Skip to content

Theming, guest view limits, custom JS, and ACL-aware rendering - #65

Closed
zhum wants to merge 6 commits into
crystallabs:masterfrom
zhum:theming-guest-acl
Closed

zhum wants to merge 6 commits into
crystallabs:masterfrom
zhum:theming-guest-acl

Conversation

@zhum

@zhum zhum commented Oct 23, 2026

Copy link
Copy Markdown

Summary

  • Theming: initial theme support (meta/themes/<theme>).
  • Custom JS: optional custom script include.
  • Guest view: guests get a reduced page view (show_guest.slang).
  • Parser: whitelists icons, headers, spans and divs in raw HTML.
  • ACL-aware rendering: links and /media images the reader can't read are replaced with a configurable label (FLUENCE_INACCESSIBLE_LABEL, FLUENCE_IMAGE_INACCESSIBLE_LABEL), and the page/media trees omit unreadable entries.
  • Merged current master; the TOC escaping spec now checks the TOC as an editor and the rendered heading as a guest, since guests no longer see the TOC.

Test plan

  • crystal spec: 106 examples, 0 failures

🤖 Generated with Claude Code

@docelic

docelic commented Oct 26, 2026 •

Copy link
Copy Markdown
Collaborator

Hello, thanks for the proposed changes.

  • There is no plan yet how languages would be supported (lang= seems a common approach, but suboptimal here)
  • Some implementation details are questionable, primary one being a stored XSS vulnerability that the PR introduces
  • Too much seems lumped into a single PR

Closing the PR, based on the mentioned criteria.

@docelic docelic closed this Oct 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants