8317238184
PocketBase sets `Content-Security-Policy: ...sandbox` on /api/files, which makes Chromium treat the response as opaque-origin and silently fail to render PDFs inside an <iframe> (downloads still work). Add a same-origin proxy at /api/pb-files that forwards the bytes and strips the CSP / X-Frame-Options headers so the iframe can render. Files: - new: src/app/api/pb-files/[collection]/[recordId]/[...filename]/route.ts - SlipPreview now uses /api/pb-files/... for PDFs and PB directly for images (<img> isn't subject to the CSP sandbox, so the direct URL works there unchanged). Path validation, ALLOWED_COLLECTIONS gate, path-traversal guard, and a stable Content-Disposition so downloads keep the original filename. |
||
|---|---|---|
| .. | ||
| app | ||
| components | ||
| hooks | ||
| lib | ||
| mcp | ||