iFrame Widget - Releases

Added

• Multi-widget slot system: Support for up to 5 public widgets and 5 group widgets per group
• Enable/Disable toggles: Individual widgets can be enabled or disabled without deleting them
• Iframe security settings: New sandbox and allow fields for granular iframe permission control
• iframeSandbox: Configure sandbox permissions (default: allow-same-origin allow-scripts allow-popups allow-forms)
• iframeAllow: Configure feature policy permissions (e.g., microphone; camera; geolocation)
• Slot-based architecture: Each widget type now uses dedicated slot classes for better isolation
• PublicWidgetSlot1-5.php for public widgets
• GroupWidgetSlot1-5.php for group widgets
• Version sync tooling: Automatic version synchronization between package.json and appinfo/info.xml
• npm run version:sync - Sync from package.json to info.xml
• npm run version:bump - Bump patch version
• npm run version:bump:minor - Bump minor version
• npm run version:bump:major - Bump major version
• npm run version:show - Display current version status
• Dynamic version display: Version shown in admin/personal settings now dynamically reads from package.json at build time
• Portuguese (pt) translations: Added complete Portuguese localization
• URL validation: All widget URLs are now validated to start with http:// or https://
• Public widget management UI: New admin interface for managing multiple public widgets with slot badges

Changed

• Widget registration: Replaced single widget classes with slot-based system in Application.php
• Admin settings UI: Complete redesign with public widgets list, slot badges, and enable/disable toggles
• Data storage: Migrated from individual config keys to JSON-based storage (publicWidgetsJson, groupWidgetsJson)
• API endpoints: Updated /public-widgets and /group-widgets endpoints for multi-widget support
• DashboardWidget component: Now slot-aware with slotNumber prop for proper state management
• Backward compatibility: First slot (slot 1) maintains original widget IDs for seamless upgrades

Fixed

• Proper widget isolation: Each widget slot now has independent configuration and state
• Config controller: Fixed request parameter parsing using $this->request->getParams() instead of php://input
• User session handling: Improved IUserSession injection in controllers
• Slot assignment: Automatic slot number assignment when creating new widgets

Security

• URL validation: Added server-side validation rejecting non-HTTP(S) URLs
• Sandbox defaults: All iframes now have secure default sandbox permissions

Dependencies

• Updated webpack from 5.98.0 to 5.104.0
• Updated @nextcloud/vue from 8.23.1 to 8.35.2
• Updated @nextcloud/dialogs from 5.3.6 to 5.3.8
• Updated @nextcloud/axios to 2.5.2
• Updated @nextcloud/router to 3.1.0
• Updated various Nextcloud internal packages

Removed

• Legacy widget classes: IframeWidget.php and GroupIframeWidget.php replaced by slot system
• isDefault field: Replaced by enabled field for clearer semantics
• Single-widget paradigm: Old single-widget admin interface replaced by multi-widget management

Migration Notes

• Existing single-widget configurations are automatically migrated to slot 1
• Legacy config keys are preserved for backward compatibility with slot 1
• No manual migration required - the app handles upgrades transparently

Security Fixes

• Fixed node-forge vulnerability (CVE-2025-12816)

Maintenance

• Bumped version to 0.8.6

## 0.8.5 - 2025-10-20

Enhancements

• Added native compatibility with Nextcloud 32 by injecting the new Content Security Policy manager service across dashboard widgets
• Refined admin UI metadata to advertise the latest release and updated compatibility information

Maintenance

• Bumped application metadata and build artifacts to version 0.8.5
• Regenerated production bundles for the admin and personal settings panels

Enhancements

• Added native compatibility with Nextcloud 32 by injecting the new Content Security Policy manager service across dashboard widgets
• Refined admin UI metadata to advertise the latest release and updated compatibility information

Maintenance

• Bumped application metadata and build artifacts to version 0.8.5
• Regenerated production bundles for the admin and personal settings panels

Bug Fixes

• hide headers for empty iframe and personal iframe widgets
• Updated GroupIframeWidget to return a static title 'Group iFrame' for widget picker/selection.
• Modified IframeWidget to return 'Public iFrame' as the title for widget picker/selection.
• Changed PersonalIframeWidget to return 'Personal iFrame' for widget picker/selection, removing user-specific title logic.
• Adjusted default configuration in PersonalDashboardWidget.vue to have an empty widgetTitle by default.
• widget title retrieval for user-specific configurations

Bug Fixes

• Fixed localization crashes: Updated outdated translation keys in pt_BR, sv, ja, and nb localization files that were causing Nextcloud crashes and OC undefined errors

Bug Fixes

• Fixed iframe scrolling: enabled scrolling functionality while hiding scrollbars for cleaner appearance

Bug Fixes

• Fixed deletion of old-style group widgets from legacy storage system
• Added support for deleting widgets with IDs ending in '_default' by cleaning up old config keys
• Fixed JavaScript error in checkIframeLoaded by adding null checks for state and iframeUrl
• Improved group widget modal to show default title and icon in dashboard selection
• Enhanced widget cleanup process to handle both JSON and legacy configuration formats

New Features

• Added group widget support with full feature parity to personal and admin widgets
• Group widgets now support custom icons, colors, and all display options

Enhancements

• Removed iframe height settings to fix inconsistent widget heights across different content
• Added height: 100% to iframe elements for proper content fitting without scrollbars
• Removed explicit width properties to let Nextcloud handle widget width naturally
• Added scrolling="no" attribute to all iframe elements to prevent unwanted scrollbars
• Improved responsive behavior by allowing Nextcloud's dashboard to control widget dimensions
• Added mutation observer for dynamic dashboard panel updates

Bug Fixes

• Fixed GroupIframeWidget.php getIconClass method to properly return default icons
• Corrected updateGroupColor method property name from iconColor to proper field
• Added missing clearGroupColor method for color picker functionality
• Fixed icon display issues in group widgets by implementing applyPanelClasses method
• Resolved state loading issues for group widget configurations

Technical Improvements

• Simplified iframe CSS by removing height and width constraints
• Improved content display consistency across all iframe widget types (public, personal, group)

Security Fixes

• Updated form-data dependency to version >=4.0.4
• Updated linkifyjs dependency to version >=4.3.2
• Updated pbkdf2 dependency to version >=3.1.3
• Updated brace-expansion dependency to version >=2.0.2
• Updated vue-template-compiler dependency to version >=3.0.0
• Updated postcss dependency to version >=8.4.31

Technical Improvements

• Resolved dependency conflicts with webpack configuration
• Fixed compatibility issues with Nextcloud 30 and 31

Enhancements

• Added complete localization support for the 14 most common Nextcloud languages:
• English (en)
• German (de)
• French (fr)
• Spanish (es)
• Italian (it)
• Dutch (nl)
• Russian (ru)
• Polish (pl)
• Portuguese (pt)
• Brazilian Portuguese (pt_BR)
• Chinese (Simplified) (zh_CN)
• Japanese (ja)
• Czech (cs)
• Swedish (sv)
• Norwegian Bokmål (nb)
• Improved translation file organization and documentation
• Added translation guide for contributors

Bug Fixes

• Added missing iframe height setting in Personal Widget settings
• Fixed preview height in Personal Widget settings to properly show iframe height changes

New Features

• Added personal widget support: Users can now configure their own iFrame widget !
• Admin Widget may now be used as "Public" Widget for all Users

Enhancements

• Improved widget rendering and styling

Added

• Multi-widget slot system: Support for up to 5 public widgets and 5 group widgets per group
• Enable/Disable toggles: Individual widgets can be enabled or disabled without deleting them
• Iframe security settings: New sandbox and allow fields for granular iframe permission control
• iframeSandbox: Configure sandbox permissions (default: allow-same-origin allow-scripts allow-popups allow-forms)
• iframeAllow: Configure feature policy permissions (e.g., microphone; camera; geolocation)
• Slot-based architecture: Each widget type now uses dedicated slot classes for better isolation
• PublicWidgetSlot1-5.php for public widgets
• GroupWidgetSlot1-5.php for group widgets
• Version sync tooling: Automatic version synchronization between package.json and appinfo/info.xml
• npm run version:sync - Sync from package.json to info.xml
• npm run version:bump - Bump patch version
• npm run version:bump:minor - Bump minor version
• npm run version:bump:major - Bump major version
• npm run version:show - Display current version status
• Dynamic version display: Version shown in admin/personal settings now dynamically reads from package.json at build time
• Portuguese (pt) translations: Added complete Portuguese localization
• URL validation: All widget URLs are now validated to start with http:// or https://
• Public widget management UI: New admin interface for managing multiple public widgets with slot badges

