Leopoldadmin/leocrm
1
0
Fork 0
Code Issues 363 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Phase 4 + M5: Low-priority fixes and frontend component integration

Browse Source 
M5: TagBadge integrated into ContactDetail (replaces plain Badge)
M5: EntityHistoryPanel integrated into ContactDetail (timeline section)

L1: Replace document.write() with Blob URL in print.ts (XSS-safe)
L2: AI UI Control feedback storage capped at 100 entries (FIFO eviction)
L3: Backup & Restore documentation added to DEPLOY.md

Verified: Backend import OK, TypeScript 0 errors
This commit is contained in:
Agent Zero
2026-07-26 21:29:37 +02:00
parent 825d638130
commit b6e3afd28b
5 changed files with 95 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/src/utils/print.ts
+14 -12
View File
@@ -49,24 +49,25 @@ export function printElement(elementId: string): void {
'}' +
'</style>';
// Single document.write — no mixing with appendChild
printWindow.document.open();
printWindow.document.write(
// Use Blob URL instead of document.write (safer — no XSS risk)
const htmlContent =
'<!DOCTYPE html><html lang="de"><head><meta charset="UTF-8">' +
'<title>Druckansicht</title>' +
stylesHtml +
printStyles +
'</head><body>' +
clone.outerHTML +
'</body></html>',
);
printWindow.document.close();
'</body></html>';
const blob = new Blob([htmlContent], { type: 'text/html' });
const blobUrl = URL.createObjectURL(blob);
printWindow.location.href = blobUrl;
// Wait for stylesheets to load before printing
printWindow.onload = () => {
printWindow.focus();
printWindow.print();
setTimeout(() => {
URL.revokeObjectURL(blobUrl);
printWindow.close();
}, 500);
};
@@ -122,23 +123,24 @@ export function exportToPDF(elementId: string, filename: string): void {
'}' +
'</style>';
// Single document.write — no mixing with appendChild
printWindow.document.open();
printWindow.document.write(
// Use Blob URL instead of document.write (safer — no XSS risk)
const htmlContent =
'<!DOCTYPE html><html lang="de"><head><meta charset="UTF-8">' +
`<title>${filename}</title>` +
stylesHtml +
printStyles +
'</head><body>' +
clone.outerHTML +
'</body></html>',
);
printWindow.document.close();
'</body></html>';
const blob = new Blob([htmlContent], { type: 'text/html' });
const blobUrl = URL.createObjectURL(blob);
printWindow.location.href = blobUrl;
printWindow.onload = () => {
printWindow.focus();
printWindow.print();
setTimeout(() => {
URL.revokeObjectURL(blobUrl);
printWindow.close();
}, 500);
};