From 1f7d51e6b10fa9bbeb236ba49581042188b6d0d3 Mon Sep 17 00:00:00 2001 From: s1to Date: Sat, 1 Aug 2026 15:14:18 +0200 Subject: [PATCH] Harden mobile quick bar: render only on mobile, drop inline style renderBottomBar now returns early when OASIS_MOBILE !== '1' (same guard as renderHiveNav), instead of emitting an inline style="display:none" to hide it on desktop. The localhost CSP is style-src 'self' without unsafe-inline, so that inline attribute was blocked there and the bar could show on the Linux build. Rendering the bar only on mobile removes the inline style entirely and keeps desktop unaffected. No change to mobile output (the bar already rendered without inline style on mobile). Follow-up from the UX security review. --- src/views/main_views.js | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/views/main_views.js b/src/views/main_views.js index 0840de4..1f96e7e 100644 --- a/src/views/main_views.js +++ b/src/views/main_views.js @@ -1160,6 +1160,7 @@ const PINNABLE_MODULES = [ exports.PINNABLE_MODULES = PINNABLE_MODULES; const renderBottomBar = () => { + if (process.env.OASIS_MOBILE !== '1') return ""; const inboxN = sharedState.getInboxCount(); const cfg = getConfig(); const modOn = (m) => !m || cfg.modules[m] === 'on' || cfg.modules[m] === undefined; @@ -1185,7 +1186,7 @@ const renderBottomBar = () => { const pair = [ bbLink("/peers", "⧖", i18n.peers || "Peers") ]; if (modOn('invitesMod')) pair.push(bbLink("/invites", "ꔮ", i18n.invites || "Invites")); return nav( - { class: "oasis-bottombar", ...(process.env.OASIS_MOBILE === '1' ? {} : { style: "display:none" }), "aria-label": i18n.bbQuickActions || "Quick actions" }, + { class: "oasis-bottombar", "aria-label": i18n.bbQuickActions || "Quick actions" }, ...slots, editSlot, div({ class: "bb-pair" }, ...pair)