release: v0.18.0 (#725)
Release v0.18.0 — merges `dev` into `main`.
## Thanks
- [@lancetm714](https://github.com/lancetm714) for the accent-contrast
fix (#680 → #724).
- [@RichKidsDev](https://github.com/RichKidsDev) for reporting the
outdated Impressum (#697).
### Security
- **Journal drafts and password-protected entries no longer render
publicly
as a subpage essay**
([#684](https://github.com/ralksta/immich-folio/pull/684),
[GHSA-987w-cpwm-c9g9](https://github.com/ralksta/immich-folio/security/advisories/GHSA-987w-cpwm-c9g9),
medium). A subpage's `essayFile` read the journal entry straight from
disk,
skipping the draft and password rules `/journal/<slug>` applies. It now
resolves through the same rules: a draft reads as missing for visitors,
and
a protected entry shows its password gate, sharing the
`lb_auth_journal_<slug>` cookie.
- **Immich descriptions are escaped in generated subpage essays**
([#684](https://github.com/ralksta/immich-folio/pull/684),
[GHSA-8ppx-39jv-q5xm](https://github.com/ralksta/immich-folio/security/advisories/GHSA-8ppx-39jv-q5xm),
low). The essay built from a subpage's albums (`layout: essay` without
markdown) put each asset's Immich description into the page as raw HTML.
Captions are now HTML-escaped, and they go through `assetCaption()`, so
`exif.caption: false` is respected there as well. Tracked in
[#689](https://github.com/ralksta/immich-folio/issues/689).
- **Admin drafts no longer keep a typed password, and the contact form's
email check runs in linear time**
([#727](https://github.com/ralksta/immich-folio/pull/727)). The admin's
session drafts wrote a password as typed to `sessionStorage`; a draft
holding a plaintext password is now not kept (the unsaved-changes guard
still warns). The email pattern could backtrack polynomially on a
crafted
domain; its labels now exclude the dot and the length is checked first.
Both found by CodeQL before release.
### Added
- **A built-in contact form with an inbox in the admin**
([#703](https://github.com/ralksta/immich-folio/pull/703), closes
[#702](https://github.com/ralksta/immich-folio/issues/702)). `/contact`
needs neither SMTP nor a form service: each message is one file in
`content/messages/` (mode `0600`), read under the new _Messages_ tab,
where
_Reply by email_ opens the owner's mail client with the message quoted.
Messages older than `contact.retentionDays` (default 90) are deleted. An
optional ntfy push goes to `contact.notifyUrl` or `CONTACT_NOTIFY_URL`,
and
since [#709](https://github.com/ralksta/immich-folio/pull/709) it
carries a
fixed "new message" line and nothing about the sender — no name, no
address, no text. Spam is kept out without a captcha: an off-screen
honeypot, a minimum fill time, three submissions a minute per IP and a
cap
of 500 stored messages. With the Impressum on and no `legal.contactUrl`,
the Impressum links the form as its second contact channel. A new doctor
check warns when the form is on but nobody is notified.
- **A privacy policy page, next to a list of what the site processes**
([#708](https://github.com/ralksta/immich-folio/pull/708)). `/privacy`
renders `content/privacy.md`, edited under Settings → Legal, and the
footer
links it once the file has text; `privacy.enabled: false` hides it.
Folio
writes no legal text. Beside the editor it lists what _this_
installation
does, read off the configuration — the map, statistics, contact form,
password cookies, CDN — and marks every entry that involves a third
party.
_Insert headings_ adds the matching section headings and nothing else.
The
doctor warns while the Impressum is on and there is no policy.
- **French, Spanish, Italian and Dutch interface translations**
([#681](https://github.com/ralksta/immich-folio/pull/681)), selected
with
`settings.yaml: lang` as before. The admin panel stays English.
- **CDN mode for photos and videos**
([#681](https://github.com/ralksta/immich-folio/pull/681)). With
`CDN_URL`
set, image and video URLs point at a pull CDN whose origin is this
server,
so repeat views reach neither the server nor Immich. A site password
switches the mode off, since a CDN would hand out cached photos without
checking the unlock cookie. The CDN origin is added to the CSP, and a
doctor check covers the password and `TRUSTED_PROXY_HOPS` cases. See
`docs/deployment.md#cdn-mode`.
- **A reworked admin panel**
([#712](https://github.com/ralksta/immich-folio/pull/712),
[#713](https://github.com/ralksta/immich-folio/pull/713),
[#714](https://github.com/ralksta/immich-folio/pull/714),
[#716](https://github.com/ralksta/immich-folio/pull/716),
[#717](https://github.com/ralksta/immich-folio/pull/717),
[#718](https://github.com/ralksta/immich-folio/pull/718),
[#719](https://github.com/ralksta/immich-folio/pull/719),
[#721](https://github.com/ralksta/immich-folio/pull/721)):
- **A sidebar instead of the header row**, grouped by task, with an
unread
count on Messages and a dot on Diagnostics while Immich is down. It
collapses to an icon rail, with names shown on hover and focus, and
remembers that per browser.
- **`/admin` is an overview**: what needs attention (unread messages,
doctor warnings), published pages, journal entries and recent views.
- **The site's own visual language** — the preset's fonts, hairline
borders, the square marker — and one page header on every screen. The
accent is kept for the current place and the primary action; switches
are now pills reading ON or OFF, in green rather than the accent, so
Studio Modern's red no longer makes an enabled setting look like an
error.
- **The page builder is a structure list and a panel.** Hero, subpages
and
standalone albums sit in one list on the left, subpages drag-sorted in
place; the selected entry is edited on the right instead of in an
overlay.
- **Dialogs only where a change is permanent.** Deleting a message or a
journal entry, and resetting the favicon (which used to delete the file
without asking), go through one confirm dialog in the admin's own look.
Removals in the page builder, which only touch unsaved state, happen at
once and offer _Undo_. No `window.confirm()` is left.
- **Feature switches are grouped by meaning** as one-line rows under
Settings → General; page transitions and scroll-to-top moved to Theme →
Look & motion. No setting keys changed.
### Changed
- **Fonts and the Leaflet stylesheet are served from the site itself**
([#700](https://github.com/ralksta/immich-folio/pull/700)). Every page
used
to link `fonts.googleapis.com`, which sends each visitor's IP address to
Google. The server now fetches a theme's Google fonts once, rewrites the
stylesheet and caches the files in `content/.fonts/`; custom fonts in
`theme.fonts` keep working. If Google cannot be reached before a font is
cached, the page falls back to the theme's system fonts. `leaflet.css`
comes from the npm package instead of unpkg. The CSP drops
`fonts.googleapis.com`, `fonts.gstatic.com` and `unpkg.com`.
- **Email addresses are kept out of the served HTML**
([#705](https://github.com/ralksta/immich-folio/pull/705)). The
Impressum
and footer render the address only after hydration, from an encoded
form,
so harvesters reading raw HTML find nothing. Without JavaScript the
Impressum shows `name [at] example [dot] de`. This defeats bulk
harvesting,
not a person with a browser.
- **The Impressum cites § 5 DDG and links its contacts**
([#698](https://github.com/ralksta/immich-folio/pull/698), reported in
[#697](https://github.com/ralksta/immich-folio/issues/697) by
[@RichKidsDev](https://github.com/RichKidsDev)). The TMG was replaced by
the
DDG in May 2024; `legal.heading` replaces the line for other laws (e.g.
§ 5 ECG in Austria). `legal.contactUrl` and `legal.contactLabel` add a
contact form as the second channel, so a phone number stays optional.
Email, phone and contact URL are now links, and the "Created with the
Impressum generator by eRecht24" line, shown on every site whether true
or
not, is gone. Settings → Legal gains fields for heading, contact URL,
VAT
ID and tax number, and a doctor check flags missing details.
- **Missing pages answer `404`**
([#704](https://github.com/ralksta/immich-folio/pull/704)). Every
missing
page used to answer `200`, because streaming had started before
`notFound()` ran. `/contact`, `/impressum`, `/map` and `/privacy` while
switched off, and `/journal/<slug>` without an entry, now return a real
404 with the same not-found page. Album and subpage slugs still depend
on
Immich and stay soft 404s.
- **Passwords set in the admin are stored as scrypt hashes**
([#706](https://github.com/ralksta/immich-folio/pull/706), closes
[#690](https://github.com/ralksta/immich-folio/issues/690)). Subpage,
album, journal-entry and site passwords were written as typed. The save
routes now hash them; a stored hash reads _Protected_ with _Change_ and
_Remove_ and is never put into an input. Visitors who unlocked a page
stay
signed in across unrelated saves. Existing plaintext passwords are
hashed
the next time their file is saved in the admin.
- **One notification surface in the admin**
([#707](https://github.com/ralksta/immich-folio/pull/707)) replaces
every
`alert()`: errors stay until dismissed, successes clear themselves, and
screen readers announce both.
### Fixed
- **Map tiles load again**
([#701](https://github.com/ralksta/immich-folio/pull/701)). CARTO
started
answering every tile with an "API KEY REQUIRED" image, leaving `/map`
and
journal map blocks as a grey grid. Tiles now come from OpenStreetMap;
the
dark look is a CSS filter, so the map now follows the colour mode.
- **The page builder no longer drops a subpage's `proofing:` flag on
save**
([#711](https://github.com/ralksta/immich-folio/pull/711)). A page
switched
off for proofing by hand reverted after any unrelated edit.
- **Unsaved edits in Settings and About survive switching admin tabs,
and a
backup restore is no longer overwritten by the next save**
([#687](https://github.com/ralksta/immich-folio/pull/687)). Editors that
were open during a restore now reload and offer unsaved edits back as a
conflict. Also: "Restore my changes" after a conflict found nothing,
removing an album left its drawer showing the next album, and the
journal
saved (rotating a backup) without changes.
- **Accent-backed buttons stay readable with a light or malformed
accent**
([#724](https://github.com/ralksta/immich-folio/pull/724), supersedes
[#680](https://github.com/ralksta/immich-folio/pull/680)) — contributed
by
[@lancetm714](https://github.com/lancetm714). A white accent made the
proofing dialog's _Download selected (.zip)_ button white on white.
`theme.accent` is now accepted as hex only and normalised to `#rrggbb`,
anything else falls back to the preset, and the proofing dialog and
filter
pills use the mode-aware `--on-accent` text colour from #688.
- **Every preset's accent is visible in both colour modes**
([#688](https://github.com/ralksta/immich-folio/pull/688)). Presets had
one
accent for both modes; minimal's dark mode drew black buttons on black.
Presets now carry a light and a dark accent, and text on accent-filled
buttons picks black or white for contrast. A custom accent stays the
owner's choice in both modes.
- **Visitor-side inconsistencies**
([#685](https://github.com/ralksta/immich-folio/pull/685)): after
visiting
`/impressum`, every subpage header turned centred and uppercase; back
links
announced "Back to Back to …"; the hero EXIF chip ignored
`exif.location`/`camera`/`settings`; videos in journal entries opened as
stills; the setup screen named a non-existent `.env.example`.
- **An essay's lightbox walks only the photos the story shows**
([#686](https://github.com/ralksta/immich-folio/pull/686)), not every
photo
of the subpage's albums, and the proofing bar in essays shows the
selection
count instead of a filter button that did nothing.
- **The page panel scrolls with the mouse wheel**
([#720](https://github.com/ralksta/immich-folio/pull/720)).
- **The journal editor's top bar wraps on phones**
([#723](https://github.com/ralksta/immich-folio/pull/723), closes
[#675](https://github.com/ralksta/immich-folio/issues/675)), so the
title
stays editable and Save stays on screen.
- **Every admin form field has a name for assistive technology**
([#715](https://github.com/ralksta/immich-folio/pull/715)). Only two
inputs
had a linked label; 47 are linked now, and clicking a label focuses its
field.
### Internal
- **`SettingsEditor` and `PageBuilder` are split up**
([#710](https://github.com/ralksta/immich-folio/pull/710),
[#711](https://github.com/ralksta/immich-folio/pull/711)). The
2,200-line
settings editor is a shell with one file per section; the page builder's
YAML handling and edits are pure functions under test. Both were checked
side by side against `dev` for identical output.
- **`useAdminFetch()`**
([#707](https://github.com/ralksta/immich-folio/pull/707))
gives Analytics, Messages, Backups and the journal list one loading and
error pattern.
- README brought up to v0.17.0
([#678](https://github.com/ralksta/immich-folio/pull/678),
[#679](https://github.com/ralksta/immich-folio/pull/679)).
### Upgrade notes
**`content/` gains two directories the app writes to:**
`content/.fonts/`
for the cached fonts and `content/messages/` for contact-form messages.
Both
are created on demand, so a writable `content/` is enough, as before.
**The server needs outbound HTTPS to Google once per font** to fill the
font
cache. Until then pages fall back to the theme's system fonts. Visitors'
browsers no longer contact Google.
**A custom CSP or reverse-proxy allowlist** must now allow
`tile.openstreetmap.org` for images instead of
`*.basemaps.cartocdn.com`,
and no longer needs `fonts.googleapis.com`, `fonts.gstatic.com` or
`unpkg.com`. The built-in CSP is updated.
**`theme.accent` must be hex** (`#rgb`, `#rrggbb` or `#rrggbbaa`).
Anything
else, including a value without `#`, falls back to the preset's accent.
**Plaintext passwords in `gallery.yaml`, `settings.yaml` or journal
entries**
are hashed the next time that file is saved in the admin; one save
clears the
doctor's warning.
**New, optional settings:** `contact.*` (the form is off by default),
`privacy.enabled`, `legal.heading`, `legal.contactUrl`,
`legal.contactLabel`,
and the `CDN_URL` and `CONTACT_NOTIFY_URL` environment variables. See
`content/settings.yaml.example` and `.env.local.example`. In the example
file,
`vatId` and `taxId` had swapped sample values; check yours if you copied
them.
No `IMAGE_CACHE_VERSION` bump is needed this time.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>
2026-09-27 14:43:38 +02:00
|
|
|
'use client';
|
|
|
|
|
|
|
|
|
|
import { useState } from 'react';
|
|
|
|
|
import * as Icons from '../Icons';
|
|
|
|
|
import type { SaveStatus } from '../SaveBar';
|
|
|
|
|
import { resolveExifDisplay } from '@/lib/config/schema';
|
2026-10-02 18:14:23 +02:00
|
|
|
import { SUPPORTED_LOCALES, getDictionary, resolveLocale } from '@/lib/i18n';
|
release: v0.18.0 (#725)
Release v0.18.0 — merges `dev` into `main`.
## Thanks
- [@lancetm714](https://github.com/lancetm714) for the accent-contrast
fix (#680 → #724).
- [@RichKidsDev](https://github.com/RichKidsDev) for reporting the
outdated Impressum (#697).
### Security
- **Journal drafts and password-protected entries no longer render
publicly
as a subpage essay**
([#684](https://github.com/ralksta/immich-folio/pull/684),
[GHSA-987w-cpwm-c9g9](https://github.com/ralksta/immich-folio/security/advisories/GHSA-987w-cpwm-c9g9),
medium). A subpage's `essayFile` read the journal entry straight from
disk,
skipping the draft and password rules `/journal/<slug>` applies. It now
resolves through the same rules: a draft reads as missing for visitors,
and
a protected entry shows its password gate, sharing the
`lb_auth_journal_<slug>` cookie.
- **Immich descriptions are escaped in generated subpage essays**
([#684](https://github.com/ralksta/immich-folio/pull/684),
[GHSA-8ppx-39jv-q5xm](https://github.com/ralksta/immich-folio/security/advisories/GHSA-8ppx-39jv-q5xm),
low). The essay built from a subpage's albums (`layout: essay` without
markdown) put each asset's Immich description into the page as raw HTML.
Captions are now HTML-escaped, and they go through `assetCaption()`, so
`exif.caption: false` is respected there as well. Tracked in
[#689](https://github.com/ralksta/immich-folio/issues/689).
- **Admin drafts no longer keep a typed password, and the contact form's
email check runs in linear time**
([#727](https://github.com/ralksta/immich-folio/pull/727)). The admin's
session drafts wrote a password as typed to `sessionStorage`; a draft
holding a plaintext password is now not kept (the unsaved-changes guard
still warns). The email pattern could backtrack polynomially on a
crafted
domain; its labels now exclude the dot and the length is checked first.
Both found by CodeQL before release.
### Added
- **A built-in contact form with an inbox in the admin**
([#703](https://github.com/ralksta/immich-folio/pull/703), closes
[#702](https://github.com/ralksta/immich-folio/issues/702)). `/contact`
needs neither SMTP nor a form service: each message is one file in
`content/messages/` (mode `0600`), read under the new _Messages_ tab,
where
_Reply by email_ opens the owner's mail client with the message quoted.
Messages older than `contact.retentionDays` (default 90) are deleted. An
optional ntfy push goes to `contact.notifyUrl` or `CONTACT_NOTIFY_URL`,
and
since [#709](https://github.com/ralksta/immich-folio/pull/709) it
carries a
fixed "new message" line and nothing about the sender — no name, no
address, no text. Spam is kept out without a captcha: an off-screen
honeypot, a minimum fill time, three submissions a minute per IP and a
cap
of 500 stored messages. With the Impressum on and no `legal.contactUrl`,
the Impressum links the form as its second contact channel. A new doctor
check warns when the form is on but nobody is notified.
- **A privacy policy page, next to a list of what the site processes**
([#708](https://github.com/ralksta/immich-folio/pull/708)). `/privacy`
renders `content/privacy.md`, edited under Settings → Legal, and the
footer
links it once the file has text; `privacy.enabled: false` hides it.
Folio
writes no legal text. Beside the editor it lists what _this_
installation
does, read off the configuration — the map, statistics, contact form,
password cookies, CDN — and marks every entry that involves a third
party.
_Insert headings_ adds the matching section headings and nothing else.
The
doctor warns while the Impressum is on and there is no policy.
- **French, Spanish, Italian and Dutch interface translations**
([#681](https://github.com/ralksta/immich-folio/pull/681)), selected
with
`settings.yaml: lang` as before. The admin panel stays English.
- **CDN mode for photos and videos**
([#681](https://github.com/ralksta/immich-folio/pull/681)). With
`CDN_URL`
set, image and video URLs point at a pull CDN whose origin is this
server,
so repeat views reach neither the server nor Immich. A site password
switches the mode off, since a CDN would hand out cached photos without
checking the unlock cookie. The CDN origin is added to the CSP, and a
doctor check covers the password and `TRUSTED_PROXY_HOPS` cases. See
`docs/deployment.md#cdn-mode`.
- **A reworked admin panel**
([#712](https://github.com/ralksta/immich-folio/pull/712),
[#713](https://github.com/ralksta/immich-folio/pull/713),
[#714](https://github.com/ralksta/immich-folio/pull/714),
[#716](https://github.com/ralksta/immich-folio/pull/716),
[#717](https://github.com/ralksta/immich-folio/pull/717),
[#718](https://github.com/ralksta/immich-folio/pull/718),
[#719](https://github.com/ralksta/immich-folio/pull/719),
[#721](https://github.com/ralksta/immich-folio/pull/721)):
- **A sidebar instead of the header row**, grouped by task, with an
unread
count on Messages and a dot on Diagnostics while Immich is down. It
collapses to an icon rail, with names shown on hover and focus, and
remembers that per browser.
- **`/admin` is an overview**: what needs attention (unread messages,
doctor warnings), published pages, journal entries and recent views.
- **The site's own visual language** — the preset's fonts, hairline
borders, the square marker — and one page header on every screen. The
accent is kept for the current place and the primary action; switches
are now pills reading ON or OFF, in green rather than the accent, so
Studio Modern's red no longer makes an enabled setting look like an
error.
- **The page builder is a structure list and a panel.** Hero, subpages
and
standalone albums sit in one list on the left, subpages drag-sorted in
place; the selected entry is edited on the right instead of in an
overlay.
- **Dialogs only where a change is permanent.** Deleting a message or a
journal entry, and resetting the favicon (which used to delete the file
without asking), go through one confirm dialog in the admin's own look.
Removals in the page builder, which only touch unsaved state, happen at
once and offer _Undo_. No `window.confirm()` is left.
- **Feature switches are grouped by meaning** as one-line rows under
Settings → General; page transitions and scroll-to-top moved to Theme →
Look & motion. No setting keys changed.
### Changed
- **Fonts and the Leaflet stylesheet are served from the site itself**
([#700](https://github.com/ralksta/immich-folio/pull/700)). Every page
used
to link `fonts.googleapis.com`, which sends each visitor's IP address to
Google. The server now fetches a theme's Google fonts once, rewrites the
stylesheet and caches the files in `content/.fonts/`; custom fonts in
`theme.fonts` keep working. If Google cannot be reached before a font is
cached, the page falls back to the theme's system fonts. `leaflet.css`
comes from the npm package instead of unpkg. The CSP drops
`fonts.googleapis.com`, `fonts.gstatic.com` and `unpkg.com`.
- **Email addresses are kept out of the served HTML**
([#705](https://github.com/ralksta/immich-folio/pull/705)). The
Impressum
and footer render the address only after hydration, from an encoded
form,
so harvesters reading raw HTML find nothing. Without JavaScript the
Impressum shows `name [at] example [dot] de`. This defeats bulk
harvesting,
not a person with a browser.
- **The Impressum cites § 5 DDG and links its contacts**
([#698](https://github.com/ralksta/immich-folio/pull/698), reported in
[#697](https://github.com/ralksta/immich-folio/issues/697) by
[@RichKidsDev](https://github.com/RichKidsDev)). The TMG was replaced by
the
DDG in May 2024; `legal.heading` replaces the line for other laws (e.g.
§ 5 ECG in Austria). `legal.contactUrl` and `legal.contactLabel` add a
contact form as the second channel, so a phone number stays optional.
Email, phone and contact URL are now links, and the "Created with the
Impressum generator by eRecht24" line, shown on every site whether true
or
not, is gone. Settings → Legal gains fields for heading, contact URL,
VAT
ID and tax number, and a doctor check flags missing details.
- **Missing pages answer `404`**
([#704](https://github.com/ralksta/immich-folio/pull/704)). Every
missing
page used to answer `200`, because streaming had started before
`notFound()` ran. `/contact`, `/impressum`, `/map` and `/privacy` while
switched off, and `/journal/<slug>` without an entry, now return a real
404 with the same not-found page. Album and subpage slugs still depend
on
Immich and stay soft 404s.
- **Passwords set in the admin are stored as scrypt hashes**
([#706](https://github.com/ralksta/immich-folio/pull/706), closes
[#690](https://github.com/ralksta/immich-folio/issues/690)). Subpage,
album, journal-entry and site passwords were written as typed. The save
routes now hash them; a stored hash reads _Protected_ with _Change_ and
_Remove_ and is never put into an input. Visitors who unlocked a page
stay
signed in across unrelated saves. Existing plaintext passwords are
hashed
the next time their file is saved in the admin.
- **One notification surface in the admin**
([#707](https://github.com/ralksta/immich-folio/pull/707)) replaces
every
`alert()`: errors stay until dismissed, successes clear themselves, and
screen readers announce both.
### Fixed
- **Map tiles load again**
([#701](https://github.com/ralksta/immich-folio/pull/701)). CARTO
started
answering every tile with an "API KEY REQUIRED" image, leaving `/map`
and
journal map blocks as a grey grid. Tiles now come from OpenStreetMap;
the
dark look is a CSS filter, so the map now follows the colour mode.
- **The page builder no longer drops a subpage's `proofing:` flag on
save**
([#711](https://github.com/ralksta/immich-folio/pull/711)). A page
switched
off for proofing by hand reverted after any unrelated edit.
- **Unsaved edits in Settings and About survive switching admin tabs,
and a
backup restore is no longer overwritten by the next save**
([#687](https://github.com/ralksta/immich-folio/pull/687)). Editors that
were open during a restore now reload and offer unsaved edits back as a
conflict. Also: "Restore my changes" after a conflict found nothing,
removing an album left its drawer showing the next album, and the
journal
saved (rotating a backup) without changes.
- **Accent-backed buttons stay readable with a light or malformed
accent**
([#724](https://github.com/ralksta/immich-folio/pull/724), supersedes
[#680](https://github.com/ralksta/immich-folio/pull/680)) — contributed
by
[@lancetm714](https://github.com/lancetm714). A white accent made the
proofing dialog's _Download selected (.zip)_ button white on white.
`theme.accent` is now accepted as hex only and normalised to `#rrggbb`,
anything else falls back to the preset, and the proofing dialog and
filter
pills use the mode-aware `--on-accent` text colour from #688.
- **Every preset's accent is visible in both colour modes**
([#688](https://github.com/ralksta/immich-folio/pull/688)). Presets had
one
accent for both modes; minimal's dark mode drew black buttons on black.
Presets now carry a light and a dark accent, and text on accent-filled
buttons picks black or white for contrast. A custom accent stays the
owner's choice in both modes.
- **Visitor-side inconsistencies**
([#685](https://github.com/ralksta/immich-folio/pull/685)): after
visiting
`/impressum`, every subpage header turned centred and uppercase; back
links
announced "Back to Back to …"; the hero EXIF chip ignored
`exif.location`/`camera`/`settings`; videos in journal entries opened as
stills; the setup screen named a non-existent `.env.example`.
- **An essay's lightbox walks only the photos the story shows**
([#686](https://github.com/ralksta/immich-folio/pull/686)), not every
photo
of the subpage's albums, and the proofing bar in essays shows the
selection
count instead of a filter button that did nothing.
- **The page panel scrolls with the mouse wheel**
([#720](https://github.com/ralksta/immich-folio/pull/720)).
- **The journal editor's top bar wraps on phones**
([#723](https://github.com/ralksta/immich-folio/pull/723), closes
[#675](https://github.com/ralksta/immich-folio/issues/675)), so the
title
stays editable and Save stays on screen.
- **Every admin form field has a name for assistive technology**
([#715](https://github.com/ralksta/immich-folio/pull/715)). Only two
inputs
had a linked label; 47 are linked now, and clicking a label focuses its
field.
### Internal
- **`SettingsEditor` and `PageBuilder` are split up**
([#710](https://github.com/ralksta/immich-folio/pull/710),
[#711](https://github.com/ralksta/immich-folio/pull/711)). The
2,200-line
settings editor is a shell with one file per section; the page builder's
YAML handling and edits are pure functions under test. Both were checked
side by side against `dev` for identical output.
- **`useAdminFetch()`**
([#707](https://github.com/ralksta/immich-folio/pull/707))
gives Analytics, Messages, Backups and the journal list one loading and
error pattern.
- README brought up to v0.17.0
([#678](https://github.com/ralksta/immich-folio/pull/678),
[#679](https://github.com/ralksta/immich-folio/pull/679)).
### Upgrade notes
**`content/` gains two directories the app writes to:**
`content/.fonts/`
for the cached fonts and `content/messages/` for contact-form messages.
Both
are created on demand, so a writable `content/` is enough, as before.
**The server needs outbound HTTPS to Google once per font** to fill the
font
cache. Until then pages fall back to the theme's system fonts. Visitors'
browsers no longer contact Google.
**A custom CSP or reverse-proxy allowlist** must now allow
`tile.openstreetmap.org` for images instead of
`*.basemaps.cartocdn.com`,
and no longer needs `fonts.googleapis.com`, `fonts.gstatic.com` or
`unpkg.com`. The built-in CSP is updated.
**`theme.accent` must be hex** (`#rgb`, `#rrggbb` or `#rrggbbaa`).
Anything
else, including a value without `#`, falls back to the preset's accent.
**Plaintext passwords in `gallery.yaml`, `settings.yaml` or journal
entries**
are hashed the next time that file is saved in the admin; one save
clears the
doctor's warning.
**New, optional settings:** `contact.*` (the form is off by default),
`privacy.enabled`, `legal.heading`, `legal.contactUrl`,
`legal.contactLabel`,
and the `CDN_URL` and `CONTACT_NOTIFY_URL` environment variables. See
`content/settings.yaml.example` and `.env.local.example`. In the example
file,
`vatId` and `taxId` had swapped sample values; check yours if you copied
them.
No `IMAGE_CACHE_VERSION` bump is needed this time.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>
2026-09-27 14:43:38 +02:00
|
|
|
import { FeatureGroup, FeatureRow, SettingRow } from './fields';
|
|
|
|
|
import type { SectionProps } from './types';
|
|
|
|
|
import { useConfirm } from '../ConfirmDialog';
|
|
|
|
|
|
2026-10-02 18:14:23 +02:00
|
|
|
export default function GeneralSection({
|
|
|
|
|
settings,
|
|
|
|
|
update,
|
|
|
|
|
updateMany,
|
|
|
|
|
siteTitleEnv,
|
|
|
|
|
}: SectionProps & { siteTitleEnv?: string | null }) {
|
release: v0.18.0 (#725)
Release v0.18.0 — merges `dev` into `main`.
## Thanks
- [@lancetm714](https://github.com/lancetm714) for the accent-contrast
fix (#680 → #724).
- [@RichKidsDev](https://github.com/RichKidsDev) for reporting the
outdated Impressum (#697).
### Security
- **Journal drafts and password-protected entries no longer render
publicly
as a subpage essay**
([#684](https://github.com/ralksta/immich-folio/pull/684),
[GHSA-987w-cpwm-c9g9](https://github.com/ralksta/immich-folio/security/advisories/GHSA-987w-cpwm-c9g9),
medium). A subpage's `essayFile` read the journal entry straight from
disk,
skipping the draft and password rules `/journal/<slug>` applies. It now
resolves through the same rules: a draft reads as missing for visitors,
and
a protected entry shows its password gate, sharing the
`lb_auth_journal_<slug>` cookie.
- **Immich descriptions are escaped in generated subpage essays**
([#684](https://github.com/ralksta/immich-folio/pull/684),
[GHSA-8ppx-39jv-q5xm](https://github.com/ralksta/immich-folio/security/advisories/GHSA-8ppx-39jv-q5xm),
low). The essay built from a subpage's albums (`layout: essay` without
markdown) put each asset's Immich description into the page as raw HTML.
Captions are now HTML-escaped, and they go through `assetCaption()`, so
`exif.caption: false` is respected there as well. Tracked in
[#689](https://github.com/ralksta/immich-folio/issues/689).
- **Admin drafts no longer keep a typed password, and the contact form's
email check runs in linear time**
([#727](https://github.com/ralksta/immich-folio/pull/727)). The admin's
session drafts wrote a password as typed to `sessionStorage`; a draft
holding a plaintext password is now not kept (the unsaved-changes guard
still warns). The email pattern could backtrack polynomially on a
crafted
domain; its labels now exclude the dot and the length is checked first.
Both found by CodeQL before release.
### Added
- **A built-in contact form with an inbox in the admin**
([#703](https://github.com/ralksta/immich-folio/pull/703), closes
[#702](https://github.com/ralksta/immich-folio/issues/702)). `/contact`
needs neither SMTP nor a form service: each message is one file in
`content/messages/` (mode `0600`), read under the new _Messages_ tab,
where
_Reply by email_ opens the owner's mail client with the message quoted.
Messages older than `contact.retentionDays` (default 90) are deleted. An
optional ntfy push goes to `contact.notifyUrl` or `CONTACT_NOTIFY_URL`,
and
since [#709](https://github.com/ralksta/immich-folio/pull/709) it
carries a
fixed "new message" line and nothing about the sender — no name, no
address, no text. Spam is kept out without a captcha: an off-screen
honeypot, a minimum fill time, three submissions a minute per IP and a
cap
of 500 stored messages. With the Impressum on and no `legal.contactUrl`,
the Impressum links the form as its second contact channel. A new doctor
check warns when the form is on but nobody is notified.
- **A privacy policy page, next to a list of what the site processes**
([#708](https://github.com/ralksta/immich-folio/pull/708)). `/privacy`
renders `content/privacy.md`, edited under Settings → Legal, and the
footer
links it once the file has text; `privacy.enabled: false` hides it.
Folio
writes no legal text. Beside the editor it lists what _this_
installation
does, read off the configuration — the map, statistics, contact form,
password cookies, CDN — and marks every entry that involves a third
party.
_Insert headings_ adds the matching section headings and nothing else.
The
doctor warns while the Impressum is on and there is no policy.
- **French, Spanish, Italian and Dutch interface translations**
([#681](https://github.com/ralksta/immich-folio/pull/681)), selected
with
`settings.yaml: lang` as before. The admin panel stays English.
- **CDN mode for photos and videos**
([#681](https://github.com/ralksta/immich-folio/pull/681)). With
`CDN_URL`
set, image and video URLs point at a pull CDN whose origin is this
server,
so repeat views reach neither the server nor Immich. A site password
switches the mode off, since a CDN would hand out cached photos without
checking the unlock cookie. The CDN origin is added to the CSP, and a
doctor check covers the password and `TRUSTED_PROXY_HOPS` cases. See
`docs/deployment.md#cdn-mode`.
- **A reworked admin panel**
([#712](https://github.com/ralksta/immich-folio/pull/712),
[#713](https://github.com/ralksta/immich-folio/pull/713),
[#714](https://github.com/ralksta/immich-folio/pull/714),
[#716](https://github.com/ralksta/immich-folio/pull/716),
[#717](https://github.com/ralksta/immich-folio/pull/717),
[#718](https://github.com/ralksta/immich-folio/pull/718),
[#719](https://github.com/ralksta/immich-folio/pull/719),
[#721](https://github.com/ralksta/immich-folio/pull/721)):
- **A sidebar instead of the header row**, grouped by task, with an
unread
count on Messages and a dot on Diagnostics while Immich is down. It
collapses to an icon rail, with names shown on hover and focus, and
remembers that per browser.
- **`/admin` is an overview**: what needs attention (unread messages,
doctor warnings), published pages, journal entries and recent views.
