From 315618a77c05c1f553f9e446b660a5bcad6eef2d Mon Sep 17 00:00:00 2001 From: Daniel <845765@qq.com> Date: Fri, 16 Jan 2026 12:34:24 +0800 Subject: [PATCH 1/4] :art: Improve image export size for database assets fields https://github.com/siyuan-note/siyuan/issues/16470 Signed-off-by: Daniel <845765@qq.com> --- kernel/model/export.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kernel/model/export.go b/kernel/model/export.go index 6cb09acb9..f255a14a7 100644 --- a/kernel/model/export.go +++ b/kernel/model/export.go @@ -2840,6 +2840,10 @@ func exportTree(tree *parse.Tree, wysiwyg, keepFold, avHiddenCol bool, img.AppendChild(&ast.Node{Type: ast.NodeLinkDest, Tokens: []byte(a.Content)}) img.AppendChild(&ast.Node{Type: ast.NodeCloseParen}) mdTableCell.AppendChild(img) + height := "height: 128px;" + spanIAL := &ast.Node{Type: ast.NodeKramdownSpanIAL, Tokens: []byte("style=\"" + height + "\"")} + mdTableCell.AppendChild(spanIAL) + img.SetIALAttr("style", height) } else if av.AssetTypeFile == a.Type { linkText := strings.TrimSpace(a.Name) if "" == linkText { From 65532aec992306f69e578ed9b155aa27e0d6ac30 Mon Sep 17 00:00:00 2001 From: Daniel <845765@qq.com> Date: Fri, 16 Jan 2026 13:52:32 +0800 Subject: [PATCH 2/4] :art: Support exporting .sy.zip after selecting multiple documents https://github.com/siyuan-note/siyuan/issues/14484 Signed-off-by: Daniel <845765@qq.com> --- app/src/menus/navigation.ts | 15 ++++++++++++++- kernel/api/export.go | 26 +++++++++++++++++++++++--- kernel/api/router.go | 1 + kernel/model/export.go | 29 +++++++++++++---------------- 4 files changed, 51 insertions(+), 20 deletions(-) diff --git a/app/src/menus/navigation.ts b/app/src/menus/navigation.ts index 96d5e5414..fa4b7f26e 100644 --- a/app/src/menus/navigation.ts +++ b/app/src/menus/navigation.ts @@ -4,7 +4,7 @@ import {FileFilter, ipcRenderer} from "electron"; import * as path from "path"; /// #endif import {MenuItem} from "./Menu"; -import {getDisplayName, getNotebookName, getTopPaths, useShell, pathPosix} from "../util/pathName"; +import {getDisplayName, getNotebookName, getTopPaths, pathPosix, useShell} from "../util/pathName"; import {hideMessage, showMessage} from "../dialog/message"; import {fetchPost, fetchSyncPost} from "../util/fetch"; import {onGetnotebookconf} from "./onGetnotebookconf"; @@ -158,6 +158,19 @@ const initMultiMenu = (selectItemElements: NodeListOf, app: App) => { type: "submenu", icon: "iconUpload", submenu: [{ + id: "exportSiYuanZip", + label: "SiYuan .sy.zip", + icon: "iconSiYuan", + click: () => { + const msgId = showMessage(window.siyuan.languages.exporting, -1); + fetchPost("/api/export/exportSYs", { + ids: blockIDs, + }, response => { + hideMessage(msgId); + openByMobile(response.data.zip); + }); + } + }, { id: "exportMarkdown", label: "Markdown .zip", icon: "iconMarkdown", diff --git a/kernel/api/export.go b/kernel/api/export.go index f0c857060..c62cba92f 100644 --- a/kernel/api/export.go +++ b/kernel/api/export.go @@ -406,6 +406,27 @@ func exportNotebookSY(c *gin.Context) { } } +func exportSYs(c *gin.Context) { + ret := gulu.Ret.NewResult() + defer c.JSON(http.StatusOK, ret) + + arg, ok := util.JsonArg(c, ret) + if !ok { + return + } + + idsArg := arg["ids"].([]interface{}) + var ids []string + for _, id := range idsArg { + ids = append(ids, id.