRoutes(app, {
+      pool: {
+        async query() {
+          return [[{ match_count: 0 }]];
+        }
+      },
+      common: {
+        getSearchQuery() {
+          return '';
+        },
+        getSortQuery(req) {
+          return req.query.sort;
+        },
+        getSortDirectionQuery(req) {
+          return req.query.direction;
+        }
+      },
+      pages: {
+        renderFontsPage(data) {
+          return JSON.stringify(data);
+        }
+      },
+      upload: {
+        single() {
+          return function (_req, _res, next) {
+            next();
+          };
+        }
+      },
+      uploadDir: 'e:/Projects Git/pulse-signage/media',
+      backgroundTaskQueue: null,
+      setAuthMessageCookie() {}
+    });
+
+    const response = {
+      statusCode: 200,
+      body: null,
+      send(value) {
+        this.body = value;
+        return this;
+      }
+    };
+
+    await handlers['GET /settings/fonts'][1]({
+      query: {
+        sort: 'format',
+        direction: 'asc'
+      },
+      currentUser: {
+        id: 1,
+        permissions: ['fonts.read']
+      }
+    }, response, function () {});
+
+    let rendered = JSON.parse(response.body);
+    assert.deepEqual(rendered.fonts.map(function (font) { return font.id; }), ['beta', 'gamma', 'alpha']);
+
+    await handlers['GET /settings/fonts'][1]({
+      query: {
+        sort: 'status',
+        direction: 'asc'
+      },
+      currentUser: {
+        id: 1,
+        permissions: ['fonts.read']
+      }
+    }, response, function () {});
+
+    rendered = JSON.parse(response.body);
+    assert.deepEqual(rendered.fonts.map(function (font) { return font.id; }), ['beta', 'alpha', 'gamma']);
+  } finally {
+    fontLibrary.loadFontLibrary = originalLoadFontLibrary;
+  }
+});
+
+test('fonts page renders the upload card above the table card', () => {
+  const html = renderFontsPage({
+    fonts: [
+      {
+        id: 'alpha',
+        family: 'Alpha Sans',
+        fileName: 'alpha.woff2',
+        format: 'woff2',
+        enabled: true,
+        inUse: false
+      }
+    ],
+    pagination: {
+      hasMultiplePages: true,
+      startItem: 1,
+      endItem: 1,
+      totalItems: 1,
+      itemLabel: 'fonts',
+      ariaLabel: 'Font pages',
+      hasPrevious: false,
+      hasNext: true,
+      previousUrl: '',
+      nextUrl: '?page=2',
+      pages: [{ number: 1, active: true, url: '' }]
+    },
+    stylesheetHref: ''
+  }, '', { id: 1 });
+
+  assert.ok(html.indexOf('Upload font') < html.indexOf('Managed fonts'));
+  assert.match(html, /data-table-search-container/);
+  assert.match(html, /table-pagination/);
+  assert.match(html, /data-async-command/);
+  assert.match(html, /data-font-toggle-row/);
+  assert.match(html, /data-font-status-badge/);
+  assert.match(html, /data-table-sort-key="family"/);
+  assert.match(html, /data-table-sort-key="file"/);
+  assert.match(html, /data-table-sort-key="format"/);
+  assert.match(html, /data-table-sort-key="status"/);
+});

test/player-page-commands-performance.test.js

@@ -92,6 +92,7 @@ function createSandbox() {
     playRegionAnimations() {
       calls.playRegionAnimations += 1;
     },
+    addEventListener() {},
     pulsePlayerRegionTypes: {
       list() {
         return [

