Fix repeated hero image: allow same-origin /img/<hash> proxy paths in safeImg (PG-admin mode rewrites images to /img/, old allowlist only accepted cdn.shopify.com → every card fell back to hero-bg.jpg)

395eb109bf0729d9e9515aa61aa1ad96e54ef846 · 2026-06-16 18:15:12 -0700 · Steve Abrams

Files touched

M public/index.html

Diff

commit 395eb109bf0729d9e9515aa61aa1ad96e54ef846
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue Jun 16 18:15:12 2026 -0700

    Fix repeated hero image: allow same-origin /img/<hash> proxy paths in safeImg (PG-admin mode rewrites images to /img/, old allowlist only accepted cdn.shopify.com → every card fell back to hero-bg.jpg)
---
 public/index.html | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/public/index.html b/public/index.html
index 1024697..2079fd3 100644
--- a/public/index.html
+++ b/public/index.html
@@ -535,8 +535,10 @@ const TOUCH = window.matchMedia('(hover: none)').matches;
 const LABELS = {"self-adhesive":"Self adhesive"};
 
 function escAttr(s) { return String(s == null ? '' : s).replace(/[&<>"']/g, c => ({ '&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;' }[c])); }
-// Image-URL allowlist: only DW Shopify CDN + designerwallcoverings.com (defends against XSS via crafted products.json)
-function safeImg(u) { return /^https:\/\/(?:cdn\.shopify\.com|designerwallcoverings\.com)\//.test(u || '') ? u : '/hero-bg.jpg'; }
+// Image-URL allowlist (defends against XSS via crafted products.json):
+//  • DW Shopify CDN + designerwallcoverings.com (static-mode absolute URLs)
+//  • same-origin /img/<hash> proxy paths (PG-admin mode rewrites images to these)
+function safeImg(u) { return /^https:\/\/(?:cdn\.shopify\.com|designerwallcoverings\.com)\//.test(u || '') || /^\/img\/[A-Za-z0-9._-]+$/.test(u || '') ? u : '/hero-bg.jpg'; }
 function cardHTML(p) {
   const eager = state.page === 1;
   return '<img loading="' + (eager ? 'eager' : 'lazy') + '"' + (eager ? ' fetchpriority="high"' : '') + ' src="' + escAttr(safeImg(p.image_url)) + '" alt="' + escAttr(p.title) + '">'

← 1cfc9d3 apartmentwallpaper: on-site Shopify Buy Button checkout — Ad · back to Apartmentwallpaper · Ideas rail: route through safeImg()+escAttr() (XSS hygiene p 9c0a8ae →