Changed

• Widget registration: Replaced single widget classes with slot-based system in Application.php
• Admin settings UI: Complete redesign with public widgets list, slot badges, and enable/disable toggles
• Data storage: Migrated from individual config keys to JSON-based storage (publicWidgetsJson, groupWidgetsJson)
• API endpoints: Updated /public-widgets and /group-widgets endpoints for multi-widget support
• DashboardWidget component: Now slot-aware with slotNumber prop for proper state management
• Backward compatibility: First slot (slot 1) maintains original widget IDs for seamless upgrades

Fixed

• Proper widget isolation: Each widget slot now has independent configuration and state
• Config controller: Fixed request parameter parsing using $this->request->getParams() instead of php://input
• User session handling: Improved IUserSession injection in controllers
• Slot assignment: Automatic slot number assignment when creating new widgets

Security

• URL validation: Added server-side validation rejecting non-HTTP(S) URLs
• Sandbox defaults: All iframes now have secure default sandbox permissions

Dependencies

• Updated webpack from 5.98.0 to 5.104.0
• Updated @nextcloud/vue from 8.23.1 to 8.35.2
• Updated @nextcloud/dialogs from 5.3.6 to 5.3.8
• Updated @nextcloud/axios to 2.5.2
• Updated @nextcloud/router to 3.1.0
• Updated various Nextcloud internal packages

Removed

• Legacy widget classes: IframeWidget.php and GroupIframeWidget.php replaced by slot system
• isDefault field: Replaced by enabled field for clearer semantics
• Single-widget paradigm: Old single-widget admin interface replaced by multi-widget management

Migration Notes

• Existing single-widget configurations are automatically migrated to slot 1
• Legacy config keys are preserved for backward compatibility with slot 1
• No manual migration required - the app handles upgrades transparently

Security Fixes

• Fixed node-forge vulnerability (CVE-2025-12816)

Maintenance

• Bumped version to 0.8.6

## 0.8.5 - 2025-10-20

Enhancements

• Added native compatibility with Nextcloud 32 by injecting the new Content Security Policy manager service across dashboard widgets
• Refined admin UI metadata to advertise the latest release and updated compatibility information

Maintenance

• Bumped application metadata and build artifacts to version 0.8.5
• Regenerated production bundles for the admin and personal settings panels

Enhancements

• Added native compatibility with Nextcloud 32 by injecting the new Content Security Policy manager service across dashboard widgets
• Refined admin UI metadata to advertise the latest release and updated compatibility information

Maintenance

• Bumped application metadata and build artifacts to version 0.8.5
• Regenerated production bundles for the admin and personal settings panels

Bug Fixes

• hide headers for empty iframe and personal iframe widgets
• Updated GroupIframeWidget to return a static title 'Group iFrame' for widget picker/selection.
• Modified IframeWidget to return 'Public iFrame' as the title for widget picker/selection.
• Changed PersonalIframeWidget to return 'Personal iFrame' for widget picker/selection, removing user-specific title logic.
• Adjusted default configuration in PersonalDashboardWidget.vue to have an empty widgetTitle by default.
• widget title retrieval for user-specific configurations

Bug Fixes

• Fixed localization crashes: Updated outdated translation keys in pt_BR, sv, ja, and nb localization files that were causing Nextcloud crashes and OC undefined errors

Bug Fixes

• Fixed iframe scrolling: enabled scrolling functionality while hiding scrollbars for cleaner appearance