- **The site's own visual language** — the preset's fonts, hairline
borders, the square marker — and one page header on every screen. The
accent is kept for the current place and the primary action; switches
are now pills reading ON or OFF, in green rather than the accent, so
Studio Modern's red no longer makes an enabled setting look like an
error.
- **The page builder is a structure list and a panel.** Hero, subpages
and
standalone albums sit in one list on the left, subpages drag-sorted in
place; the selected entry is edited on the right instead of in an
overlay.
- **Dialogs only where a change is permanent.** Deleting a message or a
journal entry, and resetting the favicon (which used to delete the file
without asking), go through one confirm dialog in the admin's own look.
Removals in the page builder, which only touch unsaved state, happen at
once and offer _Undo_. No `window.confirm()` is left.
- **Feature switches are grouped by meaning** as one-line rows under
Settings → General; page transitions and scroll-to-top moved to Theme →
Look & motion. No setting keys changed.
### Changed
- **Fonts and the Leaflet stylesheet are served from the site itself**
([#700](https://github.com/ralksta/immich-folio/pull/700)). Every page
used
to link `fonts.googleapis.com`, which sends each visitor's IP address to
Google. The server now fetches a theme's Google fonts once, rewrites the
stylesheet and caches the files in `content/.fonts/`; custom fonts in
`theme.fonts` keep working. If Google cannot be reached before a font is
cached, the page falls back to the theme's system fonts. `leaflet.css`
comes from the npm package instead of unpkg. The CSP drops
`fonts.googleapis.com`, `fonts.gstatic.com` and `unpkg.com`.
- **Email addresses are kept out of the served HTML**
([#705](https://github.com/ralksta/immich-folio/pull/705)). The
Impressum
and footer render the address only after hydration, from an encoded
form,
so harvesters reading raw HTML find nothing. Without JavaScript the
Impressum shows `name [at] example [dot] de`. This defeats bulk
harvesting,
not a person with a browser.
- **The Impressum cites § 5 DDG and links its contacts**
([#698](https://github.com/ralksta/immich-folio/pull/698), reported in
[#697](https://github.com/ralksta/immich-folio/issues/697) by
[@RichKidsDev](https://github.com/RichKidsDev)). The TMG was replaced by
the
DDG in May 2024; `legal.heading` replaces the line for other laws (e.g.
§ 5 ECG in Austria). `legal.contactUrl` and `legal.contactLabel` add a
contact form as the second channel, so a phone number stays optional.
Email, phone and contact URL are now links, and the "Created with the
Impressum generator by eRecht24" line, shown on every site whether true
or
not, is gone. Settings → Legal gains fields for heading, contact URL,
VAT
ID and tax number, and a doctor check flags missing details.
- **Missing pages answer `404`**
([#704](https://github.com/ralksta/immich-folio/pull/704)). Every
missing
page used to answer `200`, because streaming had started before
`notFound()` ran. `/contact`, `/impressum`, `/map` and `/privacy` while
switched off, and `/journal/<slug>` without an entry, now return a real
404 with the same not-found page. Album and subpage slugs still depend
on
Immich and stay soft 404s.
- **Passwords set in the admin are stored as scrypt hashes**
([#706](https://github.com/ralksta/immich-folio/pull/706), closes
[#690](https://github.com/ralksta/immich-folio/issues/690)). Subpage,
album, journal-entry and site passwords were written as typed. The save
routes now hash them; a stored hash reads _Protected_ with _Change_ and
_Remove_ and is never put into an input. Visitors who unlocked a page
stay
signed in across unrelated saves. Existing plaintext passwords are
hashed
the next time their file is saved in the admin.
- **One notification surface in the admin**
([#707](https://github.com/ralksta/immich-folio/pull/707)) replaces
every
`alert()`: errors stay until dismissed, successes clear themselves, and
screen readers announce both.
### Fixed
- **Map tiles load again**
([#701](https://github.com/ralksta/immich-folio/pull/701)). CARTO
started
answering every tile with an "API KEY REQUIRED" image, leaving `/map`
and
journal map blocks as a grey grid. Tiles now come from OpenStreetMap;
the
dark look is a CSS filter, so the map now follows the colour mode.
- **The page builder no longer drops a subpage's `proofing:` flag on
save**
([#711](https://github.com/ralksta/immich-folio/pull/711)). A page
switched
off for proofing by hand reverted after any unrelated edit.
- **Unsaved edits in Settings and About survive switching admin tabs,
and a
backup restore is no longer overwritten by the next save**
([#687](https://github.com/ralksta/immich-folio/pull/687)). Editors that
were open during a restore now reload and offer unsaved edits back as a
conflict. Also: "Restore my changes" after a conflict found nothing,
removing an album left its drawer showing the next album, and the
journal
saved (rotating a backup) without changes.
- **Accent-backed buttons stay readable with a light or malformed
accent**
([#724](https://github.com/ralksta/immich-folio/pull/724), supersedes
[#680](https://github.com/ralksta/immich-folio/pull/680)) — contributed
by
[@lancetm714](https://github.com/lancetm714). A white accent made the
proofing dialog's _Download selected (.zip)_ button white on white.
`theme.accent` is now accepted as hex only and normalised to `#rrggbb`,
anything else falls back to the preset, and the proofing dialog and
filter
pills use the mode-aware `--on-accent` text colour from #688.
- **Every preset's accent is visible in both colour modes**
([#688](https://github.com/ralksta/immich-folio/pull/688)). Presets had
one
accent for both modes; minimal's dark mode drew black buttons on black.
Presets now carry a light and a dark accent, and text on accent-filled
buttons picks black or white for contrast. A custom accent stays the
owner's choice in both modes.
- **Visitor-side inconsistencies**
([#685](https://github.com/ralksta/immich-folio/pull/685)): after
visiting
`/impressum`, every subpage header turned centred and uppercase; back
links
announced "Back to Back to …"; the hero EXIF chip ignored
`exif.location`/`camera`/`settings`; videos in journal entries opened as
stills; the setup screen named a non-existent `.env.example`.
- **An essay's lightbox walks only the photos the story shows**
([#686](https://github.com/ralksta/immich-folio/pull/686)), not every
photo
of the subpage's albums, and the proofing bar in essays shows the
selection
count instead of a filter button that did nothing.
- **The page panel scrolls with the mouse wheel**
([#720](https://github.com/ralksta/immich-folio/pull/720)).
- **The journal editor's top bar wraps on phones**
([#723](https://github.com/ralksta/immich-folio/pull/723), closes
[#675](https://github.com/ralksta/immich-folio/issues/675)), so the
title
stays editable and Save stays on screen.
- **Every admin form field has a name for assistive technology**
([#715](https://github.com/ralksta/immich-folio/pull/715)). Only two
inputs
had a linked label; 47 are linked now, and clicking a label focuses its
field.
### Internal
- **`SettingsEditor` and `PageBuilder` are split up**
([#710](https://github.com/ralksta/immich-folio/pull/710),
[#711](https://github.com/ralksta/immich-folio/pull/711)). The
2,200-line
settings editor is a shell with one file per section; the page builder's
YAML handling and edits are pure functions under test. Both were checked
side by side against `dev` for identical output.
- **`useAdminFetch()`**
([#707](https://github.com/ralksta/immich-folio/pull/707))
gives Analytics, Messages, Backups and the journal list one loading and
error pattern.
- README brought up to v0.17.0
([#678](https://github.com/ralksta/immich-folio/pull/678),
[#679](https://github.com/ralksta/immich-folio/pull/679)).
### Upgrade notes
**`content/` gains two directories the app writes to:**
`content/.fonts/`
for the cached fonts and `content/messages/` for contact-form messages.
Both
are created on demand, so a writable `content/` is enough, as before.
**The server needs outbound HTTPS to Google once per font** to fill the
font
cache. Until then pages fall back to the theme's system fonts. Visitors'
browsers no longer contact Google.
**A custom CSP or reverse-proxy allowlist** must now allow
`tile.openstreetmap.org` for images instead of
`*.basemaps.cartocdn.com`,
and no longer needs `fonts.googleapis.com`, `fonts.gstatic.com` or
`unpkg.com`. The built-in CSP is updated.
**`theme.accent` must be hex** (`#rgb`, `#rrggbb` or `#rrggbbaa`).
Anything
else, including a value without `#`, falls back to the preset's accent.
**Plaintext passwords in `gallery.yaml`, `settings.yaml` or journal
entries**
are hashed the next time that file is saved in the admin; one save
clears the
doctor's warning.
**New, optional settings:** `contact.*` (the form is off by default),
`privacy.enabled`, `legal.heading`, `legal.contactUrl`,
`legal.contactLabel`,
and the `CDN_URL` and `CONTACT_NOTIFY_URL` environment variables. See
`content/settings.yaml.example` and `.env.local.example`. In the example
file,
`vatId` and `taxId` had swapped sample values; check yours if you copied
them.
No `IMAGE_CACHE_VERSION` bump is needed this time.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>
2026-09-27 14:43:38 +02:00
|
|
|
const confirm = useConfirm();
|
2026-10-02 18:14:23 +02:00
|
|
|
// What the site shows while the field is empty, resolved as getConfig does:
|
|
|
|
|
// SITE_TITLE, else the site language's word for a gallery (QA A-15).
|
|
|
|
|
const fallbackTitle = siteTitleEnv || getDictionary(resolveLocale(settings.lang)).common.gallery;
|
release: v0.18.0 (#725)
Release v0.18.0 — merges `dev` into `main`.
## Thanks
- [@lancetm714](https://github.com/lancetm714) for the accent-contrast
fix (#680 → #724).
- [@RichKidsDev](https://github.com/RichKidsDev) for reporting the
outdated Impressum (#697).
### Security
- **Journal drafts and password-protected entries no longer render
publicly
as a subpage essay**
([#684](https://github.com/ralksta/immich-folio/pull/684),
[GHSA-987w-cpwm-c9g9](https://github.com/ralksta/immich-folio/security/advisories/GHSA-987w-cpwm-c9g9),
medium). A subpage's `essayFile` read the journal entry straight from
disk,
skipping the draft and password rules `/journal/<slug>` applies. It now
resolves through the same rules: a draft reads as missing for visitors,
and
a protected entry shows its password gate, sharing the
`lb_auth_journal_<slug>` cookie.
- **Immich descriptions are escaped in generated subpage essays**
([#684](https://github.com/ralksta/immich-folio/pull/684),
[GHSA-8ppx-39jv-q5xm](https://github.com/ralksta/immich-folio/security/advisories/GHSA-8ppx-39jv-q5xm),
low). The essay built from a subpage's albums (`layout: essay` without
markdown) put each asset's Immich description into the page as raw HTML.
Captions are now HTML-escaped, and they go through `assetCaption()`, so
`exif.caption: false` is respected there as well. Tracked in
[#689](https://github.com/ralksta/immich-folio/issues/689).
- **Admin drafts no longer keep a typed password, and the contact form's
email check runs in linear time**
([#727](https://github.com/ralksta/immich-folio/pull/727)). The admin's
session drafts wrote a password as typed to `sessionStorage`; a draft
holding a plaintext password is now not kept (the unsaved-changes guard
still warns). The email pattern could backtrack polynomially on a
crafted
domain; its labels now exclude the dot and the length is checked first.
Both found by CodeQL before release.
### Added
- **A built-in contact form with an inbox in the admin**
([#703](https://github.com/ralksta/immich-folio/pull/703), closes
[#702](https://github.com/ralksta/immich-folio/issues/702)). `/contact`
needs neither SMTP nor a form service: each message is one file in
`content/messages/` (mode `0600`), read under the new _Messages_ tab,
where
_Reply by email_ opens the owner's mail client with the message quoted.
Messages older than `contact.retentionDays` (default 90) are deleted. An
optional ntfy push goes to `contact.notifyUrl` or `CONTACT_NOTIFY_URL`,
and
since [#709](https://github.com/ralksta/immich-folio/pull/709) it
carries a
fixed "new message" line and nothing about the sender — no name, no
address, no text. Spam is kept out without a captcha: an off-screen
honeypot, a minimum fill time, three submissions a minute per IP and a
cap
of 500 stored messages. With the Impressum on and no `legal.contactUrl`,
the Impressum links the form as its second contact channel. A new doctor
check warns when the form is on but nobody is notified.
- **A privacy policy page, next to a list of what the site processes**
([#708](https://github.com/ralksta/immich-folio/pull/708)). `/privacy`
renders `content/privacy.md`, edited under Settings → Legal, and the
footer
links it once the file has text; `privacy.enabled: false` hides it.
Folio
writes no legal text. Beside the editor it lists what _this_
installation
does, read off the configuration — the map, statistics, contact form,
password cookies, CDN — and marks every entry that involves a third
party.
_Insert headings_ adds the matching section headings and nothing else.
The
doctor warns while the Impressum is on and there is no policy.
- **French, Spanish, Italian and Dutch interface translations**
([#681](https://github.com/ralksta/immich-folio/pull/681)), selected
with
`settings.yaml: lang` as before. The admin panel stays English.
- **CDN mode for photos and videos**
([#681](https://github.com/ralksta/immich-folio/pull/681)). With
`CDN_URL`
set, image and video URLs point at a pull CDN whose origin is this
server,
so repeat views reach neither the server nor Immich. A site password
switches the mode off, since a CDN would hand out cached photos without
checking the unlock cookie. The CDN origin is added to the CSP, and a
doctor check covers the password and `TRUSTED_PROXY_HOPS` cases. See
`docs/deployment.md#cdn-mode`.
- **A reworked admin panel**
([#712](https://github.com/ralksta/immich-folio/pull/712),
[#713](https://github.com/ralksta/immich-folio/pull/713),
[#714](https://github.com/ralksta/immich-folio/pull/714),
[#716](https://github.com/ralksta/immich-folio/pull/716),
[#717](https://github.com/ralksta/immich-folio/pull/717),
[#718](https://github.com/ralksta/immich-folio/pull/718),
[#719](https://github.com/ralksta/immich-folio/pull/719),
[#721](https://github.com/ralksta/immich-folio/pull/721)):
- **A sidebar instead of the header row**, grouped by task, with an
unread
count on Messages and a dot on Diagnostics while Immich is down. It
collapses to an icon rail, with names shown on hover and focus, and
remembers that per browser.
- **`/admin` is an overview**: what needs attention (unread messages,
doctor warnings), published pages, journal entries and recent views.
- **The site's own visual language** — the preset's fonts, hairline
borders, the square marker — and one page header on every screen. The
accent is kept for the current place and the primary action; switches
are now pills reading ON or OFF, in green rather than the accent, so
Studio Modern's red no longer makes an enabled setting look like an
error.
- **The page builder is a structure list and a panel.** Hero, subpages
and
standalone albums sit in one list on the left, subpages drag-sorted in
place; the selected entry is edited on the right instead of in an
overlay.
- **Dialogs only where a change is permanent.** Deleting a message or a
journal entry, and resetting the favicon (which used to delete the file
without asking), go through one confirm dialog in the admin's own look.
Removals in the page builder, which only touch unsaved state, happen at
once and offer _Undo_. No `window.confirm()` is left.
- **Feature switches are grouped by meaning** as one-line rows under
Settings → General; page transitions and scroll-to-top moved to Theme →
Look & motion. No setting keys changed.
### Changed
- **Fonts and the Leaflet stylesheet are served from the site itself**
([#700](https://github.com/ralksta/immich-folio/pull/700)). Every page
used
to link `fonts.googleapis.com`, which sends each visitor's IP address to
Google. The server now fetches a theme's Google fonts once, rewrites the
stylesheet and caches the files in `content/.fonts/`; custom fonts in
`theme.fonts` keep working. If Google cannot be reached before a font is
cached, the page falls back to the theme's system fonts. `leaflet.css`
comes from the npm package instead of unpkg. The CSP drops
`fonts.googleapis.com`, `fonts.gstatic.com` and `unpkg.com`.
- **Email addresses are kept out of the served HTML**
([#705](https://github.com/ralksta/immich-folio/pull/705)). The
Impressum
and footer render the address only after hydration, from an encoded
form,
so harvesters reading raw HTML find nothing. Without JavaScript the
Impressum shows `name [at] example [dot] de`. This defeats bulk
harvesting,
not a person with a browser.
- **The Impressum cites § 5 DDG and links its contacts**
([#698](https://github.com/ralksta/immich-folio/pull/698), reported in
[#697](https://github.com/ralksta/immich-folio/issues/697) by
[@RichKidsDev](https://github.com/RichKidsDev)). The TMG was replaced by
the
DDG in May 2024; `legal.heading` replaces the line for other laws (e.g.
§ 5 ECG in Austria). `legal.contactUrl` and `legal.contactLabel` add a
contact form as the second channel, so a phone number stays optional.
Email, phone and contact URL are now links, and the "Created with the
Impressum generator by eRecht24" line, shown on every site whether true
or
not, is gone. Settings → Legal gains fields for heading, contact URL,
VAT
ID and tax number, and a doctor check flags missing details.
- **Missing pages answer `404`**
([#704](https://github.com/ralksta/immich-folio/pull/704)). Every
missing
page used to answer `200`, because streaming had started before
`notFound()` ran. `/contact`, `/impressum`, `/map` and `/privacy` while
switched off, and `/journal/<slug>` without an entry, now return a real
404 with the same not-found page. Album and subpage slugs still depend
on
Immich and stay soft 404s.
- **Passwords set in the admin are stored as scrypt hashes**
([#706](https://github.com/ralksta/immich-folio/pull/706), closes
[#690](https://github.com/ralksta/immich-folio/issues/690)). Subpage,
album, journal-entry and site passwords were written as typed. The save
routes now hash them; a stored hash reads _Protected_ with _Change_ and
_Remove_ and is never put into an input. Visitors who unlocked a page
stay
signed in across unrelated saves. Existing plaintext passwords are
hashed
the next time their file is saved in the admin.
- **One notification surface in the admin**
([#707](https://github.com/ralksta/immich-folio/pull/707)) replaces
every
`alert()`: errors stay until dismissed, successes clear themselves, and
screen readers announce both.
### Fixed
- **Map tiles load again**
([#701](https://github.com/ralksta/immich-folio/pull/701)). CARTO
started
answering every tile with an "API KEY REQUIRED" image, leaving `/map`
and
journal map blocks as a grey grid. Tiles now come from OpenStreetMap;
the
dark look is a CSS filter, so the map now follows the colour mode.
- **The page builder no longer drops a subpage's `proofing:` flag on
save**
([#711](https://github.com/ralksta/immich-folio/pull/711)). A page
switched
off for proofing by hand reverted after any unrelated edit.
- **Unsaved edits in Settings and About survive switching admin tabs,
and a
backup restore is no longer overwritten by the next save**
([#687](https://github.com/ralksta/immich-folio/pull/687)). Editors that
were open during a restore now reload and offer unsaved edits back as a
conflict. Also: "Restore my changes" after a conflict found nothing,
removing an album left its drawer showing the next album, and the
journal
saved (rotating a backup) without changes.
- **Accent-backed buttons stay readable with a light or malformed
accent**
([#724](https://github.com/ralksta/immich-folio/pull/724), supersedes
[#680](https://github.com/ralksta/immich-folio/pull/680)) — contributed
by
[@lancetm714](https://github.com/lancetm714). A white accent made the
proofing dialog's _Download selected (.zip)_ button white on white.
`theme.accent` is now accepted as hex only and normalised to `#rrggbb`,
anything else falls back to the preset, and the proofing dialog and
filter
pills use the mode-aware `--on-accent` text colour from #688.
- **Every preset's accent is visible in both colour modes**
([#688](https://github.com/ralksta/immich-folio/pull/688)). Presets had
one
accent for both modes; minimal's dark mode drew black buttons on black.
Presets now carry a light and a dark accent, and text on accent-filled
buttons picks black or white for contrast. A custom accent stays the
owner's choice in both modes.
- **Visitor-side inconsistencies**
([#685](https://github.com/ralksta/immich-folio/pull/685)): after
visiting
`/impressum`, every subpage header turned centred and uppercase; back
links
announced "Back to Back to …"; the hero EXIF chip ignored
`exif.location`/`camera`/`settings`; videos in journal entries opened as
stills; the setup screen named a non-existent `.env.example`.
- **An essay's lightbox walks only the photos the story shows**
([#686](https://github.com/ralksta/immich-folio/pull/686)), not every
photo
of the subpage's albums, and the proofing bar in essays shows the
selection
count instead of a filter button that did nothing.
- **The page panel scrolls with the mouse wheel**
([#720](https://github.com/ralksta/immich-folio/pull/720)).
- **The journal editor's top bar wraps on phones**
([#723](https://github.com/ralksta/immich-folio/pull/723), closes
[#675](https://github.com/ralksta/immich-folio/issues/675)), so the
title
stays editable and Save stays on screen.
- **Every admin form field has a name for assistive technology**
([#715](https://github.com/ralksta/immich-folio/pull/715)). Only two
inputs
had a linked label; 47 are linked now, and clicking a label focuses its
field.
### Internal
- **`SettingsEditor` and `PageBuilder` are split up**
([#710](https://github.com/ralksta/immich-folio/pull/710),
[#711](https://github.com/ralksta/immich-folio/pull/711)). The
2,200-line
settings editor is a shell with one file per section; the page builder's
YAML handling and edits are pure functions under test. Both were checked
side by side against `dev` for identical output.
- **`useAdminFetch()`**
([#707](https://github.com/ralksta/immich-folio/pull/707))
gives Analytics, Messages, Backups and the journal list one loading and
error pattern.
- README brought up to v0.17.0
([#678](https://github.com/ralksta/immich-folio/pull/678),
[#679](https://github.com/ralksta/immich-folio/pull/679)).
### Upgrade notes
**`content/` gains two directories the app writes to:**
`content/.fonts/`
for the cached fonts and `content/messages/` for contact-form messages.
Both
are created on demand, so a writable `content/` is enough, as before.
**The server needs outbound HTTPS to Google once per font** to fill the
font
cache. Until then pages fall back to the theme's system fonts. Visitors'
browsers no longer contact Google.
**A custom CSP or reverse-proxy allowlist** must now allow
`tile.openstreetmap.org` for images instead of
`*.basemaps.cartocdn.com`,
and no longer needs `fonts.googleapis.com`, `fonts.gstatic.com` or
`unpkg.com`. The built-in CSP is updated.
**`theme.accent` must be hex** (`#rgb`, `#rrggbb` or `#rrggbbaa`).
Anything
else, including a value without `#`, falls back to the preset's accent.
**Plaintext passwords in `gallery.yaml`, `settings.yaml` or journal
entries**
are hashed the next time that file is saved in the admin; one save
clears the
doctor's warning.
**New, optional settings:** `contact.*` (the form is off by default),
`privacy.enabled`, `legal.heading`, `legal.contactUrl`,
`legal.contactLabel`,
and the `CDN_URL` and `CONTACT_NOTIFY_URL` environment variables. See
`content/settings.yaml.example` and `.env.local.example`. In the example
file,
`vatId` and `taxId` had swapped sample values; check yours if you copied
them.
No `IMAGE_CACHE_VERSION` bump is needed this time.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>
2026-09-27 14:43:38 +02:00
|
|
|
// Collapsed by default: the four metadata switches are a detail of one
|
|
|
|
|
// decision, and showing them permanently is what made the section a wall (#510).
|
|
|
|
|
const [metadataOpen, setMetadataOpen] = useState(false);
|
|
|
|
|
const [faviconUploading, setFaviconUploading] = useState(false);
|
|
|
|
|
const [faviconStatus, setFaviconStatus] = useState<SaveStatus>(null);
|
2026-10-02 18:14:23 +02:00
|
|
|
/** Bumped after an upload or reset so the preview fetches the new icon. */
|
|
|
|
|
const [faviconVersion, setFaviconVersion] = useState(0);
|
release: v0.18.0 (#725)
Release v0.18.0 — merges `dev` into `main`.
## Thanks
- [@lancetm714](https://github.com/lancetm714) for the accent-contrast
fix (#680 → #724).
- [@RichKidsDev](https://github.com/RichKidsDev) for reporting the
outdated Impressum (#697).
### Security
- **Journal drafts and password-protected entries no longer render
publicly
as a subpage essay**
([#684](https://github.com/ralksta/immich-folio/pull/684),
[GHSA-987w-cpwm-c9g9](https://github.com/ralksta/immich-folio/security/advisories/GHSA-987w-cpwm-c9g9),
medium). A subpage's `essayFile` read the journal entry straight from
disk,
skipping the draft and password rules `/journal/<slug>` applies. It now
resolves through the same rules: a draft reads as missing for visitors,
and
a protected entry shows its password gate, sharing the
`lb_auth_journal_<slug>` cookie.
- **Immich descriptions are escaped in generated subpage essays**
([#684](https://github.com/ralksta/immich-folio/pull/684),
[GHSA-8ppx-39jv-q5xm](https://github.com/ralksta/immich-folio/security/advisories/GHSA-8ppx-39jv-q5xm),
low). The essay built from a subpage's albums (`layout: essay` without
markdown) put each asset's Immich description into the page as raw HTML.
Captions are now HTML-escaped, and they go through `assetCaption()`, so
`exif.caption: false` is respected there as well. Tracked in
[#689](https://github.com/ralksta/immich-folio/issues/689).
- **Admin drafts no longer keep a typed password, and the contact form's
email check runs in linear time**
([#727](https://github.com/ralksta/immich-folio/pull/727)). The admin's
session drafts wrote a password as typed to `sessionStorage`; a draft
holding a plaintext password is now not kept (the unsaved-changes guard
still warns). The email pattern could backtrack polynomially on a
crafted
domain; its labels now exclude the dot and the length is checked first.
Both found by CodeQL before release.
### Added
- **A built-in contact form with an inbox in the admin**
([#703](https://github.com/ralksta/immich-folio/pull/703), closes
[#702](https://github.com/ralksta/immich-folio/issues/702)). `/contact`
needs neither SMTP nor a form service: each message is one file in
`content/messages/` (mode `0600`), read under the new _Messages_ tab,
where
_Reply by email_ opens the owner's mail client with the message quoted.
Messages older than `contact.retentionDays` (default 90) are deleted. An
optional ntfy push goes to `contact.notifyUrl` or `CONTACT_NOTIFY_URL`,
and
since [#709](https://github.com/ralksta/immich-folio/pull/709) it
carries a
fixed "new message" line and nothing about the sender — no name, no
address, no text. Spam is kept out without a captcha: an off-screen
honeypot, a minimum fill time, three submissions a minute per IP and a
cap
of 500 stored messages. With the Impressum on and no `legal.contactUrl`,
the Impressum links the form as its second contact channel. A new doctor
check warns when the form is on but nobody is notified.
- **A privacy policy page, next to a list of what the site processes**
([#708](https://github.com/ralksta/immich-folio/pull/708)). `/privacy`
renders `content/privacy.md`, edited under Settings → Legal, and the
footer
links it once the file has text; `privacy.enabled: false` hides it.
Folio
writes no legal text. Beside the editor it lists what _this_
installation
does, read off the configuration — the map, statistics, contact form,
password cookies, CDN — and marks every entry that involves a third
party.
_Insert headings_ adds the matching section headings and nothing else.
The
doctor warns while the Impressum is on and there is no policy.
- **French, Spanish, Italian and Dutch interface translations**
([#681](https://github.com/ralksta/immich-folio/pull/681)), selected
with
`settings.yaml: lang` as before. The admin panel stays English.
- **CDN mode for photos and videos**
([#681](https://github.com/ralksta/immich-folio/pull/681)). With
`CDN_URL`
set, image and video URLs point at a pull CDN whose origin is this
server,
so repeat views reach neither the server nor Immich. A site password
switches the mode off, since a CDN would hand out cached photos without
checking the unlock cookie. The CDN origin is added to the CSP, and a
doctor check covers the password and `TRUSTED_PROXY_HOPS` cases. See
`docs/deployment.md#cdn-mode`.
- **A reworked admin panel**
([#712](https://github.com/ralksta/immich-folio/pull/712),
[#713](https://github.com/ralksta/immich-folio/pull/713),
[#714](https://github.com/ralksta/immich-folio/pull/714),
[#716](https://github.com/ralksta/immich-folio/pull/716),
[#717](https://github.com/ralksta/immich-folio/pull/717),
[#718](https://github.com/ralksta/immich-folio/pull/718),
[#719](https://github.com/ralksta/immich-folio/pull/719),
[#721](https://github.com/ralksta/immich-folio/pull/721)):
- **A sidebar instead of the header row**, grouped by task, with an
unread
count on Messages and a dot on Diagnostics while Immich is down. It
collapses to an icon rail, with names shown on hover and focus, and
remembers that per browser.
- **`/admin` is an overview**: what needs attention (unread messages,
doctor warnings), published pages, journal entries and recent views.
- **The site's own visual language** — the preset's fonts, hairline
borders, the square marker — and one page header on every screen. The
accent is kept for the current place and the primary action; switches
are now pills reading ON or OFF, in green rather than the accent, so
Studio Modern's red no longer makes an enabled setting look like an
error.
- **The page builder is a structure list and a panel.** Hero, subpages
and
standalone albums sit in one list on the left, subpages drag-sorted in
place; the selected entry is edited on the right instead of in an
overlay.
- **Dialogs only where a change is permanent.** Deleting a message or a
journal entry, and resetting the favicon (which used to delete the file
without asking), go through one confirm dialog in the admin's own look.
Removals in the page builder, which only touch unsaved state, happen at
once and offer _Undo_. No `window.confirm()` is left.
- **Feature switches are grouped by meaning** as one-line rows under
Settings → General; page transitions and scroll-to-top moved to Theme →
Look & motion. No setting keys changed.
### Changed
- **Fonts and the Leaflet stylesheet are served from the site itself**
([#700](https://github.com/ralksta/immich-folio/pull/700)). Every page
used
to link `fonts.googleapis.com`, which sends each visitor's IP address to
Google. The server now fetches a theme's Google fonts once, rewrites the
stylesheet and caches the files in `content/.fonts/`; custom fonts in
`theme.fonts` keep working. If Google cannot be reached before a font is
cached, the page falls back to the theme's system fonts. `leaflet.css`
comes from the npm package instead of unpkg. The CSP drops
`fonts.googleapis.com`, `fonts.gstatic.com` and `unpkg.com`.
- **Email addresses are kept out of the served HTML**
([#705](https://github.com/ralksta/immich-folio/pull/705)). The
Impressum
and footer render the address only after hydration, from an encoded
form,
so harvesters reading raw HTML find nothing. Without JavaScript the
Impressum shows `name [at] example [dot] de`. This defeats bulk
harvesting,
not a person with a browser.
- **The Impressum cites § 5 DDG and links its contacts**
([#698](https://github.com/ralksta/immich-folio/pull/698), reported in
[#697](https://github.com/ralksta/immich-folio/issues/697) by
[@RichKidsDev](https://github.com/RichKidsDev)). The TMG was replaced by
the
DDG in May 2024; `legal.heading` replaces the line for other laws (e.g.
§ 5 ECG in Austria). `legal.contactUrl` and `legal.contactLabel` add a
contact form as the second channel, so a phone number stays optional.
Email, phone and contact URL are now links, and the "Created with the
Impressum generator by eRecht24" line, shown on every site whether true
or
not, is gone. Settings → Legal gains fields for heading, contact URL,
VAT
ID and tax number, and a doctor check flags missing details.
- **Missing pages answer `404`**
([#704](https://github.com/ralksta/immich-folio/pull/704)). Every
missing
page used to answer `200`, because streaming had started before
`notFound()` ran. `/contact`, `/impressum`, `/map` and `/privacy` while
switched off, and `/journal/<slug>` without an entry, now return a real
404 with the same not-found page. Album and subpage slugs still depend
on
Immich and stay soft 404s.
- **Passwords set in the admin are stored as scrypt hashes**
([#706](https://github.com/ralksta/immich-folio/pull/706), closes
[#690](https://github.com/ralksta/immich-folio/issues/690)). Subpage,
album, journal-entry and site passwords were written as typed. The save
routes now hash them; a stored hash reads _Protected_ with _Change_ and
_Remove_ and is never put into an input. Visitors who unlocked a page
stay
signed in across unrelated saves. Existing plaintext passwords are
hashed
the next time their file is saved in the admin.
- **One notification surface in the admin**
([#707](https://github.com/ralksta/immich-folio/pull/707)) replaces
every
`alert()`: errors stay until dismissed, successes clear themselves, and
screen readers announce both.
### Fixed
- **Map tiles load again**
([#701](https://github.com/ralksta/immich-folio/pull/701)). CARTO
started
answering every tile with an "API KEY REQUIRED" image, leaving `/map`
and
journal map blocks as a grey grid. Tiles now come from OpenStreetMap;
the
dark look is a CSS filter, so the map now follows the colour mode.
- **The page builder no longer drops a subpage's `proofing:` flag on
save**
([#711](https://github.com/ralksta/immich-folio/pull/711)). A page
switched
off for proofing by hand reverted after any unrelated edit.
- **Unsaved edits in Settings and About survive switching admin tabs,
and a
backup restore is no longer overwritten by the next save**
([#687](https://github.com/ralksta/immich-folio/pull/687)). Editors that
were open during a restore now reload and offer unsaved edits back as a
conflict. Also: "Restore my changes" after a conflict found nothing,
removing an album left its drawer showing the next album, and the
journal
saved (rotating a backup) without changes.
- **Accent-backed buttons stay readable with a light or malformed
accent**
([#724](https://github.com/ralksta/immich-folio/pull/724), supersedes
[#680](https://github.com/ralksta/immich-folio/pull/680)) — contributed
by
[@lancetm714](https://github.com/lancetm714). A white accent made the
proofing dialog's _Download selected (.zip)_ button white on white.
`theme.accent` is now accepted as hex only and normalised to `#rrggbb`,
anything else falls back to the preset, and the proofing dialog and
filter
pills use the mode-aware `--on-accent` text colour from #688.