test/player-page-playback.test.js

@@ -39,6 +39,11 @@ test('playlist refresh queues updates until the next slide transition', async ()
     pausedRemainingMs: null,
     app: null,
     currentPlaylistEtag: '',
+    initialData: {
+      rssFeeds: [{ id: 1 }],
+      apiSources: [{ id: 2 }],
+      timetableGroups: [{ id: 3 }]
+    },
     activeSlidesCacheKey: '',
     activeSlidesCacheValue: [],
     renderCacheViewportKey: '',
@@ -63,6 +68,7 @@ test('playlist refresh queues updates until the next slide transition', async ()
     scheduleRefreshRetry() {},
     syncWebpagePreloads() {},
     syncRtmpWarmups() {},
+    addEventListener() {},
     showCurrent() {
       calls.showCurrent += 1;
     },
@@ -94,6 +100,9 @@ test('playlist refresh queues updates until the next slide transition', async ()
       this.responseText = JSON.stringify({
         signature: 'next-signature',
         slides: [{ id: 1, duration_seconds: 12, disable_audio: false }],
+        rssFeeds: [{ id: 10 }],
+        apiSources: [{ id: 20 }],
+        timetableGroups: [{ id: 30 }],
         playlist: { fade_between_slides: false, skip_unavailable_rtmp: false }
       });
       if (typeof this.onreadystatechange === 'function') {
@@ -133,6 +142,9 @@ test('playlist refresh queues updates until the next slide transition', async ()
   assert.equal(calls.showCurrent, 0);
   assert.equal(sandbox.currentPlaylistSignature, 'old-signature');
   assert.equal(sandbox.slides[0].disable_audio, undefined);
+  assert.deepEqual(sandbox.initialData.rssFeeds, [{ id: 10 }]);
+  assert.deepEqual(sandbox.initialData.apiSources, [{ id: 20 }]);
+  assert.deepEqual(sandbox.initialData.timetableGroups, [{ id: 30 }]);
   assert.equal(calls.logDebug.some((entry) => entry.includes('Unable to load screen playlist.')), false);
   assert.equal(calls.logDebug.some((entry) => entry.includes('applying on next slide transition')), true);
 });
@@ -198,6 +210,7 @@ test('single-slide playlists re-render the active slide instead of refreshing af
     scheduleRefreshRetry() {},
     syncWebpagePreloads() {},
     syncRtmpWarmups() {},
+    addEventListener() {},
     clearActiveSlidesCache() {},
     showCurrent() {},
     sendCommandState() {},
@@ -336,6 +349,7 @@ test('deferred playlist updates preserve the current slide index', async () => {
     scheduleRefreshRetry() {},
     syncWebpagePreloads() {},
     syncRtmpWarmups() {},
+    addEventListener() {},
     clearActiveSlidesCache() {},
     showCurrent() {},
     sendCommandState() {},
@@ -395,6 +409,87 @@ test('deferred playlist updates preserve the current slide index', async () => {
   assert.equal(sandbox.index, 1);
 });
 
