max / balanced_breakfast

Fix dead OPML-import link: wire click programmatically, not inline onclick BB already ships CSP script-src 'self' (no 'unsafe-inline'), so the one inline onclick on the empty-state "import an OPML file" link was refused by the WebView (nonce makes 'unsafe-inline' ineffective) and did nothing. Wire it via .onclick after render, matching BB's existing programmatic-handler idiom. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: Max Johnson <me@maxj.phd> · 2026-07-13 21:07 UTC

Commit: 32cc291d722d7e0e784c7bfd156bf9bc181bd0d9

Parent: 5b96b69

1 file changed, +5 insertions, -1 deletion

M src-tauri/frontend/js/sources.js +5 -1

			@@ -165,7 +165,11 @@
165	165		if (sources.length === 0) {
166	166		const emptyLi = document.createElement('li');
167	167		emptyLi.className = 'source-item source-item--empty';
168		-	emptyLi.innerHTML = '<div class="source-item-empty-icon">' + BB.ui.emptyStateIcon('feed') + '</div>Add your first feed to get started.<br>Click <strong class="source-item-empty-strong">+ Add Feed</strong> above,<br>or <a href="#" onclick="event.preventDefault(); BB.feeds.importOpml();" class="source-item-empty-link">import an OPML file</a>.';
	168	+	emptyLi.innerHTML = '<div class="source-item-empty-icon">' + BB.ui.emptyStateIcon('feed') + '</div>Add your first feed to get started.<br>Click <strong class="source-item-empty-strong">+ Add Feed</strong> above,<br>or <a href="#" class="source-item-empty-link">import an OPML file</a>.';
	169	+	// Wired programmatically (not inline onclick) so the CSP script-src
	170	+	// can stay 'self' with no 'unsafe-inline'.
	171	+	const importLink = emptyLi.querySelector('.source-item-empty-link');
	172	+	if (importLink) importLink.onclick = (e) => { e.preventDefault(); BB.feeds.importOpml(); };
169	173		frag.appendChild(emptyLi);
170	174		}
171	175