- **Every preset's accent is visible in both colour modes**
([#688](https://github.com/ralksta/immich-folio/pull/688)). Presets had
one
accent for both modes; minimal's dark mode drew black buttons on black.
Presets now carry a light and a dark accent, and text on accent-filled
buttons picks black or white for contrast. A custom accent stays the
owner's choice in both modes.
- **Visitor-side inconsistencies**
([#685](https://github.com/ralksta/immich-folio/pull/685)): after
visiting
`/impressum`, every subpage header turned centred and uppercase; back
links
announced "Back to Back to …"; the hero EXIF chip ignored
`exif.location`/`camera`/`settings`; videos in journal entries opened as
stills; the setup screen named a non-existent `.env.example`.
- **An essay's lightbox walks only the photos the story shows**
([#686](https://github.com/ralksta/immich-folio/pull/686)), not every
photo
of the subpage's albums, and the proofing bar in essays shows the
selection
count instead of a filter button that did nothing.
- **The page panel scrolls with the mouse wheel**
([#720](https://github.com/ralksta/immich-folio/pull/720)).
- **The journal editor's top bar wraps on phones**
([#723](https://github.com/ralksta/immich-folio/pull/723), closes
[#675](https://github.com/ralksta/immich-folio/issues/675)), so the
title
stays editable and Save stays on screen.
- **Every admin form field has a name for assistive technology**
([#715](https://github.com/ralksta/immich-folio/pull/715)). Only two
inputs
had a linked label; 47 are linked now, and clicking a label focuses its
field.
### Internal
- **`SettingsEditor` and `PageBuilder` are split up**
([#710](https://github.com/ralksta/immich-folio/pull/710),
[#711](https://github.com/ralksta/immich-folio/pull/711)). The
2,200-line
settings editor is a shell with one file per section; the page builder's
YAML handling and edits are pure functions under test. Both were checked
side by side against `dev` for identical output.
- **`useAdminFetch()`**
([#707](https://github.com/ralksta/immich-folio/pull/707))
gives Analytics, Messages, Backups and the journal list one loading and
error pattern.
- README brought up to v0.17.0
([#678](https://github.com/ralksta/immich-folio/pull/678),
[#679](https://github.com/ralksta/immich-folio/pull/679)).
### Upgrade notes
**`content/` gains two directories the app writes to:**
`content/.fonts/`
for the cached fonts and `content/messages/` for contact-form messages.
Both
are created on demand, so a writable `content/` is enough, as before.
**The server needs outbound HTTPS to Google once per font** to fill the
font
cache. Until then pages fall back to the theme's system fonts. Visitors'
browsers no longer contact Google.
**A custom CSP or reverse-proxy allowlist** must now allow
`tile.openstreetmap.org` for images instead of
`*.basemaps.cartocdn.com`,
and no longer needs `fonts.googleapis.com`, `fonts.gstatic.com` or
`unpkg.com`. The built-in CSP is updated.
**`theme.accent` must be hex** (`#rgb`, `#rrggbb` or `#rrggbbaa`).
Anything
else, including a value without `#`, falls back to the preset's accent.
**Plaintext passwords in `gallery.yaml`, `settings.yaml` or journal
entries**
are hashed the next time that file is saved in the admin; one save
clears the
doctor's warning.
**New, optional settings:** `contact.*` (the form is off by default),
`privacy.enabled`, `legal.heading`, `legal.contactUrl`,
`legal.contactLabel`,
and the `CDN_URL` and `CONTACT_NOTIFY_URL` environment variables. See
`content/settings.yaml.example` and `.env.local.example`. In the example
file,
`vatId` and `taxId` had swapped sample values; check yours if you copied
them.
No `IMAGE_CACHE_VERSION` bump is needed this time.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>
2026-09-27 14:43:38 +02:00
|
|
|
|
|
|
|
|
// Resolved the same way the site resolves it, so the switches show what a
|
|
|
|
|
// visitor actually sees — including a config that only ever set the older
|
|
|
|
|
// `exifOnHover`.
|
|
|
|
|
const exif = resolveExifDisplay(settings.exif, settings.exifOnHover);
|
|
|
|
|
|
|
|
|
|
// The master switch has no key of its own and needs none: "off" is all four
|
|
|
|
|
// groups off, a state the site already acts on — with nothing left to show,
|
|
|
|
|
// the lightbox withdraws its info button and the `i` key entirely (#506).
|
|
|
|
|
const anyMetadata = exif.camera || exif.settings || exif.location || exif.caption;
|
|
|
|
|
const metadataSummary =
|
|
|
|
|
[
|
|
|
|
|
exif.camera && 'Camera & lens',
|
|
|
|
|
exif.settings && 'Exposure',
|
|
|
|
|
exif.location && 'Location',
|
|
|
|
|
exif.caption && 'Description',
|
|
|
|
|
]
|
|
|
|
|
.filter(Boolean)
|
|
|
|
|
.join(' · ') || 'Nothing published — the lightbox hides its info panel';
|
|
|
|
|
|
|
|
|
|
/** Turning it back on selects everything; the details below narrow it again. */
|
|
|
|
|
const toggleMetadata = () =>
|
|
|
|
|
updateMany({
|
|
|
|
|
'exif.camera': !anyMetadata,
|
|
|
|
|
'exif.settings': !anyMetadata,
|
|
|
|
|
'exif.location': !anyMetadata,
|
|
|
|
|
'exif.caption': !anyMetadata,
|
|
|
|
|
});
|
|
|
|
|
|
|
|
|
|
return (
|
|
|
|
|
<div className="settings-panel">
|
|
|
|
|
<div className="settings-section-header">
|
|
|
|
|
<h3>
|
|
|
|
|
<Icons.IconGear size={18} /> General Site Settings
|
|
|
|
|
</h3>
|
|
|
|
|
<p className="settings-section-sub">
|
|
|
|
|
Configure basic site identity, language, and core feature toggles.
|
|
|
|
|
</p>
|
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
<div className="admin-field">
|
|
|
|
|
<label htmlFor="general-site-title">Site Title</label>
|
|
|
|
|
<input
|
|
|
|
|
id="general-site-title"
|
|
|
|
|
value={settings.title || ''}
|
|
|
|
|
onChange={(e) => update('title', e.target.value)}
|
2026-10-02 18:14:23 +02:00
|
|
|
placeholder={fallbackTitle}
|
|
|
|
|
aria-describedby="general-site-title-hint"
|
release: v0.18.0 (#725)
Release v0.18.0 — merges `dev` into `main`.
## Thanks
- [@lancetm714](https://github.com/lancetm714) for the accent-contrast
fix (#680 → #724).
- [@RichKidsDev](https://github.com/RichKidsDev) for reporting the
outdated Impressum (#697).
### Security
- **Journal drafts and password-protected entries no longer render
publicly
as a subpage essay**
([#684](https://github.com/ralksta/immich-folio/pull/684),
[GHSA-987w-cpwm-c9g9](https://github.com/ralksta/immich-folio/security/advisories/GHSA-987w-cpwm-c9g9),
medium). A subpage's `essayFile` read the journal entry straight from
disk,
skipping the draft and password rules `/journal/<slug>` applies. It now
resolves through the same rules: a draft reads as missing for visitors,
and
a protected entry shows its password gate, sharing the
`lb_auth_journal_<slug>` cookie.
- **Immich descriptions are escaped in generated subpage essays**
([#684](https://github.com/ralksta/immich-folio/pull/684),
[GHSA-8ppx-39jv-q5xm](https://github.com/ralksta/immich-folio/security/advisories/GHSA-8ppx-39jv-q5xm),
low). The essay built from a subpage's albums (`layout: essay` without
markdown) put each asset's Immich description into the page as raw HTML.
Captions are now HTML-escaped, and they go through `assetCaption()`, so
`exif.caption: false` is respected there as well. Tracked in
[#689](https://github.com/ralksta/immich-folio/issues/689).
- **Admin drafts no longer keep a typed password, and the contact form's
email check runs in linear time**
([#727](https://github.com/ralksta/immich-folio/pull/727)). The admin's
session drafts wrote a password as typed to `sessionStorage`; a draft
holding a plaintext password is now not kept (the unsaved-changes guard
still warns). The email pattern could backtrack polynomially on a
crafted
domain; its labels now exclude the dot and the length is checked first.
Both found by CodeQL before release.
### Added
- **A built-in contact form with an inbox in the admin**
([#703](https://github.com/ralksta/immich-folio/pull/703), closes
[#702](https://github.com/ralksta/immich-folio/issues/702)). `/contact`
needs neither SMTP nor a form service: each message is one file in
`content/messages/` (mode `0600`), read under the new _Messages_ tab,
where
_Reply by email_ opens the owner's mail client with the message quoted.
Messages older than `contact.retentionDays` (default 90) are deleted. An
optional ntfy push goes to `contact.notifyUrl` or `CONTACT_NOTIFY_URL`,
and
since [#709](https://github.com/ralksta/immich-folio/pull/709) it
carries a
fixed "new message" line and nothing about the sender — no name, no
address, no text. Spam is kept out without a captcha: an off-screen
honeypot, a minimum fill time, three submissions a minute per IP and a
cap
of 500 stored messages. With the Impressum on and no `legal.contactUrl`,
the Impressum links the form as its second contact channel. A new doctor
check warns when the form is on but nobody is notified.
- **A privacy policy page, next to a list of what the site processes**
([#708](https://github.com/ralksta/immich-folio/pull/708)). `/privacy`
renders `content/privacy.md`, edited under Settings → Legal, and the
footer
links it once the file has text; `privacy.enabled: false` hides it.
Folio
writes no legal text. Beside the editor it lists what _this_
installation
does, read off the configuration — the map, statistics, contact form,
password cookies, CDN — and marks every entry that involves a third
party.
_Insert headings_ adds the matching section headings and nothing else.
The
doctor warns while the Impressum is on and there is no policy.
- **French, Spanish, Italian and Dutch interface translations**
([#681](https://github.com/ralksta/immich-folio/pull/681)), selected
with
`settings.yaml: lang` as before. The admin panel stays English.
- **CDN mode for photos and videos**
([#681](https://github.com/ralksta/immich-folio/pull/681)). With
`CDN_URL`
set, image and video URLs point at a pull CDN whose origin is this
server,
so repeat views reach neither the server nor Immich. A site password
switches the mode off, since a CDN would hand out cached photos without
checking the unlock cookie. The CDN origin is added to the CSP, and a
doctor check covers the password and `TRUSTED_PROXY_HOPS` cases. See
`docs/deployment.md#cdn-mode`.
- **A reworked admin panel**
([#712](https://github.com/ralksta/immich-folio/pull/712),
[#713](https://github.com/ralksta/immich-folio/pull/713),
[#714](https://github.com/ralksta/immich-folio/pull/714),
[#716](https://github.com/ralksta/immich-folio/pull/716),
[#717](https://github.com/ralksta/immich-folio/pull/717),
[#718](https://github.com/ralksta/immich-folio/pull/718),
[#719](https://github.com/ralksta/immich-folio/pull/719),
[#721](https://github.com/ralksta/immich-folio/pull/721)):
- **A sidebar instead of the header row**, grouped by task, with an
unread
count on Messages and a dot on Diagnostics while Immich is down. It
collapses to an icon rail, with names shown on hover and focus, and
remembers that per browser.
- **`/admin` is an overview**: what needs attention (unread messages,
doctor warnings), published pages, journal entries and recent views.
- **The site's own visual language** — the preset's fonts, hairline
borders, the square marker — and one page header on every screen. The
accent is kept for the current place and the primary action; switches
are now pills reading ON or OFF, in green rather than the accent, so
Studio Modern's red no longer makes an enabled setting look like an
error.
- **The page builder is a structure list and a panel.** Hero, subpages
and
standalone albums sit in one list on the left, subpages drag-sorted in
place; the selected entry is edited on the right instead of in an
overlay.
- **Dialogs only where a change is permanent.** Deleting a message or a
journal entry, and resetting the favicon (which used to delete the file
without asking), go through one confirm dialog in the admin's own look.
Removals in the page builder, which only touch unsaved state, happen at
once and offer _Undo_. No `window.confirm()` is left.
- **Feature switches are grouped by meaning** as one-line rows under
Settings → General; page transitions and scroll-to-top moved to Theme →
Look & motion. No setting keys changed.
### Changed
- **Fonts and the Leaflet stylesheet are served from the site itself**
([#700](https://github.com/ralksta/immich-folio/pull/700)). Every page
used
to link `fonts.googleapis.com`, which sends each visitor's IP address to
Google. The server now fetches a theme's Google fonts once, rewrites the
stylesheet and caches the files in `content/.fonts/`; custom fonts in
`theme.fonts` keep working. If Google cannot be reached before a font is
cached, the page falls back to the theme's system fonts. `leaflet.css`
comes from the npm package instead of unpkg. The CSP drops
`fonts.googleapis.com`, `fonts.gstatic.com` and `unpkg.com`.
- **Email addresses are kept out of the served HTML**
([#705](https://github.com/ralksta/immich-folio/pull/705)). The
Impressum
and footer render the address only after hydration, from an encoded
form,
so harvesters reading raw HTML find nothing. Without JavaScript the
Impressum shows `name [at] example [dot] de`. This defeats bulk
harvesting,
not a person with a browser.
- **The Impressum cites § 5 DDG and links its contacts**
([#698](https://github.com/ralksta/immich-folio/pull/698), reported in
[#697](https://github.com/ralksta/immich-folio/issues/697) by
[@RichKidsDev](https://github.com/RichKidsDev)). The TMG was replaced by
the
DDG in May 2024; `legal.heading` replaces the line for other laws (e.g.
§ 5 ECG in Austria). `legal.contactUrl` and `legal.contactLabel` add a
contact form as the second channel, so a phone number stays optional.
Email, phone and contact URL are now links, and the "Created with the
Impressum generator by eRecht24" line, shown on every site whether true
or
not, is gone. Settings → Legal gains fields for heading, contact URL,
VAT
ID and tax number, and a doctor check flags missing details.
- **Missing pages answer `404`**
([#704](https://github.com/ralksta/immich-folio/pull/704)). Every
missing
page used to answer `200`, because streaming had started before
`notFound()` ran. `/contact`, `/impressum`, `/map` and `/privacy` while
switched off, and `/journal/<slug>` without an entry, now return a real
404 with the same not-found page. Album and subpage slugs still depend
on
Immich and stay soft 404s.
- **Passwords set in the admin are stored as scrypt hashes**
([#706](https://github.com/ralksta/immich-folio/pull/706), closes
[#690](https://github.com/ralksta/immich-folio/issues/690)). Subpage,
album, journal-entry and site passwords were written as typed. The save
routes now hash them; a stored hash reads _Protected_ with _Change_ and
_Remove_ and is never put into an input. Visitors who unlocked a page
stay
signed in across unrelated saves. Existing plaintext passwords are
hashed
the next time their file is saved in the admin.
- **One notification surface in the admin**
([#707](https://github.com/ralksta/immich-folio/pull/707)) replaces
every
`alert()`: errors stay until dismissed, successes clear themselves, and
screen readers announce both.
### Fixed
- **Map tiles load again**
([#701](https://github.com/ralksta/immich-folio/pull/701)). CARTO
started
answering every tile with an "API KEY REQUIRED" image, leaving `/map`
and
journal map blocks as a grey grid. Tiles now come from OpenStreetMap;
the
dark look is a CSS filter, so the map now follows the colour mode.
- **The page builder no longer drops a subpage's `proofing:` flag on
save**
([#711](https://github.com/ralksta/immich-folio/pull/711)). A page
switched
off for proofing by hand reverted after any unrelated edit.
- **Unsaved edits in Settings and About survive switching admin tabs,
and a
backup restore is no longer overwritten by the next save**
([#687](https://github.com/ralksta/immich-folio/pull/687)). Editors that
were open during a restore now reload and offer unsaved edits back as a
conflict. Also: "Restore my changes" after a conflict found nothing,
removing an album left its drawer showing the next album, and the
journal
saved (rotating a backup) without changes.
- **Accent-backed buttons stay readable with a light or malformed
accent**
([#724](https://github.com/ralksta/immich-folio/pull/724), supersedes
[#680](https://github.com/ralksta/immich-folio/pull/680)) — contributed
by
[@lancetm714](https://github.com/lancetm714). A white accent made the
proofing dialog's _Download selected (.zip)_ button white on white.
`theme.accent` is now accepted as hex only and normalised to `#rrggbb`,
anything else falls back to the preset, and the proofing dialog and
filter
pills use the mode-aware `--on-accent` text colour from #688.
- **Every preset's accent is visible in both colour modes**
([#688](https://github.com/ralksta/immich-folio/pull/688)). Presets had
one
accent for both modes; minimal's dark mode drew black buttons on black.
Presets now carry a light and a dark accent, and text on accent-filled
buttons picks black or white for contrast. A custom accent stays the
owner's choice in both modes.
- **Visitor-side inconsistencies**
([#685](https://github.com/ralksta/immich-folio/pull/685)): after
visiting
`/impressum`, every subpage header turned centred and uppercase; back
links
announced "Back to Back to …"; the hero EXIF chip ignored
`exif.location`/`camera`/`settings`; videos in journal entries opened as
stills; the setup screen named a non-existent `.env.example`.
- **An essay's lightbox walks only the photos the story shows**
([#686](https://github.com/ralksta/immich-folio/pull/686)), not every
photo
of the subpage's albums, and the proofing bar in essays shows the
selection
count instead of a filter button that did nothing.
- **The page panel scrolls with the mouse wheel**
([#720](https://github.com/ralksta/immich-folio/pull/720)).
- **The journal editor's top bar wraps on phones**
([#723](https://github.com/ralksta/immich-folio/pull/723), closes
[#675](https://github.com/ralksta/immich-folio/issues/675)), so the
title
stays editable and Save stays on screen.
- **Every admin form field has a name for assistive technology**
([#715](https://github.com/ralksta/immich-folio/pull/715)). Only two
inputs
had a linked label; 47 are linked now, and clicking a label focuses its
field.
### Internal
- **`SettingsEditor` and `PageBuilder` are split up**
([#710](https://github.com/ralksta/immich-folio/pull/710),
[#711](https://github.com/ralksta/immich-folio/pull/711)). The
2,200-line
settings editor is a shell with one file per section; the page builder's
YAML handling and edits are pure functions under test. Both were checked
side by side against `dev` for identical output.
- **`useAdminFetch()`**
([#707](https://github.com/ralksta/immich-folio/pull/707))
gives Analytics, Messages, Backups and the journal list one loading and
error pattern.
- README brought up to v0.17.0
([#678](https://github.com/ralksta/immich-folio/pull/678),
[#679](https://github.com/ralksta/immich-folio/pull/679)).
### Upgrade notes
**`content/` gains two directories the app writes to:**
`content/.fonts/`
for the cached fonts and `content/messages/` for contact-form messages.
Both
are created on demand, so a writable `content/` is enough, as before.
**The server needs outbound HTTPS to Google once per font** to fill the
font
cache. Until then pages fall back to the theme's system fonts. Visitors'
browsers no longer contact Google.
**A custom CSP or reverse-proxy allowlist** must now allow
`tile.openstreetmap.org` for images instead of
`*.basemaps.cartocdn.com`,
and no longer needs `fonts.googleapis.com`, `fonts.gstatic.com` or
`unpkg.com`. The built-in CSP is updated.
**`theme.accent` must be hex** (`#rgb`, `#rrggbb` or `#rrggbbaa`).
Anything
else, including a value without `#`, falls back to the preset's accent.
**Plaintext passwords in `gallery.yaml`, `settings.yaml` or journal
entries**
are hashed the next time that file is saved in the admin; one save
clears the
doctor's warning.
**New, optional settings:** `contact.*` (the form is off by default),
`privacy.enabled`, `legal.heading`, `legal.contactUrl`,
`legal.contactLabel`,
and the `CDN_URL` and `CONTACT_NOTIFY_URL` environment variables. See
`content/settings.yaml.example` and `.env.local.example`. In the example
file,
`vatId` and `taxId` had swapped sample values; check yours if you copied
them.
No `IMAGE_CACHE_VERSION` bump is needed this time.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>
2026-09-27 14:43:38 +02:00
|
|
|
/>
|
2026-10-02 18:14:23 +02:00
|
|
|
<p id="general-site-title-hint" className="admin-field-hint">
|
|
|
|
|
{settings.title
|
|
|
|
|
? 'Shown in the header, the browser tab and link previews.'
|
|
|
|
|
: `Empty, so the site shows “${fallbackTitle}”${siteTitleEnv ? ', from SITE_TITLE' : ''}.`}
|
|
|
|
|
</p>
|
release: v0.18.0 (#725)
Release v0.18.0 — merges `dev` into `main`.
## Thanks
- [@lancetm714](https://github.com/lancetm714) for the accent-contrast
fix (#680 → #724).
- [@RichKidsDev](https://github.com/RichKidsDev) for reporting the
outdated Impressum (#697).
### Security
- **Journal drafts and password-protected entries no longer render
publicly
as a subpage essay**
([#684](https://github.com/ralksta/immich-folio/pull/684),
[GHSA-987w-cpwm-c9g9](https://github.com/ralksta/immich-folio/security/advisories/GHSA-987w-cpwm-c9g9),
medium). A subpage's `essayFile` read the journal entry straight from
disk,
skipping the draft and password rules `/journal/<slug>` applies. It now
resolves through the same rules: a draft reads as missing for visitors,
and
a protected entry shows its password gate, sharing the
`lb_auth_journal_<slug>` cookie.
- **Immich descriptions are escaped in generated subpage essays**
([#684](https://github.com/ralksta/immich-folio/pull/684),
[GHSA-8ppx-39jv-q5xm](https://github.com/ralksta/immich-folio/security/advisories/GHSA-8ppx-39jv-q5xm),
low). The essay built from a subpage's albums (`layout: essay` without
markdown) put each asset's Immich description into the page as raw HTML.
Captions are now HTML-escaped, and they go through `assetCaption()`, so
`exif.caption: false` is respected there as well. Tracked in
[#689](https://github.com/ralksta/immich-folio/issues/689).
- **Admin drafts no longer keep a typed password, and the contact form's
email check runs in linear time**
([#727](https://github.com/ralksta/immich-folio/pull/727)). The admin's
session drafts wrote a password as typed to `sessionStorage`; a draft
holding a plaintext password is now not kept (the unsaved-changes guard
still warns). The email pattern could backtrack polynomially on a
crafted
domain; its labels now exclude the dot and the length is checked first.
Both found by CodeQL before release.
### Added
- **A built-in contact form with an inbox in the admin**
([#703](https://github.com/ralksta/immich-folio/pull/703), closes
[#702](https://github.com/ralksta/immich-folio/issues/702)). `/contact`
needs neither SMTP nor a form service: each message is one file in
`content/messages/` (mode `0600`), read under the new _Messages_ tab,
where
_Reply by email_ opens the owner's mail client with the message quoted.
Messages older than `contact.retentionDays` (default 90) are deleted. An
optional ntfy push goes to `contact.notifyUrl` or `CONTACT_NOTIFY_URL`,
and
since [#709](https://github.com/ralksta/immich-folio/pull/709) it
carries a
fixed "new message" line and nothing about the sender — no name, no
address, no text. Spam is kept out without a captcha: an off-screen
honeypot, a minimum fill time, three submissions a minute per IP and a
cap
of 500 stored messages. With the Impressum on and no `legal.contactUrl`,
the Impressum links the form as its second contact channel. A new doctor
check warns when the form is on but nobody is notified.
- **A privacy policy page, next to a list of what the site processes**
([#708](https://github.com/ralksta/immich-folio/pull/708)). `/privacy`
renders `content/privacy.md`, edited under Settings → Legal, and the
footer
links it once the file has text; `privacy.enabled: false` hides it.
Folio
writes no legal text. Beside the editor it lists what _this_
installation
does, read off the configuration — the map, statistics, contact form,
password cookies, CDN — and marks every entry that involves a third
party.
_Insert headings_ adds the matching section headings and nothing else.
The
doctor warns while the Impressum is on and there is no policy.
- **French, Spanish, Italian and Dutch interface translations**
([#681](https://github.com/ralksta/immich-folio/pull/681)), selected
with
`settings.yaml: lang` as before. The admin panel stays English.
- **CDN mode for photos and videos**
([#681](https://github.com/ralksta/immich-folio/pull/681)). With
`CDN_URL`
set, image and video URLs point at a pull CDN whose origin is this
server,
so repeat views reach neither the server nor Immich. A site password
switches the mode off, since a CDN would hand out cached photos without
checking the unlock cookie. The CDN origin is added to the CSP, and a
doctor check covers the password and `TRUSTED_PROXY_HOPS` cases. See
`docs/deployment.md#cdn-mode`.
- **A reworked admin panel**
([#712](https://github.com/ralksta/immich-folio/pull/712),
[#713](https://github.com/ralksta/immich-folio/pull/713),
[#714](https://github.com/ralksta/immich-folio/pull/714),
[#716](https://github.com/ralksta/immich-folio/pull/716),
[#717](https://github.com/ralksta/immich-folio/pull/717),
[#718](https://github.com/ralksta/immich-folio/pull/718),
[#719](https://github.com/ralksta/immich-folio/pull/719),
[#721](https://github.com/ralksta/immich-folio/pull/721)):
- **A sidebar instead of the header row**, grouped by task, with an
unread
count on Messages and a dot on Diagnostics while Immich is down. It
collapses to an icon rail, with names shown on hover and focus, and
remembers that per browser.
- **`/admin` is an overview**: what needs attention (unread messages,
doctor warnings), published pages, journal entries and recent views.
- **The site's own visual language** — the preset's fonts, hairline
borders, the square marker — and one page header on every screen. The
accent is kept for the current place and the primary action; switches
are now pills reading ON or OFF, in green rather than the accent, so
Studio Modern's red no longer makes an enabled setting look like an
error.
- **The page builder is a structure list and a panel.** Hero, subpages
and
standalone albums sit in one list on the left, subpages drag-sorted in
place; the selected entry is edited on the right instead of in an
overlay.
- **Dialogs only where a change is permanent.** Deleting a message or a
journal entry, and resetting the favicon (which used to delete the file
without asking), go through one confirm dialog in the admin's own look.
Removals in the page builder, which only touch unsaved state, happen at
once and offer _Undo_. No `window.confirm()` is left.
- **Feature switches are grouped by meaning** as one-line rows under
Settings → General; page transitions and scroll-to-top moved to Theme →
Look & motion. No setting keys changed.
### Changed
- **Fonts and the Leaflet stylesheet are served from the site itself**
([#700](https://github.com/ralksta/immich-folio/pull/700)). Every page
used
to link `fonts.googleapis.com`, which sends each visitor's IP address to
Google. The server now fetches a theme's Google fonts once, rewrites the
stylesheet and caches the files in `content/.fonts/`; custom fonts in
`theme.fonts` keep working. If Google cannot be reached before a font is
cached, the page falls back to the theme's system fonts. `leaflet.css`
comes from the npm package instead of unpkg. The CSP drops
`fonts.googleapis.com`, `fonts.gstatic.com` and `unpkg.com`.
- **Email addresses are kept out of the served HTML**
([#705](https://github.com/ralksta/immich-folio/pull/705)). The
Impressum
and footer render the address only after hydration, from an encoded
form,
so harvesters reading raw HTML find nothing. Without JavaScript the
Impressum shows `name [at] example [dot] de`. This defeats bulk
harvesting,
not a person with a browser.
- **The Impressum cites § 5 DDG and links its contacts**
([#698](https://github.com/ralksta/immich-folio/pull/698), reported in
[#697](https://github.com/ralksta/immich-folio/issues/697) by
[@RichKidsDev](https://github.com/RichKidsDev)). The TMG was replaced by
the
DDG in May 2024; `legal.heading` replaces the line for other laws (e.g.
§ 5 ECG in Austria). `legal.contactUrl` and `legal.contactLabel` add a
contact form as the second channel, so a phone number stays optional.
Email, phone and contact URL are now links, and the "Created with the
Impressum generator by eRecht24" line, shown on every site whether true
or
not, is gone. Settings → Legal gains fields for heading, contact URL,
VAT
ID and tax number, and a doctor check flags missing details.
- **Missing pages answer `404`**
([#704](https://github.com/ralksta/immich-folio/pull/704)). Every
missing
page used to answer `200`, because streaming had started before
`notFound()` ran. `/contact`, `/impressum`, `/map` and `/privacy` while
switched off, and `/journal/<slug>` without an entry, now return a real
404 with the same not-found page. Album and subpage slugs still depend
on
Immich and stay soft 404s.
- **Passwords set in the admin are stored as scrypt hashes**
([#706](https://github.com/ralksta/immich-folio/pull/706), closes
[#690](https://github.com/ralksta/immich-folio/issues/690)). Subpage,
album, journal-entry and site passwords were written as typed. The save
routes now hash them; a stored hash reads _Protected_ with _Change_ and
_Remove_ and is never put into an input. Visitors who unlocked a page
stay
signed in across unrelated saves. Existing plaintext passwords are
hashed
the next time their file is saved in the admin.
- **One notification surface in the admin**
([#707](https://github.com/ralksta/immich-folio/pull/707)) replaces
every
`alert()`: errors stay until dismissed, successes clear themselves, and
screen readers announce both.
### Fixed
- **Map tiles load again**
([#701](https://github.com/ralksta/immich-folio/pull/701)). CARTO
started
answering every tile with an "API KEY REQUIRED" image, leaving `/map`
and
journal map blocks as a grey grid. Tiles now come from OpenStreetMap;
the
dark look is a CSS filter, so the map now follows the colour mode.
- **The page builder no longer drops a subpage's `proofing:` flag on
save**
([#711](https://github.com/ralksta/immich-folio/pull/711)). A page
switched
off for proofing by hand reverted after any unrelated edit.
- **Unsaved edits in Settings and About survive switching admin tabs,
and a
backup restore is no longer overwritten by the next save**
([#687](https://github.com/ralksta/immich-folio/pull/687)). Editors that
were open during a restore now reload and offer unsaved edits back as a
conflict. Also: "Restore my changes" after a conflict found nothing,
removing an album left its drawer showing the next album, and the
journal
saved (rotating a backup) without changes.
- **Accent-backed buttons stay readable with a light or malformed
accent**
([#724](https://github.com/ralksta/immich-folio/pull/724), supersedes
[#680](https://github.com/ralksta/immich-folio/pull/680)) — contributed
by
[@lancetm714](https://github.com/lancetm714). A white accent made the
proofing dialog's _Download selected (.zip)_ button white on white.
`theme.accent` is now accepted as hex only and normalised to `#rrggbb`,
anything else falls back to the preset, and the proofing dialog and
filter
pills use the mode-aware `--on-accent` text colour from #688.
- **Every preset's accent is visible in both colour modes**
([#688](https://github.com/ralksta/immich-folio/pull/688)). Presets had
one
accent for both modes; minimal's dark mode drew black buttons on black.
Presets now carry a light and a dark accent, and text on accent-filled
buttons picks black or white for contrast. A custom accent stays the
owner's choice in both modes.
- **Visitor-side inconsistencies**
([#685](https://github.com/ralksta/immich-folio/pull/685)): after
visiting
`/impressum`, every subpage header turned centred and uppercase; back
links
announced "Back to Back to …"; the hero EXIF chip ignored
`exif.location`/`camera`/`settings`; videos in journal entries opened as
stills; the setup screen named a non-existent `.env.example`.
- **An essay's lightbox walks only the photos the story shows**
([#686](https://github.com/ralksta/immich-folio/pull/686)), not every
photo
of the subpage's albums, and the proofing bar in essays shows the
selection
count instead of a filter button that did nothing.
- **The page panel scrolls with the mouse wheel**
([#720](https://github.com/ralksta/immich-folio/pull/720)).
- **The journal editor's top bar wraps on phones**
([#723](https://github.com/ralksta/immich-folio/pull/723), closes
[#675](https://github.com/ralksta/immich-folio/issues/675)), so the
title
stays editable and Save stays on screen.
- **Every admin form field has a name for assistive technology**
([#715](https://github.com/ralksta/immich-folio/pull/715)). Only two
inputs
had a linked label; 47 are linked now, and clicking a label focuses its
field.
### Internal
- **`SettingsEditor` and `PageBuilder` are split up**
([#710](https://github.com/ralksta/immich-folio/pull/710),
[#711](https://github.com/ralksta/immich-folio/pull/711)). The
2,200-line
settings editor is a shell with one file per section; the page builder's
YAML handling and edits are pure functions under test. Both were checked
side by side against `dev` for identical output.
- **`useAdminFetch()`**
([#707](https://github.com/ralksta/immich-folio/pull/707))
gives Analytics, Messages, Backups and the journal list one loading and
error pattern.
- README brought up to v0.17.0
([#678](https://github.com/ralksta/immich-folio/pull/678),
[#679](https://github.com/ralksta/immich-folio/pull/679)).
### Upgrade notes
**`content/` gains two directories the app writes to:**
`content/.fonts/`
for the cached fonts and `content/messages/` for contact-form messages.
Both
are created on demand, so a writable `content/` is enough, as before.
**The server needs outbound HTTPS to Google once per font** to fill the
font
cache. Until then pages fall back to the theme's system fonts. Visitors'
browsers no longer contact Google.
**A custom CSP or reverse-proxy allowlist** must now allow
`tile.openstreetmap.org` for images instead of
`*.basemaps.cartocdn.com`,
and no longer needs `fonts.googleapis.com`, `fonts.gstatic.com` or
`unpkg.com`. The built-in CSP is updated.
**`theme.accent` must be hex** (`#rgb`, `#rrggbb` or `#rrggbbaa`).
Anything
else, including a value without `#`, falls back to the preset's accent.
