Unclosed $ delimiters would span across multiple lines, causing
protectMathPipes() to corrupt table cell delimiters in unrelated
content. Limit inline math matching to the same line to prevent
false matches.
Co-authored-by: Claude <noreply@anthropic.com>
AI-model: kimi-for-coding/k2p6
Wiki.js uses markdown-it-attrs which interprets curly braces inside
inline math ($...$) as attribute directives, stripping them from the
formula. Additionally, markdown table parsers split cells at both `|`
and `&` characters, breaking formulas containing those symbols.
This fix replaces `{`, `}`, `|`, and `&` inside math expressions with
Unicode Private Use Area placeholders during markdown parsing, then
restores them before passing to KaTeX/MathJax for rendering.
- `<E000>` / `<E001>`: temporary replacements for `{` / `}`
- `<E002>`: temporary replacement for `|` (table cell delimiter)
- `<E003>`: temporary replacement for `&` (table cell delimiter in
multiline tables, used by LaTeX cases/arrays)
The placeholder approach was chosen over HTML escaping because it
preserves LaTeX environments like `\begin{array}` that were broken
by the previous `{{}}` escaping method.
Fixes#1581Fixes#1462
Co-authored-by: Claude <noreply@anthropic.com>
AI-model: kimi-for-coding/k2p6
The onConnect handler for GraphQL subscriptions was empty, allowing any
client to establish a WebSocket connection and subscribe to loggingLiveTrail
without authentication. Added JWT verification in onConnect using the same
RS256 credentials and permission checks (manage:system) used elsewhere.
Co-authored-by: kolega.dev <faizan@kolega.ai>
The loginRedirect cookie value was used directly in res.redirect() and
window.location.replace() without validation, allowing redirection to
arbitrary external URLs. Added validation to ensure the redirect target
is a relative path before use.
Co-authored-by: kolega.dev <faizan@kolega.ai>
* fix: Apply theme style to embedded diagram (#7903)
When diagrams are created with "adaptive colors" they automatically
change to light-/darkmode depending on the browser preference. This
leads to rendering problems when the settings in the browser differ
from the wiki.js theme setting.
Fixes#7677
* fix: Update color scheme for SVG in diagram class
Refactor SVG color scheme handling in diagram class.
* fix: remove duplicate svg first-child class
Removed unnecessary direction property from first SVG in diagram.
---------
Co-authored-by: Nicolas Giard <github@ngpixel.com>
This commit resolves the recurring issue where password managers
incorrectly autofill the header search bar when viewing the user
profile page.
This is achieved by wrapping the password change fields in a <form>
element, properly scoping them for browser autofill logic, and using
modern, standard `autocomplete` attributes. This addresses the root
cause of the issue, whereas previous attempts tried to mitigate the
symptom in the search bar.
Fixes#2324Closes#3327
* feat: Add link to admin area on welcome page
See: #1259
* fix: remove trailing slash from welcome admin button
* fix: welcome page admin button link
Co-authored-by: Nicolas Giard <github@ngpixel.com>