deploy: cd657c3

Author: phoenixide

appConfig.js

@@ -35,7 +35,7 @@ window.AppConfig = {
         "app_update_url": "https://updates.phcode.io/tauri/update-latest-pre-release.json",
         "extensionTakedownURL": "https://updates.phcode.io/extension_takedown.json",
         "linting.enabled_by_default": true,
-        "build_timestamp": "2026-04-26T15:23:36.538Z",
+        "build_timestamp": "2026-04-26T16:59:45.309Z",
         "googleAnalyticsID": "G-FP5S9BKDSJ",
         "googleAnalyticsIDDesktop": "G-D5R1Y6PTS8",
         "mixPanelID": "a7e08ffd43c37767c29b13df1d2e6c62",
@@ -47,7 +47,7 @@ window.AppConfig = {
         "bugsnagEnv": "staging"
     },
     "name": "Phoenix Code",
-    "version": "5.1.8-22816",
+    "version": "5.1.8-22818",
     "apiVersion": "5.1.8",
     "homepage": "https://core.ai",
     "issues": {

assets/default-project/en.zip

@@ -5,14 +5,40 @@
         <link rel="stylesheet" href="styles.css">
         <meta name="robots" content="noindex">
         <script type="text/javascript">
+            // URL params are reflected into the page, so they must NEVER reach
+            // innerHTML — that would be reflected XSS. Build the DOM with
+            // textContent and createElement only. The strings are plain text:
+            // mainHeading uses "\n" for line breaks, mainSpan uses "{0}" as
+            // the placeholder for the phcode.io link.
             function applyTranslations() {
-                const urlSearchParams = new URLSearchParams(window.location.search);
-                const params = Object.fromEntries(urlSearchParams.entries());
-                if(params.mainHeading){
-                    document.getElementById("mainHeading").innerHTML = decodeURIComponent(params.mainHeading);
+                const params = Object.fromEntries(
+                    new URLSearchParams(window.location.search).entries()
+                );
+                if (params.mainHeading) {
+                    const el = document.getElementById("mainHeading");
+                    el.textContent = "";
+                    const lines = decodeURIComponent(params.mainHeading).split("\n");
+                    lines.forEach(function(line, i) {
+                        if (i > 0) {
+                            el.appendChild(document.createElement("br"));
+                        }
+                        el.appendChild(document.createTextNode(line));
+                    });
                 }
-                if(params.mainSpan){
-                    document.getElementById("mainSpan").innerHTML = decodeURIComponent(params.mainSpan);
+                if (params.mainSpan) {
+                    const el = document.getElementById("mainSpan");
+                    el.textContent = "";
+                    const parts = decodeURIComponent(params.mainSpan).split("{0}");
+                    parts.forEach(function(part, i) {
+                        if (i > 0) {
+                            const a = document.createElement("a");
+                            a.href = "https://phcode.io";
+                            a.style.color = "white";
+                            a.textContent = "phcode.io";
+                            el.appendChild(a);
+                        }
+                        el.appendChild(document.createTextNode(part));
+                    });
                 }
             }
         </script>
@@ -23,9 +49,9 @@
         <div id="mainDiv">
             <img id="logo"  src="images/phoenix-logo-broken.svg"/>
             <div id="MainText" class="safari-text">
-                <h2 id="mainHeading">Uh Oh! <br>Your current browser doesn't support live preview.</h2>
+                <h2 id="mainHeading">Uh Oh!<br>Your current browser doesn't support live preview.</h2>
                 <span id="mainSpan">
-                    Get the best live preview experience by downloading our native apps for Windows, Mac, and Linux from <a href="https://phcode.io" style="color: white">phcode.io</a>.<br>
+                    Get the best live preview experience by downloading our native apps for Windows, Mac, and Linux from <a href="https://phcode.io" style="color: white">phcode.io</a>.
                 </span><br>
             </div>
         </div>