**Plaintext passwords in `gallery.yaml`, `settings.yaml` or journal
entries**
are hashed the next time that file is saved in the admin; one save
clears the
doctor's warning.
**New, optional settings:** `contact.*` (the form is off by default),
`privacy.enabled`, `legal.heading`, `legal.contactUrl`,
`legal.contactLabel`,
and the `CDN_URL` and `CONTACT_NOTIFY_URL` environment variables. See
`content/settings.yaml.example` and `.env.local.example`. In the example
file,
`vatId` and `taxId` had swapped sample values; check yours if you copied
them.
No `IMAGE_CACHE_VERSION` bump is needed this time.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>
2026-09-27 14:43:38 +02:00
|
|
|
</div>
|
|
|
|
|
<div className="admin-field">
|
|
|
|
|
<label htmlFor="general-subtitle">Subtitle</label>
|
|
|
|
|
<input
|
|
|
|
|
id="general-subtitle"
|
|
|
|
|
value={settings.subtitle || ''}
|
|
|
|
|
onChange={(e) => update('subtitle', e.target.value)}
|
|
|
|
|
placeholder="A visual journal"
|
|
|
|
|
/>
|
|
|
|
|
</div>
|
|
|
|
|
<div className="admin-field">
|
|
|
|
|
<label htmlFor="general-language">Language</label>
|
|
|
|
|
<select
|
|
|
|
|
id="general-language"
|
|
|
|
|
aria-label="Language"
|
|
|
|
|
value={settings.lang || 'en'}
|
|
|
|
|
onChange={(e) => update('lang', e.target.value)}
|
|
|
|
|
>
|
|
|
|
|
<option value="en">English (US)</option>
|
|
|
|
|
<option value="de">Deutsch (DE)</option>
|
|
|
|
|
<option value="fr">Français (FR)</option>
|
|
|
|
|
<option value="es">Español (ES)</option>
|
|
|
|
|
<option value="it">Italiano (IT)</option>
|
|
|
|
|
<option value="nl">Nederlands (NL)</option>
|
|
|
|
|
<option value="ja">日本語 (JA)</option>
|
|
|
|
|
</select>
|
|
|
|
|
<p className="admin-field-hint">
|
|
|
|
|
The visitor-facing interface is translated for {SUPPORTED_LOCALES.join(', ')}. Other
|
|
|
|
|
languages still set <code><html lang></code> and date formatting, but show the
|
|
|
|
|
English interface. The admin panel is always English.
|
|
|
|
|
</p>
|
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
<div className="settings-section-divider" />
|
|
|
|
|
|
|
|
|
|
<div className="settings-section-header">
|
|
|
|
|
<h3>
|
|
|
|
|
<Icons.IconSparkles size={18} /> Portfolio Features & Modules
|
|
|
|
|
</h3>
|
|
|
|
|
<p className="settings-section-sub">
|
|
|
|
|
Optional pages, and what the site reveals about your photos and counts about visits.
|
|
|
|
|
</p>
|
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
<FeatureGroup
|
|
|
|
|
icon={<Icons.IconFrame size={13} />}
|
|
|
|
|
title="Modules"
|
|
|
|
|
description="Each one adds a page or a control visitors can use."
|
|
|
|
|
>
|
|
|
|
|
<div className="feature-list">
|
|
|
|
|
<FeatureRow
|
|
|
|
|
icon={<Icons.IconCamera size={15} />}
|
|
|
|
|
title="About page"
|
|
|
|
|
description="Portrait, bio and gear at /about"
|
|
|
|
|
checked={settings.about?.enabled !== false}
|
|
|
|
|
onToggle={() => update('about.enabled', settings.about?.enabled === false)}
|
|
|
|
|
href="/admin/settings/about"
|
|
|
|
|
/>
|
|
|
|
|
<FeatureRow
|
|
|
|
|
icon={<Icons.IconMap size={15} />}
|
|
|
|
|
title="Map"
|
|
|
|
|
description="Photo locations on a world map at /map"
|
|
|
|
|
checked={settings.map === true}
|
|
|
|
|
onToggle={() => update('map', !settings.map)}
|
|
|
|
|
/>
|
|
|
|
|
<FeatureRow
|
|
|
|
|
icon={<Icons.IconHeart size={15} />}
|
|
|
|
|
title="Client proofing"
|
|
|
|
|
description="Visitors heart, filter and export a selection of photos"
|
|
|
|
|
checked={settings.proofing?.enabled !== false}
|
|
|
|
|
onToggle={() => update('proofing.enabled', settings.proofing?.enabled === false)}
|
|
|
|
|
/>
|
2026-10-02 18:14:23 +02:00
|
|
|
<FeatureRow
|
|
|
|
|
icon={<Icons.IconSearch size={15} />}
|
|
|
|
|
title="Photo zoom"
|
|
|
|
|
description="Visitors zoom into a photo to full resolution (1:1) to check sharpness. Pages and albums can override this"
|
|
|
|
|
checked={settings.zoom === true}
|
|
|
|
|
onToggle={() => update('zoom', !settings.zoom)}
|
|
|
|
|
/>
|
release: v0.18.0 (#725)
Release v0.18.0 — merges `dev` into `main`.
## Thanks
- [@lancetm714](https://github.com/lancetm714) for the accent-contrast
fix (#680 → #724).
- [@RichKidsDev](https://github.com/RichKidsDev) for reporting the
outdated Impressum (#697).
### Security
- **Journal drafts and password-protected entries no longer render
publicly
as a subpage essay**
([#684](https://github.com/ralksta/immich-folio/pull/684),
[GHSA-987w-cpwm-c9g9](https://github.com/ralksta/immich-folio/security/advisories/GHSA-987w-cpwm-c9g9),
medium). A subpage's `essayFile` read the journal entry straight from
disk,
skipping the draft and password rules `/journal/<slug>` applies. It now
resolves through the same rules: a draft reads as missing for visitors,
and
a protected entry shows its password gate, sharing the
`lb_auth_journal_<slug>` cookie.
- **Immich descriptions are escaped in generated subpage essays**
([#684](https://github.com/ralksta/immich-folio/pull/684),
[GHSA-8ppx-39jv-q5xm](https://github.com/ralksta/immich-folio/security/advisories/GHSA-8ppx-39jv-q5xm),
low). The essay built from a subpage's albums (`layout: essay` without
markdown) put each asset's Immich description into the page as raw HTML.
Captions are now HTML-escaped, and they go through `assetCaption()`, so
`exif.caption: false` is respected there as well. Tracked in
[#689](https://github.com/ralksta/immich-folio/issues/689).
- **Admin drafts no longer keep a typed password, and the contact form's
email check runs in linear time**
([#727](https://github.com/ralksta/immich-folio/pull/727)). The admin's
session drafts wrote a password as typed to `sessionStorage`; a draft
holding a plaintext password is now not kept (the unsaved-changes guard
still warns). The email pattern could backtrack polynomially on a
crafted
domain; its labels now exclude the dot and the length is checked first.
Both found by CodeQL before release.
### Added
- **A built-in contact form with an inbox in the admin**
([#703](https://github.com/ralksta/immich-folio/pull/703), closes
[#702](https://github.com/ralksta/immich-folio/issues/702)). `/contact`
needs neither SMTP nor a form service: each message is one file in
`content/messages/` (mode `0600`), read under the new _Messages_ tab,
where
_Reply by email_ opens the owner's mail client with the message quoted.
Messages older than `contact.retentionDays` (default 90) are deleted. An
optional ntfy push goes to `contact.notifyUrl` or `CONTACT_NOTIFY_URL`,
and
since [#709](https://github.com/ralksta/immich-folio/pull/709) it
carries a
fixed "new message" line and nothing about the sender — no name, no
address, no text. Spam is kept out without a captcha: an off-screen
honeypot, a minimum fill time, three submissions a minute per IP and a
cap
of 500 stored messages. With the Impressum on and no `legal.contactUrl`,
the Impressum links the form as its second contact channel. A new doctor
check warns when the form is on but nobody is notified.
- **A privacy policy page, next to a list of what the site processes**
([#708](https://github.com/ralksta/immich-folio/pull/708)). `/privacy`
renders `content/privacy.md`, edited under Settings → Legal, and the
footer
links it once the file has text; `privacy.enabled: false` hides it.
Folio
writes no legal text. Beside the editor it lists what _this_
installation
does, read off the configuration — the map, statistics, contact form,
password cookies, CDN — and marks every entry that involves a third
party.
_Insert headings_ adds the matching section headings and nothing else.
The
doctor warns while the Impressum is on and there is no policy.
- **French, Spanish, Italian and Dutch interface translations**
([#681](https://github.com/ralksta/immich-folio/pull/681)), selected
with
`settings.yaml: lang` as before. The admin panel stays English.
- **CDN mode for photos and videos**
([#681](https://github.com/ralksta/immich-folio/pull/681)). With
`CDN_URL`
set, image and video URLs point at a pull CDN whose origin is this
server,
so repeat views reach neither the server nor Immich. A site password
switches the mode off, since a CDN would hand out cached photos without
checking the unlock cookie. The CDN origin is added to the CSP, and a
doctor check covers the password and `TRUSTED_PROXY_HOPS` cases. See
`docs/deployment.md#cdn-mode`.
- **A reworked admin panel**
([#712](https://github.com/ralksta/immich-folio/pull/712),
[#713](https://github.com/ralksta/immich-folio/pull/713),
[#714](https://github.com/ralksta/immich-folio/pull/714),
[#716](https://github.com/ralksta/immich-folio/pull/716),
[#717](https://github.com/ralksta/immich-folio/pull/717),
[#718](https://github.com/ralksta/immich-folio/pull/718),
[#719](https://github.com/ralksta/immich-folio/pull/719),
[#721](https://github.com/ralksta/immich-folio/pull/721)):
- **A sidebar instead of the header row**, grouped by task, with an
unread
count on Messages and a dot on Diagnostics while Immich is down. It
collapses to an icon rail, with names shown on hover and focus, and
remembers that per browser.
- **`/admin` is an overview**: what needs attention (unread messages,
doctor warnings), published pages, journal entries and recent views.
- **The site's own visual language** — the preset's fonts, hairline
borders, the square marker — and one page header on every screen. The
accent is kept for the current place and the primary action; switches
are now pills reading ON or OFF, in green rather than the accent, so
Studio Modern's red no longer makes an enabled setting look like an
error.
- **The page builder is a structure list and a panel.** Hero, subpages
and
standalone albums sit in one list on the left, subpages drag-sorted in
place; the selected entry is edited on the right instead of in an
overlay.
- **Dialogs only where a change is permanent.** Deleting a message or a
journal entry, and resetting the favicon (which used to delete the file
without asking), go through one confirm dialog in the admin's own look.
Removals in the page builder, which only touch unsaved state, happen at
once and offer _Undo_. No `window.confirm()` is left.
- **Feature switches are grouped by meaning** as one-line rows under
Settings → General; page transitions and scroll-to-top moved to Theme →
Look & motion. No setting keys changed.
### Changed
- **Fonts and the Leaflet stylesheet are served from the site itself**
([#700](https://github.com/ralksta/immich-folio/pull/700)). Every page
used
to link `fonts.googleapis.com`, which sends each visitor's IP address to
Google. The server now fetches a theme's Google fonts once, rewrites the
stylesheet and caches the files in `content/.fonts/`; custom fonts in
`theme.fonts` keep working. If Google cannot be reached before a font is
cached, the page falls back to the theme's system fonts. `leaflet.css`
comes from the npm package instead of unpkg. The CSP drops
`fonts.googleapis.com`, `fonts.gstatic.com` and `unpkg.com`.
- **Email addresses are kept out of the served HTML**
([#705](https://github.com/ralksta/immich-folio/pull/705)). The
Impressum
and footer render the address only after hydration, from an encoded
form,
so harvesters reading raw HTML find nothing. Without JavaScript the
Impressum shows `name [at] example [dot] de`. This defeats bulk
harvesting,
not a person with a browser.
- **The Impressum cites § 5 DDG and links its contacts**
([#698](https://github.com/ralksta/immich-folio/pull/698), reported in
[#697](https://github.com/ralksta/immich-folio/issues/697) by
[@RichKidsDev](https://github.com/RichKidsDev)). The TMG was replaced by
the
DDG in May 2024; `legal.heading` replaces the line for other laws (e.g.
§ 5 ECG in Austria). `legal.contactUrl` and `legal.contactLabel` add a
contact form as the second channel, so a phone number stays optional.
Email, phone and contact URL are now links, and the "Created with the
Impressum generator by eRecht24" line, shown on every site whether true
or
not, is gone. Settings → Legal gains fields for heading, contact URL,
VAT
ID and tax number, and a doctor check flags missing details.
- **Missing pages answer `404`**
([#704](https://github.com/ralksta/immich-folio/pull/704)). Every
missing
page used to answer `200`, because streaming had started before
`notFound()` ran. `/contact`, `/impressum`, `/map` and `/privacy` while
switched off, and `/journal/<slug>` without an entry, now return a real
404 with the same not-found page. Album and subpage slugs still depend
on
Immich and stay soft 404s.
- **Passwords set in the admin are stored as scrypt hashes**
([#706](https://github.com/ralksta/immich-folio/pull/706), closes
[#690](https://github.com/ralksta/immich-folio/issues/690)). Subpage,
album, journal-entry and site passwords were written as typed. The save
routes now hash them; a stored hash reads _Protected_ with _Change_ and
_Remove_ and is never put into an input. Visitors who unlocked a page
stay
signed in across unrelated saves. Existing plaintext passwords are
hashed
the next time their file is saved in the admin.
- **One notification surface in the admin**
([#707](https://github.com/ralksta/immich-folio/pull/707)) replaces
every
`alert()`: errors stay until dismissed, successes clear themselves, and
screen readers announce both.
### Fixed
- **Map tiles load again**
([#701](https://github.com/ralksta/immich-folio/pull/701)). CARTO
started
answering every tile with an "API KEY REQUIRED" image, leaving `/map`
and
journal map blocks as a grey grid. Tiles now come from OpenStreetMap;
the
dark look is a CSS filter, so the map now follows the colour mode.
- **The page builder no longer drops a subpage's `proofing:` flag on
save**
([#711](https://github.com/ralksta/immich-folio/pull/711)). A page
switched
off for proofing by hand reverted after any unrelated edit.
- **Unsaved edits in Settings and About survive switching admin tabs,
and a
backup restore is no longer overwritten by the next save**
([#687](https://github.com/ralksta/immich-folio/pull/687)). Editors that
were open during a restore now reload and offer unsaved edits back as a
conflict. Also: "Restore my changes" after a conflict found nothing,
removing an album left its drawer showing the next album, and the
journal
saved (rotating a backup) without changes.
- **Accent-backed buttons stay readable with a light or malformed
accent**
([#724](https://github.com/ralksta/immich-folio/pull/724), supersedes
[#680](https://github.com/ralksta/immich-folio/pull/680)) — contributed
by
[@lancetm714](https://github.com/lancetm714). A white accent made the
proofing dialog's _Download selected (.zip)_ button white on white.
`theme.accent` is now accepted as hex only and normalised to `#rrggbb`,
anything else falls back to the preset, and the proofing dialog and
filter
pills use the mode-aware `--on-accent` text colour from #688.
- **Every preset's accent is visible in both colour modes**
([#688](https://github.com/ralksta/immich-folio/pull/688)). Presets had
one
accent for both modes; minimal's dark mode drew black buttons on black.
Presets now carry a light and a dark accent, and text on accent-filled
buttons picks black or white for contrast. A custom accent stays the
owner's choice in both modes.
- **Visitor-side inconsistencies**
([#685](https://github.com/ralksta/immich-folio/pull/685)): after
visiting
`/impressum`, every subpage header turned centred and uppercase; back
links
announced "Back to Back to …"; the hero EXIF chip ignored
`exif.location`/`camera`/`settings`; videos in journal entries opened as
stills; the setup screen named a non-existent `.env.example`.
- **An essay's lightbox walks only the photos the story shows**
([#686](https://github.com/ralksta/immich-folio/pull/686)), not every
photo
of the subpage's albums, and the proofing bar in essays shows the
selection
count instead of a filter button that did nothing.
- **The page panel scrolls with the mouse wheel**
([#720](https://github.com/ralksta/immich-folio/pull/720)).
- **The journal editor's top bar wraps on phones**
([#723](https://github.com/ralksta/immich-folio/pull/723), closes
[#675](https://github.com/ralksta/immich-folio/issues/675)), so the
title
stays editable and Save stays on screen.
- **Every admin form field has a name for assistive technology**
([#715](https://github.com/ralksta/immich-folio/pull/715)). Only two
inputs
had a linked label; 47 are linked now, and clicking a label focuses its
field.
### Internal
- **`SettingsEditor` and `PageBuilder` are split up**
([#710](https://github.com/ralksta/immich-folio/pull/710),
[#711](https://github.com/ralksta/immich-folio/pull/711)). The
2,200-line
settings editor is a shell with one file per section; the page builder's
YAML handling and edits are pure functions under test. Both were checked
side by side against `dev` for identical output.
- **`useAdminFetch()`**
([#707](https://github.com/ralksta/immich-folio/pull/707))
gives Analytics, Messages, Backups and the journal list one loading and
error pattern.
- README brought up to v0.17.0
([#678](https://github.com/ralksta/immich-folio/pull/678),
[#679](https://github.com/ralksta/immich-folio/pull/679)).
### Upgrade notes
**`content/` gains two directories the app writes to:**
`content/.fonts/`
for the cached fonts and `content/messages/` for contact-form messages.
Both
are created on demand, so a writable `content/` is enough, as before.
**The server needs outbound HTTPS to Google once per font** to fill the
font
cache. Until then pages fall back to the theme's system fonts. Visitors'
browsers no longer contact Google.
**A custom CSP or reverse-proxy allowlist** must now allow
`tile.openstreetmap.org` for images instead of
`*.basemaps.cartocdn.com`,
and no longer needs `fonts.googleapis.com`, `fonts.gstatic.com` or
`unpkg.com`. The built-in CSP is updated.
**`theme.accent` must be hex** (`#rgb`, `#rrggbb` or `#rrggbbaa`).
Anything
else, including a value without `#`, falls back to the preset's accent.
**Plaintext passwords in `gallery.yaml`, `settings.yaml` or journal
entries**
are hashed the next time that file is saved in the admin; one save
clears the
doctor's warning.
**New, optional settings:** `contact.*` (the form is off by default),
`privacy.enabled`, `legal.heading`, `legal.contactUrl`,
`legal.contactLabel`,
and the `CDN_URL` and `CONTACT_NOTIFY_URL` environment variables. See
`content/settings.yaml.example` and `.env.local.example`. In the example
file,
`vatId` and `taxId` had swapped sample values; check yours if you copied
them.
No `IMAGE_CACHE_VERSION` bump is needed this time.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>
2026-09-27 14:43:38 +02:00
|
|
|
</div>
|
2026-09-29 22:50:30 +02:00
|
|
|
{/* Shown even while proofing is off globally: a subpage can switch it
|
|
|
|
|
on for itself (`proofing: true`), so the address still has to be
|
|
|
|
|
settable from here. */}
|
|
|
|
|
<div className="admin-field">
|
|
|
|
|
<label htmlFor="proofing-email">Proofing email</label>
|
|
|
|
|
<input
|
|
|
|
|
id="proofing-email"
|
|
|
|
|
type="email"
|
|
|
|
|
value={settings.proofing?.email || ''}
|
|
|
|
|
onChange={(e) => update('proofing.email', e.target.value)}
|
|
|
|
|
placeholder="Defaults to the footer contact email"
|
|
|
|
|
/>
|
|
|
|
|
<p className="admin-field-hint">
|
|
|
|
|
Where “Email to photographer” sends a selection. Falls back to the footer
|
|
|
|
|
contact email; when neither is set, the button is hidden.
|
|
|
|
|
</p>
|
|
|
|
|
</div>
|
release: v0.18.0 (#725)
Release v0.18.0 — merges `dev` into `main`.
## Thanks
- [@lancetm714](https://github.com/lancetm714) for the accent-contrast
fix (#680 → #724).
- [@RichKidsDev](https://github.com/RichKidsDev) for reporting the
outdated Impressum (#697).
### Security
- **Journal drafts and password-protected entries no longer render
publicly
as a subpage essay**
([#684](https://github.com/ralksta/immich-folio/pull/684),
[GHSA-987w-cpwm-c9g9](https://github.com/ralksta/immich-folio/security/advisories/GHSA-987w-cpwm-c9g9),
medium). A subpage's `essayFile` read the journal entry straight from
disk,
skipping the draft and password rules `/journal/<slug>` applies. It now
resolves through the same rules: a draft reads as missing for visitors,
and
a protected entry shows its password gate, sharing the
`lb_auth_journal_<slug>` cookie.
- **Immich descriptions are escaped in generated subpage essays**
([#684](https://github.com/ralksta/immich-folio/pull/684),
[GHSA-8ppx-39jv-q5xm](https://github.com/ralksta/immich-folio/security/advisories/GHSA-8ppx-39jv-q5xm),
low). The essay built from a subpage's albums (`layout: essay` without
markdown) put each asset's Immich description into the page as raw HTML.
Captions are now HTML-escaped, and they go through `assetCaption()`, so
`exif.caption: false` is respected there as well. Tracked in
[#689](https://github.com/ralksta/immich-folio/issues/689).
- **Admin drafts no longer keep a typed password, and the contact form's
email check runs in linear time**
([#727](https://github.com/ralksta/immich-folio/pull/727)). The admin's
session drafts wrote a password as typed to `sessionStorage`; a draft
holding a plaintext password is now not kept (the unsaved-changes guard
still warns). The email pattern could backtrack polynomially on a
crafted
domain; its labels now exclude the dot and the length is checked first.
Both found by CodeQL before release.
### Added
- **A built-in contact form with an inbox in the admin**
([#703](https://github.com/ralksta/immich-folio/pull/703), closes
[#702](https://github.com/ralksta/immich-folio/issues/702)). `/contact`
needs neither SMTP nor a form service: each message is one file in
`content/messages/` (mode `0600`), read under the new _Messages_ tab,
where
_Reply by email_ opens the owner's mail client with the message quoted.
Messages older than `contact.retentionDays` (default 90) are deleted. An
optional ntfy push goes to `contact.notifyUrl` or `CONTACT_NOTIFY_URL`,
and
since [#709](https://github.com/ralksta/immich-folio/pull/709) it
carries a
fixed "new message" line and nothing about the sender — no name, no
address, no text. Spam is kept out without a captcha: an off-screen
honeypot, a minimum fill time, three submissions a minute per IP and a
cap
of 500 stored messages. With the Impressum on and no `legal.contactUrl`,
the Impressum links the form as its second contact channel. A new doctor
check warns when the form is on but nobody is notified.
- **A privacy policy page, next to a list of what the site processes**
([#708](https://github.com/ralksta/immich-folio/pull/708)). `/privacy`
renders `content/privacy.md`, edited under Settings → Legal, and the
footer
links it once the file has text; `privacy.enabled: false` hides it.
Folio
writes no legal text. Beside the editor it lists what _this_
installation
does, read off the configuration — the map, statistics, contact form,
password cookies, CDN — and marks every entry that involves a third
party.
_Insert headings_ adds the matching section headings and nothing else.
The
doctor warns while the Impressum is on and there is no policy.
- **French, Spanish, Italian and Dutch interface translations**
([#681](https://github.com/ralksta/immich-folio/pull/681)), selected
with
`settings.yaml: lang` as before. The admin panel stays English.
- **CDN mode for photos and videos**
([#681](https://github.com/ralksta/immich-folio/pull/681)). With
`CDN_URL`
set, image and video URLs point at a pull CDN whose origin is this
server,
so repeat views reach neither the server nor Immich. A site password
switches the mode off, since a CDN would hand out cached photos without
checking the unlock cookie. The CDN origin is added to the CSP, and a
doctor check covers the password and `TRUSTED_PROXY_HOPS` cases. See
`docs/deployment.md#cdn-mode`.
- **A reworked admin panel**
([#712](https://github.com/ralksta/immich-folio/pull/712),
[#713](https://github.com/ralksta/immich-folio/pull/713),
[#714](https://github.com/ralksta/immich-folio/pull/714),
[#716](https://github.com/ralksta/immich-folio/pull/716),
[#717](https://github.com/ralksta/immich-folio/pull/717),
[#718](https://github.com/ralksta/immich-folio/pull/718),
[#719](https://github.com/ralksta/immich-folio/pull/719),
[#721](https://github.com/ralksta/immich-folio/pull/721)):
- **A sidebar instead of the header row**, grouped by task, with an
unread
count on Messages and a dot on Diagnostics while Immich is down. It
collapses to an icon rail, with names shown on hover and focus, and
remembers that per browser.
- **`/admin` is an overview**: what needs attention (unread messages,
doctor warnings), published pages, journal entries and recent views.
- **The site's own visual language** — the preset's fonts, hairline
borders, the square marker — and one page header on every screen. The
accent is kept for the current place and the primary action; switches
are now pills reading ON or OFF, in green rather than the accent, so
Studio Modern's red no longer makes an enabled setting look like an
error.
- **The page builder is a structure list and a panel.** Hero, subpages
and
standalone albums sit in one list on the left, subpages drag-sorted in
place; the selected entry is edited on the right instead of in an
overlay.
- **Dialogs only where a change is permanent.** Deleting a message or a
journal entry, and resetting the favicon (which used to delete the file
without asking), go through one confirm dialog in the admin's own look.
Removals in the page builder, which only touch unsaved state, happen at
once and offer _Undo_. No `window.confirm()` is left.
- **Feature switches are grouped by meaning** as one-line rows under
Settings → General; page transitions and scroll-to-top moved to Theme →
Look & motion. No setting keys changed.
### Changed
- **Fonts and the Leaflet stylesheet are served from the site itself**
([#700](https://github.com/ralksta/immich-folio/pull/700)). Every page
used
to link `fonts.googleapis.com`, which sends each visitor's IP address to
Google. The server now fetches a theme's Google fonts once, rewrites the
stylesheet and caches the files in `content/.fonts/`; custom fonts in
`theme.fonts` keep working. If Google cannot be reached before a font is
cached, the page falls back to the theme's system fonts. `leaflet.css`
comes from the npm package instead of unpkg. The CSP drops
`fonts.googleapis.com`, `fonts.gstatic.com` and `unpkg.com`.
- **Email addresses are kept out of the served HTML**
([#705](https://github.com/ralksta/immich-folio/pull/705)). The
Impressum
and footer render the address only after hydration, from an encoded
form,
so harvesters reading raw HTML find nothing. Without JavaScript the
Impressum shows `name [at] example [dot] de`. This defeats bulk
harvesting,
not a person with a browser.
- **The Impressum cites § 5 DDG and links its contacts**
([#698](https://github.com/ralksta/immich-folio/pull/698), reported in
[#697](https://github.com/ralksta/immich-folio/issues/697) by
[@RichKidsDev](https://github.com/RichKidsDev)). The TMG was replaced by
the
DDG in May 2024; `legal.heading` replaces the line for other laws (e.g.
§ 5 ECG in Austria). `legal.contactUrl` and `legal.contactLabel` add a
contact form as the second channel, so a phone number stays optional.
Email, phone and contact URL are now links, and the "Created with the
Impressum generator by eRecht24" line, shown on every site whether true
or
not, is gone. Settings → Legal gains fields for heading, contact URL,
VAT
ID and tax number, and a doctor check flags missing details.
- **Missing pages answer `404`**
([#704](https://github.com/ralksta/immich-folio/pull/704)). Every
missing
page used to answer `200`, because streaming had started before
`notFound()` ran. `/contact`, `/impressum`, `/map` and `/privacy` while
switched off, and `/journal/<slug>` without an entry, now return a real
404 with the same not-found page. Album and subpage slugs still depend
on
Immich and stay soft 404s.
- **Passwords set in the admin are stored as scrypt hashes**
([#706](https://github.com/ralksta/immich-folio/pull/706), closes
[#690](https://github.com/ralksta/immich-folio/issues/690)). Subpage,
album, journal-entry and site passwords were written as typed. The save
routes now hash them; a stored hash reads _Protected_ with _Change_ and
_Remove_ and is never put into an input. Visitors who unlocked a page
stay
signed in across unrelated saves. Existing plaintext passwords are
hashed
the next time their file is saved in the admin.
- **One notification surface in the admin**
([#707](https://github.com/ralksta/immich-folio/pull/707)) replaces
every
`alert()`: errors stay until dismissed, successes clear themselves, and
screen readers announce both.
### Fixed
- **Map tiles load again**
([#701](https://github.com/ralksta/immich-folio/pull/701)). CARTO
started
answering every tile with an "API KEY REQUIRED" image, leaving `/map`
and
journal map blocks as a grey grid. Tiles now come from OpenStreetMap;
the
dark look is a CSS filter, so the map now follows the colour mode.
- **The page builder no longer drops a subpage's `proofing:` flag on
save**
([#711](https://github.com/ralksta/immich-folio/pull/711)). A page
switched
off for proofing by hand reverted after any unrelated edit.
- **Unsaved edits in Settings and About survive switching admin tabs,
and a
backup restore is no longer overwritten by the next save**
([#687](https://github.com/ralksta/immich-folio/pull/687)). Editors that
were open during a restore now reload and offer unsaved edits back as a
conflict. Also: "Restore my changes" after a conflict found nothing,
removing an album left its drawer showing the next album, and the
journal
saved (rotating a backup) without changes.
- **Accent-backed buttons stay readable with a light or malformed
accent**
([#724](https://github.com/ralksta/immich-folio/pull/724), supersedes
[#680](https://github.com/ralksta/immich-folio/pull/680)) — contributed
by
[@lancetm714](https://github.com/lancetm714). A white accent made the
proofing dialog's _Download selected (.zip)_ button white on white.
`theme.accent` is now accepted as hex only and normalised to `#rrggbb`,
anything else falls back to the preset, and the proofing dialog and
filter
pills use the mode-aware `--on-accent` text colour from #688.
- **Every preset's accent is visible in both colour modes**
([#688](https://github.com/ralksta/immich-folio/pull/688)). Presets had
one
accent for both modes; minimal's dark mode drew black buttons on black.
Presets now carry a light and a dark accent, and text on accent-filled
buttons picks black or white for contrast. A custom accent stays the
owner's choice in both modes.
- **Visitor-side inconsistencies**
([#685](https://github.com/ralksta/immich-folio/pull/685)): after
visiting
`/impressum`, every subpage header turned centred and uppercase; back
links
announced "Back to Back to …"; the hero EXIF chip ignored
`exif.location`/`camera`/`settings`; videos in journal entries opened as
stills; the setup screen named a non-existent `.env.example`.
- **An essay's lightbox walks only the photos the story shows**
([#686](https://github.com/ralksta/immich-folio/pull/686)), not every
photo
of the subpage's albums, and the proofing bar in essays shows the
selection
count instead of a filter button that did nothing.
- **The page panel scrolls with the mouse wheel**
([#720](https://github.com/ralksta/immich-folio/pull/720)).
- **The journal editor's top bar wraps on phones**
([#723](https://github.com/ralksta/immich-folio/pull/723), closes
[#675](https://github.com/ralksta/immich-folio/issues/675)), so the
title
stays editable and Save stays on screen.
- **Every admin form field has a name for assistive technology**
([#715](https://github.com/ralksta/immich-folio/pull/715)). Only two
inputs
had a linked label; 47 are linked now, and clicking a label focuses its
field.
### Internal
- **`SettingsEditor` and `PageBuilder` are split up**
([#710](https://github.com/ralksta/immich-folio/pull/710),
[#711](https://github.com/ralksta/immich-folio/pull/711)). The
2,200-line
settings editor is a shell with one file per section; the page builder's
YAML handling and edits are pure functions under test. Both were checked
side by side against `dev` for identical output.
- **`useAdminFetch()`**
([#707](https://github.com/ralksta/immich-folio/pull/707))
gives Analytics, Messages, Backups and the journal list one loading and
error pattern.
- README brought up to v0.17.0
([#678](https://github.com/ralksta/immich-folio/pull/678),
[#679](https://github.com/ralksta/immich-folio/pull/679)).
### Upgrade notes
**`content/` gains two directories the app writes to:**
`content/.fonts/`
for the cached fonts and `content/messages/` for contact-form messages.
Both
are created on demand, so a writable `content/` is enough, as before.
**The server needs outbound HTTPS to Google once per font** to fill the
font
cache. Until then pages fall back to the theme's system fonts. Visitors'
browsers no longer contact Google.
**A custom CSP or reverse-proxy allowlist** must now allow
`tile.openstreetmap.org` for images instead of
`*.basemaps.cartocdn.com`,
and no longer needs `fonts.googleapis.com`, `fonts.gstatic.com` or
`unpkg.com`. The built-in CSP is updated.
**`theme.accent` must be hex** (`#rgb`, `#rrggbb` or `#rrggbbaa`).
Anything
else, including a value without `#`, falls back to the preset's accent.
**Plaintext passwords in `gallery.yaml`, `settings.yaml` or journal
entries**
are hashed the next time that file is saved in the admin; one save
clears the
doctor's warning.
**New, optional settings:** `contact.*` (the form is off by default),
`privacy.enabled`, `legal.heading`, `legal.contactUrl`,
`legal.contactLabel`,
and the `CDN_URL` and `CONTACT_NOTIFY_URL` environment variables. See
`content/settings.yaml.example` and `.env.local.example`. In the example
file,
`vatId` and `taxId` had swapped sample values; check yours if you copied
them.