+test('player page arrow keys move between slides', async () => {
+  const handlers = Object.create(null);
+  const calls = [];
+
+  const sandbox = {
+    window: null,
+    console,
+    Array,
+    Object,
+    String,
+    Boolean,
+    Number,
+    Math,
+    Date,
+    JSON,
+    Promise,
+    setTimeout,
+    clearTimeout,
+    location: { origin: 'http://localhost', href: 'http://localhost/screen/test2' },
+    addEventListener(type, handler) {
+      handlers[type] = handler;
+    },
+    slides: [{ id: 1 }, { id: 2 }, { id: 3 }],
+    lastRenderedSlide: { id: 2 },
+    index: 1,
+    timer: null,
+    slideOutroTimers: [],
+    getCurrentActiveSlides() {
+      return sandbox.slides;
+    },
+    clearSlideTimer() {},
+    applyPendingPlaylistUpdate() {},
+    renderSlideAtIndex(_sourceSlides, targetIndex) {
+      calls.push(targetIndex);
+    }
+  };
+  sandbox.window = sandbox;
+
+  const scriptPath = path.join(__dirname, '..', 'src', 'player', 'public', 'js', 'player-page-commands.js');
+  const script = fs.readFileSync(scriptPath, 'utf8');
+  vm.runInNewContext(script, sandbox, { filename: scriptPath });
+
+  assert.equal(typeof handlers.keydown, 'function');
+
+  let prevented = false;
+  handlers.keydown({
+    key: 'ArrowLeft',
+    target: {},
+    preventDefault() {
+      prevented = true;
+    }
+  });
+
+  assert.deepEqual(calls, [0]);
+  assert.equal(prevented, true);
+
+  sandbox.lastRenderedSlide = { id: 2 };
+  sandbox.index = 1;
+  prevented = false;
+  handlers.keydown({
+    key: 'ArrowRight',
+    target: {},
+    preventDefault() {
+      prevented = true;
+    }
+  });
+
+  assert.deepEqual(calls, [0, 2]);
+  assert.equal(prevented, true);
+
+  handlers.keydown({
+    key: 'ArrowLeft',
+    target: { tagName: 'INPUT' },
+    preventDefault() {
+      throw new Error('should not be called for editable targets');
+    }
+  });
+
+  assert.deepEqual(calls, [0, 2]);
+});
+
 test('removing the currently visible slide from a two-slide playlist applies the one-slide update immediately', async () => {
   const calls = {
     showCurrent: 0,
@@ -453,6 +548,7 @@ test('removing the currently visible slide from a two-slide playlist applies the
     scheduleRefreshRetry() {},
     syncWebpagePreloads() {},
     syncRtmpWarmups() {},
+    addEventListener() {},
     clearActiveSlidesCache() {},
     showCurrent() {
       calls.showCurrent += 1;

test/player-render-helpers.test.js

@@ -1,12 +1,16 @@
 const test = require('node:test');
 const assert = require('node:assert/strict');
+const fs = require('node:fs');
 
 require('../src/common');
 
+const timetableRegionSource = fs.readFileSync(require.resolve('../src/player/regions/timetable.js'), 'utf8');
+
 const {
   mediaKind,
   normalizeSlide,
   renderEditorJsContent,
+  renderHtmlRegionContent,
   sanitizeRichText
 } = require('../src/player/render-helpers');
 
@@ -18,11 +22,11 @@ test('mediaKind classifies player media by extension', () => {
 });
 
 test('sanitizeRichText strips unsafe content but preserves allowed markup', () => {
-  const html = '<div class="wrap"><a href="https://example.com" target="_blank">Link</a><script>alert(1)</script><span style="color:red">Text</span><img src="x" onerror="alert(1)"></div>';
+  const html = '<div class="wrap"><a href="https://example.com" target="_blank">Link</a><script>alert(1)</script><span style="color:red">Text</span><table class="grid"><colgroup><col span="1" style="width:50%"><col span="1" style="width:50%"></colgroup><thead><tr><th scope="col">Name</th><th scope="col">Value</th></tr></thead><tbody><tr><td>Alpha</td><td>Beta</td></tr></tbody></table><img src="/media/uploads/photo.png" alt="Photo" loading="lazy" onerror="alert(1)"></div>';
 
   assert.equal(
     sanitizeRichText(html),
-    '<div class="wrap"><a href="https://example.com" target="_blank" rel="noreferrer noopener">Link</a><span style="color:red">Text</span></div>'
+    '<div class="wrap"><a href="https://example.com" target="_blank" rel="noreferrer noopener">Link</a><span style="color:red">Text</span><table class="grid"><colgroup><col span="1" style="width:50%"><col span="1" style="width:50%"></colgroup><thead><tr><th scope="col">Name</th><th scope="col">Value</th></tr></thead><tbody><tr><td>Alpha</td><td>Beta</td></tr></tbody></table><img src="/media/uploads/photo.png" alt="Photo" loading="lazy"></div>'
   );
 });
 
