7dd4f2db99
- Attachments render inline only from config.mediaHosts (default upload.<domain>). Media from other hosts stays a link, so a stranger's message can't make the browser fetch from their server, and it matches the CSP planned in PLAN.md (now spelled out there). - Images, audio and video that fail to load — typically deleted after the upload service's one-week expiry — fall back to a file link with "No longer available on the server". - Test for the host rule (15 tests). Checked in a browser: expired file falls back; foreign image stays a link with zero requests to its host. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
11 lines
446 B
JavaScript
11 lines
446 B
JavaScript
// Development defaults. In production, Nix writes this file per host
|
|
// (websocket, domains, name, palette) and the build stays identical.
|
|
window.config = {
|
|
name: "0ff chat",
|
|
// Relative paths resolve against the page's own origin (ws: or wss:).
|
|
websocket: "/xmpp-websocket",
|
|
domain: "0ff.space",
|
|
mucDomain: "muc.0ff.space",
|
|
// Attachments from these hosts are shown inline; others stay links.
|
|
mediaHosts: ["upload.0ff.space"],
|
|
};
|