Bug Fixes

• Fixed deletion of old-style group widgets from legacy storage system
• Added support for deleting widgets with IDs ending in '_default' by cleaning up old config keys
• Fixed JavaScript error in checkIframeLoaded by adding null checks for state and iframeUrl
• Improved group widget modal to show default title and icon in dashboard selection
• Enhanced widget cleanup process to handle both JSON and legacy configuration formats

New Features

• Added group widget support with full feature parity to personal and admin widgets
• Group widgets now support custom icons, colors, and all display options

Enhancements

• Removed iframe height settings to fix inconsistent widget heights across different content
• Added height: 100% to iframe elements for proper content fitting without scrollbars
• Removed explicit width properties to let Nextcloud handle widget width naturally
• Added scrolling="no" attribute to all iframe elements to prevent unwanted scrollbars
• Improved responsive behavior by allowing Nextcloud's dashboard to control widget dimensions
• Added mutation observer for dynamic dashboard panel updates

Bug Fixes

• Fixed GroupIframeWidget.php getIconClass method to properly return default icons
• Corrected updateGroupColor method property name from iconColor to proper field
• Added missing clearGroupColor method for color picker functionality
• Fixed icon display issues in group widgets by implementing applyPanelClasses method
• Resolved state loading issues for group widget configurations

Technical Improvements

• Simplified iframe CSS by removing height and width constraints
• Improved content display consistency across all iframe widget types (public, personal, group)

Security Fixes

• Updated form-data dependency to version >=4.0.4
• Updated linkifyjs dependency to version >=4.3.2
• Updated pbkdf2 dependency to version >=3.1.3
• Updated brace-expansion dependency to version >=2.0.2
• Updated vue-template-compiler dependency to version >=3.0.0
• Updated postcss dependency to version >=8.4.31

Technical Improvements

• Resolved dependency conflicts with webpack configuration
• Fixed compatibility issues with Nextcloud 30 and 31

Enhancements

• Added complete localization support for the 14 most common Nextcloud languages:
• English (en)
• German (de)
• French (fr)
• Spanish (es)
• Italian (it)
• Dutch (nl)
• Russian (ru)
• Polish (pl)
• Portuguese (pt)
• Brazilian Portuguese (pt_BR)
• Chinese (Simplified) (zh_CN)
• Japanese (ja)
• Czech (cs)
• Swedish (sv)
• Norwegian Bokmål (nb)
• Improved translation file organization and documentation
• Added translation guide for contributors

Bug Fixes

• Added missing iframe height setting in Personal Widget settings
• Fixed preview height in Personal Widget settings to properly show iframe height changes

New Features

• Added personal widget support: Users can now configure their own iFrame widget !
• Admin Widget may now be used as "Public" Widget for all Users

Enhancements

• Improved widget rendering and styling

Documentation

• Optimized Nextcloud App Store Description

Bug Fixes

• Fixed a bug which throws false-positive CSP errors

Bug Fixes

• Fixed CSP Check behavior

New Features

• Added user-friendly CSP (Content Security Policy) error handling
• Added helpful guidance when iframe content is blocked by CSP restrictions
• Added direct links to documentation for solving CSP-related issues
• Implemented automatic detection of CSP blocking via content access checks

Security Enhancements

• Fixed multiple security vulnerabilities in dependencies
• Updated PostCSS to version 8.4.31 to address moderate severity vulnerabilities
• Implemented proper Node.js polyfills for webpack 5
• Enhanced Content Security Policy handling for iframe content

Technical Improvements

• Fixed compatibility with Nextcloud 30 and added 31
• Fixed webpack configuration to properly handle module resolution
• Improved error handling and reporting throughout the application

Documentation

• Added comprehensive error messages with links to documentation

Bug Fixes

• Improved error state display and fallback mechanisms

This update represents a significant improvement in security, stability, and user experience for the iFrame Widget, focusing on providing better guidance when configuration issues arise.