@@ -78,4 +82,32 @@ test('renderEditorJsContent sanitizes editor blocks and wraps legacy text', () =
     '<h2><strong>Title</strong></h2><p><a>bad</a><em>ok</em></p><ol style="list-style-type:decimal;padding-left:1.4em;"><li>One</li><li><span>Two</span></li></ol>'
   );
   assert.equal(renderEditorJsContent('plain text'), '<p>plain text</p>');
+});
+
+test('timetable region registers the timetable type', () => {
+  assert.ok(timetableRegionSource.includes("registry.register('timetable'"));
+  assert.ok(timetableRegionSource.includes("sanitizeRichText(substituteTimetableVariables(value"));
+});
+
+test('shared iframe renderers size preview content explicitly', () => {
+  const playerHtmlRegionSource = fs.readFileSync(require.resolve('../src/player/regions/html.js'), 'utf8');
+  const playerWebpageRegionSource = fs.readFileSync(require.resolve('../src/player/regions/webpage.js'), 'utf8');
+  const playerRenderHelpersSource = fs.readFileSync(require.resolve('../src/player/render-helpers.js'), 'utf8');
+  const slideThumbnailPreviewSource = fs.readFileSync(require.resolve('../src/web/lib/media/slide-thumbnail-preview.js'), 'utf8');
+  const slideThumbnailsSource = fs.readFileSync(require.resolve('../src/web/lib/media/slide-thumbnails.js'), 'utf8');
+
+  assert.ok(playerHtmlRegionSource.includes('style="width:100%;height:100%;border:0;display:block;background:transparent;overflow:hidden;"'));
+  assert.ok(playerWebpageRegionSource.includes('style="width:100%;height:100%;border:0;display:block;background:#fff;overflow:hidden;"'));
+  assert.ok(playerRenderHelpersSource.includes('style="width:100%;height:100%;border:0;display:block;background:transparent;overflow:hidden;"'));
+  assert.ok(slideThumbnailPreviewSource.includes('style="width:100%;height:100%;border:0;display:block;background:#fff;overflow:hidden;"'));
+  assert.ok(slideThumbnailPreviewSource.includes('style="width:100%;height:100%;border:0;display:block;background:transparent;overflow:hidden;"'));
+  assert.ok(slideThumbnailsSource.includes('style="width:100%;height:100%;border:0;display:block;background:#fff;overflow:hidden;"'));
+  assert.ok(slideThumbnailsSource.includes('style="width:100%;height:100%;border:0;display:block;background:transparent;overflow:hidden;"'));
+});
+
+test('html region helpers unwrap object-shaped values before rendering', () => {
+  const rendered = renderHtmlRegionContent({ html: '<div>Hi</div>' });
+
+  assert.match(rendered, /srcdoc="&lt;!doctype html&gt;&lt;html&gt;&lt;head&gt;&lt;style&gt;html,body\{margin:0;width:100%;height:100%;overflow:hidden;background:transparent;\}&lt;\/style&gt;&lt;\/head&gt;&lt;body&gt;&lt;div&gt;Hi&lt;\/div&gt;&lt;\/body&gt;&lt;\/html&gt;"/);
+  assert.doesNotMatch(rendered, /\[object Object\]/);
 });

