Skip to content

Show project support links and translate remaining workspace strings - #331

Merged
bifrost0x merged 3 commits into
mainfrom
dev/support-links-settings-96dd15
Nov 13, 2026
Merged

bifrost0x merged 3 commits into
mainfrom
dev/support-links-settings-96dd15

Conversation

@bifrost0x

Copy link
Copy Markdown
Owner

Problem and outcome

WebSSH has funding profiles in .github/FUNDING.yml, but the application never pointed users to them. The Settings side panel now lists GitHub Sponsors, Patreon and Buy Me a Coffee below the account and version facts. That panel only appears at 1500px and wider, so the account menu also links to the repository's sponsor dialog (?sponsor=1), which lists the same profiles.

The links open in a new tab with rel="noopener noreferrer" and load nothing external until a user follows one. Administrators of company or customer instances can hide them for all users under Administration → Integrations → Project support links.

A review of the frontend found small defects that are fixed in separate commits:

  • Several labels stayed English in every language: the truncated preview notice, the image preview alt text, one connection resources navigation label, the Bash activation command field, the cancel button on a connecting tab, the tmux badge tooltip, the SSH key validation message, the drop hint without a session, and the file manager quick connect password field. The quick connect dialog now translates placeholders.
  • The SMB source dialog used --primary-color and --danger-color, which nothing defines, so its error and pending status lost their colour. Unused .session-cpu-gauge rules, the only other user of an undefined property, are removed.

Scope and links

Related issue/proposal: none
Target milestone (if accepted into a release): next minor release

Validation

  • Tested revision: 7232cb3
  • pytest: everything except tests that cannot run in this environment passes. The automation cron/schedule tests fail locally with ZoneInfoNotFoundError (tzdata missing from the local virtualenv), and test_pytest_shard fails only under xdist; it passes on its own. The first commit was also tested on its own (test_security_ui, test_admin_routes, test_i18n_parity, test_version).
  • Playwright: 150 passed (account-menu, admin-keyboard-auth, file-workspace, primary-workspace-navigation, profile-launcher, session-workspace, smb-file-workspace), plus account-theme-matrix and ssh-gateway.
  • ESLint clean. npm run test:js passes except automation-tools.test.js "maintenance template runs exactly the probe", which fails only on a Windows CRLF checkout and is unrelated.
  • New coverage:
    • Support link targets are checked against FUNDING.yml, including noopener/noreferrer.
    • The admin setting requires step-up, rejects non-boolean values and hides the links in both templates.
    • An E2E test toggles the setting and checks that a support link opens a new tab without window.opener.
    • Workspace strings are checked for translation hooks.
    • A new test fails when CSS uses var() without a fallback for an undefined custom property.
  • Compatibility, upgrade and security impact:
    • support_links_enabled is an additional optional boolean in app_settings.json. A missing key means shown. Older versions ignore the key, so backups restore in both directions.
    • Changing the setting goes through the existing /admin/api/settings endpoint with the settings.update step-up and is logged.
    • No new dependencies, requests or tracking.
  • Remaining limitations: the Automation workspace still has three English aria-labels, because its own translation helper does not handle aria labels yet. That is left for a separate change.

Delivery

Merging implements the change; it does not publish a versioned release.

The Settings side panel lists GitHub Sponsors, Patreon and Buy Me a
Coffee below the account and version facts. The side panel only appears
on wide screens, so the account menu also links to the repository's
sponsor dialog, which lists the same profiles.

The links open in a new tab without access to the WebSSH window and
load nothing from external sites until a user follows one.

Administrators can hide the links for all users under Administration ->
Integrations. The setting is shown by default, stored in
app_settings.json and changed through the existing step-up protected
settings endpoint. Older versions ignore the additional key.
Several labels stayed English regardless of the selected language: the
truncated file preview notice, the image preview alt text, one
connection resources navigation label, the Bash activation command
field, the cancel button on a connecting tab, the tmux badge tooltip,
the SSH key validation message, the drop hint without a session, and
the file manager quick connect password field.

They now use existing keys where one fits and new keys in all six
languages otherwise. The quick connect dialog also translates
placeholders now. Decorative icons in the touched markup are hidden
from screen readers.
The SMB dialog used --primary-color and --danger-color, which no
stylesheet defines, so the error and pending status and the security
note icon fell back to the inherited text colour. They now use the
theme's --accent-primary and --error-color.

Remove the .session-cpu-gauge rules: the gauge left the templates and
scripts earlier and its rules were the only other use of an undefined
property. A test now fails when a stylesheet uses var() without a
fallback for a property nothing defines.
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Nov 13, 2026 •

Copy link
Copy Markdown
Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-11-13T17:22:22.657207Z 7232cb3 PR opened
🔒 Security Review ✅ Completed 2026-11-13T17:24:26.142838Z 7232cb3 PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@bifrost0x
bifrost0x merged commit 4f6f73c into main Nov 13, 2026
34 checks passed
@bifrost0x
bifrost0x deleted the dev/support-links-settings-96dd15 branch November 13, 2026 17:29
@github-project-automation github-project-automation Bot moved this from Backlog to Done in WebSSH Roadmap Nov 13, 2026
@bifrost0x bifrost0x added this to the v3.1.0 milestone Nov 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

1 participant