(string)) + } + + zipPath := model.ExportSYs(ids) + ret.Data = map[string]interface{}{ + "zip": zipPath, + } +} + func exportSY(c *gin.Context) { ret := gulu.Ret.NewResult() defer c.JSON(http.StatusOK, ret) @@ -416,10 +437,9 @@ func exportSY(c *gin.Context) { } id := arg["id"].(string) - name, zipPath := model.ExportSY(id) + zipPath := model.ExportSYs([]string{id}) ret.Data = map[string]interface{}{ - "name": name, - "zip": zipPath, + "zip": zipPath, } } diff --git a/kernel/api/router.go b/kernel/api/router.go index b85699b88..61b53393b 100644 --- a/kernel/api/router.go +++ b/kernel/api/router.go @@ -315,6 +315,7 @@ func ServeAPI(ginServer *gin.Engine) { ginServer.Handle("POST", "/api/export/exportNotebookMd", model.CheckAuth, model.CheckAdminRole, exportNotebookMd) ginServer.Handle("POST", "/api/export/exportMds", model.CheckAuth, model.CheckAdminRole, exportMds) ginServer.Handle("POST", "/api/export/exportMd", model.CheckAuth, model.CheckAdminRole, exportMd) + ginServer.Handle("POST", "/api/export/exportSYs", model.CheckAuth, model.CheckAdminRole, exportSYs) ginServer.Handle("POST", "/api/export/exportSY", model.CheckAuth, model.CheckAdminRole, exportSY) ginServer.Handle("POST", "/api/export/exportNotebookSY", model.CheckAuth, model.CheckAdminRole, exportNotebookSY) ginServer.Handle("POST", "/api/export/exportMdContent", model.CheckAuth, model.CheckAdminRole, exportMdContent) diff --git a/kernel/model/export.go b/kernel/model/export.go index f255a14a7..720ddc586 100644 --- a/kernel/model/export.go +++ b/kernel/model/export.go @@ -451,27 +451,24 @@ func ExportNotebookSY(id string) (zipPath string) { return } -func ExportSY(id string) (name, zipPath string) { - block := treenode.GetBlockTree(id) - if nil == block { - logging.LogErrorf("not found block [%s]", id) - return - } - - boxID := block.BoxID - box := Conf.Box(boxID) +func ExportSYs(ids []string) (zipPath string) { + block := treenode.GetBlockTree(ids[0]) + box := Conf.Box(block.BoxID) baseFolderName := path.Base(block.HPath) if "." == baseFolderName { baseFolderName = path.Base(block.Path) } - rootPath := block.Path - docPaths := []string{rootPath} - docFiles := box.ListFiles(strings.TrimSuffix(block.Path, ".sy")) - for _, docFile := range docFiles { - docPaths = append(docPaths, docFile.path) + + var docPaths []string + bts := treenode.GetBlockTrees(ids) + for _, bt := range bts { + docPaths = append(docPaths, bt.Path) + docFiles := box.ListFiles(strings.TrimSuffix(bt.Path, ".sy")) + for _, docFile := range docFiles { + docPaths = append(docPaths, docFile.path) + } } - zipPath = exportSYZip(boxID, path.Dir(rootPath), baseFolderName, docPaths) - name = util.GetTreeID(block.Path) + zipPath = exportSYZip(block.BoxID, path.Dir(block.Path), baseFolderName, docPaths) return } From 11115da3d0de950593ee4ce375cf7f9018484388 Mon Sep 17 00:00:00 2001 From: Daniel <845765@qq.com> Date: Fri, 16 Jan 2026 18:11:55 +0800 Subject: [PATCH 3/4] :lock: Do not execute scripts in assets SVG by default to prevent XSS https://github.com/siyuan-note/siyuan/issues/16844 Signed-off-by: Daniel <845765@qq.com> --- app/appearance/langs/ar_SA.json | 2 ++ app/appearance/langs/de_DE.json | 2 ++ app/appearance/langs/en_US.json | 2 ++ app/appearance/langs/es_ES.json | 2 ++ app/appearance/langs/fr_FR.json | 2 ++ app/appearance/langs/he_IL.json | 2 ++ app/appearance/langs/it_IT.json | 2 ++ app/appearance/langs/ja_JP.json | 2 ++ app/appearance/langs/ko_KR.json | 2 ++ app/appearance/langs/pl_PL.json | 2 ++ app/appearance/langs/pt_BR.json | 2 ++ app/appearance/langs/ru_RU.json | 2 ++ app/appearance/langs/tr_TR.json | 2 ++ app/appearance/langs/zh_CHT.json | 2 ++ app/appearance/langs/zh_CN.json | 2 ++ app/src/config/editor.ts | 9 ++++++ app/src/config/search.ts | 2 +- app/src/mobile/settings/editor.ts | 9 ++++++ app/src/protyle/export/index.ts | 1 + app/src/types/config.d.ts | 5 ++++ kernel/conf/editor.go | 1 + kernel/server/serve.go | 21 +++++++++++-- kernel/util/misc.go | 50 +++++++++++++++++++++++++++++++ 23 files changed, 125 insertions(+), 3 deletions(-) diff --git a/app/appearance/langs/ar_SA.json b/app/appearance/langs/ar_SA.json index 2fb45b107..1dfa19cc9 100644 --- a/app/appearance/langs/ar_SA.json +++ b/app/appearance/langs/ar_SA.json @@ -128,6 +128,8 @@ "click": "نقر", "allowHTMLBLockScript": "‫السماح بتنفيذ البرامج النصية في كتل HTML‬", "allowHTMLBLockScriptTip": "‫بعد التمكين، لن يتم تصحيح البرنامج النصي في كتلة HTML، يرجى إدراك المخاطر المحتملة لهجمات XSS‬", + "allowSVGScript": "السماح بتشغيل السكربتات داخل SVG", + "allowSVGScriptTip": "عند التفعيل، لن يتم تصفية الكود داخل SVG لأغراض الأمان. يرجى الانتباه إلى مخاطر XSS المحتملة", "autoLaunchMode0": "عدم التشغيل تلقائيًا", "autoLaunchMode1": "التشغيل التلقائي بعد الإقلاع", "autoLaunchMode2": "التشغيل التلقائي وتقليل الواجهة الرئيسية بعد الإقلاع", diff --git a/app/appearance/langs/de_DE.json b/app/appearance/langs/de_DE.json index 66b563be3..1221ccd4a 100644 --- a/app/appearance/langs/de_DE.json +++ b/app/appearance/langs/de_DE.json @@ -128,6 +128,8 @@ "click": "Klick", "allowHTMLBLockScript": "Die Ausführung von Skripten innerhalb von HTML-Blöcken zulassen", "allowHTMLBLockScriptTip": "Nach der Aktivierung wird das Skript im HTML-Block nicht bereinigt. Bitte seien Sie sich des potenziellen Risikos von XSS-Angriffen bewusst.", + "allowSVGScript": "Ausführen von Skripten innerhalb von SVG erlauben", + "allowSVGScriptTip": "Wenn aktiviert, wird der Code im SVG nicht sicherheitsgefiltert。Achten Sie auf mögliche XSS-Risiken", "autoLaunchMode0": "Nicht automatisch starten", "autoLaunchMode1": "Automatisch nach dem Booten starten", "autoLaunchMode2": "Automatisch starten und die Hauptoberfläche minimieren nach dem Booten", diff --git a/app/appearance/langs/en_US.json b/app/appearance/langs/en_US.json index 28de7b264..4dbdc436e 100644 --- a/app/appearance/langs/en_US.json +++ b/app/appearance/langs/en_US.json @@ -128,6 +128,8 @@ "click": "Click", "allowHTMLBLockScript": "Allow execution of scripts within HTML blocks", "allowHTMLBLockScriptTip": "When enabled, the script in the HTML block will not be sanitized, Please be aware of the potential risk of XSS attacks", + "allowSVGScript": "Allow execution of scripts inside SVG", + "allowSVGScriptTip": "When enabled, code inside SVG will not be security-filtered. Be aware of potential XSS risks", "autoLaunchMode0": "Do not launch automatically", "autoLaunchMode1": "Auto launch after booting", "autoLaunchMode2": "Auto launch and minimize the main interface after booting", diff --git a/app/appearance/langs/es_ES.json b/app/appearance/langs/es_ES.json index 3786e8f83..4b81e0931 100644 --- a/app/appearance/langs/es_ES.json +++ b/app/appearance/langs/es_ES.json @@ -128,6 +128,8 @@ "click": "Hacer clic", "allowHTMLBLockScript": "Permitir la ejecución de scripts dentro de bloques HTML", "allowHTMLBLockScriptTip": "Después de habilitarlo, el script en el bloque HTML no se desinfectará. Tenga en cuenta el riesgo potencial de ataques XSS", + "allowSVGScript": "Permitir ejecutar scripts dentro del SVG", + "allowSVGScriptTip": "Al activarlo, el código dentro del SVG no será filtrado por seguridad。