No `IMAGE_CACHE_VERSION` bump is needed this time.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>
2026-09-27 14:43:38 +02:00
|
|
|
</FeatureGroup>
|
|
|
|
|
|
|
|
|
|
<FeatureGroup
|
|
|
|
|
icon={<Icons.IconShieldCheck size={13} />}
|
|
|
|
|
title="What visitors learn about you"
|
|
|
|
|
description="What each photo reveals, and what is counted about a visit."
|
|
|
|
|
chip="visible to visitors"
|
|
|
|
|
>
|
|
|
|
|
<div className={`metadata-card ${anyMetadata ? 'active' : ''}`}>
|
|
|
|
|
<button
|
|
|
|
|
type="button"
|
|
|
|
|
className="metadata-card-main"
|
|
|
|
|
onClick={toggleMetadata}
|
|
|
|
|
aria-pressed={anyMetadata}
|
|
|
|
|
>
|
|
|
|
|
<span className="toggle-card-info">
|
|
|
|
|
<span className="toggle-card-title">
|
|
|
|
|
<Icons.IconCamera size={16} /> Photo metadata
|
|
|
|
|
</span>
|
|
|
|
|
<span className="toggle-card-desc">{metadataSummary}</span>
|
|
|
|
|
</span>
|
|
|
|
|
<span className={`switch-toggle ${anyMetadata ? 'on' : ''}`}>
|
|
|
|
|
<span className="switch-slider" />
|
|
|
|
|
</span>
|
|
|
|
|
</button>
|
|
|
|
|
|
|
|
|
|
<button
|
|
|
|
|
type="button"
|
|
|
|
|
className="metadata-details-btn"
|
|
|
|
|
onClick={() => setMetadataOpen((open) => !open)}
|
|
|
|
|
aria-expanded={metadataOpen}
|
|
|
|
|
>
|
|
|
|
|
Details
|
|
|
|
|
<Icons.IconChevronDown
|
|
|
|
|
size={13}
|
|
|
|
|
className={`metadata-details-chevron${metadataOpen ? ' open' : ''}`}
|
|
|
|
|
/>
|
|
|
|
|
</button>
|
|
|
|
|
|
|
|
|
|
{metadataOpen && (
|
|
|
|
|
<div className="metadata-details">
|
|
|
|
|
<SettingRow
|
|
|
|
|
title="Camera & Lens"
|
|
|
|
|
description="Body, lens and focal length"
|
|
|
|
|
checked={exif.camera}
|
|
|
|
|
onToggle={() => update('exif.camera', !exif.camera)}
|
|
|
|
|
/>
|
|
|
|
|
<SettingRow
|
|
|
|
|
title="Exposure Settings"
|
|
|
|
|
description="Aperture, shutter speed and ISO"
|
|
|
|
|
checked={exif.settings}
|
|
|
|
|
onToggle={() => update('exif.settings', !exif.settings)}
|
|
|
|
|
/>
|
|
|
|
|
<SettingRow
|
|
|
|
|
title="Location"
|
|
|
|
|
description="City and country from the photo's GPS data"
|
|
|
|
|
checked={exif.location}
|
|
|
|
|
onToggle={() => update('exif.location', !exif.location)}
|
|
|
|
|
/>
|
|
|
|
|
<SettingRow
|
|
|
|
|
title="Photo Description"
|
|
|
|
|
description="The description written in Immich"
|
|
|
|
|
checked={exif.caption}
|
|
|
|
|
onToggle={() => update('exif.caption', !exif.caption)}
|
|
|
|
|
/>
|
|
|
|
|
|
|
|
|
|
{/* Dependent, not a peer: this only controls the grid overlay, and
|
|
|
|
|
the overlay carries camera and lens. With those off it has
|
|
|
|
|
nothing to show, which used to leave it switched on and
|
|
|
|
|
silently doing nothing (#510). */}
|
|
|
|
|
<SettingRow
|
|
|
|
|
indented
|
|
|
|
|
title="Summary on grid hover"
|
|
|
|
|
description="Camera and lens over the photo, not only in the lightbox"
|
|
|
|
|
checked={settings.exifOnHover !== false}
|
|
|
|
|
disabled={!exif.camera}
|
|
|
|
|
hint={exif.camera ? undefined : 'Needs Camera & Lens'}
|
|
|
|
|
onToggle={() => update('exifOnHover', settings.exifOnHover === false)}
|
|
|
|
|
/>
|
|
|
|
|
</div>
|
|
|
|
|
)}
|
|
|
|
|
</div>
|
|
|
|
|
<div className="feature-list">
|
|
|
|
|
<FeatureRow
|
|
|
|
|
icon={<Icons.IconBarChart size={15} />}
|
|
|
|
|
title="Analytics"
|
|
|
|
|
description="Cookieless view counts, stored on your server only"
|
|
|
|
|
checked={settings.analytics !== false}
|
|
|
|
|
onToggle={() => update('analytics', settings.analytics === false)}
|
|
|
|
|
href="/admin/analytics"
|
|
|
|
|
/>
|
|
|
|
|
</div>
|
|
|
|
|
</FeatureGroup>
|
|
|
|
|
|
|
|
|
|
<div className="admin-field favicon-field">
|
2026-10-02 18:14:23 +02:00
|
|
|
<span className="admin-field-label" id="favicon-label">
|
|
|
|
|
Favicon
|
|
|
|
|
</span>
|
release: v0.18.0 (#725)
Release v0.18.0 — merges `dev` into `main`.
## Thanks
- [@lancetm714](https://github.com/lancetm714) for the accent-contrast
fix (#680 → #724).
- [@RichKidsDev](https://github.com/RichKidsDev) for reporting the
outdated Impressum (#697).
### Security
- **Journal drafts and password-protected entries no longer render
publicly
as a subpage essay**
([#684](https://github.com/ralksta/immich-folio/pull/684),
[GHSA-987w-cpwm-c9g9](https://github.com/ralksta/immich-folio/security/advisories/GHSA-987w-cpwm-c9g9),
medium). A subpage's `essayFile` read the journal entry straight from
disk,
skipping the draft and password rules `/journal/<slug>` applies. It now
resolves through the same rules: a draft reads as missing for visitors,
and
a protected entry shows its password gate, sharing the
`lb_auth_journal_<slug>` cookie.
- **Immich descriptions are escaped in generated subpage essays**
([#684](https://github.com/ralksta/immich-folio/pull/684),
[GHSA-8ppx-39jv-q5xm](https://github.com/ralksta/immich-folio/security/advisories/GHSA-8ppx-39jv-q5xm),
low). The essay built from a subpage's albums (`layout: essay` without
markdown) put each asset's Immich description into the page as raw HTML.
Captions are now HTML-escaped, and they go through `assetCaption()`, so
`exif.caption: false` is respected there as well. Tracked in
[#689](https://github.com/ralksta/immich-folio/issues/689).
- **Admin drafts no longer keep a typed password, and the contact form's
email check runs in linear time**
([#727](https://github.com/ralksta/immich-folio/pull/727)). The admin's
session drafts wrote a password as typed to `sessionStorage`; a draft
holding a plaintext password is now not kept (the unsaved-changes guard
still warns). The email pattern could backtrack polynomially on a
crafted
domain; its labels now exclude the dot and the length is checked first.
Both found by CodeQL before release.
### Added
- **A built-in contact form with an inbox in the admin**
([#703](https://github.com/ralksta/immich-folio/pull/703), closes
[#702](https://github.com/ralksta/immich-folio/issues/702)). `/contact`
needs neither SMTP nor a form service: each message is one file in
`content/messages/` (mode `0600`), read under the new _Messages_ tab,
where
_Reply by email_ opens the owner's mail client with the message quoted.
Messages older than `contact.retentionDays` (default 90) are deleted. An
optional ntfy push goes to `contact.notifyUrl` or `CONTACT_NOTIFY_URL`,
and
since [#709](https://github.com/ralksta/immich-folio/pull/709) it
carries a
fixed "new message" line and nothing about the sender — no name, no
address, no text. Spam is kept out without a captcha: an off-screen
honeypot, a minimum fill time, three submissions a minute per IP and a
cap
of 500 stored messages. With the Impressum on and no `legal.contactUrl`,
the Impressum links the form as its second contact channel. A new doctor
check warns when the form is on but nobody is notified.
- **A privacy policy page, next to a list of what the site processes**
([#708](https://github.com/ralksta/immich-folio/pull/708)). `/privacy`
renders `content/privacy.md`, edited under Settings → Legal, and the
footer
links it once the file has text; `privacy.enabled: false` hides it.
Folio
writes no legal text. Beside the editor it lists what _this_
installation
does, read off the configuration — the map, statistics, contact form,
password cookies, CDN — and marks every entry that involves a third
party.
_Insert headings_ adds the matching section headings and nothing else.
The
doctor warns while the Impressum is on and there is no policy.
- **French, Spanish, Italian and Dutch interface translations**
([#681](https://github.com/ralksta/immich-folio/pull/681)), selected
with
`settings.yaml: lang` as before. The admin panel stays English.
- **CDN mode for photos and videos**
([#681](https://github.com/ralksta/immich-folio/pull/681)). With
`CDN_URL`
set, image and video URLs point at a pull CDN whose origin is this
server,
so repeat views reach neither the server nor Immich. A site password
switches the mode off, since a CDN would hand out cached photos without
checking the unlock cookie. The CDN origin is added to the CSP, and a
doctor check covers the password and `TRUSTED_PROXY_HOPS` cases. See
`docs/deployment.md#cdn-mode`.
- **A reworked admin panel**
([#712](https://github.com/ralksta/immich-folio/pull/712),
[#713](https://github.com/ralksta/immich-folio/pull/713),
[#714](https://github.com/ralksta/immich-folio/pull/714),
[#716](https://github.com/ralksta/immich-folio/pull/716),
[#717](https://github.com/ralksta/immich-folio/pull/717),
[#718](https://github.com/ralksta/immich-folio/pull/718),
[#719](https://github.com/ralksta/immich-folio/pull/719),
[#721](https://github.com/ralksta/immich-folio/pull/721)):
- **A sidebar instead of the header row**, grouped by task, with an
unread
count on Messages and a dot on Diagnostics while Immich is down. It
collapses to an icon rail, with names shown on hover and focus, and
remembers that per browser.
- **`/admin` is an overview**: what needs attention (unread messages,
doctor warnings), published pages, journal entries and recent views.
- **The site's own visual language** — the preset's fonts, hairline
borders, the square marker — and one page header on every screen. The
accent is kept for the current place and the primary action; switches
are now pills reading ON or OFF, in green rather than the accent, so
Studio Modern's red no longer makes an enabled setting look like an
error.
- **The page builder is a structure list and a panel.** Hero, subpages
and
standalone albums sit in one list on the left, subpages drag-sorted in
place; the selected entry is edited on the right instead of in an
overlay.
- **Dialogs only where a change is permanent.** Deleting a message or a
journal entry, and resetting the favicon (which used to delete the file
without asking), go through one confirm dialog in the admin's own look.
Removals in the page builder, which only touch unsaved state, happen at
once and offer _Undo_. No `window.confirm()` is left.
- **Feature switches are grouped by meaning** as one-line rows under
Settings → General; page transitions and scroll-to-top moved to Theme →
Look & motion. No setting keys changed.
### Changed
- **Fonts and the Leaflet stylesheet are served from the site itself**
([#700](https://github.com/ralksta/immich-folio/pull/700)). Every page
used
to link `fonts.googleapis.com`, which sends each visitor's IP address to
Google. The server now fetches a theme's Google fonts once, rewrites the
stylesheet and caches the files in `content/.fonts/`; custom fonts in
`theme.fonts` keep working. If Google cannot be reached before a font is
cached, the page falls back to the theme's system fonts. `leaflet.css`
comes from the npm package instead of unpkg. The CSP drops
`fonts.googleapis.com`, `fonts.gstatic.com` and `unpkg.com`.
- **Email addresses are kept out of the served HTML**
([#705](https://github.com/ralksta/immich-folio/pull/705)). The
Impressum
and footer render the address only after hydration, from an encoded
form,
so harvesters reading raw HTML find nothing. Without JavaScript the
Impressum shows `name [at] example [dot] de`. This defeats bulk
harvesting,
not a person with a browser.
- **The Impressum cites § 5 DDG and links its contacts**
([#698](https://github.com/ralksta/immich-folio/pull/698), reported in
[#697](https://github.com/ralksta/immich-folio/issues/697) by
[@RichKidsDev](https://github.com/RichKidsDev)). The TMG was replaced by
the
DDG in May 2024; `legal.heading` replaces the line for other laws (e.g.
§ 5 ECG in Austria). `legal.contactUrl` and `legal.contactLabel` add a
contact form as the second channel, so a phone number stays optional.
Email, phone and contact URL are now links, and the "Created with the
Impressum generator by eRecht24" line, shown on every site whether true
or
not, is gone. Settings → Legal gains fields for heading, contact URL,
VAT
ID and tax number, and a doctor check flags missing details.
- **Missing pages answer `404`**
([#704](https://github.com/ralksta/immich-folio/pull/704)). Every
missing
page used to answer `200`, because streaming had started before
`notFound()` ran. `/contact`, `/impressum`, `/map` and `/privacy` while
switched off, and `/journal/<slug>` without an entry, now return a real
404 with the same not-found page. Album and subpage slugs still depend
on
Immich and stay soft 404s.
- **Passwords set in the admin are stored as scrypt hashes**
([#706](https://github.com/ralksta/immich-folio/pull/706), closes
[#690](https://github.com/ralksta/immich-folio/issues/690)). Subpage,
album, journal-entry and site passwords were written as typed. The save
routes now hash them; a stored hash reads _Protected_ with _Change_ and
_Remove_ and is never put into an input. Visitors who unlocked a page
stay
signed in across unrelated saves. Existing plaintext passwords are
hashed
the next time their file is saved in the admin.
- **One notification surface in the admin**
([#707](https://github.com/ralksta/immich-folio/pull/707)) replaces
every
`alert()`: errors stay until dismissed, successes clear themselves, and
screen readers announce both.
### Fixed
- **Map tiles load again**
([#701](https://github.com/ralksta/immich-folio/pull/701)). CARTO
started
answering every tile with an "API KEY REQUIRED" image, leaving `/map`
and
journal map blocks as a grey grid. Tiles now come from OpenStreetMap;
the
dark look is a CSS filter, so the map now follows the colour mode.
- **The page builder no longer drops a subpage's `proofing:` flag on
save**
([#711](https://github.com/ralksta/immich-folio/pull/711)). A page
switched
off for proofing by hand reverted after any unrelated edit.
- **Unsaved edits in Settings and About survive switching admin tabs,
and a
backup restore is no longer overwritten by the next save**
([#687](https://github.com/ralksta/immich-folio/pull/687)). Editors that
were open during a restore now reload and offer unsaved edits back as a
conflict. Also: "Restore my changes" after a conflict found nothing,
removing an album left its drawer showing the next album, and the
journal
saved (rotating a backup) without changes.
- **Accent-backed buttons stay readable with a light or malformed
accent**
([#724](https://github.com/ralksta/immich-folio/pull/724), supersedes
[#680](https://github.com/ralksta/immich-folio/pull/680)) — contributed
by
[@lancetm714](https://github.com/lancetm714). A white accent made the
proofing dialog's _Download selected (.zip)_ button white on white.
`theme.accent` is now accepted as hex only and normalised to `#rrggbb`,
anything else falls back to the preset, and the proofing dialog and
filter
pills use the mode-aware `--on-accent` text colour from #688.
- **Every preset's accent is visible in both colour modes**
([#688](https://github.com/ralksta/immich-folio/pull/688)). Presets had
one
accent for both modes; minimal's dark mode drew black buttons on black.
Presets now carry a light and a dark accent, and text on accent-filled
buttons picks black or white for contrast. A custom accent stays the
owner's choice in both modes.
- **Visitor-side inconsistencies**
([#685](https://github.com/ralksta/immich-folio/pull/685)): after
visiting
`/impressum`, every subpage header turned centred and uppercase; back
links
announced "Back to Back to …"; the hero EXIF chip ignored
`exif.location`/`camera`/`settings`; videos in journal entries opened as
stills; the setup screen named a non-existent `.env.example`.
- **An essay's lightbox walks only the photos the story shows**
([#686](https://github.com/ralksta/immich-folio/pull/686)), not every
photo
of the subpage's albums, and the proofing bar in essays shows the
selection
count instead of a filter button that did nothing.
- **The page panel scrolls with the mouse wheel**
([#720](https://github.com/ralksta/immich-folio/pull/720)).
- **The journal editor's top bar wraps on phones**
([#723](https://github.com/ralksta/immich-folio/pull/723), closes
[#675](https://github.com/ralksta/immich-folio/issues/675)), so the
title
stays editable and Save stays on screen.
- **Every admin form field has a name for assistive technology**
([#715](https://github.com/ralksta/immich-folio/pull/715)). Only two
inputs
had a linked label; 47 are linked now, and clicking a label focuses its
field.
### Internal
- **`SettingsEditor` and `PageBuilder` are split up**
([#710](https://github.com/ralksta/immich-folio/pull/710),
[#711](https://github.com/ralksta/immich-folio/pull/711)). The
2,200-line
settings editor is a shell with one file per section; the page builder's
YAML handling and edits are pure functions under test. Both were checked
side by side against `dev` for identical output.
- **`useAdminFetch()`**
([#707](https://github.com/ralksta/immich-folio/pull/707))
gives Analytics, Messages, Backups and the journal list one loading and
error pattern.
- README brought up to v0.17.0
([#678](https://github.com/ralksta/immich-folio/pull/678),
[#679](https://github.com/ralksta/immich-folio/pull/679)).
### Upgrade notes
**`content/` gains two directories the app writes to:**
`content/.fonts/`
for the cached fonts and `content/messages/` for contact-form messages.
Both
are created on demand, so a writable `content/` is enough, as before.
**The server needs outbound HTTPS to Google once per font** to fill the
font
cache. Until then pages fall back to the theme's system fonts. Visitors'
browsers no longer contact Google.
**A custom CSP or reverse-proxy allowlist** must now allow
`tile.openstreetmap.org` for images instead of
`*.basemaps.cartocdn.com`,
and no longer needs `fonts.googleapis.com`, `fonts.gstatic.com` or
`unpkg.com`. The built-in CSP is updated.
**`theme.accent` must be hex** (`#rgb`, `#rrggbb` or `#rrggbbaa`).
Anything
else, including a value without `#`, falls back to the preset's accent.
**Plaintext passwords in `gallery.yaml`, `settings.yaml` or journal
entries**
are hashed the next time that file is saved in the admin; one save
clears the
doctor's warning.
**New, optional settings:** `contact.*` (the form is off by default),
`privacy.enabled`, `legal.heading`, `legal.contactUrl`,
`legal.contactLabel`,
and the `CDN_URL` and `CONTACT_NOTIFY_URL` environment variables. See
`content/settings.yaml.example` and `.env.local.example`. In the example
file,
`vatId` and `taxId` had swapped sample values; check yours if you copied
them.
No `IMAGE_CACHE_VERSION` bump is needed this time.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>
2026-09-27 14:43:38 +02:00
|
|
|
<div className="favicon-row">
|
2026-10-02 18:14:23 +02:00
|
|
|
{/* eslint-disable-next-line @next/next/no-img-element -- the site's own icon route, a 32px preview */}
|
|
|
|
|
<img
|
|
|
|
|
className="favicon-preview"
|
|
|
|
|
src={`/api/favicon?v=${faviconVersion}`}
|
|
|
|
|
alt="Current favicon"
|
|
|
|
|
width={32}
|
|
|
|
|
height={32}
|
|
|
|
|
/>
|
|
|
|
|
{/* The native file input stays the control — focusable, keyboard
|
|
|
|
|
operable, announced as a file picker — but is visually hidden;
|
|
|
|
|
its label is drawn as the admin's secondary button, with the
|
|
|
|
|
focus ring passed through (QA A-18). */}
|
release: v0.18.0 (#725)
Release v0.18.0 — merges `dev` into `main`.
## Thanks
- [@lancetm714](https://github.com/lancetm714) for the accent-contrast
fix (#680 → #724).
- [@RichKidsDev](https://github.com/RichKidsDev) for reporting the
outdated Impressum (#697).
### Security
- **Journal drafts and password-protected entries no longer render
publicly
as a subpage essay**
([#684](https://github.com/ralksta/immich-folio/pull/684),
[GHSA-987w-cpwm-c9g9](https://github.com/ralksta/immich-folio/security/advisories/GHSA-987w-cpwm-c9g9),
medium). A subpage's `essayFile` read the journal entry straight from
disk,
skipping the draft and password rules `/journal/<slug>` applies. It now
resolves through the same rules: a draft reads as missing for visitors,
and
a protected entry shows its password gate, sharing the
`lb_auth_journal_<slug>` cookie.
- **Immich descriptions are escaped in generated subpage essays**
([#684](https://github.com/ralksta/immich-folio/pull/684),
[GHSA-8ppx-39jv-q5xm](https://github.com/ralksta/immich-folio/security/advisories/GHSA-8ppx-39jv-q5xm),
low). The essay built from a subpage's albums (`layout: essay` without
markdown) put each asset's Immich description into the page as raw HTML.
Captions are now HTML-escaped, and they go through `assetCaption()`, so
`exif.caption: false` is respected there as well. Tracked in
[#689](https://github.com/ralksta/immich-folio/issues/689).
- **Admin drafts no longer keep a typed password, and the contact form's
email check runs in linear time**
([#727](https://github.com/ralksta/immich-folio/pull/727)). The admin's
session drafts wrote a password as typed to `sessionStorage`; a draft
holding a plaintext password is now not kept (the unsaved-changes guard
still warns). The email pattern could backtrack polynomially on a
crafted
domain; its labels now exclude the dot and the length is checked first.
Both found by CodeQL before release.
### Added
- **A built-in contact form with an inbox in the admin**
([#703](https://github.com/ralksta/immich-folio/pull/703), closes
[#702](https://github.com/ralksta/immich-folio/issues/702)). `/contact`
needs neither SMTP nor a form service: each message is one file in
`content/messages/` (mode `0600`), read under the new _Messages_ tab,
where
_Reply by email_ opens the owner's mail client with the message quoted.
Messages older than `contact.retentionDays` (default 90) are deleted. An
optional ntfy push goes to `contact.notifyUrl` or `CONTACT_NOTIFY_URL`,
and
since [#709](https://github.com/ralksta/immich-folio/pull/709) it
carries a
fixed "new message" line and nothing about the sender — no name, no
address, no text. Spam is kept out without a captcha: an off-screen
honeypot, a minimum fill time, three submissions a minute per IP and a
cap
of 500 stored messages. With the Impressum on and no `legal.contactUrl`,
the Impressum links the form as its second contact channel. A new doctor
check warns when the form is on but nobody is notified.
- **A privacy policy page, next to a list of what the site processes**
([#708](https://github.com/ralksta/immich-folio/pull/708)). `/privacy`
renders `content/privacy.md`, edited under Settings → Legal, and the
footer
links it once the file has text; `privacy.enabled: false` hides it.
Folio
writes no legal text. Beside the editor it lists what _this_
installation
does, read off the configuration — the map, statistics, contact form,
password cookies, CDN — and marks every entry that involves a third
party.
_Insert headings_ adds the matching section headings and nothing else.
The
doctor warns while the Impressum is on and there is no policy.
- **French, Spanish, Italian and Dutch interface translations**
([#681](https://github.com/ralksta/immich-folio/pull/681)), selected
with
`settings.yaml: lang` as before. The admin panel stays English.
- **CDN mode for photos and videos**
([#681](https://github.com/ralksta/immich-folio/pull/681)). With
`CDN_URL`
set, image and video URLs point at a pull CDN whose origin is this
server,
so repeat views reach neither the server nor Immich. A site password
switches the mode off, since a CDN would hand out cached photos without
checking the unlock cookie. The CDN origin is added to the CSP, and a
doctor check covers the password and `TRUSTED_PROXY_HOPS` cases. See
`docs/deployment.md#cdn-mode`.
- **A reworked admin panel**
([#712](https://github.com/ralksta/immich-folio/pull/712),
[#713](https://github.com/ralksta/immich-folio/pull/713),
[#714](https://github.com/ralksta/immich-folio/pull/714),
[#716](https://github.com/ralksta/immich-folio/pull/716),
[#717](https://github.com/ralksta/immich-folio/pull/717),
[#718](https://github.com/ralksta/immich-folio/pull/718),
[#719](https://github.com/ralksta/immich-folio/pull/719),
[#721](https://github.com/ralksta/immich-folio/pull/721)):
- **A sidebar instead of the header row**, grouped by task, with an
unread
count on Messages and a dot on Diagnostics while Immich is down. It
collapses to an icon rail, with names shown on hover and focus, and
remembers that per browser.
- **`/admin` is an overview**: what needs attention (unread messages,
doctor warnings), published pages, journal entries and recent views.
- **The site's own visual language** — the preset's fonts, hairline
borders, the square marker — and one page header on every screen. The
accent is kept for the current place and the primary action; switches
are now pills reading ON or OFF, in green rather than the accent, so
Studio Modern's red no longer makes an enabled setting look like an
error.
- **The page builder is a structure list and a panel.** Hero, subpages
and
standalone albums sit in one list on the left, subpages drag-sorted in
place; the selected entry is edited on the right instead of in an
overlay.
- **Dialogs only where a change is permanent.** Deleting a message or a
journal entry, and resetting the favicon (which used to delete the file
without asking), go through one confirm dialog in the admin's own look.
Removals in the page builder, which only touch unsaved state, happen at
once and offer _Undo_. No `window.confirm()` is left.
- **Feature switches are grouped by meaning** as one-line rows under
Settings → General; page transitions and scroll-to-top moved to Theme →
Look & motion. No setting keys changed.
### Changed
- **Fonts and the Leaflet stylesheet are served from the site itself**
([#700](https://github.com/ralksta/immich-folio/pull/700)). Every page
used
to link `fonts.googleapis.com`, which sends each visitor's IP address to
Google. The server now fetches a theme's Google fonts once, rewrites the
stylesheet and caches the files in `content/.fonts/`; custom fonts in
`theme.fonts` keep working. If Google cannot be reached before a font is
cached, the page falls back to the theme's system fonts. `leaflet.css`
comes from the npm package instead of unpkg. The CSP drops
`fonts.googleapis.com`, `fonts.gstatic.com` and `unpkg.com`.
- **Email addresses are kept out of the served HTML**
([#705](https://github.com/ralksta/immich-folio/pull/705)). The
Impressum
and footer render the address only after hydration, from an encoded
form,
so harvesters reading raw HTML find nothing. Without JavaScript the
Impressum shows `name [at] example [dot] de`. This defeats bulk
harvesting,
not a person with a browser.
- **The Impressum cites § 5 DDG and links its contacts**
([#698](https://github.com/ralksta/immich-folio/pull/698), reported in
[#697](https://github.com/ralksta/immich-folio/issues/697) by
[@RichKidsDev](https://github.com/RichKidsDev)). The TMG was replaced by
the
DDG in May 2024; `legal.heading` replaces the line for other laws (e.g.
§ 5 ECG in Austria). `legal.contactUrl` and `legal.contactLabel` add a
contact form as the second channel, so a phone number stays optional.
Email, phone and contact URL are now links, and the "Created with the
Impressum generator by eRecht24" line, shown on every site whether true
or
not, is gone. Settings → Legal gains fields for heading, contact URL,
VAT
ID and tax number, and a doctor check flags missing details.
- **Missing pages answer `404`**
([#704](https://github.com/ralksta/immich-folio/pull/704)). Every
missing
page used to answer `200`, because streaming had started before
`notFound()` ran. `/contact`, `/impressum`, `/map` and `/privacy` while
switched off, and `/journal/<slug>` without an entry, now return a real
404 with the same not-found page. Album and subpage slugs still depend
on
Immich and stay soft 404s.
- **Passwords set in the admin are stored as scrypt hashes**
([#706](https://github.com/ralksta/immich-folio/pull/706), closes
[#690](https://github.com/ralksta/immich-folio/issues/690)). Subpage,
album, journal-entry and site passwords were written as typed. The save
routes now hash them; a stored hash reads _Protected_ with _Change_ and
_Remove_ and is never put into an input. Visitors who unlocked a page
stay
signed in across unrelated saves. Existing plaintext passwords are
hashed
the next time their file is saved in the admin.
- **One notification surface in the admin**
([#707](https://github.com/ralksta/immich-folio/pull/707)) replaces
every
`alert()`: errors stay until dismissed, successes clear themselves, and
screen readers announce both.
### Fixed
- **Map tiles load again**
([#701](https://github.com/ralksta/immich-folio/pull/701)). CARTO
started
answering every tile with an "API KEY REQUIRED" image, leaving `/map`
and
journal map blocks as a grey grid. Tiles now come from OpenStreetMap;
the
dark look is a CSS filter, so the map now follows the colour mode.
- **The page builder no longer drops a subpage's `proofing:` flag on
save**
([#711](https://github.com/ralksta/immich-folio/pull/711)). A page
switched
off for proofing by hand reverted after any unrelated edit.
- **Unsaved edits in Settings and About survive switching admin tabs,
and a
backup restore is no longer overwritten by the next save**
([#687](https://github.com/ralksta/immich-folio/pull/687)). Editors that
were open during a restore now reload and offer unsaved edits back as a
conflict. Also: "Restore my changes" after a conflict found nothing,
removing an album left its drawer showing the next album, and the
journal
saved (rotating a backup) without changes.
- **Accent-backed buttons stay readable with a light or malformed
accent**
([#724](https://github.com/ralksta/immich-folio/pull/724), supersedes
[#680](https://github.com/ralksta/immich-folio/pull/680)) — contributed
by
[@lancetm714](https://github.com/lancetm714). A white accent made the
proofing dialog's _Download selected (.zip)_ button white on white.
`theme.accent` is now accepted as hex only and normalised to `#rrggbb`,
anything else falls back to the preset, and the proofing dialog and
filter
pills use the mode-aware `--on-accent` text colour from #688.
- **Every preset's accent is visible in both colour modes**
([#688](https://github.com/ralksta/immich-folio/pull/688)). Presets had
one
accent for both modes; minimal's dark mode drew black buttons on black.
Presets now carry a light and a dark accent, and text on accent-filled
buttons picks black or white for contrast. A custom accent stays the
owner's choice in both modes.
- **Visitor-side inconsistencies**
([#685](https://github.com/ralksta/immich-folio/pull/685)): after
visiting
`/impressum`, every subpage header turned centred and uppercase; back
links
announced "Back to Back to …"; the hero EXIF chip ignored
`exif.location`/`camera`/`settings`; videos in journal entries opened as
stills; the setup screen named a non-existent `.env.example`.
- **An essay's lightbox walks only the photos the story shows**
([#686](https://github.com/ralksta/immich-folio/pull/686)), not every
photo
of the subpage's albums, and the proofing bar in essays shows the
selection
count instead of a filter button that did nothing.
- **The page panel scrolls with the mouse wheel**
([#720](https://github.com/ralksta/immich-folio/pull/720)).
- **The journal editor's top bar wraps on phones**
([#723](https://github.com/ralksta/immich-folio/pull/723), closes
[#675](https://github.com/ralksta/immich-folio/issues/675)), so the
title
stays editable and Save stays on screen.
- **Every admin form field has a name for assistive technology**
([#715](https://github.com/ralksta/immich-folio/pull/715)). Only two
inputs
had a linked label; 47 are linked now, and clicking a label focuses its
field.
### Internal
- **`SettingsEditor` and `PageBuilder` are split up**
([#710](https://github.com/ralksta/immich-folio/pull/710),
[#711](https://github.com/ralksta/immich-folio/pull/711)). The
2,200-line
settings editor is a shell with one file per section; the page builder's
YAML handling and edits are pure functions under test. Both were checked
side by side against `dev` for identical output.
- **`useAdminFetch()`**
([#707](https://github.com/ralksta/immich-folio/pull/707))
gives Analytics, Messages, Backups and the journal list one loading and
error pattern.
- README brought up to v0.17.0
([#678](https://github.com/ralksta/immich-folio/pull/678),
[#679](https://github.com/ralksta/immich-folio/pull/679)).
### Upgrade notes
**`content/` gains two directories the app writes to:**
`content/.fonts/`
for the cached fonts and `content/messages/` for contact-form messages.
Both
are created on demand, so a writable `content/` is enough, as before.
**The server needs outbound HTTPS to Google once per font** to fill the
font
cache. Until then pages fall back to the theme's system fonts. Visitors'
browsers no longer contact Google.
**A custom CSP or reverse-proxy allowlist** must now allow
`tile.openstreetmap.org` for images instead of
`*.basemaps.cartocdn.com`,
and no longer needs `fonts.googleapis.com`, `fonts.gstatic.com` or
`unpkg.com`. The built-in CSP is updated.
**`theme.accent` must be hex** (`#rgb`, `#rrggbb` or `#rrggbbaa`).
Anything
else, including a value without `#`, falls back to the preset's accent.
**Plaintext passwords in `gallery.yaml`, `settings.yaml` or journal
entries**
are hashed the next time that file is saved in the admin; one save
clears the
doctor's warning.
**New, optional settings:** `contact.*` (the form is off by default),
`privacy.enabled`, `legal.heading`, `legal.contactUrl`,
`legal.contactLabel`,
and the `CDN_URL` and `CONTACT_NOTIFY_URL` environment variables. See
`content/settings.yaml.example` and `.env.local.example`. In the example
file,
`vatId` and `taxId` had swapped sample values; check yours if you copied
them.
No `IMAGE_CACHE_VERSION` bump is needed this time.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>
2026-09-27 14:43:38 +02:00
|
|
|
<input
|
2026-10-02 18:14:23 +02:00
|
|
|
id="favicon-file"
|
|
|
|
|
className="favicon-file-input"
|
release: v0.18.0 (#725)
Release v0.18.0 — merges `dev` into `main`.
## Thanks
- [@lancetm714](https://github.com/lancetm714) for the accent-contrast
fix (#680 → #724).
