sandrodachandClaude Opus 5.5
b2ecda9896
MindSift CI & Docker Release / Build, Test in Container & Push (push) Successful in 1m48s
safeHref lets only http, https and mailto become links (Markdown viewer, outliner, legal links); javascript: and friends show as text. A middleware sets a Content-Security-Policy (scripts only from MindSift, no framing, connections only to this server), X-Frame-Options, nosniff, Referrer-Policy and a Permissions-Policy. The two inline scripts of index.html moved to files so script-src stays 'self'. The second inline script also deleted every cache on each page load, which undermined the offline start; it is gone. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
9 lines
413 B
JavaScript
9 lines
413 B
JavaScript
// Runs before the app: browsers fire beforeinstallprompt early, the app picks it up later
|
|
// ("App installieren"). A file instead of an inline script so the CSP can stay at script-src 'self'.
|
|
window.__deferredPwaPrompt = null;
|
|
window.addEventListener('beforeinstallprompt', function (e) {
|
|
e.preventDefault();
|
|
window.__deferredPwaPrompt = e;
|
|
window.dispatchEvent(new CustomEvent('mindsift:pwa-ready'));
|
|
});
|