Tenga en cuenta el riesgo potencial de XSS", "autoLaunchMode0": "No iniciar automáticamente", "autoLaunchMode1": "Inicio automático después del arranque", "autoLaunchMode2": "Iniciar automáticamente y minimizar la interfaz principal después del arranque", diff --git a/app/appearance/langs/fr_FR.json b/app/appearance/langs/fr_FR.json index 927da7f53..a3c655faa 100644 --- a/app/appearance/langs/fr_FR.json +++ b/app/appearance/langs/fr_FR.json @@ -128,6 +128,8 @@ "click": "Cliquez sur", "allowHTMLBLockScript": "Autoriser l'exécution de scripts dans les blocs HTML", "allowHTMLBLockScriptTip": "Après activation, le script dans le bloc HTML ne sera pas nettoyé. Veuillez être conscient du risque potentiel d'attaques XSS", + "allowSVGScript": "Autoriser l'exécution de scripts dans le SVG", + "allowSVGScriptTip": "Si activé, le code dans le SVG ne sera pas filtré pour la sécurité。Veuillez noter le risque potentiel de XSS", "autoLaunchMode0": "Ne pas lancer automatiquement", "autoLaunchMode1": "Lancement automatique après le démarrage", "autoLaunchMode2": "Lancement automatique et minimisation de l'interface principale après le démarrage", diff --git a/app/appearance/langs/he_IL.json b/app/appearance/langs/he_IL.json index 69fd71814..921ed610b 100644 --- a/app/appearance/langs/he_IL.json +++ b/app/appearance/langs/he_IL.json @@ -128,6 +128,8 @@ "click": "לחץ", "allowHTMLBLockScript": "אפשר הפעלת סקריפטים בתוך בלוקים של HTML", "allowHTMLBLockScriptTip": "לאחר הפעלה, הסקריפט בבלוק HTML לא יחוטא, שים לב לסיכון פוטנציאלי של התקפות XSS", + "allowSVGScript": "לאפשר הרצת סקריפטים בתוך SVG", + "allowSVGScriptTip": "בהפעלת האפשרות, הקוד בתוך SVG לא יסונן מבחינה בטיחותית — יש לשים לב לסיכון אפשרי של XSS", "autoLaunchMode0": "אל תצא אוטומטית", "autoLaunchMode1": "צא אוטומטית לאחר אתחול", "autoLaunchMode2": "צא אוטומטית ומזער את הממשק העיקרי לאחר אתחול", diff --git a/app/appearance/langs/it_IT.json b/app/appearance/langs/it_IT.json index b5e842ee9..ab494379f 100644 --- a/app/appearance/langs/it_IT.json +++ b/app/appearance/langs/it_IT.json @@ -128,6 +128,8 @@ "click": "Clicca", "allowHTMLBLockScript": "Consenti l'esecuzione di script nei blocchi HTML", "allowHTMLBLockScriptTip": "Dopo l'abilitazione, lo script nel blocco HTML non verrà sanificato. Si prega di essere consapevoli del potenziale rischio di attacchi XSS.", + "allowSVGScript": "Consenti l'esecuzione di script all'interno di SVG", + "allowSVGScriptTip": "Se abilitato, il codice all'interno dell'SVG non sarà filtrato per motivi di sicurezza. Prestare attenzione al rischio potenziale di XSS", "autoLaunchMode0": "Non avviare automaticamente", "autoLaunchMode1": "Avvio automatico dopo l'accensione", "autoLaunchMode2": "Avvio automatico e minimizzazione dell'interfaccia principale dopo l'accensione", diff --git a/app/appearance/langs/ja_JP.json b/app/appearance/langs/ja_JP.json index 75962b9fc..957fb39ba 100644 --- a/app/appearance/langs/ja_JP.json +++ b/app/appearance/langs/ja_JP.json @@ -128,6 +128,8 @@ "click": "クリック", "allowHTMLBLockScript": "HTML ブロック内のスクリプトの実行を許可", "allowHTMLBLockScriptTip": "HTML ブロック内のスクリプトはサニタイズされません。