test/player-time-date-region.test.js

@@ -0,0 +1,65 @@
+const test = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const vm = require('node:vm');
+
+function loadTimeDateModule() {
+  const webUiHelpersScript = fs.readFileSync(require.resolve('../src/web/public/js/web-ui-helpers.js'), 'utf8');
+  const renderingScript = fs.readFileSync(require.resolve('../src/player/public/js/player-page-rendering.js'), 'utf8');
+  const placeholderScript = fs.readFileSync(require.resolve('../src/web/public/js/shared/placeholder-utils.js'), 'utf8');
+  const timeDateScript = fs.readFileSync(require.resolve('../src/player/regions/time-date.js'), 'utf8');
+  const registry = new Map();
+  const sandbox = {
+    document: {
+      addEventListener() {}
+    },
+    window: {
+      pulsePlayerRegionTypes: {
+        register(type, module) {
+          registry.set(type, module);
+        }
+      },
+      innerWidth: 1280,
+      innerHeight: 720,
+      Intl: Intl,
+      Date: Date,
+      Object: Object,
+      Array: Array,
+      Number: Number,
+      String: String,
+      Boolean: Boolean,
+      Math: Math,
+      JSON: JSON,
+      RegExp: RegExp,
+      console: console
+    }
+  };
+
+  sandbox.window = Object.assign({}, sandbox.window);
+
+  vm.runInNewContext(webUiHelpersScript, sandbox, { filename: 'web-ui-helpers.js' });
+  sandbox.escapeHtml = sandbox.window.escapeHtml;
+  vm.runInNewContext(renderingScript, sandbox, { filename: 'player-page-rendering.js' });
+  vm.runInNewContext(placeholderScript, sandbox, { filename: 'placeholder-utils.js' });
+  vm.runInNewContext(timeDateScript, sandbox, { filename: 'time-date.js' });
+
+  return registry.get('time-date');
+}
+
+test('time/date region renders placeholder tokens on the player side', () => {
+  const module = loadTimeDateModule();
+  const markup = module.renderRegion(
+    {
+      pixelWidth: 320,
+      pixelHeight: 180,
+      canvasScale: 1,
+      baseStyle: 'position:absolute;'
+    },
+    {
+      value: '{{hh}}:{{mm}}',
+      timezone: 'UTC'
+    }
+  );
+
+  assert.match(markup, /<p>\d{2}:\d{2}<\/p>/);
+});

test/slide-form-editor.test.js

@@ -3,7 +3,79 @@ const assert = require('node:assert/strict');
 const fs = require('node:fs');
 
 const slideFormEditorSource = fs.readFileSync(require.resolve('../src/web/public/js/slides/slide-form-editor.js'), 'utf8');
+const slideFormSource = fs.readFileSync(require.resolve('../src/web/public/js/slides/slide-form.js'), 'utf8');
+const slideThumbnailPreviewSource = fs.readFileSync(require.resolve('../src/web/lib/media/slide-thumbnail-preview.js'), 'utf8');
+const slideThumbnailsSource = fs.readFileSync(require.resolve('../src/web/lib/media/slide-thumbnails.js'), 'utf8');
+const slideHtmlRegionSource = fs.readFileSync(require.resolve('../src/web/public/js/regions/type/html.js'), 'utf8');
+const slideWebpageRegionSource = fs.readFileSync(require.resolve('../src/web/public/js/regions/type/webpage.js'), 'utf8');
 
