From 8f29cef7171f90d4253a3cf75e5ca543a7314c00 Mon Sep 17 00:00:00 2001
From: Zef Hemel <zef@zef.me>
Date: Sat, 8 Feb 2025 20:38:41 +0100
Subject: [PATCH] Disable rendering widgets on federated pages (security)

---
 web/cm_plugins/util.ts | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/web/cm_plugins/util.ts b/web/cm_plugins/util.ts
index eccac5ef..3cb31ccd 100644
--- a/web/cm_plugins/util.ts
+++ b/web/cm_plugins/util.ts
@@ -179,5 +179,6 @@ export const invisibleDecoration = Decoration.replace({});
 export function shouldRenderWidgets(client: Client) {
   const currentPageMeta = client.ui.viewState.currentPageMeta;
   return !currentPageMeta?.tags?.includes("template") &&
-    currentPageMeta?.pageDecoration?.renderWidgets !== false;
+    currentPageMeta?.pageDecoration?.renderWidgets !== false &&
+    !currentPageMeta?.name.startsWith("!");
 }