Skipping API responses, where we need absolute URLs, and those that are
intended for sharing or external use:
- account/join_codes/show.html.erb - Join code URL for sharing
- boards/edit/_publication.html.erb - Publication URL for sharing
- public/* views - Public page URLs and og:url meta tags
- pwa/manifest.json.erb - PWA manifest needs absolute URLs
For this, we had to replace `url_for` used with Active Storage variants
and previews with the specific path helper (for Active Storage
representations).
Remove data-action from the sanitizer allowlist to disallow injection
of potentially malicious Stimulus actions in user-provided
content. The lightbox controller now uses imageTarget callbacks to
handle clicks on image links.
Also add the file name as a caption in the light box, and fix the
caption color for dark mode visibility.
to avoid implicitly creating a variant during a GET to a read replica,
which will raise an exception and cause the image to fail to load.
This feels pretty brittle, to be honest, and we'll need to be careful
in the future about creating and using new variants; we will probably
need to backfill the new variant for existing images because we can't
guarantee that they will be created implicitly/lazily if the GET lands
on the replica.
ref: https://fizzy.37signals.com/5986089/collections/7/cards/942
Embedded PDF previewing isnt' reliable (not working in Safari with active storage). Instead
let's align the editor with Active Storage previews and support pdf previews
Rosa Gutierrez