- [@RichKidsDev](https://github.com/RichKidsDev) for reporting the
outdated Impressum (#697).
### Security
- **Journal drafts and password-protected entries no longer render
publicly
as a subpage essay**
([#684](https://github.com/ralksta/immich-folio/pull/684),
[GHSA-987w-cpwm-c9g9](https://github.com/ralksta/immich-folio/security/advisories/GHSA-987w-cpwm-c9g9),
medium). A subpage's `essayFile` read the journal entry straight from
disk,
skipping the draft and password rules `/journal/<slug>` applies. It now
resolves through the same rules: a draft reads as missing for visitors,
and
a protected entry shows its password gate, sharing the
`lb_auth_journal_<slug>` cookie.
- **Immich descriptions are escaped in generated subpage essays**
([#684](https://github.com/ralksta/immich-folio/pull/684),
[GHSA-8ppx-39jv-q5xm](https://github.com/ralksta/immich-folio/security/advisories/GHSA-8ppx-39jv-q5xm),
low). The essay built from a subpage's albums (`layout: essay` without
markdown) put each asset's Immich description into the page as raw HTML.
Captions are now HTML-escaped, and they go through `assetCaption()`, so
`exif.caption: false` is respected there as well. Tracked in
[#689](https://github.com/ralksta/immich-folio/issues/689).
- **Admin drafts no longer keep a typed password, and the contact form's
email check runs in linear time**
([#727](https://github.com/ralksta/immich-folio/pull/727)). The admin's
session drafts wrote a password as typed to `sessionStorage`; a draft
holding a plaintext password is now not kept (the unsaved-changes guard
still warns). The email pattern could backtrack polynomially on a
crafted
domain; its labels now exclude the dot and the length is checked first.
Both found by CodeQL before release.
### Added
- **A built-in contact form with an inbox in the admin**
([#703](https://github.com/ralksta/immich-folio/pull/703), closes
[#702](https://github.com/ralksta/immich-folio/issues/702)). `/contact`
needs neither SMTP nor a form service: each message is one file in
`content/messages/` (mode `0600`), read under the new _Messages_ tab,
where
_Reply by email_ opens the owner's mail client with the message quoted.
Messages older than `contact.retentionDays` (default 90) are deleted. An
optional ntfy push goes to `contact.notifyUrl` or `CONTACT_NOTIFY_URL`,
and
since [#709](https://github.com/ralksta/immich-folio/pull/709) it
carries a
fixed "new message" line and nothing about the sender — no name, no
address, no text. Spam is kept out without a captcha: an off-screen
honeypot, a minimum fill time, three submissions a minute per IP and a
cap
of 500 stored messages. With the Impressum on and no `legal.contactUrl`,
the Impressum links the form as its second contact channel. A new doctor
check warns when the form is on but nobody is notified.
- **A privacy policy page, next to a list of what the site processes**
([#708](https://github.com/ralksta/immich-folio/pull/708)). `/privacy`
renders `content/privacy.md`, edited under Settings → Legal, and the
footer
links it once the file has text; `privacy.enabled: false` hides it.
Folio
writes no legal text. Beside the editor it lists what _this_
installation
does, read off the configuration — the map, statistics, contact form,
password cookies, CDN — and marks every entry that involves a third
party.
_Insert headings_ adds the matching section headings and nothing else.
The
doctor warns while the Impressum is on and there is no policy.
- **French, Spanish, Italian and Dutch interface translations**
([#681](https://github.com/ralksta/immich-folio/pull/681)), selected
with
`settings.yaml: lang` as before. The admin panel stays English.
- **CDN mode for photos and videos**
([#681](https://github.com/ralksta/immich-folio/pull/681)). With
`CDN_URL`
set, image and video URLs point at a pull CDN whose origin is this
server,
so repeat views reach neither the server nor Immich. A site password
switches the mode off, since a CDN would hand out cached photos without
checking the unlock cookie. The CDN origin is added to the CSP, and a
doctor check covers the password and `TRUSTED_PROXY_HOPS` cases. See
`docs/deployment.md#cdn-mode`.
- **A reworked admin panel**
([#712](https://github.com/ralksta/immich-folio/pull/712),
[#713](https://github.com/ralksta/immich-folio/pull/713),
[#714](https://github.com/ralksta/immich-folio/pull/714),
[#716](https://github.com/ralksta/immich-folio/pull/716),
[#717](https://github.com/ralksta/immich-folio/pull/717),
[#718](https://github.com/ralksta/immich-folio/pull/718),
[#719](https://github.com/ralksta/immich-folio/pull/719),
[#721](https://github.com/ralksta/immich-folio/pull/721)):
- **A sidebar instead of the header row**, grouped by task, with an
unread
count on Messages and a dot on Diagnostics while Immich is down. It
collapses to an icon rail, with names shown on hover and focus, and
remembers that per browser.
- **`/admin` is an overview**: what needs attention (unread messages,
doctor warnings), published pages, journal entries and recent views.
- **The site's own visual language** — the preset's fonts, hairline
borders, the square marker — and one page header on every screen. The
accent is kept for the current place and the primary action; switches
are now pills reading ON or OFF, in green rather than the accent, so
Studio Modern's red no longer makes an enabled setting look like an
error.
- **The page builder is a structure list and a panel.** Hero, subpages
and
standalone albums sit in one list on the left, subpages drag-sorted in
place; the selected entry is edited on the right instead of in an
overlay.
- **Dialogs only where a change is permanent.** Deleting a message or a
journal entry, and resetting the favicon (which used to delete the file
without asking), go through one confirm dialog in the admin's own look.
Removals in the page builder, which only touch unsaved state, happen at
once and offer _Undo_. No `window.confirm()` is left.
- **Feature switches are grouped by meaning** as one-line rows under
Settings → General; page transitions and scroll-to-top moved to Theme →
Look & motion. No setting keys changed.
### Changed
- **Fonts and the Leaflet stylesheet are served from the site itself**
([#700](https://github.com/ralksta/immich-folio/pull/700)). Every page
used
to link `fonts.googleapis.com`, which sends each visitor's IP address to
Google. The server now fetches a theme's Google fonts once, rewrites the
stylesheet and caches the files in `content/.fonts/`; custom fonts in
`theme.fonts` keep working. If Google cannot be reached before a font is
cached, the page falls back to the theme's system fonts. `leaflet.css`
comes from the npm package instead of unpkg. The CSP drops
`fonts.googleapis.com`, `fonts.gstatic.com` and `unpkg.com`.
- **Email addresses are kept out of the served HTML**
([#705](https://github.com/ralksta/immich-folio/pull/705)). The
Impressum
and footer render the address only after hydration, from an encoded
form,
so harvesters reading raw HTML find nothing. Without JavaScript the
Impressum shows `name [at] example [dot] de`. This defeats bulk
harvesting,
not a person with a browser.
- **The Impressum cites § 5 DDG and links its contacts**
([#698](https://github.com/ralksta/immich-folio/pull/698), reported in
[#697](https://github.com/ralksta/immich-folio/issues/697) by
[@RichKidsDev](https://github.com/RichKidsDev)). The TMG was replaced by
the
DDG in May 2024; `legal.heading` replaces the line for other laws (e.g.
§ 5 ECG in Austria). `legal.contactUrl` and `legal.contactLabel` add a
contact form as the second channel, so a phone number stays optional.
Email, phone and contact URL are now links, and the "Created with the
Impressum generator by eRecht24" line, shown on every site whether true
or
not, is gone. Settings → Legal gains fields for heading, contact URL,
VAT
ID and tax number, and a doctor check flags missing details.
- **Missing pages answer `404`**
([#704](https://github.com/ralksta/immich-folio/pull/704)). Every
missing
page used to answer `200`, because streaming had started before
`notFound()` ran. `/contact`, `/impressum`, `/map` and `/privacy` while
switched off, and `/journal/<slug>` without an entry, now return a real
404 with the same not-found page. Album and subpage slugs still depend
on
Immich and stay soft 404s.
- **Passwords set in the admin are stored as scrypt hashes**
([#706](https://github.com/ralksta/immich-folio/pull/706), closes
[#690](https://github.com/ralksta/immich-folio/issues/690)). Subpage,
album, journal-entry and site passwords were written as typed. The save
routes now hash them; a stored hash reads _Protected_ with _Change_ and
_Remove_ and is never put into an input. Visitors who unlocked a page
stay
signed in across unrelated saves. Existing plaintext passwords are
hashed
the next time their file is saved in the admin.
- **One notification surface in the admin**
([#707](https://github.com/ralksta/immich-folio/pull/707)) replaces
every
`alert()`: errors stay until dismissed, successes clear themselves, and
screen readers announce both.
### Fixed
- **Map tiles load again**
([#701](https://github.com/ralksta/immich-folio/pull/701)). CARTO
started
answering every tile with an "API KEY REQUIRED" image, leaving `/map`
and
journal map blocks as a grey grid. Tiles now come from OpenStreetMap;
the
dark look is a CSS filter, so the map now follows the colour mode.
- **The page builder no longer drops a subpage's `proofing:` flag on
save**
([#711](https://github.com/ralksta/immich-folio/pull/711)). A page
switched
off for proofing by hand reverted after any unrelated edit.
- **Unsaved edits in Settings and About survive switching admin tabs,
and a
backup restore is no longer overwritten by the next save**
([#687](https://github.com/ralksta/immich-folio/pull/687)). Editors that
were open during a restore now reload and offer unsaved edits back as a
conflict. Also: "Restore my changes" after a conflict found nothing,
removing an album left its drawer showing the next album, and the
journal
saved (rotating a backup) without changes.
- **Accent-backed buttons stay readable with a light or malformed
accent**
([#724](https://github.com/ralksta/immich-folio/pull/724), supersedes
[#680](https://github.com/ralksta/immich-folio/pull/680)) — contributed
by
[@lancetm714](https://github.com/lancetm714). A white accent made the
proofing dialog's _Download selected (.zip)_ button white on white.
`theme.accent` is now accepted as hex only and normalised to `#rrggbb`,
anything else falls back to the preset, and the proofing dialog and
filter
pills use the mode-aware `--on-accent` text colour from #688.
- **Every preset's accent is visible in both colour modes**
([#688](https://github.com/ralksta/immich-folio/pull/688)). Presets had
one
accent for both modes; minimal's dark mode drew black buttons on black.
Presets now carry a light and a dark accent, and text on accent-filled
buttons picks black or white for contrast. A custom accent stays the
owner's choice in both modes.
- **Visitor-side inconsistencies**
([#685](https://github.com/ralksta/immich-folio/pull/685)): after
visiting
`/impressum`, every subpage header turned centred and uppercase; back
links
announced "Back to Back to …"; the hero EXIF chip ignored
`exif.location`/`camera`/`settings`; videos in journal entries opened as
stills; the setup screen named a non-existent `.env.example`.
- **An essay's lightbox walks only the photos the story shows**
([#686](https://github.com/ralksta/immich-folio/pull/686)), not every
photo
of the subpage's albums, and the proofing bar in essays shows the
selection
count instead of a filter button that did nothing.
- **The page panel scrolls with the mouse wheel**
([#720](https://github.com/ralksta/immich-folio/pull/720)).
- **The journal editor's top bar wraps on phones**
([#723](https://github.com/ralksta/immich-folio/pull/723), closes
[#675](https://github.com/ralksta/immich-folio/issues/675)), so the
title
stays editable and Save stays on screen.
- **Every admin form field has a name for assistive technology**
([#715](https://github.com/ralksta/immich-folio/pull/715)). Only two
inputs
had a linked label; 47 are linked now, and clicking a label focuses its
field.
### Internal
- **`SettingsEditor` and `PageBuilder` are split up**
([#710](https://github.com/ralksta/immich-folio/pull/710),
[#711](https://github.com/ralksta/immich-folio/pull/711)). The
2,200-line
settings editor is a shell with one file per section; the page builder's
YAML handling and edits are pure functions under test. Both were checked
side by side against `dev` for identical output.
- **`useAdminFetch()`**
([#707](https://github.com/ralksta/immich-folio/pull/707))
gives Analytics, Messages, Backups and the journal list one loading and
error pattern.
- README brought up to v0.17.0
([#678](https://github.com/ralksta/immich-folio/pull/678),
[#679](https://github.com/ralksta/immich-folio/pull/679)).
### Upgrade notes
**`content/` gains two directories the app writes to:**
`content/.fonts/`
for the cached fonts and `content/messages/` for contact-form messages.
Both
are created on demand, so a writable `content/` is enough, as before.
**The server needs outbound HTTPS to Google once per font** to fill the
font
cache. Until then pages fall back to the theme's system fonts. Visitors'
browsers no longer contact Google.
**A custom CSP or reverse-proxy allowlist** must now allow
`tile.openstreetmap.org` for images instead of
`*.basemaps.cartocdn.com`,
and no longer needs `fonts.googleapis.com`, `fonts.gstatic.com` or
`unpkg.com`. The built-in CSP is updated.
**`theme.accent` must be hex** (`#rgb`, `#rrggbb` or `#rrggbbaa`).
Anything
else, including a value without `#`, falls back to the preset's accent.
**Plaintext passwords in `gallery.yaml`, `settings.yaml` or journal
entries**
are hashed the next time that file is saved in the admin; one save
clears the
doctor's warning.
**New, optional settings:** `contact.*` (the form is off by default),
`privacy.enabled`, `legal.heading`, `legal.contactUrl`,
`legal.contactLabel`,
and the `CDN_URL` and `CONTACT_NOTIFY_URL` environment variables. See
`content/settings.yaml.example` and `.env.local.example`. In the example
file,
`vatId` and `taxId` had swapped sample values; check yours if you copied
them.
No `IMAGE_CACHE_VERSION` bump is needed this time.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>
2026-09-27 14:43:38 +02:00
|
|
|
type="file"
|
|
|
|
|
accept=".svg,.png,.ico,.jpg,.jpeg"
|
|
|
|
|
disabled={faviconUploading}
|
2026-10-02 18:14:23 +02:00
|
|
|
aria-labelledby="favicon-label favicon-file-button"
|
|
|
|
|
aria-describedby="favicon-hint"
|
release: v0.18.0 (#725)
Release v0.18.0 — merges `dev` into `main`.
## Thanks
- [@lancetm714](https://github.com/lancetm714) for the accent-contrast
fix (#680 → #724).
- [@RichKidsDev](https://github.com/RichKidsDev) for reporting the
outdated Impressum (#697).
### Security
- **Journal drafts and password-protected entries no longer render
publicly
as a subpage essay**
([#684](https://github.com/ralksta/immich-folio/pull/684),
[GHSA-987w-cpwm-c9g9](https://github.com/ralksta/immich-folio/security/advisories/GHSA-987w-cpwm-c9g9),
medium). A subpage's `essayFile` read the journal entry straight from
disk,
skipping the draft and password rules `/journal/<slug>` applies. It now
resolves through the same rules: a draft reads as missing for visitors,
and
a protected entry shows its password gate, sharing the
`lb_auth_journal_<slug>` cookie.
- **Immich descriptions are escaped in generated subpage essays**
([#684](https://github.com/ralksta/immich-folio/pull/684),
[GHSA-8ppx-39jv-q5xm](https://github.com/ralksta/immich-folio/security/advisories/GHSA-8ppx-39jv-q5xm),
low). The essay built from a subpage's albums (`layout: essay` without
markdown) put each asset's Immich description into the page as raw HTML.
Captions are now HTML-escaped, and they go through `assetCaption()`, so
`exif.caption: false` is respected there as well. Tracked in
[#689](https://github.com/ralksta/immich-folio/issues/689).
- **Admin drafts no longer keep a typed password, and the contact form's
email check runs in linear time**
([#727](https://github.com/ralksta/immich-folio/pull/727)). The admin's
session drafts wrote a password as typed to `sessionStorage`; a draft
holding a plaintext password is now not kept (the unsaved-changes guard
still warns). The email pattern could backtrack polynomially on a
crafted
domain; its labels now exclude the dot and the length is checked first.
Both found by CodeQL before release.
### Added
- **A built-in contact form with an inbox in the admin**
([#703](https://github.com/ralksta/immich-folio/pull/703), closes
[#702](https://github.com/ralksta/immich-folio/issues/702)). `/contact`
needs neither SMTP nor a form service: each message is one file in
`content/messages/` (mode `0600`), read under the new _Messages_ tab,
where
_Reply by email_ opens the owner's mail client with the message quoted.
Messages older than `contact.retentionDays` (default 90) are deleted. An
optional ntfy push goes to `contact.notifyUrl` or `CONTACT_NOTIFY_URL`,
and
since [#709](https://github.com/ralksta/immich-folio/pull/709) it
carries a
fixed "new message" line and nothing about the sender — no name, no
address, no text. Spam is kept out without a captcha: an off-screen
honeypot, a minimum fill time, three submissions a minute per IP and a
cap
of 500 stored messages. With the Impressum on and no `legal.contactUrl`,
the Impressum links the form as its second contact channel. A new doctor
check warns when the form is on but nobody is notified.
- **A privacy policy page, next to a list of what the site processes**
([#708](https://github.com/ralksta/immich-folio/pull/708)). `/privacy`
renders `content/privacy.md`, edited under Settings → Legal, and the
footer
links it once the file has text; `privacy.enabled: false` hides it.
Folio
writes no legal text. Beside the editor it lists what _this_
installation
does, read off the configuration — the map, statistics, contact form,
password cookies, CDN — and marks every entry that involves a third
party.
_Insert headings_ adds the matching section headings and nothing else.
The
doctor warns while the Impressum is on and there is no policy.
- **French, Spanish, Italian and Dutch interface translations**
([#681](https://github.com/ralksta/immich-folio/pull/681)), selected
with
`settings.yaml: lang` as before. The admin panel stays English.
- **CDN mode for photos and videos**
([#681](https://github.com/ralksta/immich-folio/pull/681)). With
`CDN_URL`
set, image and video URLs point at a pull CDN whose origin is this
server,
so repeat views reach neither the server nor Immich. A site password
switches the mode off, since a CDN would hand out cached photos without
checking the unlock cookie. The CDN origin is added to the CSP, and a
doctor check covers the password and `TRUSTED_PROXY_HOPS` cases. See
`docs/deployment.md#cdn-mode`.
- **A reworked admin panel**
([#712](https://github.com/ralksta/immich-folio/pull/712),
[#713](https://github.com/ralksta/immich-folio/pull/713),
[#714](https://github.com/ralksta/immich-folio/pull/714),
[#716](https://github.com/ralksta/immich-folio/pull/716),
[#717](https://github.com/ralksta/immich-folio/pull/717),
[#718](https://github.com/ralksta/immich-folio/pull/718),
[#719](https://github.com/ralksta/immich-folio/pull/719),
[#721](https://github.com/ralksta/immich-folio/pull/721)):
- **A sidebar instead of the header row**, grouped by task, with an
unread
count on Messages and a dot on Diagnostics while Immich is down. It
collapses to an icon rail, with names shown on hover and focus, and
remembers that per browser.
- **`/admin` is an overview**: what needs attention (unread messages,
doctor warnings), published pages, journal entries and recent views.
- **The site's own visual language** — the preset's fonts, hairline
borders, the square marker — and one page header on every screen. The
accent is kept for the current place and the primary action; switches
are now pills reading ON or OFF, in green rather than the accent, so
Studio Modern's red no longer makes an enabled setting look like an
error.
- **The page builder is a structure list and a panel.** Hero, subpages
and
standalone albums sit in one list on the left, subpages drag-sorted in
place; the selected entry is edited on the right instead of in an
overlay.
- **Dialogs only where a change is permanent.** Deleting a message or a
journal entry, and resetting the favicon (which used to delete the file
without asking), go through one confirm dialog in the admin's own look.
Removals in the page builder, which only touch unsaved state, happen at
once and offer _Undo_. No `window.confirm()` is left.
- **Feature switches are grouped by meaning** as one-line rows under
Settings → General; page transitions and scroll-to-top moved to Theme →
Look & motion. No setting keys changed.
### Changed
- **Fonts and the Leaflet stylesheet are served from the site itself**
([#700](https://github.com/ralksta/immich-folio/pull/700)). Every page
used
to link `fonts.googleapis.com`, which sends each visitor's IP address to
Google. The server now fetches a theme's Google fonts once, rewrites the
stylesheet and caches the files in `content/.fonts/`; custom fonts in
`theme.fonts` keep working. If Google cannot be reached before a font is
cached, the page falls back to the theme's system fonts. `leaflet.css`
comes from the npm package instead of unpkg. The CSP drops
`fonts.googleapis.com`, `fonts.gstatic.com` and `unpkg.com`.
- **Email addresses are kept out of the served HTML**
([#705](https://github.com/ralksta/immich-folio/pull/705)). The
Impressum
and footer render the address only after hydration, from an encoded
form,
so harvesters reading raw HTML find nothing. Without JavaScript the
Impressum shows `name [at] example [dot] de`. This defeats bulk
harvesting,
not a person with a browser.
- **The Impressum cites § 5 DDG and links its contacts**
([#698](https://github.com/ralksta/immich-folio/pull/698), reported in
[#697](https://github.com/ralksta/immich-folio/issues/697) by
[@RichKidsDev](https://github.com/RichKidsDev)). The TMG was replaced by
the
DDG in May 2024; `legal.heading` replaces the line for other laws (e.g.
§ 5 ECG in Austria). `legal.contactUrl` and `legal.contactLabel` add a
contact form as the second channel, so a phone number stays optional.
Email, phone and contact URL are now links, and the "Created with the
Impressum generator by eRecht24" line, shown on every site whether true
or
not, is gone. Settings → Legal gains fields for heading, contact URL,
VAT
ID and tax number, and a doctor check flags missing details.
- **Missing pages answer `404`**
([#704](https://github.com/ralksta/immich-folio/pull/704)). Every
missing
page used to answer `200`, because streaming had started before
`notFound()` ran. `/contact`, `/impressum`, `/map` and `/privacy` while
switched off, and `/journal/<slug>` without an entry, now return a real
404 with the same not-found page. Album and subpage slugs still depend
on
Immich and stay soft 404s.
- **Passwords set in the admin are stored as scrypt hashes**
([#706](https://github.com/ralksta/immich-folio/pull/706), closes
[#690](https://github.com/ralksta/immich-folio/issues/690)). Subpage,
album, journal-entry and site passwords were written as typed. The save
routes now hash them; a stored hash reads _Protected_ with _Change_ and
_Remove_ and is never put into an input. Visitors who unlocked a page
stay
signed in across unrelated saves. Existing plaintext passwords are
hashed
the next time their file is saved in the admin.
- **One notification surface in the admin**
([#707](https://github.com/ralksta/immich-folio/pull/707)) replaces
every
`alert()`: errors stay until dismissed, successes clear themselves, and
screen readers announce both.
### Fixed
- **Map tiles load again**
([#701](https://github.com/ralksta/immich-folio/pull/701)). CARTO
started
answering every tile with an "API KEY REQUIRED" image, leaving `/map`
and
journal map blocks as a grey grid. Tiles now come from OpenStreetMap;
the
dark look is a CSS filter, so the map now follows the colour mode.
- **The page builder no longer drops a subpage's `proofing:` flag on
save**
([#711](https://github.com/ralksta/immich-folio/pull/711)). A page
switched
off for proofing by hand reverted after any unrelated edit.
- **Unsaved edits in Settings and About survive switching admin tabs,
and a
backup restore is no longer overwritten by the next save**
([#687](https://github.com/ralksta/immich-folio/pull/687)). Editors that
were open during a restore now reload and offer unsaved edits back as a
conflict. Also: "Restore my changes" after a conflict found nothing,
removing an album left its drawer showing the next album, and the
journal
saved (rotating a backup) without changes.
- **Accent-backed buttons stay readable with a light or malformed
accent**
([#724](https://github.com/ralksta/immich-folio/pull/724), supersedes
[#680](https://github.com/ralksta/immich-folio/pull/680)) — contributed
by
[@lancetm714](https://github.com/lancetm714). A white accent made the
proofing dialog's _Download selected (.zip)_ button white on white.
`theme.accent` is now accepted as hex only and normalised to `#rrggbb`,
anything else falls back to the preset, and the proofing dialog and
filter
pills use the mode-aware `--on-accent` text colour from #688.
- **Every preset's accent is visible in both colour modes**
([#688](https://github.com/ralksta/immich-folio/pull/688)). Presets had
one
accent for both modes; minimal's dark mode drew black buttons on black.
Presets now carry a light and a dark accent, and text on accent-filled
buttons picks black or white for contrast. A custom accent stays the
owner's choice in both modes.
- **Visitor-side inconsistencies**
([#685](https://github.com/ralksta/immich-folio/pull/685)): after
visiting
`/impressum`, every subpage header turned centred and uppercase; back
links
announced "Back to Back to …"; the hero EXIF chip ignored
`exif.location`/`camera`/`settings`; videos in journal entries opened as
stills; the setup screen named a non-existent `.env.example`.
- **An essay's lightbox walks only the photos the story shows**
([#686](https://github.com/ralksta/immich-folio/pull/686)), not every
photo
of the subpage's albums, and the proofing bar in essays shows the
selection
count instead of a filter button that did nothing.
- **The page panel scrolls with the mouse wheel**
([#720](https://github.com/ralksta/immich-folio/pull/720)).
- **The journal editor's top bar wraps on phones**
([#723](https://github.com/ralksta/immich-folio/pull/723), closes
[#675](https://github.com/ralksta/immich-folio/issues/675)), so the
title
stays editable and Save stays on screen.
- **Every admin form field has a name for assistive technology**
([#715](https://github.com/ralksta/immich-folio/pull/715)). Only two
inputs
had a linked label; 47 are linked now, and clicking a label focuses its
field.
### Internal
- **`SettingsEditor` and `PageBuilder` are split up**
([#710](https://github.com/ralksta/immich-folio/pull/710),
[#711](https://github.com/ralksta/immich-folio/pull/711)). The
2,200-line
settings editor is a shell with one file per section; the page builder's
YAML handling and edits are pure functions under test. Both were checked
side by side against `dev` for identical output.
- **`useAdminFetch()`**
([#707](https://github.com/ralksta/immich-folio/pull/707))
gives Analytics, Messages, Backups and the journal list one loading and
error pattern.
- README brought up to v0.17.0
([#678](https://github.com/ralksta/immich-folio/pull/678),
[#679](https://github.com/ralksta/immich-folio/pull/679)).
### Upgrade notes
**`content/` gains two directories the app writes to:**
`content/.fonts/`
for the cached fonts and `content/messages/` for contact-form messages.
Both
are created on demand, so a writable `content/` is enough, as before.
**The server needs outbound HTTPS to Google once per font** to fill the
font
cache. Until then pages fall back to the theme's system fonts. Visitors'
browsers no longer contact Google.
**A custom CSP or reverse-proxy allowlist** must now allow
`tile.openstreetmap.org` for images instead of
`*.basemaps.cartocdn.com`,
and no longer needs `fonts.googleapis.com`, `fonts.gstatic.com` or
`unpkg.com`. The built-in CSP is updated.
**`theme.accent` must be hex** (`#rgb`, `#rrggbb` or `#rrggbbaa`).
Anything
else, including a value without `#`, falls back to the preset's accent.
**Plaintext passwords in `gallery.yaml`, `settings.yaml` or journal
entries**
are hashed the next time that file is saved in the admin; one save
clears the
doctor's warning.
**New, optional settings:** `contact.*` (the form is off by default),
`privacy.enabled`, `legal.heading`, `legal.contactUrl`,
`legal.contactLabel`,
and the `CDN_URL` and `CONTACT_NOTIFY_URL` environment variables. See
`content/settings.yaml.example` and `.env.local.example`. In the example
file,
`vatId` and `taxId` had swapped sample values; check yours if you copied
them.
No `IMAGE_CACHE_VERSION` bump is needed this time.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>
2026-09-27 14:43:38 +02:00
|
|
|
onChange={async (e) => {
|
|
|
|
|
const file = e.target.files?.[0];
|
|
|
|
|
if (!file) return;
|
|
|
|
|
setFaviconStatus(null);
|
|
|
|
|
setFaviconUploading(true);
|
|
|
|
|
const form = new FormData();
|
|
|
|
|
form.append('file', file);
|
|
|
|
|
try {
|
|
|
|
|
const res = await fetch('/api/admin/favicon', {
|
|
|
|
|
method: 'PUT',
|
|
|
|
|
body: form,
|
|
|
|
|
});
|
|
|
|
|
const data = await res.json();
|
|
|
|
|
setFaviconStatus(
|
|
|
|
|
res.ok
|
|
|
|
|
? { kind: 'success', message: data.message }
|
|
|
|
|
: { kind: 'error', message: `Error: ${data.error}` },
|
|
|
|
|
);
|
2026-10-02 18:14:23 +02:00
|
|
|
if (res.ok) setFaviconVersion((v) => v + 1);
|
release: v0.18.0 (#725)
Release v0.18.0 — merges `dev` into `main`.
## Thanks
- [@lancetm714](https://github.com/lancetm714) for the accent-contrast
fix (#680 → #724).
- [@RichKidsDev](https://github.com/RichKidsDev) for reporting the
outdated Impressum (#697).
### Security
- **Journal drafts and password-protected entries no longer render
publicly
as a subpage essay**
([#684](https://github.com/ralksta/immich-folio/pull/684),
[GHSA-987w-cpwm-c9g9](https://github.com/ralksta/immich-folio/security/advisories/GHSA-987w-cpwm-c9g9),
medium). A subpage's `essayFile` read the journal entry straight from
disk,
skipping the draft and password rules `/journal/<slug>` applies. It now
resolves through the same rules: a draft reads as missing for visitors,
and
a protected entry shows its password gate, sharing the
`lb_auth_journal_<slug>` cookie.
- **Immich descriptions are escaped in generated subpage essays**
([#684](https://github.com/ralksta/immich-folio/pull/684),
[GHSA-8ppx-39jv-q5xm](https://github.com/ralksta/immich-folio/security/advisories/GHSA-8ppx-39jv-q5xm),
low). The essay built from a subpage's albums (`layout: essay` without
markdown) put each asset's Immich description into the page as raw HTML.
Captions are now HTML-escaped, and they go through `assetCaption()`, so
`exif.caption: false` is respected there as well. Tracked in
[#689](https://github.com/ralksta/immich-folio/issues/689).
- **Admin drafts no longer keep a typed password, and the contact form's
email check runs in linear time**
([#727](https://github.com/ralksta/immich-folio/pull/727)). The admin's
session drafts wrote a password as typed to `sessionStorage`; a draft
holding a plaintext password is now not kept (the unsaved-changes guard
still warns). The email pattern could backtrack polynomially on a
crafted
domain; its labels now exclude the dot and the length is checked first.
Both found by CodeQL before release.
### Added
- **A built-in contact form with an inbox in the admin**
([#703](https://github.com/ralksta/immich-folio/pull/703), closes
[#702](https://github.com/ralksta/immich-folio/issues/702)). `/contact`
needs neither SMTP nor a form service: each message is one file in
`content/messages/` (mode `0600`), read under the new _Messages_ tab,
where
_Reply by email_ opens the owner's mail client with the message quoted.
Messages older than `contact.retentionDays` (default 90) are deleted. An
optional ntfy push goes to `contact.notifyUrl` or `CONTACT_NOTIFY_URL`,
and
since [#709](https://github.com/ralksta/immich-folio/pull/709) it
carries a
fixed "new message" line and nothing about the sender — no name, no
address, no text. Spam is kept out without a captcha: an off-screen
honeypot, a minimum fill time, three submissions a minute per IP and a
cap
of 500 stored messages. With the Impressum on and no `legal.contactUrl`,
the Impressum links the form as its second contact channel. A new doctor
check warns when the form is on but nobody is notified.
- **A privacy policy page, next to a list of what the site processes**
([#708](https://github.com/ralksta/immich-folio/pull/708)). `/privacy`
renders `content/privacy.md`, edited under Settings → Legal, and the
footer
links it once the file has text; `privacy.enabled: false` hides it.
Folio
writes no legal text. Beside the editor it lists what _this_
installation
does, read off the configuration — the map, statistics, contact form,
password cookies, CDN — and marks every entry that involves a third
party.
_Insert headings_ adds the matching section headings and nothing else.
The
doctor warns while the Impressum is on and there is no policy.
- **French, Spanish, Italian and Dutch interface translations**
([#681](https://github.com/ralksta/immich-folio/pull/681)), selected
with
`settings.yaml: lang` as before. The admin panel stays English.
- **CDN mode for photos and videos**
([#681](https://github.com/ralksta/immich-folio/pull/681)). With
`CDN_URL`
set, image and video URLs point at a pull CDN whose origin is this
server,
so repeat views reach neither the server nor Immich. A site password
switches the mode off, since a CDN would hand out cached photos without
checking the unlock cookie. The CDN origin is added to the CSP, and a
doctor check covers the password and `TRUSTED_PROXY_HOPS` cases. See
`docs/deployment.md#cdn-mode`.
- **A reworked admin panel**
([#712](https://github.com/ralksta/immich-folio/pull/712),
[#713](https://github.com/ralksta/immich-folio/pull/713),
[#714](https://github.com/ralksta/immich-folio/pull/714),
[#716](https://github.com/ralksta/immich-folio/pull/716),
[#717](https://github.com/ralksta/immich-folio/pull/717),
[#718](https://github.com/ralksta/immich-folio/pull/718),
[#719](https://github.com/ralksta/immich-folio/pull/719),
[#721](https://github.com/ralksta/immich-folio/pull/721)):
- **A sidebar instead of the header row**, grouped by task, with an
unread
count on Messages and a dot on Diagnostics while Immich is down. It
collapses to an icon rail, with names shown on hover and focus, and
remembers that per browser.
- **`/admin` is an overview**: what needs attention (unread messages,
doctor warnings), published pages, journal entries and recent views.