 test('slide editor disables pasted data images in TinyMCE', () => {
   assert.ok(slideFormEditorSource.includes('paste_data_images: false'));
+});
+
+test('slide editor enables server-backed image uploads', () => {
+  assert.ok(slideFormEditorSource.includes("plugins: 'lists code advlist fullscreen table image'"));
+  assert.ok(slideFormEditorSource.includes('automatic_uploads: true'));
+  assert.ok(slideFormEditorSource.includes('images_file_types: imageUploadFileTypes'));
+  assert.ok(slideFormEditorSource.includes('images_upload_handler: uploadEditorImage'));
+  assert.ok(slideFormEditorSource.includes('table image chip | fullscreen'));
+  assert.ok(slideFormEditorSource.includes('relative_urls: false'));
+  assert.ok(slideFormEditorSource.includes('remove_script_host: false'));
+});
+
+test('slide editor inserts tables with zero padding and spacing by default', () => {
+  assert.ok(slideFormEditorSource.includes("table_default_attributes: {"));
+  assert.ok(slideFormEditorSource.includes("cellpadding: '0'"));
+  assert.ok(slideFormEditorSource.includes("cellspacing: '0'"));
+  assert.ok(slideFormEditorSource.includes('td, th { border: 1px solid currentColor; padding: 0; vertical-align: top; }'));
+});
+
+test('slide editor uses a smaller wysiwyg image limit', () => {
+  assert.ok(slideFormEditorSource.includes('var imageUploadMaxBytes = Math.max(1, Number(settings.imageUploadMaxBytes || 2 * 1024 * 1024));'));
+  assert.ok(slideFormEditorSource.includes('Image must be '));
+  assert.ok(slideFormEditorSource.includes('Larger images should use the dedicated Image region.'));
+  assert.ok(slideFormEditorSource.includes("xhr.setRequestHeader('X-Upload-Context', imageUploadContext);"));
+});
+
+test('slide editor tracks uploaded image paths for cleanup', () => {
+  assert.ok(slideFormEditorSource.includes('var editorImageUploadPaths = new Set();'));
+  assert.ok(slideFormEditorSource.includes('getImageUploadCleanupPaths'));
+  assert.ok(slideFormEditorSource.includes('getCommittedImageUploadCleanupPaths'));
+  assert.ok(slideFormEditorSource.includes('getPendingImageUploadPaths'));
+  assert.ok(slideFormEditorSource.includes('clearImageUploadPaths'));
+});
+
+test('slide editor keeps image-only rich text from being treated as empty', () => {
+  assert.ok(slideFormEditorSource.includes('/<img\\b/i.test(raw)'));
+});
+
+test('slide form queues editor image cleanup on save and close', () => {
+  assert.ok(slideFormSource.includes('getImageUploadCleanupPaths'));
+  assert.ok(slideFormSource.includes('getCommittedImageUploadCleanupPaths'));
+  assert.ok(slideFormSource.includes("regionMediaController.queueUploadCleanup(slideFormEditorController.getImageUploadCleanupPaths())"));
+});
+
+test('slide thumbnail previews treat image-only text as visible content', () => {
+  assert.ok(slideThumbnailPreviewSource.includes('/<img\\b/i.test(raw)'));
+  assert.ok(slideThumbnailsSource.includes('/<img\\b/i.test(raw)'));
+});
+
+test('popup preview falls back to iframe sizing rules', () => {
+  const popupPreviewSource = fs.readFileSync(require.resolve('../src/web/views/signage/slides/popup-preview.hbs'), 'utf8');
+
+  assert.ok(popupPreviewSource.includes('#popup-preview-canvas iframe'));
+  assert.ok(popupPreviewSource.includes('#popup-preview-canvas .slide-preview-webpage-region iframe'));
+  assert.ok(popupPreviewSource.includes('#popup-preview-canvas .slide-preview-html-region iframe'));
+});
+
+test('browser preview helpers normalize object-shaped HTML and webpage values', () => {
+  assert.ok(slideHtmlRegionSource.includes('normalizePreviewValue'));
+  assert.ok(slideWebpageRegionSource.includes('normalizePreviewValue'));
+});
+
+test('webpage preview updates only through the explicit button', () => {
+  assert.ok(slideWebpageRegionSource.includes('input-group flex-nowrap'));
+  assert.ok(slideWebpageRegionSource.includes('data-webpage-preview-update'));
+  assert.ok(slideFormSource.includes('input[type="url"][name^="region_webpage_"]'));
+  assert.ok(slideFormSource.includes('requestPreviewRender();'));
 });

