nvrl 7f15206ffb markdown: links open nothing they can reach back from ...

Every link with a target now gets rel="noopener noreferrer", and only
_blank is kept as a target. A named target such as target="foo" left
the page it opened a handle on this one — browsers imply noopener for
_blank alone — which it could use to send the tab to a lookalike login.

The share page turned links into the private workspace into plain text
with a regex over the sanitised HTML. A pattern over markup can end
inside an attribute, and on an engine that does not escape < and > in
attribute values a crafted link title became markup. The rewrite now
happens in renderMarkdown, on the parsed page.

2026-10-20 11:45:11 +02:00

..

Actions.svelte

tree: several nodes picked up and moved at once

2026-10-20 11:13:52 +02:00

Agenda.svelte

ui: touch parity, saves that survive outages, edits that do not collide

2026-10-20 05:53:34 +02:00

api.ts

vault, sftp: a key reads sealed files only when allowed to

2026-10-20 11:43:39 +02:00

Bar.svelte

tree: several nodes picked up and moved at once

2026-10-20 11:13:52 +02:00

Board.svelte

board: one model — first list inbox, last list done

2026-10-19 14:45:35 +02:00

carry.ts

tree: several nodes picked up and moved at once

2026-10-20 11:13:52 +02:00

CertView.svelte

files: PDFs, text, code, tables and certificates open in place

2026-10-20 09:57:09 +02:00

Clock.svelte

ui: share view in the shell, icon rail, phone polish

2026-10-17 17:27:59 +02:00

CommandLine.svelte

agenda, capture and finder: what needs doing comes to you

2026-10-19 14:51:52 +02:00

commands.ts

vault, sftp: a key reads sealed files only when allowed to

2026-10-20 11:43:39 +02:00

DocumentPane.svelte

vault: a lock that lets go, and seals that say what they broke

2026-10-20 01:43:45 +02:00

Editor.svelte

hyprland

2026-10-17 14:25:32 +02:00

FilePane.svelte

files: PDFs, text, code, tables and certificates open in place

2026-10-20 09:57:09 +02:00

Help.svelte

tree: several nodes picked up and moved at once

2026-10-20 11:13:52 +02:00

Icon.svelte

ui: touch parity, saves that survive outages, edits that do not collide

2026-10-20 05:53:34 +02:00

Login.svelte

ui: touch parity, saves that survive outages, edits that do not collide

2026-10-20 05:53:34 +02:00

markdown.ts

markdown: links open nothing they can reach back from

2026-10-20 11:45:11 +02:00

math.svelte.ts

markdown: math set by KaTeX, fetched only when a page has some

2026-10-20 10:25:26 +02:00

MediaBrowser.svelte

integrity: one write, one transaction, and nothing left behind

2026-10-20 01:26:47 +02:00

Outline.svelte

ui: share view in the shell, icon rail, phone polish

2026-10-17 17:27:59 +02:00

Overview.svelte

ui: share view in the shell, icon rail, phone polish

2026-10-17 17:27:59 +02:00

preview.ts

files: PDFs, text, code, tables and certificates open in place

2026-10-20 09:57:09 +02:00

Prompt.svelte

keys act on the focused pane, deletes ask y/N in place

2026-10-19 14:39:38 +02:00

Rail.svelte

tree: several nodes picked up and moved at once

2026-10-20 11:13:52 +02:00

SecretPrompt.svelte

vault prompt: appears at once and stays put between questions

2026-10-20 11:00:08 +02:00

Shared.svelte

markdown: links open nothing they can reach back from

2026-10-20 11:45:11 +02:00

Sidebar.svelte

tree: several nodes picked up and moved at once

2026-10-20 11:13:52 +02:00

StatusBar.svelte

vault: files sealed under a password that is never stored

2026-10-19 16:03:59 +02:00

store.svelte.ts

tree: several nodes picked up and moved at once

2026-10-20 11:13:52 +02:00

util.ts

vault: a lock that lets go, and seals that say what they broke

2026-10-20 01:43:45 +02:00