diff --git a/CHANGELOG.md b/CHANGELOG.md index 80d6ec51..cda50f68 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -22,6 +22,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 when the workspace HTML-embed toggle is on, can be inserted by any member (previously admin-only). Turning the toggle off hides existing embeds and stops serving them on public share pages. +- Remove the server-side role-based stripping of HTML-embed blocks from the + write paths (collab/REST/MCP, page create/duplicate, import, transclusion + unsync); sandboxing makes per-write gating unnecessary. The only remaining + server-side strip is the public-share read path, which still honors the + workspace HTML-embed toggle. ## [0.91.0] - 2026-06-18 diff --git a/apps/client/src/features/editor/components/html-embed/html-embed-sandbox.ts b/apps/client/src/features/editor/components/html-embed/html-embed-sandbox.ts index 983269f9..d4ea79f4 100644 --- a/apps/client/src/features/editor/components/html-embed/html-embed-sandbox.ts +++ b/apps/client/src/features/editor/components/html-embed/html-embed-sandbox.ts @@ -22,20 +22,42 @@ export function buildSandboxSrcdoc(source: string): string { const bootstrap = ` ")}