- **The site's own visual language** — the preset's fonts, hairline
borders, the square marker — and one page header on every screen. The
accent is kept for the current place and the primary action; switches
are now pills reading ON or OFF, in green rather than the accent, so
Studio Modern's red no longer makes an enabled setting look like an
error.
- **The page builder is a structure list and a panel.** Hero, subpages
and
standalone albums sit in one list on the left, subpages drag-sorted in
place; the selected entry is edited on the right instead of in an
overlay.
- **Dialogs only where a change is permanent.** Deleting a message or a
journal entry, and resetting the favicon (which used to delete the file
without asking), go through one confirm dialog in the admin's own look.
Removals in the page builder, which only touch unsaved state, happen at
once and offer _Undo_. No `window.confirm()` is left.
- **Feature switches are grouped by meaning** as one-line rows under
Settings → General; page transitions and scroll-to-top moved to Theme →
Look & motion. No setting keys changed.
### Changed
- **Fonts and the Leaflet stylesheet are served from the site itself**
([#700](https://github.com/ralksta/immich-folio/pull/700)). Every page
used
to link `fonts.googleapis.com`, which sends each visitor's IP address to
Google. The server now fetches a theme's Google fonts once, rewrites the
stylesheet and caches the files in `content/.fonts/`; custom fonts in
`theme.fonts` keep working. If Google cannot be reached before a font is
cached, the page falls back to the theme's system fonts. `leaflet.css`
comes from the npm package instead of unpkg. The CSP drops
`fonts.googleapis.com`, `fonts.gstatic.com` and `unpkg.com`.
- **Email addresses are kept out of the served HTML**
([#705](https://github.com/ralksta/immich-folio/pull/705)). The
Impressum
and footer render the address only after hydration, from an encoded
form,
so harvesters reading raw HTML find nothing. Without JavaScript the
Impressum shows `name [at] example [dot] de`. This defeats bulk
harvesting,
not a person with a browser.
- **The Impressum cites § 5 DDG and links its contacts**
([#698](https://github.com/ralksta/immich-folio/pull/698), reported in
[#697](https://github.com/ralksta/immich-folio/issues/697) by
[@RichKidsDev](https://github.com/RichKidsDev)). The TMG was replaced by
the
DDG in May 2024; `legal.heading` replaces the line for other laws (e.g.
§ 5 ECG in Austria). `legal.contactUrl` and `legal.contactLabel` add a
contact form as the second channel, so a phone number stays optional.
Email, phone and contact URL are now links, and the "Created with the
Impressum generator by eRecht24" line, shown on every site whether true
or
not, is gone. Settings → Legal gains fields for heading, contact URL,
VAT
ID and tax number, and a doctor check flags missing details.
- **Missing pages answer `404`**
([#704](https://github.com/ralksta/immich-folio/pull/704)). Every
missing
page used to answer `200`, because streaming had started before
`notFound()` ran. `/contact`, `/impressum`, `/map` and `/privacy` while
switched off, and `/journal/<slug>` without an entry, now return a real
404 with the same not-found page. Album and subpage slugs still depend
on
Immich and stay soft 404s.
- **Passwords set in the admin are stored as scrypt hashes**
([#706](https://github.com/ralksta/immich-folio/pull/706), closes
[#690](https://github.com/ralksta/immich-folio/issues/690)). Subpage,
album, journal-entry and site passwords were written as typed. The save
routes now hash them; a stored hash reads _Protected_ with _Change_ and
_Remove_ and is never put into an input. Visitors who unlocked a page
stay
signed in across unrelated saves. Existing plaintext passwords are
hashed
the next time their file is saved in the admin.
- **One notification surface in the admin**
([#707](https://github.com/ralksta/immich-folio/pull/707)) replaces
every
`alert()`: errors stay until dismissed, successes clear themselves, and
screen readers announce both.
### Fixed
- **Map tiles load again**
([#701](https://github.com/ralksta/immich-folio/pull/701)). CARTO
started
answering every tile with an "API KEY REQUIRED" image, leaving `/map`
and
journal map blocks as a grey grid. Tiles now come from OpenStreetMap;
the
dark look is a CSS filter, so the map now follows the colour mode.
- **The page builder no longer drops a subpage's `proofing:` flag on
save**
([#711](https://github.com/ralksta/immich-folio/pull/711)). A page
switched
off for proofing by hand reverted after any unrelated edit.
- **Unsaved edits in Settings and About survive switching admin tabs,
and a
backup restore is no longer overwritten by the next save**
([#687](https://github.com/ralksta/immich-folio/pull/687)). Editors that
were open during a restore now reload and offer unsaved edits back as a
conflict. Also: "Restore my changes" after a conflict found nothing,
removing an album left its drawer showing the next album, and the
journal
saved (rotating a backup) without changes.
- **Accent-backed buttons stay readable with a light or malformed
accent**
([#724](https://github.com/ralksta/immich-folio/pull/724), supersedes
[#680](https://github.com/ralksta/immich-folio/pull/680)) — contributed
by
[@lancetm714](https://github.com/lancetm714). A white accent made the
proofing dialog's _Download selected (.zip)_ button white on white.
`theme.accent` is now accepted as hex only and normalised to `#rrggbb`,
anything else falls back to the preset, and the proofing dialog and
filter
pills use the mode-aware `--on-accent` text colour from #688.
- **Every preset's accent is visible in both colour modes**
([#688](https://github.com/ralksta/immich-folio/pull/688)). Presets had
one
accent for both modes; minimal's dark mode drew black buttons on black.
Presets now carry a light and a dark accent, and text on accent-filled
buttons picks black or white for contrast. A custom accent stays the
owner's choice in both modes.
- **Visitor-side inconsistencies**
([#685](https://github.com/ralksta/immich-folio/pull/685)): after
visiting
`/impressum`, every subpage header turned centred and uppercase; back
links
announced "Back to Back to …"; the hero EXIF chip ignored
`exif.location`/`camera`/`settings`; videos in journal entries opened as
stills; the setup screen named a non-existent `.env.example`.
- **An essay's lightbox walks only the photos the story shows**
([#686](https://github.com/ralksta/immich-folio/pull/686)), not every
photo
of the subpage's albums, and the proofing bar in essays shows the
selection
count instead of a filter button that did nothing.
- **The page panel scrolls with the mouse wheel**
([#720](https://github.com/ralksta/immich-folio/pull/720)).
- **The journal editor's top bar wraps on phones**
([#723](https://github.com/ralksta/immich-folio/pull/723), closes
[#675](https://github.com/ralksta/immich-folio/issues/675)), so the
title
stays editable and Save stays on screen.
- **Every admin form field has a name for assistive technology**
([#715](https://github.com/ralksta/immich-folio/pull/715)). Only two
inputs
had a linked label; 47 are linked now, and clicking a label focuses its
field.
### Internal
- **`SettingsEditor` and `PageBuilder` are split up**
([#710](https://github.com/ralksta/immich-folio/pull/710),
[#711](https://github.com/ralksta/immich-folio/pull/711)). The
2,200-line
settings editor is a shell with one file per section; the page builder's
YAML handling and edits are pure functions under test. Both were checked
side by side against `dev` for identical output.
- **`useAdminFetch()`**
([#707](https://github.com/ralksta/immich-folio/pull/707))
gives Analytics, Messages, Backups and the journal list one loading and
error pattern.
- README brought up to v0.17.0
([#678](https://github.com/ralksta/immich-folio/pull/678),
[#679](https://github.com/ralksta/immich-folio/pull/679)).
### Upgrade notes
**`content/` gains two directories the app writes to:**
`content/.fonts/`
for the cached fonts and `content/messages/` for contact-form messages.
Both
are created on demand, so a writable `content/` is enough, as before.
**The server needs outbound HTTPS to Google once per font** to fill the
font
cache. Until then pages fall back to the theme's system fonts. Visitors'
browsers no longer contact Google.
**A custom CSP or reverse-proxy allowlist** must now allow
`tile.openstreetmap.org` for images instead of
`*.basemaps.cartocdn.com`,
and no longer needs `fonts.googleapis.com`, `fonts.gstatic.com` or
`unpkg.com`. The built-in CSP is updated.
**`theme.accent` must be hex** (`#rgb`, `#rrggbb` or `#rrggbbaa`).
Anything
else, including a value without `#`, falls back to the preset's accent.
**Plaintext passwords in `gallery.yaml`, `settings.yaml` or journal
entries**
are hashed the next time that file is saved in the admin; one save
clears the
doctor's warning.
**New, optional settings:** `contact.*` (the form is off by default),
`privacy.enabled`, `legal.heading`, `legal.contactUrl`,
`legal.contactLabel`,
and the `CDN_URL` and `CONTACT_NOTIFY_URL` environment variables. See
`content/settings.yaml.example` and `.env.local.example`. In the example
file,
`vatId` and `taxId` had swapped sample values; check yours if you copied
them.
No `IMAGE_CACHE_VERSION` bump is needed this time.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>
2026-09-27 14:43:38 +02:00
|
|
|
} catch {
|
|
|
|
|
setFaviconStatus({ kind: 'error', message: 'Error: Upload failed' });
|
|
|
|
|
} finally {
|
|
|
|
|
setFaviconUploading(false);
|
|
|
|
|
e.target.value = '';
|
|
|
|
|
}
|
|
|
|
|
}}
|
|
|
|
|
/>
|
2026-10-02 18:14:23 +02:00
|
|
|
<label
|
|
|
|
|
htmlFor="favicon-file"
|
|
|
|
|
id="favicon-file-button"
|
|
|
|
|
className="admin-btn admin-btn-sm admin-btn-secondary favicon-upload-btn"
|
|
|
|
|
>
|
|
|
|
|
<Icons.IconImage size={14} /> Upload icon
|
|
|
|
|
</label>
|
release: v0.18.0 (#725)
Release v0.18.0 — merges `dev` into `main`.
## Thanks
- [@lancetm714](https://github.com/lancetm714) for the accent-contrast
fix (#680 → #724).
- [@RichKidsDev](https://github.com/RichKidsDev) for reporting the
outdated Impressum (#697).
### Security
- **Journal drafts and password-protected entries no longer render
publicly
as a subpage essay**
([#684](https://github.com/ralksta/immich-folio/pull/684),
[GHSA-987w-cpwm-c9g9](https://github.com/ralksta/immich-folio/security/advisories/GHSA-987w-cpwm-c9g9),
medium). A subpage's `essayFile` read the journal entry straight from
disk,
skipping the draft and password rules `/journal/<slug>` applies. It now
resolves through the same rules: a draft reads as missing for visitors,
and
a protected entry shows its password gate, sharing the
`lb_auth_journal_<slug>` cookie.
- **Immich descriptions are escaped in generated subpage essays**
([#684](https://github.com/ralksta/immich-folio/pull/684),
[GHSA-8ppx-39jv-q5xm](https://github.com/ralksta/immich-folio/security/advisories/GHSA-8ppx-39jv-q5xm),
low). The essay built from a subpage's albums (`layout: essay` without
markdown) put each asset's Immich description into the page as raw HTML.
Captions are now HTML-escaped, and they go through `assetCaption()`, so
`exif.caption: false` is respected there as well. Tracked in
[#689](https://github.com/ralksta/immich-folio/issues/689).
- **Admin drafts no longer keep a typed password, and the contact form's
email check runs in linear time**
([#727](https://github.com/ralksta/immich-folio/pull/727)). The admin's
session drafts wrote a password as typed to `sessionStorage`; a draft
holding a plaintext password is now not kept (the unsaved-changes guard
still warns). The email pattern could backtrack polynomially on a
crafted
domain; its labels now exclude the dot and the length is checked first.
Both found by CodeQL before release.
### Added
- **A built-in contact form with an inbox in the admin**
([#703](https://github.com/ralksta/immich-folio/pull/703), closes
[#702](https://github.com/ralksta/immich-folio/issues/702)). `/contact`
needs neither SMTP nor a form service: each message is one file in
`content/messages/` (mode `0600`), read under the new _Messages_ tab,
where
_Reply by email_ opens the owner's mail client with the message quoted.
Messages older than `contact.retentionDays` (default 90) are deleted. An
optional ntfy push goes to `contact.notifyUrl` or `CONTACT_NOTIFY_URL`,
and
since [#709](https://github.com/ralksta/immich-folio/pull/709) it
carries a
fixed "new message" line and nothing about the sender — no name, no
address, no text. Spam is kept out without a captcha: an off-screen
honeypot, a minimum fill time, three submissions a minute per IP and a
cap
of 500 stored messages. With the Impressum on and no `legal.contactUrl`,
the Impressum links the form as its second contact channel. A new doctor
check warns when the form is on but nobody is notified.
- **A privacy policy page, next to a list of what the site processes**
([#708](https://github.com/ralksta/immich-folio/pull/708)). `/privacy`
renders `content/privacy.md`, edited under Settings → Legal, and the
footer
links it once the file has text; `privacy.enabled: false` hides it.
Folio
writes no legal text. Beside the editor it lists what _this_
installation
does, read off the configuration — the map, statistics, contact form,
password cookies, CDN — and marks every entry that involves a third
party.
_Insert headings_ adds the matching section headings and nothing else.
The
doctor warns while the Impressum is on and there is no policy.
- **French, Spanish, Italian and Dutch interface translations**
([#681](https://github.com/ralksta/immich-folio/pull/681)), selected
with
`settings.yaml: lang` as before. The admin panel stays English.
- **CDN mode for photos and videos**
([#681](https://github.com/ralksta/immich-folio/pull/681)). With
`CDN_URL`
set, image and video URLs point at a pull CDN whose origin is this
server,
so repeat views reach neither the server nor Immich. A site password
switches the mode off, since a CDN would hand out cached photos without
checking the unlock cookie. The CDN origin is added to the CSP, and a
doctor check covers the password and `TRUSTED_PROXY_HOPS` cases. See
`docs/deployment.md#cdn-mode`.
- **A reworked admin panel**
([#712](https://github.com/ralksta/immich-folio/pull/712),
[#713](https://github.com/ralksta/immich-folio/pull/713),
[#714](https://github.com/ralksta/immich-folio/pull/714),
[#716](https://github.com/ralksta/immich-folio/pull/716),
[#717](https://github.com/ralksta/immich-folio/pull/717),
[#718](https://github.com/ralksta/immich-folio/pull/718),
[#719](https://github.com/ralksta/immich-folio/pull/719),
[#721](https://github.com/ralksta/immich-folio/pull/721)):
- **A sidebar instead of the header row**, grouped by task, with an
unread
count on Messages and a dot on Diagnostics while Immich is down. It
collapses to an icon rail, with names shown on hover and focus, and
remembers that per browser.
- **`/admin` is an overview**: what needs attention (unread messages,
doctor warnings), published pages, journal entries and recent views.
- **The site's own visual language** — the preset's fonts, hairline
borders, the square marker — and one page header on every screen. The
accent is kept for the current place and the primary action; switches
are now pills reading ON or OFF, in green rather than the accent, so
Studio Modern's red no longer makes an enabled setting look like an
error.
- **The page builder is a structure list and a panel.** Hero, subpages
and
standalone albums sit in one list on the left, subpages drag-sorted in
place; the selected entry is edited on the right instead of in an
overlay.
- **Dialogs only where a change is permanent.** Deleting a message or a
journal entry, and resetting the favicon (which used to delete the file
without asking), go through one confirm dialog in the admin's own look.
Removals in the page builder, which only touch unsaved state, happen at
once and offer _Undo_. No `window.confirm()` is left.
- **Feature switches are grouped by meaning** as one-line rows under
Settings → General; page transitions and scroll-to-top moved to Theme →
Look & motion. No setting keys changed.
### Changed
- **Fonts and the Leaflet stylesheet are served from the site itself**
([#700](https://github.com/ralksta/immich-folio/pull/700)). Every page
used
to link `fonts.googleapis.com`, which sends each visitor's IP address to
Google. The server now fetches a theme's Google fonts once, rewrites the
stylesheet and caches the files in `content/.fonts/`; custom fonts in
`theme.fonts` keep working. If Google cannot be reached before a font is
cached, the page falls back to the theme's system fonts. `leaflet.css`
comes from the npm package instead of unpkg. The CSP drops
`fonts.googleapis.com`, `fonts.gstatic.com` and `unpkg.com`.
- **Email addresses are kept out of the served HTML**
([#705](https://github.com/ralksta/immich-folio/pull/705)). The
Impressum
and footer render the address only after hydration, from an encoded
form,
so harvesters reading raw HTML find nothing. Without JavaScript the
Impressum shows `name [at] example [dot] de`. This defeats bulk
harvesting,
not a person with a browser.
- **The Impressum cites § 5 DDG and links its contacts**
([#698](https://github.com/ralksta/immich-folio/pull/698), reported in
[#697](https://github.com/ralksta/immich-folio/issues/697) by
[@RichKidsDev](https://github.com/RichKidsDev)). The TMG was replaced by
the
DDG in May 2024; `legal.heading` replaces the line for other laws (e.g.
§ 5 ECG in Austria). `legal.contactUrl` and `legal.contactLabel` add a
contact form as the second channel, so a phone number stays optional.
Email, phone and contact URL are now links, and the "Created with the
Impressum generator by eRecht24" line, shown on every site whether true
or
not, is gone. Settings → Legal gains fields for heading, contact URL,
VAT
ID and tax number, and a doctor check flags missing details.
- **Missing pages answer `404`**
([#704](https://github.com/ralksta/immich-folio/pull/704)). Every
missing
page used to answer `200`, because streaming had started before
`notFound()` ran. `/contact`, `/impressum`, `/map` and `/privacy` while
switched off, and `/journal/<slug>` without an entry, now return a real
404 with the same not-found page. Album and subpage slugs still depend
on
Immich and stay soft 404s.
- **Passwords set in the admin are stored as scrypt hashes**
([#706](https://github.com/ralksta/immich-folio/pull/706), closes
[#690](https://github.com/ralksta/immich-folio/issues/690)). Subpage,
album, journal-entry and site passwords were written as typed. The save
routes now hash them; a stored hash reads _Protected_ with _Change_ and
_Remove_ and is never put into an input. Visitors who unlocked a page
stay
signed in across unrelated saves. Existing plaintext passwords are
hashed
the next time their file is saved in the admin.
- **One notification surface in the admin**
([#707](https://github.com/ralksta/immich-folio/pull/707)) replaces
every
`alert()`: errors stay until dismissed, successes clear themselves, and
screen readers announce both.
### Fixed
- **Map tiles load again**
([#701](https://github.com/ralksta/immich-folio/pull/701)). CARTO
started
answering every tile with an "API KEY REQUIRED" image, leaving `/map`
and
journal map blocks as a grey grid. Tiles now come from OpenStreetMap;
the
dark look is a CSS filter, so the map now follows the colour mode.
- **The page builder no longer drops a subpage's `proofing:` flag on
save**
([#711](https://github.com/ralksta/immich-folio/pull/711)). A page
switched
off for proofing by hand reverted after any unrelated edit.
- **Unsaved edits in Settings and About survive switching admin tabs,
and a
backup restore is no longer overwritten by the next save**
([#687](https://github.com/ralksta/immich-folio/pull/687)). Editors that
were open during a restore now reload and offer unsaved edits back as a
conflict. Also: "Restore my changes" after a conflict found nothing,
removing an album left its drawer showing the next album, and the
journal
saved (rotating a backup) without changes.
- **Accent-backed buttons stay readable with a light or malformed
accent**
([#724](https://github.com/ralksta/immich-folio/pull/724), supersedes
[#680](https://github.com/ralksta/immich-folio/pull/680)) — contributed
by
[@lancetm714](https://github.com/lancetm714). A white accent made the
proofing dialog's _Download selected (.zip)_ button white on white.
`theme.accent` is now accepted as hex only and normalised to `#rrggbb`,
anything else falls back to the preset, and the proofing dialog and
filter
pills use the mode-aware `--on-accent` text colour from #688.
- **Every preset's accent is visible in both colour modes**
([#688](https://github.com/ralksta/immich-folio/pull/688)). Presets had
one
accent for both modes; minimal's dark mode drew black buttons on black.
Presets now carry a light and a dark accent, and text on accent-filled
buttons picks black or white for contrast. A custom accent stays the
owner's choice in both modes.
- **Visitor-side inconsistencies**
([#685](https://github.com/ralksta/immich-folio/pull/685)): after
visiting
`/impressum`, every subpage header turned centred and uppercase; back
links
announced "Back to Back to …"; the hero EXIF chip ignored
`exif.location`/`camera`/`settings`; videos in journal entries opened as
stills; the setup screen named a non-existent `.env.example`.
- **An essay's lightbox walks only the photos the story shows**
([#686](https://github.com/ralksta/immich-folio/pull/686)), not every
photo
of the subpage's albums, and the proofing bar in essays shows the
selection
count instead of a filter button that did nothing.
- **The page panel scrolls with the mouse wheel**
([#720](https://github.com/ralksta/immich-folio/pull/720)).
- **The journal editor's top bar wraps on phones**
([#723](https://github.com/ralksta/immich-folio/pull/723), closes
[#675](https://github.com/ralksta/immich-folio/issues/675)), so the
title
stays editable and Save stays on screen.
- **Every admin form field has a name for assistive technology**
([#715](https://github.com/ralksta/immich-folio/pull/715)). Only two
inputs
had a linked label; 47 are linked now, and clicking a label focuses its
field.
### Internal
- **`SettingsEditor` and `PageBuilder` are split up**
([#710](https://github.com/ralksta/immich-folio/pull/710),
[#711](https://github.com/ralksta/immich-folio/pull/711)). The
2,200-line
settings editor is a shell with one file per section; the page builder's
YAML handling and edits are pure functions under test. Both were checked
side by side against `dev` for identical output.
- **`useAdminFetch()`**
([#707](https://github.com/ralksta/immich-folio/pull/707))
gives Analytics, Messages, Backups and the journal list one loading and
error pattern.
- README brought up to v0.17.0
([#678](https://github.com/ralksta/immich-folio/pull/678),
[#679](https://github.com/ralksta/immich-folio/pull/679)).
### Upgrade notes
**`content/` gains two directories the app writes to:**
`content/.fonts/`
for the cached fonts and `content/messages/` for contact-form messages.
Both
are created on demand, so a writable `content/` is enough, as before.
**The server needs outbound HTTPS to Google once per font** to fill the
font
cache. Until then pages fall back to the theme's system fonts. Visitors'
browsers no longer contact Google.
**A custom CSP or reverse-proxy allowlist** must now allow
`tile.openstreetmap.org` for images instead of
`*.basemaps.cartocdn.com`,
and no longer needs `fonts.googleapis.com`, `fonts.gstatic.com` or
`unpkg.com`. The built-in CSP is updated.
**`theme.accent` must be hex** (`#rgb`, `#rrggbb` or `#rrggbbaa`).
Anything
else, including a value without `#`, falls back to the preset's accent.
**Plaintext passwords in `gallery.yaml`, `settings.yaml` or journal
entries**
are hashed the next time that file is saved in the admin; one save
clears the
doctor's warning.
**New, optional settings:** `contact.*` (the form is off by default),
`privacy.enabled`, `legal.heading`, `legal.contactUrl`,
`legal.contactLabel`,
and the `CDN_URL` and `CONTACT_NOTIFY_URL` environment variables. See
`content/settings.yaml.example` and `.env.local.example`. In the example
file,
`vatId` and `taxId` had swapped sample values; check yours if you copied
them.
No `IMAGE_CACHE_VERSION` bump is needed this time.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>
2026-09-27 14:43:38 +02:00
|
|
|
<button
|
|
|
|
|
type="button"
|
2026-10-02 18:14:23 +02:00
|
|
|
className="admin-btn admin-btn-sm admin-btn-secondary"
|
release: v0.18.0 (#725)
Release v0.18.0 — merges `dev` into `main`.
## Thanks
- [@lancetm714](https://github.com/lancetm714) for the accent-contrast
fix (#680 → #724).
- [@RichKidsDev](https://github.com/RichKidsDev) for reporting the
outdated Impressum (#697).
### Security
- **Journal drafts and password-protected entries no longer render
publicly
as a subpage essay**
([#684](https://github.com/ralksta/immich-folio/pull/684),
[GHSA-987w-cpwm-c9g9](https://github.com/ralksta/immich-folio/security/advisories/GHSA-987w-cpwm-c9g9),
medium). A subpage's `essayFile` read the journal entry straight from
disk,
skipping the draft and password rules `/journal/<slug>` applies. It now
resolves through the same rules: a draft reads as missing for visitors,
and
a protected entry shows its password gate, sharing the
`lb_auth_journal_<slug>` cookie.
- **Immich descriptions are escaped in generated subpage essays**
([#684](https://github.com/ralksta/immich-folio/pull/684),
[GHSA-8ppx-39jv-q5xm](https://github.com/ralksta/immich-folio/security/advisories/GHSA-8ppx-39jv-q5xm),
low). The essay built from a subpage's albums (`layout: essay` without
markdown) put each asset's Immich description into the page as raw HTML.
Captions are now HTML-escaped, and they go through `assetCaption()`, so
`exif.caption: false` is respected there as well. Tracked in
[#689](https://github.com/ralksta/immich-folio/issues/689).
- **Admin drafts no longer keep a typed password, and the contact form's
email check runs in linear time**
([#727](https://github.com/ralksta/immich-folio/pull/727)). The admin's
session drafts wrote a password as typed to `sessionStorage`; a draft
holding a plaintext password is now not kept (the unsaved-changes guard
still warns). The email pattern could backtrack polynomially on a
crafted
domain; its labels now exclude the dot and the length is checked first.
Both found by CodeQL before release.
### Added
- **A built-in contact form with an inbox in the admin**
([#703](https://github.com/ralksta/immich-folio/pull/703), closes
[#702](https://github.com/ralksta/immich-folio/issues/702)). `/contact`
needs neither SMTP nor a form service: each message is one file in
`content/messages/` (mode `0600`), read under the new _Messages_ tab,
where
_Reply by email_ opens the owner's mail client with the message quoted.
Messages older than `contact.retentionDays` (default 90) are deleted. An
optional ntfy push goes to `contact.notifyUrl` or `CONTACT_NOTIFY_URL`,
and
since [#709](https://github.com/ralksta/immich-folio/pull/709) it
carries a
fixed "new message" line and nothing about the sender — no name, no
address, no text. Spam is kept out without a captcha: an off-screen
honeypot, a minimum fill time, three submissions a minute per IP and a
cap
of 500 stored messages. With the Impressum on and no `legal.contactUrl`,
the Impressum links the form as its second contact channel. A new doctor
check warns when the form is on but nobody is notified.
- **A privacy policy page, next to a list of what the site processes**
([#708](https://github.com/ralksta/immich-folio/pull/708)). `/privacy`
renders `content/privacy.md`, edited under Settings → Legal, and the
footer
links it once the file has text; `privacy.enabled: false` hides it.
Folio
writes no legal text. Beside the editor it lists what _this_
installation
does, read off the configuration — the map, statistics, contact form,
password cookies, CDN — and marks every entry that involves a third
party.
_Insert headings_ adds the matching section headings and nothing else.
The
doctor warns while the Impressum is on and there is no policy.
- **French, Spanish, Italian and Dutch interface translations**
([#681](https://github.com/ralksta/immich-folio/pull/681)), selected
with
`settings.yaml: lang` as before. The admin panel stays English.
- **CDN mode for photos and videos**
([#681](https://github.com/ralksta/immich-folio/pull/681)). With
`CDN_URL`
set, image and video URLs point at a pull CDN whose origin is this
server,
so repeat views reach neither the server nor Immich. A site password
switches the mode off, since a CDN would hand out cached photos without
checking the unlock cookie. The CDN origin is added to the CSP, and a
doctor check covers the password and `TRUSTED_PROXY_HOPS` cases. See
`docs/deployment.md#cdn-mode`.
- **A reworked admin panel**
([#712](https://github.com/ralksta/immich-folio/pull/712),
[#713](https://github.com/ralksta/immich-folio/pull/713),
[#714](https://github.com/ralksta/immich-folio/pull/714),
[#716](https://github.com/ralksta/immich-folio/pull/716),
[#717](https://github.com/ralksta/immich-folio/pull/717),
[#718](https://github.com/ralksta/immich-folio/pull/718),
[#719](https://github.com/ralksta/immich-folio/pull/719),
[#721](https://github.com/ralksta/immich-folio/pull/721)):
- **A sidebar instead of the header row**, grouped by task, with an
unread
count on Messages and a dot on Diagnostics while Immich is down. It
collapses to an icon rail, with names shown on hover and focus, and
remembers that per browser.
- **`/admin` is an overview**: what needs attention (unread messages,
doctor warnings), published pages, journal entries and recent views.
- **The site's own visual language** — the preset's fonts, hairline
borders, the square marker — and one page header on every screen. The
accent is kept for the current place and the primary action; switches
are now pills reading ON or OFF, in green rather than the accent, so
Studio Modern's red no longer makes an enabled setting look like an
error.
- **The page builder is a structure list and a panel.** Hero, subpages
and
standalone albums sit in one list on the left, subpages drag-sorted in
place; the selected entry is edited on the right instead of in an
overlay.
- **Dialogs only where a change is permanent.** Deleting a message or a
journal entry, and resetting the favicon (which used to delete the file
without asking), go through one confirm dialog in the admin's own look.
Removals in the page builder, which only touch unsaved state, happen at
once and offer _Undo_. No `window.confirm()` is left.
- **Feature switches are grouped by meaning** as one-line rows under
Settings → General; page transitions and scroll-to-top moved to Theme →
Look & motion. No setting keys changed.
### Changed
- **Fonts and the Leaflet stylesheet are served from the site itself**
([#700](https://github.com/ralksta/immich-folio/pull/700)). Every page
used
to link `fonts.googleapis.com`, which sends each visitor's IP address to
Google. The server now fetches a theme's Google fonts once, rewrites the
stylesheet and caches the files in `content/.fonts/`; custom fonts in
`theme.fonts` keep working. If Google cannot be reached before a font is
cached, the page falls back to the theme's system fonts. `leaflet.css`
comes from the npm package instead of unpkg. The CSP drops
`fonts.googleapis.com`, `fonts.gstatic.com` and `unpkg.com`.
- **Email addresses are kept out of the served HTML**
([#705](https://github.com/ralksta/immich-folio/pull/705)). The
Impressum
and footer render the address only after hydration, from an encoded
form,
so harvesters reading raw HTML find nothing. Without JavaScript the
Impressum shows `name [at] example [dot] de`. This defeats bulk
harvesting,
not a person with a browser.
- **The Impressum cites § 5 DDG and links its contacts**
([#698](https://github.com/ralksta/immich-folio/pull/698), reported in
[#697](https://github.com/ralksta/immich-folio/issues/697) by
[@RichKidsDev](https://github.com/RichKidsDev)). The TMG was replaced by
the
DDG in May 2024; `legal.heading` replaces the line for other laws (e.g.
§ 5 ECG in Austria). `legal.contactUrl` and `legal.contactLabel` add a
contact form as the second channel, so a phone number stays optional.
Email, phone and contact URL are now links, and the "Created with the
Impressum generator by eRecht24" line, shown on every site whether true
or
not, is gone. Settings → Legal gains fields for heading, contact URL,
VAT
ID and tax number, and a doctor check flags missing details.
- **Missing pages answer `404`**
([#704](https://github.com/ralksta/immich-folio/pull/704)). Every
missing
page used to answer `200`, because streaming had started before
`notFound()` ran. `/contact`, `/impressum`, `/map` and `/privacy` while
switched off, and `/journal/<slug>` without an entry, now return a real
404 with the same not-found page. Album and subpage slugs still depend
on
Immich and stay soft 404s.
- **Passwords set in the admin are stored as scrypt hashes**
([#706](https://github.com/ralksta/immich-folio/pull/706), closes
[#690](https://github.com/ralksta/immich-folio/issues/690)). Subpage,
album, journal-entry and site passwords were written as typed. The save
routes now hash them; a stored hash reads _Protected_ with _Change_ and
_Remove_ and is never put into an input. Visitors who unlocked a page
stay
signed in across unrelated saves. Existing plaintext passwords are
hashed
the next time their file is saved in the admin.
- **One notification surface in the admin**
([#707](https://github.com/ralksta/immich-folio/pull/707)) replaces
every
`alert()`: errors stay until dismissed, successes clear themselves, and
screen readers announce both.
### Fixed
- **Map tiles load again**
([#701](https://github.com/ralksta/immich-folio/pull/701)). CARTO
started
answering every tile with an "API KEY REQUIRED" image, leaving `/map`
and
journal map blocks as a grey grid. Tiles now come from OpenStreetMap;
the
dark look is a CSS filter, so the map now follows the colour mode.
- **The page builder no longer drops a subpage's `proofing:` flag on
save**
([#711](https://github.com/ralksta/immich-folio/pull/711)). A page
switched
off for proofing by hand reverted after any unrelated edit.
- **Unsaved edits in Settings and About survive switching admin tabs,
and a
backup restore is no longer overwritten by the next save**
([#687](https://github.com/ralksta/immich-folio/pull/687)). Editors that
were open during a restore now reload and offer unsaved edits back as a
conflict. Also: "Restore my changes" after a conflict found nothing,
removing an album left its drawer showing the next album, and the
journal
saved (rotating a backup) without changes.
- **Accent-backed buttons stay readable with a light or malformed
accent**
([#724](https://github.com/ralksta/immich-folio/pull/724), supersedes
[#680](https://github.com/ralksta/immich-folio/pull/680)) — contributed
by
[@lancetm714](https://github.com/lancetm714). A white accent made the
proofing dialog's _Download selected (.zip)_ button white on white.
`theme.accent` is now accepted as hex only and normalised to `#rrggbb`,
anything else falls back to the preset, and the proofing dialog and
filter
pills use the mode-aware `--on-accent` text colour from #688.
