41f3944e79
The html-embed feature toggle was enforced CLIENT-side in the NodeView (reads settings.htmlEmbed from the logged-in workspace), so an anonymous public-share viewer — who has no workspace context — always saw it as OFF and got a placeholder instead of the executing embed. That broke the whole point (a tracker must run for anonymous visitors). Make it server-authoritative: - share.service prepareContentForShare (the single path both share-content flows use) strips htmlEmbed from served content when the workspace toggle is OFF; both callers (updatePublicAttachments host page + lookupTransclusionForShare) resolve the toggle once and pass it. Fail-closed: missing workspace -> OFF -> stripped. - NodeView executes whatever it was served in read-only/share mode (shouldExecute = !editor.isEditable || htmlEmbedEnabled); the disabled placeholder now only shows in the editable editor when OFF. Net: anonymous share + toggle ON -> server serves the (admin-authored) embed -> it executes for everyone; toggle OFF -> stripped server-side from every share-content path (true kill switch); a non-admin embed can never be served (save-path strip). No XSS regression in the editable editor. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
A progressive Node.js framework for building efficient and scalable server-side applications.
Description
Nest framework TypeScript starter repository.
Installation
$ npm install
Running the app
# development
$ npm run start
# watch mode
$ npm run start:dev
# production mode
$ npm run start:prod
Migrations
# This creates a new empty migration file named 'init'
$ npm run migration:create --name=init
# Generates 'init' migration file from existing entities to update the database schema
$ npm run migration:generate --name=init
# Runs all pending migrations to update the database schema
$ npm run migration:run
# Reverts the last executed migration
$ npm run migration:revert
# Reverts all migrations
$ npm run migration:revert
# Shows the list of executed and pending migrations
$ npm run migration:show
## Test
```bash
# unit tests
$ npm run test
# e2e tests
$ npm run test:e2e
# test coverage
$ npm run test:cov
Support
Nest is an MIT-licensed open source project. It can grow thanks to the sponsors and support by the amazing backers. If you'd like to join them, please read more here.
Stay in touch
- Author - Kamil Myśliwiec
- Website - https://nestjs.com
- Twitter - @nestframework
License
Nest is MIT licensed.