Merge remote-tracking branch 'origin/dev' into dev

kernel/model/attribute_view.go

@@ -119,6 +119,20 @@ func ChangeAttrViewLayout(blockID, avID string, layout av.LayoutType) (err error
 
 	view.LayoutType = newLayout
 	err = av.SaveAttributeView(attrView)
+
+	node, tree, err := getNodeByBlockID(nil, blockID)
+	if err != nil {
+		return
+	}
+
+	node.AttributeViewType = string(view.LayoutType)
+	attrs := parse.IAL2Map(node.KramdownIAL)
+	attrs[av.NodeAttrView] = view.ID
+	err = setNodeAttrs(node, tree, attrs)
+	if err != nil {
+		logging.LogWarnf("set node [%s] attrs failed: %s", blockID, err)
+		return
+	}
 	return
 }
 
@@ -469,7 +483,6 @@ func SetDatabaseBlockView(blockID, avID, viewID string) (err error) {
 	}
 
 	node.AttributeViewType = string(view.LayoutType)
-
 	attrs := parse.IAL2Map(node.KramdownIAL)
 	attrs[av.NodeAttrView] = viewID
 	err = setNodeAttrs(node, tree, attrs)

kernel/model/box.go

@@ -127,10 +127,16 @@ func ListNotebooks() (ret []*Box, err error) {
 		}
 
 		id := dir.Name()
+		icon := boxConf.Icon
+		if strings.Contains(icon, ".") { // 说明是自定义图标
+			// XSS through emoji name https://github.com/siyuan-note/siyuan/issues/15034
+			icon = util.FilterUploadFileName(icon)
+		}
+
 		box := &Box{
 			ID:       id,
 			Name:     boxConf.Name,
-			Icon:     boxConf.Icon,
+			Icon:     icon,
 			Sort:     boxConf.Sort,
 			SortMode: boxConf.SortMode,
 			Closed:   boxConf.Closed,