- **Every preset's accent is visible in both colour modes**
([#688](https://github.com/ralksta/immich-folio/pull/688)). Presets had
one
accent for both modes; minimal's dark mode drew black buttons on black.
Presets now carry a light and a dark accent, and text on accent-filled
buttons picks black or white for contrast. A custom accent stays the
owner's choice in both modes.
- **Visitor-side inconsistencies**
([#685](https://github.com/ralksta/immich-folio/pull/685)): after
visiting
`/impressum`, every subpage header turned centred and uppercase; back
links
announced "Back to Back to …"; the hero EXIF chip ignored
`exif.location`/`camera`/`settings`; videos in journal entries opened as
stills; the setup screen named a non-existent `.env.example`.
- **An essay's lightbox walks only the photos the story shows**
([#686](https://github.com/ralksta/immich-folio/pull/686)), not every
photo
of the subpage's albums, and the proofing bar in essays shows the
selection
count instead of a filter button that did nothing.
- **The page panel scrolls with the mouse wheel**
([#720](https://github.com/ralksta/immich-folio/pull/720)).
- **The journal editor's top bar wraps on phones**
([#723](https://github.com/ralksta/immich-folio/pull/723), closes
[#675](https://github.com/ralksta/immich-folio/issues/675)), so the
title
stays editable and Save stays on screen.
- **Every admin form field has a name for assistive technology**
([#715](https://github.com/ralksta/immich-folio/pull/715)). Only two
inputs
had a linked label; 47 are linked now, and clicking a label focuses its
field.
### Internal
- **`SettingsEditor` and `PageBuilder` are split up**
([#710](https://github.com/ralksta/immich-folio/pull/710),
[#711](https://github.com/ralksta/immich-folio/pull/711)). The
2,200-line
settings editor is a shell with one file per section; the page builder's
YAML handling and edits are pure functions under test. Both were checked
side by side against `dev` for identical output.
- **`useAdminFetch()`**
([#707](https://github.com/ralksta/immich-folio/pull/707))
gives Analytics, Messages, Backups and the journal list one loading and
error pattern.
- README brought up to v0.17.0
([#678](https://github.com/ralksta/immich-folio/pull/678),
[#679](https://github.com/ralksta/immich-folio/pull/679)).
### Upgrade notes
**`content/` gains two directories the app writes to:**
`content/.fonts/`
for the cached fonts and `content/messages/` for contact-form messages.
Both
are created on demand, so a writable `content/` is enough, as before.
**The server needs outbound HTTPS to Google once per font** to fill the
font
cache. Until then pages fall back to the theme's system fonts. Visitors'
browsers no longer contact Google.
**A custom CSP or reverse-proxy allowlist** must now allow
`tile.openstreetmap.org` for images instead of
`*.basemaps.cartocdn.com`,
and no longer needs `fonts.googleapis.com`, `fonts.gstatic.com` or
`unpkg.com`. The built-in CSP is updated.
**`theme.accent` must be hex** (`#rgb`, `#rrggbb` or `#rrggbbaa`).
Anything
else, including a value without `#`, falls back to the preset's accent.
**Plaintext passwords in `gallery.yaml`, `settings.yaml` or journal
entries**
are hashed the next time that file is saved in the admin; one save
clears the
doctor's warning.
**New, optional settings:** `contact.*` (the form is off by default),
`privacy.enabled`, `legal.heading`, `legal.contactUrl`,
`legal.contactLabel`,
and the `CDN_URL` and `CONTACT_NOTIFY_URL` environment variables. See
`content/settings.yaml.example` and `.env.local.example`. In the example
file,
`vatId` and `taxId` had swapped sample values; check yours if you copied
them.
No `IMAGE_CACHE_VERSION` bump is needed this time.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>
2026-09-27 14:43:38 +02:00
|
|
|
disabled={faviconUploading}
|
|
|
|
|
onClick={async () => {
|
|
|
|
|
// Deletes the uploaded file at once, outside the staged form.
|
|
|
|
|
const ok = await confirm({
|
|
|
|
|
title: 'Reset the favicon?',
|
|
|
|
|
message: 'The uploaded icon is deleted and the bundled default is used again.',
|
|
|
|
|
confirmLabel: 'Reset',
|
|
|
|
|
danger: true,
|
|
|
|
|
});
|
|
|
|
|
if (!ok) return;
|
|
|
|
|
setFaviconStatus(null);
|
|
|
|
|
setFaviconUploading(true);
|
|
|
|
|
try {
|
|
|
|
|
const res = await fetch('/api/admin/favicon', { method: 'DELETE' });
|
|
|
|
|
const data = await res.json();
|
|
|
|
|
setFaviconStatus(
|
|
|
|
|
res.ok
|
|
|
|
|
? { kind: 'success', message: data.message }
|
|
|
|
|
: { kind: 'error', message: `Error: ${data.error}` },
|
|
|
|
|
);
|
2026-10-02 18:14:23 +02:00
|
|
|
if (res.ok) setFaviconVersion((v) => v + 1);
|
release: v0.18.0 (#725)
Release v0.18.0 — merges `dev` into `main`.
## Thanks
- [@lancetm714](https://github.com/lancetm714) for the accent-contrast
fix (#680 → #724).
- [@RichKidsDev](https://github.com/RichKidsDev) for reporting the
outdated Impressum (#697).
### Security
- **Journal drafts and password-protected entries no longer render
publicly
as a subpage essay**
([#684](https://github.com/ralksta/immich-folio/pull/684),
[GHSA-987w-cpwm-c9g9](https://github.com/ralksta/immich-folio/security/advisories/GHSA-987w-cpwm-c9g9),
medium). A subpage's `essayFile` read the journal entry straight from
disk,
skipping the draft and password rules `/journal/<slug>` applies. It now
resolves through the same rules: a draft reads as missing for visitors,
and
a protected entry shows its password gate, sharing the
`lb_auth_journal_<slug>` cookie.
- **Immich descriptions are escaped in generated subpage essays**
([#684](https://github.com/ralksta/immich-folio/pull/684),
[GHSA-8ppx-39jv-q5xm](https://github.com/ralksta/immich-folio/security/advisories/GHSA-8ppx-39jv-q5xm),
low). The essay built from a subpage's albums (`layout: essay` without
markdown) put each asset's Immich description into the page as raw HTML.
Captions are now HTML-escaped, and they go through `assetCaption()`, so
`exif.caption: false` is respected there as well. Tracked in
[#689](https://github.com/ralksta/immich-folio/issues/689).
- **Admin drafts no longer keep a typed password, and the contact form's
email check runs in linear time**
([#727](https://github.com/ralksta/immich-folio/pull/727)). The admin's
session drafts wrote a password as typed to `sessionStorage`; a draft
holding a plaintext password is now not kept (the unsaved-changes guard
still warns). The email pattern could backtrack polynomially on a
crafted
domain; its labels now exclude the dot and the length is checked first.
Both found by CodeQL before release.
### Added
- **A built-in contact form with an inbox in the admin**
([#703](https://github.com/ralksta/immich-folio/pull/703), closes
[#702](https://github.com/ralksta/immich-folio/issues/702)). `/contact`
needs neither SMTP nor a form service: each message is one file in
`content/messages/` (mode `0600`), read under the new _Messages_ tab,
where
_Reply by email_ opens the owner's mail client with the message quoted.
Messages older than `contact.retentionDays` (default 90) are deleted. An
optional ntfy push goes to `contact.notifyUrl` or `CONTACT_NOTIFY_URL`,
and
since [#709](https://github.com/ralksta/immich-folio/pull/709) it
carries a
fixed "new message" line and nothing about the sender — no name, no
address, no text. Spam is kept out without a captcha: an off-screen
honeypot, a minimum fill time, three submissions a minute per IP and a
cap
of 500 stored messages. With the Impressum on and no `legal.contactUrl`,
the Impressum links the form as its second contact channel. A new doctor
check warns when the form is on but nobody is notified.
- **A privacy policy page, next to a list of what the site processes**
([#708](https://github.com/ralksta/immich-folio/pull/708)). `/privacy`
renders `content/privacy.md`, edited under Settings → Legal, and the
footer
links it once the file has text; `privacy.enabled: false` hides it.
Folio
writes no legal text. Beside the editor it lists what _this_
installation
does, read off the configuration — the map, statistics, contact form,
password cookies, CDN — and marks every entry that involves a third
party.
_Insert headings_ adds the matching section headings and nothing else.
The
doctor warns while the Impressum is on and there is no policy.
- **French, Spanish, Italian and Dutch interface translations**
([#681](https://github.com/ralksta/immich-folio/pull/681)), selected
with
`settings.yaml: lang` as before. The admin panel stays English.
- **CDN mode for photos and videos**
([#681](https://github.com/ralksta/immich-folio/pull/681)). With
`CDN_URL`
set, image and video URLs point at a pull CDN whose origin is this
server,
so repeat views reach neither the server nor Immich. A site password
switches the mode off, since a CDN would hand out cached photos without
checking the unlock cookie. The CDN origin is added to the CSP, and a
doctor check covers the password and `TRUSTED_PROXY_HOPS` cases. See
`docs/deployment.md#cdn-mode`.
- **A reworked admin panel**
([#712](https://github.com/ralksta/immich-folio/pull/712),
[#713](https://github.com/ralksta/immich-folio/pull/713),
[#714](https://github.com/ralksta/immich-folio/pull/714),
[#716](https://github.com/ralksta/immich-folio/pull/716),
[#717](https://github.com/ralksta/immich-folio/pull/717),
[#718](https://github.com/ralksta/immich-folio/pull/718),
[#719](https://github.com/ralksta/immich-folio/pull/719),
[#721](https://github.com/ralksta/immich-folio/pull/721)):
- **A sidebar instead of the header row**, grouped by task, with an
unread
count on Messages and a dot on Diagnostics while Immich is down. It
collapses to an icon rail, with names shown on hover and focus, and
remembers that per browser.
- **`/admin` is an overview**: what needs attention (unread messages,
doctor warnings), published pages, journal entries and recent views.
- **The site's own visual language** — the preset's fonts, hairline
borders, the square marker — and one page header on every screen. The
accent is kept for the current place and the primary action; switches
are now pills reading ON or OFF, in green rather than the accent, so
Studio Modern's red no longer makes an enabled setting look like an
error.
- **The page builder is a structure list and a panel.** Hero, subpages
and
standalone albums sit in one list on the left, subpages drag-sorted in
place; the selected entry is edited on the right instead of in an
overlay.
- **Dialogs only where a change is permanent.** Deleting a message or a
journal entry, and resetting the favicon (which used to delete the file
without asking), go through one confirm dialog in the admin's own look.
Removals in the page builder, which only touch unsaved state, happen at
once and offer _Undo_. No `window.confirm()` is left.
- **Feature switches are grouped by meaning** as one-line rows under
Settings → General; page transitions and scroll-to-top moved to Theme →
Look & motion. No setting keys changed.
### Changed
- **Fonts and the Leaflet stylesheet are served from the site itself**
([#700](https://github.com/ralksta/immich-folio/pull/700)). Every page
used
to link `fonts.googleapis.com`, which sends each visitor's IP address to
Google. The server now fetches a theme's Google fonts once, rewrites the
stylesheet and caches the files in `content/.fonts/`; custom fonts in
`theme.fonts` keep working. If Google cannot be reached before a font is
cached, the page falls back to the theme's system fonts. `leaflet.css`
comes from the npm package instead of unpkg. The CSP drops
`fonts.googleapis.com`, `fonts.gstatic.com` and `unpkg.com`.
- **Email addresses are kept out of the served HTML**
([#705](https://github.com/ralksta/immich-folio/pull/705)). The
Impressum
and footer render the address only after hydration, from an encoded
form,
so harvesters reading raw HTML find nothing. Without JavaScript the
Impressum shows `name [at] example [dot] de`. This defeats bulk
harvesting,
not a person with a browser.
- **The Impressum cites § 5 DDG and links its contacts**
([#698](https://github.com/ralksta/immich-folio/pull/698), reported in
[#697](https://github.com/ralksta/immich-folio/issues/697) by
[@RichKidsDev](https://github.com/RichKidsDev)). The TMG was replaced by
the
DDG in May 2024; `legal.heading` replaces the line for other laws (e.g.
§ 5 ECG in Austria). `legal.contactUrl` and `legal.contactLabel` add a
contact form as the second channel, so a phone number stays optional.
Email, phone and contact URL are now links, and the "Created with the
Impressum generator by eRecht24" line, shown on every site whether true
or
not, is gone. Settings → Legal gains fields for heading, contact URL,
VAT
ID and tax number, and a doctor check flags missing details.
- **Missing pages answer `404`**
([#704](https://github.com/ralksta/immich-folio/pull/704)). Every
missing
page used to answer `200`, because streaming had started before
`notFound()` ran. `/contact`, `/impressum`, `/map` and `/privacy` while
switched off, and `/journal/<slug>` without an entry, now return a real
404 with the same not-found page. Album and subpage slugs still depend
on
Immich and stay soft 404s.
- **Passwords set in the admin are stored as scrypt hashes**
([#706](https://github.com/ralksta/immich-folio/pull/706), closes
[#690](https://github.com/ralksta/immich-folio/issues/690)). Subpage,
album, journal-entry and site passwords were written as typed. The save
routes now hash them; a stored hash reads _Protected_ with _Change_ and
_Remove_ and is never put into an input. Visitors who unlocked a page
stay
signed in across unrelated saves. Existing plaintext passwords are
hashed
the next time their file is saved in the admin.
- **One notification surface in the admin**
([#707](https://github.com/ralksta/immich-folio/pull/707)) replaces
every
`alert()`: errors stay until dismissed, successes clear themselves, and
screen readers announce both.
### Fixed
- **Map tiles load again**
([#701](https://github.com/ralksta/immich-folio/pull/701)). CARTO
started
answering every tile with an "API KEY REQUIRED" image, leaving `/map`
and
journal map blocks as a grey grid. Tiles now come from OpenStreetMap;
the
dark look is a CSS filter, so the map now follows the colour mode.
- **The page builder no longer drops a subpage's `proofing:` flag on
save**
([#711](https://github.com/ralksta/immich-folio/pull/711)). A page
switched
off for proofing by hand reverted after any unrelated edit.
- **Unsaved edits in Settings and About survive switching admin tabs,
and a
backup restore is no longer overwritten by the next save**
([#687](https://github.com/ralksta/immich-folio/pull/687)). Editors that
were open during a restore now reload and offer unsaved edits back as a
conflict. Also: "Restore my changes" after a conflict found nothing,
removing an album left its drawer showing the next album, and the
journal
saved (rotating a backup) without changes.
- **Accent-backed buttons stay readable with a light or malformed
accent**
([#724](https://github.com/ralksta/immich-folio/pull/724), supersedes
[#680](https://github.com/ralksta/immich-folio/pull/680)) — contributed
by
[@lancetm714](https://github.com/lancetm714). A white accent made the
proofing dialog's _Download selected (.zip)_ button white on white.
`theme.accent` is now accepted as hex only and normalised to `#rrggbb`,
anything else falls back to the preset, and the proofing dialog and
filter
pills use the mode-aware `--on-accent` text colour from #688.
- **Every preset's accent is visible in both colour modes**
([#688](https://github.com/ralksta/immich-folio/pull/688)). Presets had
one
accent for both modes; minimal's dark mode drew black buttons on black.
Presets now carry a light and a dark accent, and text on accent-filled
buttons picks black or white for contrast. A custom accent stays the
owner's choice in both modes.
- **Visitor-side inconsistencies**
([#685](https://github.com/ralksta/immich-folio/pull/685)): after
visiting
`/impressum`, every subpage header turned centred and uppercase; back
links
announced "Back to Back to …"; the hero EXIF chip ignored
`exif.location`/`camera`/`settings`; videos in journal entries opened as
stills; the setup screen named a non-existent `.env.example`.
- **An essay's lightbox walks only the photos the story shows**
([#686](https://github.com/ralksta/immich-folio/pull/686)), not every
photo
of the subpage's albums, and the proofing bar in essays shows the
selection
count instead of a filter button that did nothing.
- **The page panel scrolls with the mouse wheel**
([#720](https://github.com/ralksta/immich-folio/pull/720)).
- **The journal editor's top bar wraps on phones**
([#723](https://github.com/ralksta/immich-folio/pull/723), closes
[#675](https://github.com/ralksta/immich-folio/issues/675)), so the
title
stays editable and Save stays on screen.
- **Every admin form field has a name for assistive technology**
([#715](https://github.com/ralksta/immich-folio/pull/715)). Only two
inputs
had a linked label; 47 are linked now, and clicking a label focuses its
field.
### Internal
- **`SettingsEditor` and `PageBuilder` are split up**
([#710](https://github.com/ralksta/immich-folio/pull/710),
[#711](https://github.com/ralksta/immich-folio/pull/711)). The
2,200-line
settings editor is a shell with one file per section; the page builder's
YAML handling and edits are pure functions under test. Both were checked
side by side against `dev` for identical output.
- **`useAdminFetch()`**
([#707](https://github.com/ralksta/immich-folio/pull/707))
gives Analytics, Messages, Backups and the journal list one loading and
error pattern.
- README brought up to v0.17.0
([#678](https://github.com/ralksta/immich-folio/pull/678),
[#679](https://github.com/ralksta/immich-folio/pull/679)).
### Upgrade notes
**`content/` gains two directories the app writes to:**
`content/.fonts/`
for the cached fonts and `content/messages/` for contact-form messages.
Both
are created on demand, so a writable `content/` is enough, as before.
**The server needs outbound HTTPS to Google once per font** to fill the
font
cache. Until then pages fall back to the theme's system fonts. Visitors'
browsers no longer contact Google.
**A custom CSP or reverse-proxy allowlist** must now allow
`tile.openstreetmap.org` for images instead of
`*.basemaps.cartocdn.com`,
and no longer needs `fonts.googleapis.com`, `fonts.gstatic.com` or
`unpkg.com`. The built-in CSP is updated.
**`theme.accent` must be hex** (`#rgb`, `#rrggbb` or `#rrggbbaa`).
Anything
else, including a value without `#`, falls back to the preset's accent.
**Plaintext passwords in `gallery.yaml`, `settings.yaml` or journal
entries**
are hashed the next time that file is saved in the admin; one save
clears the
doctor's warning.
**New, optional settings:** `contact.*` (the form is off by default),
`privacy.enabled`, `legal.heading`, `legal.contactUrl`,
`legal.contactLabel`,
and the `CDN_URL` and `CONTACT_NOTIFY_URL` environment variables. See
`content/settings.yaml.example` and `.env.local.example`. In the example
file,
`vatId` and `taxId` had swapped sample values; check yours if you copied
them.
No `IMAGE_CACHE_VERSION` bump is needed this time.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>
2026-09-27 14:43:38 +02:00
|
|
|
} catch {
|
|
|
|
|
setFaviconStatus({ kind: 'error', message: 'Error: Reset failed' });
|
|
|
|
|
} finally {
|
|
|
|
|
setFaviconUploading(false);
|
|
|
|
|
}
|
|
|
|
|
}}
|
|
|
|
|
>
|
|
|
|
|
Reset
|
|
|
|
|
</button>
|
|
|
|
|
{faviconUploading && <div className="admin-spinner" />}
|
|
|
|
|
</div>
|
|
|
|
|
{faviconStatus && (
|
|
|
|
|
<p className={`save-message ${faviconStatus.kind}`}>{faviconStatus.message}</p>
|
|
|
|
|
)}
|
2026-10-02 18:14:23 +02:00
|
|
|
<span id="favicon-hint" className="admin-field-hint">
|
release: v0.18.0 (#725)
Release v0.18.0 — merges `dev` into `main`.
## Thanks
- [@lancetm714](https://github.com/lancetm714) for the accent-contrast
fix (#680 → #724).
- [@RichKidsDev](https://github.com/RichKidsDev) for reporting the
outdated Impressum (#697).
### Security
- **Journal drafts and password-protected entries no longer render
publicly
as a subpage essay**
([#684](https://github.com/ralksta/immich-folio/pull/684),
[GHSA-987w-cpwm-c9g9](https://github.com/ralksta/immich-folio/security/advisories/GHSA-987w-cpwm-c9g9),
medium). A subpage's `essayFile` read the journal entry straight from
disk,
skipping the draft and password rules `/journal/<slug>` applies. It now
resolves through the same rules: a draft reads as missing for visitors,
and
a protected entry shows its password gate, sharing the
`lb_auth_journal_<slug>` cookie.
- **Immich descriptions are escaped in generated subpage essays**
([#684](https://github.com/ralksta/immich-folio/pull/684),
[GHSA-8ppx-39jv-q5xm](https://github.com/ralksta/immich-folio/security/advisories/GHSA-8ppx-39jv-q5xm),
low). The essay built from a subpage's albums (`layout: essay` without
markdown) put each asset's Immich description into the page as raw HTML.
Captions are now HTML-escaped, and they go through `assetCaption()`, so
`exif.caption: false` is respected there as well. Tracked in
[#689](https://github.com/ralksta/immich-folio/issues/689).
- **Admin drafts no longer keep a typed password, and the contact form's
email check runs in linear time**
([#727](https://github.com/ralksta/immich-folio/pull/727)). The admin's
session drafts wrote a password as typed to `sessionStorage`; a draft
holding a plaintext password is now not kept (the unsaved-changes guard
still warns). The email pattern could backtrack polynomially on a
crafted
domain; its labels now exclude the dot and the length is checked first.
Both found by CodeQL before release.
### Added
- **A built-in contact form with an inbox in the admin**
([#703](https://github.com/ralksta/immich-folio/pull/703), closes
[#702](https://github.com/ralksta/immich-folio/issues/702)). `/contact`
needs neither SMTP nor a form service: each message is one file in
`content/messages/` (mode `0600`), read under the new _Messages_ tab,
where
_Reply by email_ opens the owner's mail client with the message quoted.
Messages older than `contact.retentionDays` (default 90) are deleted. An
optional ntfy push goes to `contact.notifyUrl` or `CONTACT_NOTIFY_URL`,
and
since [#709](https://github.com/ralksta/immich-folio/pull/709) it
carries a
fixed "new message" line and nothing about the sender — no name, no
address, no text. Spam is kept out without a captcha: an off-screen
honeypot, a minimum fill time, three submissions a minute per IP and a
cap
of 500 stored messages. With the Impressum on and no `legal.contactUrl`,
the Impressum links the form as its second contact channel. A new doctor
check warns when the form is on but nobody is notified.
- **A privacy policy page, next to a list of what the site processes**
([#708](https://github.com/ralksta/immich-folio/pull/708)). `/privacy`
renders `content/privacy.md`, edited under Settings → Legal, and the
footer
links it once the file has text; `privacy.enabled: false` hides it.
Folio
writes no legal text. Beside the editor it lists what _this_
installation
does, read off the configuration — the map, statistics, contact form,
password cookies, CDN — and marks every entry that involves a third
party.
_Insert headings_ adds the matching section headings and nothing else.
The
doctor warns while the Impressum is on and there is no policy.
- **French, Spanish, Italian and Dutch interface translations**
([#681](https://github.com/ralksta/immich-folio/pull/681)), selected
with
`settings.yaml: lang` as before. The admin panel stays English.
- **CDN mode for photos and videos**
([#681](https://github.com/ralksta/immich-folio/pull/681)). With
`CDN_URL`
set, image and video URLs point at a pull CDN whose origin is this
server,
so repeat views reach neither the server nor Immich. A site password
switches the mode off, since a CDN would hand out cached photos without
checking the unlock cookie. The CDN origin is added to the CSP, and a
doctor check covers the password and `TRUSTED_PROXY_HOPS` cases. See
`docs/deployment.md#cdn-mode`.
- **A reworked admin panel**
([#712](https://github.com/ralksta/immich-folio/pull/712),
[#713](https://github.com/ralksta/immich-folio/pull/713),
[#714](https://github.com/ralksta/immich-folio/pull/714),
[#716](https://github.com/ralksta/immich-folio/pull/716),
[#717](https://github.com/ralksta/immich-folio/pull/717),
[#718](https://github.com/ralksta/immich-folio/pull/718),
[#719](https://github.com/ralksta/immich-folio/pull/719),
[#721](https://github.com/ralksta/immich-folio/pull/721)):
- **A sidebar instead of the header row**, grouped by task, with an
unread
count on Messages and a dot on Diagnostics while Immich is down. It
collapses to an icon rail, with names shown on hover and focus, and
remembers that per browser.
- **`/admin` is an overview**: what needs attention (unread messages,
doctor warnings), published pages, journal entries and recent views.
- **The site's own visual language** — the preset's fonts, hairline
borders, the square marker — and one page header on every screen. The
accent is kept for the current place and the primary action; switches
are now pills reading ON or OFF, in green rather than the accent, so
Studio Modern's red no longer makes an enabled setting look like an
error.
- **The page builder is a structure list and a panel.** Hero, subpages
and
standalone albums sit in one list on the left, subpages drag-sorted in
place; the selected entry is edited on the right instead of in an
overlay.
- **Dialogs only where a change is permanent.** Deleting a message or a
journal entry, and resetting the favicon (which used to delete the file
without asking), go through one confirm dialog in the admin's own look.
Removals in the page builder, which only touch unsaved state, happen at
once and offer _Undo_. No `window.confirm()` is left.
- **Feature switches are grouped by meaning** as one-line rows under
Settings → General; page transitions and scroll-to-top moved to Theme →
Look & motion. No setting keys changed.
### Changed
- **Fonts and the Leaflet stylesheet are served from the site itself**
([#700](https://github.com/ralksta/immich-folio/pull/700)). Every page
used
to link `fonts.googleapis.com`, which sends each visitor's IP address to
Google. The server now fetches a theme's Google fonts once, rewrites the
stylesheet and caches the files in `content/.fonts/`; custom fonts in
`theme.fonts` keep working. If Google cannot be reached before a font is
cached, the page falls back to the theme's system fonts. `leaflet.css`
comes from the npm package instead of unpkg. The CSP drops
`fonts.googleapis.com`, `fonts.gstatic.com` and `unpkg.com`.
- **Email addresses are kept out of the served HTML**
([#705](https://github.com/ralksta/immich-folio/pull/705)). The
Impressum
and footer render the address only after hydration, from an encoded
form,
so harvesters reading raw HTML find nothing. Without JavaScript the
Impressum shows `name [at] example [dot] de`. This defeats bulk
harvesting,
not a person with a browser.
- **The Impressum cites § 5 DDG and links its contacts**
([#698](https://github.com/ralksta/immich-folio/pull/698), reported in
[#697](https://github.com/ralksta/immich-folio/issues/697) by
[@RichKidsDev](https://github.com/RichKidsDev)). The TMG was replaced by
the
DDG in May 2024; `legal.heading` replaces the line for other laws (e.g.
§ 5 ECG in Austria). `legal.contactUrl` and `legal.contactLabel` add a
contact form as the second channel, so a phone number stays optional.
Email, phone and contact URL are now links, and the "Created with the
Impressum generator by eRecht24" line, shown on every site whether true
or
not, is gone. Settings → Legal gains fields for heading, contact URL,
VAT
ID and tax number, and a doctor check flags missing details.
- **Missing pages answer `404`**
([#704](https://github.com/ralksta/immich-folio/pull/704)). Every
missing
page used to answer `200`, because streaming had started before
`notFound()` ran. `/contact`, `/impressum`, `/map` and `/privacy` while
switched off, and `/journal/<slug>` without an entry, now return a real
404 with the same not-found page. Album and subpage slugs still depend
on
Immich and stay soft 404s.
- **Passwords set in the admin are stored as scrypt hashes**
([#706](https://github.com/ralksta/immich-folio/pull/706), closes
[#690](https://github.com/ralksta/immich-folio/issues/690)). Subpage,
album, journal-entry and site passwords were written as typed. The save
routes now hash them; a stored hash reads _Protected_ with _Change_ and
_Remove_ and is never put into an input. Visitors who unlocked a page
stay
signed in across unrelated saves. Existing plaintext passwords are
hashed
the next time their file is saved in the admin.
- **One notification surface in the admin**
([#707](https://github.com/ralksta/immich-folio/pull/707)) replaces
every
`alert()`: errors stay until dismissed, successes clear themselves, and
screen readers announce both.
### Fixed
- **Map tiles load again**
([#701](https://github.com/ralksta/immich-folio/pull/701)). CARTO
started
answering every tile with an "API KEY REQUIRED" image, leaving `/map`
and
journal map blocks as a grey grid. Tiles now come from OpenStreetMap;
the
dark look is a CSS filter, so the map now follows the colour mode.
- **The page builder no longer drops a subpage's `proofing:` flag on
save**
([#711](https://github.com/ralksta/immich-folio/pull/711)). A page
switched
off for proofing by hand reverted after any unrelated edit.
- **Unsaved edits in Settings and About survive switching admin tabs,
and a
backup restore is no longer overwritten by the next save**
([#687](https://github.com/ralksta/immich-folio/pull/687)). Editors that
were open during a restore now reload and offer unsaved edits back as a
conflict. Also: "Restore my changes" after a conflict found nothing,
removing an album left its drawer showing the next album, and the
journal
saved (rotating a backup) without changes.
- **Accent-backed buttons stay readable with a light or malformed
accent**
([#724](https://github.com/ralksta/immich-folio/pull/724), supersedes
[#680](https://github.com/ralksta/immich-folio/pull/680)) — contributed
by
[@lancetm714](https://github.com/lancetm714). A white accent made the
proofing dialog's _Download selected (.zip)_ button white on white.
`theme.accent` is now accepted as hex only and normalised to `#rrggbb`,
anything else falls back to the preset, and the proofing dialog and
filter
pills use the mode-aware `--on-accent` text colour from #688.
- **Every preset's accent is visible in both colour modes**
([#688](https://github.com/ralksta/immich-folio/pull/688)). Presets had
one
accent for both modes; minimal's dark mode drew black buttons on black.
Presets now carry a light and a dark accent, and text on accent-filled
buttons picks black or white for contrast. A custom accent stays the
owner's choice in both modes.
- **Visitor-side inconsistencies**
([#685](https://github.com/ralksta/immich-folio/pull/685)): after
visiting
`/impressum`, every subpage header turned centred and uppercase; back
links
announced "Back to Back to …"; the hero EXIF chip ignored
`exif.location`/`camera`/`settings`; videos in journal entries opened as
stills; the setup screen named a non-existent `.env.example`.
- **An essay's lightbox walks only the photos the story shows**
([#686](https://github.com/ralksta/immich-folio/pull/686)), not every
photo
of the subpage's albums, and the proofing bar in essays shows the
selection
count instead of a filter button that did nothing.
- **The page panel scrolls with the mouse wheel**
([#720](https://github.com/ralksta/immich-folio/pull/720)).
- **The journal editor's top bar wraps on phones**
([#723](https://github.com/ralksta/immich-folio/pull/723), closes
[#675](https://github.com/ralksta/immich-folio/issues/675)), so the
title
stays editable and Save stays on screen.
- **Every admin form field has a name for assistive technology**
([#715](https://github.com/ralksta/immich-folio/pull/715)). Only two
inputs
had a linked label; 47 are linked now, and clicking a label focuses its
field.
### Internal
- **`SettingsEditor` and `PageBuilder` are split up**
([#710](https://github.com/ralksta/immich-folio/pull/710),
[#711](https://github.com/ralksta/immich-folio/pull/711)). The
2,200-line
settings editor is a shell with one file per section; the page builder's
YAML handling and edits are pure functions under test. Both were checked
side by side against `dev` for identical output.
- **`useAdminFetch()`**
([#707](https://github.com/ralksta/immich-folio/pull/707))
gives Analytics, Messages, Backups and the journal list one loading and
error pattern.
- README brought up to v0.17.0
([#678](https://github.com/ralksta/immich-folio/pull/678),
[#679](https://github.com/ralksta/immich-folio/pull/679)).
### Upgrade notes
**`content/` gains two directories the app writes to:**
`content/.fonts/`
for the cached fonts and `content/messages/` for contact-form messages.
Both
are created on demand, so a writable `content/` is enough, as before.
**The server needs outbound HTTPS to Google once per font** to fill the
font
cache. Until then pages fall back to the theme's system fonts. Visitors'
browsers no longer contact Google.
**A custom CSP or reverse-proxy allowlist** must now allow
`tile.openstreetmap.org` for images instead of
`*.basemaps.cartocdn.com`,
and no longer needs `fonts.googleapis.com`, `fonts.gstatic.com` or
`unpkg.com`. The built-in CSP is updated.
**`theme.accent` must be hex** (`#rgb`, `#rrggbb` or `#rrggbbaa`).
Anything
else, including a value without `#`, falls back to the preset's accent.
**Plaintext passwords in `gallery.yaml`, `settings.yaml` or journal
entries**
are hashed the next time that file is saved in the admin; one save
clears the
doctor's warning.
**New, optional settings:** `contact.*` (the form is off by default),
`privacy.enabled`, `legal.heading`, `legal.contactUrl`,
`legal.contactLabel`,
and the `CDN_URL` and `CONTACT_NOTIFY_URL` environment variables. See
`content/settings.yaml.example` and `.env.local.example`. In the example
file,
`vatId` and `taxId` had swapped sample values; check yours if you copied
them.
No `IMAGE_CACHE_VERSION` bump is needed this time.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>
Co-authored-by: Lance Martin <lancetaylor95@gmail.com>
2026-09-27 14:43:38 +02:00
|
|
|
SVG, PNG, ICO, or JPEG — max 512 kB. Stored in the content volume. Reset restores the
|
|
|
|
|
bundled default.
|
|
|
|
|
</span>
|
|
|
|
|
</div>
|
|
|
|
|
</div>
|
|
|
|
|
);
|
|
|
|
|
}
|