Added

• Multi-widget slot system: Support for up to 5 public widgets and 5 group widgets per group
• Enable/Disable toggles: Individual widgets can be enabled or disabled without deleting them
• Iframe security settings: New sandbox and allow fields for granular iframe permission control
• iframeSandbox: Configure sandbox permissions (default: allow-same-origin allow-scripts allow-popups allow-forms)
• iframeAllow: Configure feature policy permissions (e.g., microphone; camera; geolocation)
• Slot-based architecture: Each widget type now uses dedicated slot classes for better isolation
• PublicWidgetSlot1-5.php for public widgets
• GroupWidgetSlot1-5.php for group widgets
• Version sync tooling: Automatic version synchronization between package.json and appinfo/info.xml
• npm run version:sync - Sync from package.json to info.xml
• npm run version:bump - Bump patch version
• npm run version:bump:minor - Bump minor version
• npm run version:bump:major - Bump major version
• npm run version:show - Display current version status
• Dynamic version display: Version shown in admin/personal settings now dynamically reads from package.json at build time
• Portuguese (pt) translations: Added complete Portuguese localization
• URL validation: All widget URLs are now validated to start with http:// or https://
• Public widget management UI: New admin interface for managing multiple public widgets with slot badges

Changed

• Widget registration: Replaced single widget classes with slot-based system in Application.php
• Admin settings UI: Complete redesign with public widgets list, slot badges, and enable/disable toggles
• Data storage: Migrated from individual config keys to JSON-based storage (publicWidgetsJson, groupWidgetsJson)
• API endpoints: Updated /public-widgets and /group-widgets endpoints for multi-widget support
• DashboardWidget component: Now slot-aware with slotNumber prop for proper state management
• Backward compatibility: First slot (slot 1) maintains original widget IDs for seamless upgrades

Fixed

• Proper widget isolation: Each widget slot now has independent configuration and state
• Config controller: Fixed request parameter parsing using $this->request->getParams() instead of php://input
• User session handling: Improved IUserSession injection in controllers
• Slot assignment: Automatic slot number assignment when creating new widgets

Security

• URL validation: Added server-side validation rejecting non-HTTP(S) URLs
• Sandbox defaults: All iframes now have secure default sandbox permissions

Dependencies

• Updated webpack from 5.98.0 to 5.104.0
• Updated @nextcloud/vue from 8.23.1 to 8.35.2
• Updated @nextcloud/dialogs from 5.3.6 to 5.3.8
• Updated @nextcloud/axios to 2.5.2
• Updated @nextcloud/router to 3.1.0
• Updated various Nextcloud internal packages

Removed

• Legacy widget classes: IframeWidget.php and GroupIframeWidget.php replaced by slot system
• isDefault field: Replaced by enabled field for clearer semantics
• Single-widget paradigm: Old single-widget admin interface replaced by multi-widget management

Migration Notes

• Existing single-widget configurations are automatically migrated to slot 1
• Legacy config keys are preserved for backward compatibility with slot 1
• No manual migration required - the app handles upgrades transparently

Security Fixes

• Fixed node-forge vulnerability (CVE-2025-12816)

Maintenance

• Bumped version to 0.8.6

## 0.8.5 - 2025-10-20

Enhancements

• Added native compatibility with Nextcloud 32 by injecting the new Content Security Policy manager service across dashboard widgets
• Refined admin UI metadata to advertise the latest release and updated compatibility information

Maintenance

• Bumped application metadata and build artifacts to version 0.8.5
• Regenerated production bundles for the admin and personal settings panels

Enhancements

• Added native compatibility with Nextcloud 32 by injecting the new Content Security Policy manager service across dashboard widgets
• Refined admin UI metadata to advertise the latest release and updated compatibility information

Maintenance

• Bumped application metadata and build artifacts to version 0.8.5
• Regenerated production bundles for the admin and personal settings panels

Bug Fixes

• hide headers for empty iframe and personal iframe widgets
• Updated GroupIframeWidget to return a static title 'Group iFrame' for widget picker/selection.
• Modified IframeWidget to return 'Public iFrame' as the title for widget picker/selection.
• Changed PersonalIframeWidget to return 'Personal iFrame' for widget picker/selection, removing user-specific title logic.
• Adjusted default configuration in PersonalDashboardWidget.vue to have an empty widgetTitle by default.
• widget title retrieval for user-specific configurations

Bug Fixes

• Fixed localization crashes: Updated outdated translation keys in pt_BR, sv, ja, and nb localization files that were causing Nextcloud crashes and OC undefined errors

