hacklab/OASIS_MOBILE
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Harden mobile quick bar: render only on mobile, drop inline style

Browse source 
renderBottomBar now returns early when OASIS_MOBILE !== '1' (same guard
as renderHiveNav), instead of emitting an inline style="display:none" to
hide it on desktop. The localhost CSP is style-src 'self' without
unsafe-inline, so that inline attribute was blocked there and the bar
could show on the Linux build. Rendering the bar only on mobile removes
the inline style entirely and keeps desktop unaffected.

No change to mobile output (the bar already rendered without inline
style on mobile). Follow-up from the UX security review.
This commit is contained in:
s1to 2026-08-01 15:14:18 +02:00
parent 8ab1cf6d18
commit 1f7d51e6b1
1 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
src/views/main_views.js
View file

@ -1160,6 +1160,7 @@ const PINNABLE_MODULES = [
exports.PINNABLE_MODULES = PINNABLE_MODULES;
const renderBottomBar = () => {
if (process.env.OASIS_MOBILE !== '1') return "";
const inboxN = sharedState.getInboxCount();
const cfg = getConfig();
const modOn = (m) => !m || cfg.modules[m] === 'on' || cfg.modules[m] === undefined;
@ -1185,7 +1186,7 @@ const renderBottomBar = () => {
const pair = [ bbLink("/peers", "⧖", i18n.peers || "Peers") ];
if (modOn('invitesMod')) pair.push(bbLink("/invites", "ꔮ", i18n.invites || "Invites"));
return nav(
{ class: "oasis-bottombar", ...(process.env.OASIS_MOBILE === '1' ? {} : { style: "display:none" }), "aria-label": i18n.bbQuickActions || "Quick actions" },
{ class: "oasis-bottombar", "aria-label": i18n.bbQuickActions || "Quick actions" },
...slots,
editSlot,
div({ class: "bb-pair" }, ...pair)