test/timetable-region-timezone.test.js

@@ -6,7 +6,7 @@ const vm = require('node:vm');
 function loadScheduleModule(overrides) {
   const timeDatePlaceholdersScript = fs.readFileSync(require.resolve('../src/web/public/js/shared/time-date-placeholders.js'), 'utf8');
   const placeholderScript = fs.readFileSync(require.resolve('../src/web/public/js/shared/placeholder-utils.js'), 'utf8');
-  const scriptPath = require.resolve('../src/web/public/js/regions/type/schedule.js');
+  const scriptPath = require.resolve('../src/web/public/js/regions/type/timetable.js');
   const script = fs.readFileSync(scriptPath, 'utf8');
   const registry = new Map();
   const customWindow = overrides && overrides.window ? overrides.window : {};
@@ -161,8 +161,8 @@ test('timetable region preview resolves timezone placeholders from explicit time
               id: 101,
               title: 'Launch',
               short_description: 'Doors open',
-              start_datetime: '2026-08-10T10:00:00.000Z',
+              start_datetime: '2026-08-20T10:00:00.000Z',
-              end_datetime: '2026-08-10T11:00:00.000Z'
+              end_datetime: '2026-08-20T11:00:00.000Z'
             }
           ]
         }
@@ -281,8 +281,8 @@ test('timetable preview does not force the group timezone into placeholder trans
               id: 101,
               title: 'Launch',
               short_description: 'Doors open',
-              start_datetime: '2026-08-10T10:00:00.000Z',
+              start_datetime: '2026-08-20T10:00:00.000Z',
-              end_datetime: '2026-08-10T11:00:00.000Z'
+              end_datetime: '2026-08-20T11:00:00.000Z'
             }
           ]
         }

test/timetable-region.test.js

@@ -39,4 +39,62 @@ test('buildSlidePayload normalizes timetable region fields', async () => {
   assert.equal(content.timetable.max_items, '7');
   assert.equal(Object.prototype.hasOwnProperty.call(content.timetable, 'timetable_display_mode'), false);
   assert.equal(Object.prototype.hasOwnProperty.call(content.timetable, 'timetable_max_items'), false);
+});
+
+test('buildSlidePayload preserves safe image markup in text regions', async () => {
+  const pool = {
+    async query(sql) {
+      if (sql.includes('FROM c_templates st')) {
+        return [[{ id: 9, name: 'Template 9', canvas_size_id: 1, canvas_size_width: 1920, canvas_size_height: 1080 }]];
+      }
+
+      if (sql.includes('FROM c_template_regions')) {
+        return [[{ id: 47, template_id: 9, region_key: 'body', region_type: 'text', label: 'Body' }]];
+      }
+
+      return [[]];
+    }
+  };
+
+  const payload = await buildSlidePayload(pool, {
+    body: {
+      title: 'Text slide',
+      template_id: '9',
+      region_text_47: '<p><img src="/media/uploads/photo.png" alt="Photo" onerror="alert(1)"></p>'
+    },
+    files: []
+  }, null);
+
+  const content = JSON.parse(payload.contentJson);
+  assert.equal(content.body.type, 'text');
+  assert.equal(content.body.value, '<p><img src="/media/uploads/photo.png" alt="Photo"></p>');
+});
+
+test('buildSlidePayload preserves safe color spans in text regions', async () => {
+  const pool = {
+    async query(sql) {
+      if (sql.includes('FROM c_templates st')) {
+        return [[{ id: 9, name: 'Template 9', canvas_size_id: 1, canvas_size_width: 1920, canvas_size_height: 1080 }]];
+      }
+
+      if (sql.includes('FROM c_template_regions')) {
+        return [[{ id: 47, template_id: 9, region_key: 'body', region_type: 'text', label: 'Body' }]];
+      }
+
+      return [[]];
+    }
+  };
+
+  const payload = await buildSlidePayload(pool, {
+    body: {
+      title: 'Text slide',
+      template_id: '9',
+      region_text_47: '<p><span style="color:#ff0000" class="text-emphasis">Hello</span></p>'
+    },
+    files: []
+  }, null);
+
+  const content = JSON.parse(payload.contentJson);
+  assert.equal(content.body.type, 'text');
+  assert.equal(content.body.value, '<p><span style="color:#ff0000" class="text-emphasis">Hello</span></p>');
 });

test/web-manage-routes.test.js

@@ -3,7 +3,7 @@ const assert = require('node:assert/strict');
 
 const registerManageRoutes = require('../src/web/routes/admin/manage');
 