Bug Fixes

• Fixed iframe scrolling: enabled scrolling functionality while hiding scrollbars for cleaner appearance

Bug Fixes

• Fixed deletion of old-style group widgets from legacy storage system
• Added support for deleting widgets with IDs ending in '_default' by cleaning up old config keys
• Fixed JavaScript error in checkIframeLoaded by adding null checks for state and iframeUrl
• Improved group widget modal to show default title and icon in dashboard selection
• Enhanced widget cleanup process to handle both JSON and legacy configuration formats

New Features

• Added group widget support with full feature parity to personal and admin widgets
• Group widgets now support custom icons, colors, and all display options

Enhancements

• Removed iframe height settings to fix inconsistent widget heights across different content
• Added height: 100% to iframe elements for proper content fitting without scrollbars
• Removed explicit width properties to let Nextcloud handle widget width naturally
• Added scrolling="no" attribute to all iframe elements to prevent unwanted scrollbars
• Improved responsive behavior by allowing Nextcloud's dashboard to control widget dimensions
• Added mutation observer for dynamic dashboard panel updates

Bug Fixes

• Fixed GroupIframeWidget.php getIconClass method to properly return default icons
• Corrected updateGroupColor method property name from iconColor to proper field
• Added missing clearGroupColor method for color picker functionality
• Fixed icon display issues in group widgets by implementing applyPanelClasses method
• Resolved state loading issues for group widget configurations

Technical Improvements

• Simplified iframe CSS by removing height and width constraints
• Improved content display consistency across all iframe widget types (public, personal, group)

Security Fixes

• Updated form-data dependency to version >=4.0.4
• Updated linkifyjs dependency to version >=4.3.2
• Updated pbkdf2 dependency to version >=3.1.3
• Updated brace-expansion dependency to version >=2.0.2
• Updated vue-template-compiler dependency to version >=3.0.0
• Updated postcss dependency to version >=8.4.31

Technical Improvements

• Resolved dependency conflicts with webpack configuration
• Fixed compatibility issues with Nextcloud 30 and 31

Enhancements

• Added complete localization support for the 14 most common Nextcloud languages:
• English (en)
• German (de)
• French (fr)
• Spanish (es)
• Italian (it)
• Dutch (nl)
• Russian (ru)
• Polish (pl)
• Portuguese (pt)
• Brazilian Portuguese (pt_BR)
• Chinese (Simplified) (zh_CN)
• Japanese (ja)
• Czech (cs)
• Swedish (sv)
• Norwegian Bokmål (nb)
• Improved translation file organization and documentation
• Added translation guide for contributors

Bug Fixes

• Added missing iframe height setting in Personal Widget settings
• Fixed preview height in Personal Widget settings to properly show iframe height changes

New Features

• Added personal widget support: Users can now configure their own iFrame widget !
• Admin Widget may now be used as "Public" Widget for all Users

Enhancements

• Improved widget rendering and styling

Documentation

• Optimized Nextcloud App Store Description

Bug Fixes

• Fixed a bug which throws false-positive CSP errors

Bug Fixes

• Fixed CSP Check behavior

New Features

• Added user-friendly CSP (Content Security Policy) error handling
• Added helpful guidance when iframe content is blocked by CSP restrictions
• Added direct links to documentation for solving CSP-related issues
• Implemented automatic detection of CSP blocking via content access checks

Security Enhancements

• Fixed multiple security vulnerabilities in dependencies
• Updated PostCSS to version 8.4.31 to address moderate severity vulnerabilities
• Implemented proper Node.js polyfills for webpack 5
• Enhanced Content Security Policy handling for iframe content

Technical Improvements

• Fixed compatibility with Nextcloud 30 and added 31
• Fixed webpack configuration to properly handle module resolution
• Improved error handling and reporting throughout the application

Documentation

• Added comprehensive error messages with links to documentation

Bug Fixes

• Improved error state display and fallback mechanisms

This update represents a significant improvement in security, stability, and user experience for the iFrame Widget, focusing on providing better guidance when configuration issues arise.