-test('screen update redirects and forwards redirect when the slug changes', async () => {
+test('screen update keeps the existing slug on edit', async () => {
   const handlers = {};
   const app = {
     post(path, ...routeHandlers) {
@@ -14,37 +14,13 @@ test('screen update redirects and forwards redirect when the slug changes', asyn
 
   const pool = {
     async query(sql) {
-      if (sql.includes('SELECT s.slug, s.player_id, p.public_base_url, p.internal_base_url') && sql.includes('WHERE s.slug = ?')) {
-        return [[{
-          slug: 'alpha',
-          player_id: 'player-a',
-          public_base_url: 'http://player.local',
-          internal_base_url: 'http://player.internal'
-        }]];
-      }
       if (sql.includes('SELECT id, name, slug, playlist_id')) {
         return [[{ id: 42, name: 'Old Screen', slug: 'alpha', playlist_id: null }]];
       }
-      if (sql.includes('SELECT s.slug, s.player_id, p.public_base_url, p.internal_base_url')) {
+      if (sql.includes('UPDATE d_screens SET name = ?, slug = ?, playlist_id = ?, modified_by = ? WHERE id = ?')) {
-        return [[
-          {
-            slug: 'alpha',
-            player_id: 'player-a',
-            public_base_url: 'http://player-a.example',
-            internal_base_url: 'http://player-a.internal'
-          },
-          {
-            slug: 'beta',
-            player_id: 'player-b',
-            public_base_url: 'http://player-b.example',
-            internal_base_url: 'http://player-b.internal'
-          }
-        ]];
-      }
-      if (sql.includes('UPDATE d_screens SET name = ?, slug = ?, playlist_id = ?, player_id = ?, modified_by = ? WHERE id = ?')) {
         return [{ affectedRows: 1 }];
       }
-      return [[]];
+      throw new Error(`Unexpected SQL: ${sql}`);
     }
   };
 
@@ -137,7 +113,6 @@ test('screen update redirects and forwards redirect when the slug changes', asyn
 
   assert.equal(res.redirectedTo, '/screens?edit=42');
   assert.deepEqual(calls, [
-    { kind: 'forwardPlayerCommandToBaseUrl', baseUrl: 'http://player.internal', slug: 'alpha', payload: { command: 'redirect', url: 'http://player.local/screen/beta' } },
     { kind: 'redirectAfterSave', url: '/screens?edit=42' }
   ]);
 });

test/web-screens-routes.test.js

@@ -48,7 +48,22 @@ test('screen edit page includes shared launcher downloads and base player url',
     pages,
     buildDashboardState: async () => ({ screens: [] }),
     getScreenDeleteBlockMessage: async () => '',
-    getScreenConnections: async () => [],
+    getScreenConnections: async (slug) => {
+      if (slug !== 'demo-conference') {
+        return { connections: [] };
+      }
+
+      return {
+        connections: [
+          {
+            id: 'conn-1',
+            clientId: 'conn-1',
+            deviceId: 'device-1',
+            playerPublicBaseUrl: 'http://player.example/'
+          }
+        ]
+      };
+    },
     playerPublicBaseUrl: 'http://player.example',
     requirePermission() {
       return function (_req, _res, next) {
@@ -265,6 +280,8 @@ test('screen edit page renders player urls as an adminlte table', async () => {
       name: 'Demo Conference',
       slug: 'demo-conference',
       playlist_id: null,
+      slug_update_confirm_live_connection_count: 2,
+      slug_update_confirm_message: 'Are you sure you want to update the slug? This will refresh all screens using this slug.',
       player_urls: [
         {
           identifier: 'player-alpha',
@@ -283,6 +300,8 @@ test('screen edit page renders player urls as an adminlte table', async () => {
   assert.match(html, /card-body table-responsive p-0/);
   assert.match(html, /table table-striped w-100 mb-0/);
   assert.match(html, /player-alpha/);
+  assert.match(html, /<input[^>]+id="screen-slug"[^>]+disabled/);
+  assert.match(html, /Slug cannot be changed after creation/);
 });
 
 test('screen launcher downloads are shared and attached', async () => {