XSS 攻撃の潜在的なリスクに十分注意してください", + "allowSVGScript": "SVG 内のスクリプトを実行許可", + "allowSVGScriptTip": "有効にすると SVG 内のコードはセキュリティフィルタの対象になりません。潜在的な XSS 攻撃に注意してください", "autoLaunchMode0": "自動的に起動しない", "autoLaunchMode1": "システムの起動後に自動的に起動する", "autoLaunchMode2": "システムの起動後にインターフェースを最小化して自動的に起動する", diff --git a/app/appearance/langs/ko_KR.json b/app/appearance/langs/ko_KR.json index e26dced27..c4c4ec386 100644 --- a/app/appearance/langs/ko_KR.json +++ b/app/appearance/langs/ko_KR.json @@ -128,6 +128,8 @@ "click": "클릭", "allowHTMLBLockScript": "HTML 블록 내 스크립트 실행 허용", "allowHTMLBLockScriptTip": "활성화하면 HTML 블록의 스크립트가 삭제되지 않습니다. XSS 공격의 잠재적 위험에 주의하세요", + "allowSVGScript": "SVG 내부 스크립트 실행 허용", + "allowSVGScriptTip": "활성화하면 SVG 내의 코드는 보안 필터링 대상이 되지 않습니다。잠재적 XSS 공격에 주의하세요", "autoLaunchMode0": "자동으로 시작하지 않음", "autoLaunchMode1": "부팅 후 자동 시작", "autoLaunchMode2": "부팅 후 자동 시작 및 메인 인터페이스 최소화", diff --git a/app/appearance/langs/pl_PL.json b/app/appearance/langs/pl_PL.json index 65d937b67..b09472c04 100644 --- a/app/appearance/langs/pl_PL.json +++ b/app/appearance/langs/pl_PL.json @@ -128,6 +128,8 @@ "click": "Kliknij", "allowHTMLBLockScript": "Zezwalaj na wykonywanie skryptów w blokach HTML", "allowHTMLBLockScriptTip": "Po włączeniu skrypt w bloku HTML nie będzie czyszczony, proszę być świadomym potencjalnego ryzyka ataków XSS", + "allowSVGScript": "Zezwól na wykonywanie skryptów w SVG", + "allowSVGScriptTip": "Po włączeniu kod w SVG nie będzie filtrowany pod kątem bezpieczeństwa — uważaj na potencjalne ataki XSS", "autoLaunchMode0": "Nie uruchamiaj automatycznie", "autoLaunchMode1": "Uruchom automatycznie po włączeniu", "autoLaunchMode2": "Uruchom automatycznie i zminimalizuj główny interfejs po włączeniu", diff --git a/app/appearance/langs/pt_BR.json b/app/appearance/langs/pt_BR.json index 9af227a36..b1e112e65 100644 --- a/app/appearance/langs/pt_BR.json +++ b/app/appearance/langs/pt_BR.json @@ -128,6 +128,8 @@ "click": "Clique", "allowHTMLBLockScript": "Permitir execução de scripts dentro de blocos HTML", "allowHTMLBLockScriptTip": "Quando ativado, o script no bloco HTML não será sanitizado, esteja ciente do risco potencial de ataques XSS", + "allowSVGScript": "Permitir execução de scripts dentro de SVG", + "allowSVGScriptTip": "Ao ativar, o código dentro do SVG não será filtrado por segurança。Atenção ao risco potencial de XSS", "autoLaunchMode0": "Não iniciar automaticamente", "autoLaunchMode1": "Iniciar automaticamente após inicialização", "autoLaunchMode2": "Iniciar automaticamente e minimizar a interface principal após inicialização", diff --git a/app/appearance/langs/ru_RU.json b/app/appearance/langs/ru_RU.json index a5d923241..0bb06134e 100644 --- a/app/appearance/langs/ru_RU.json +++ b/app/appearance/langs/ru_RU.json @@ -128,6 +128,8 @@ "click": "Клик", "allowHTMLBLockScript": "Разрешить выполнение скриптов внутри HTML блоков", "allowHTMLBLockScriptTip": "После включения скрипт в HTML блоке не будет очищен, Пожалуйста, имейте в виду потенциальный риск XSS-атак", + "allowSVGScript": "Разрешить выполнение скриптов в SVG", + "allowSVGScriptTip": "При включении код внутри SVG не будет проходить фильтрацию безопасности — будьте внимательны к потенциальным XSS-уязвимостям", "autoLaunchMode0": "Не запускать автоматически", "autoLaunchMode1": "Автозапуск после загрузки", "autoLaunchMode2": "Автозапуск и минимизация главного интерфейса после загрузки", diff --git a/app/appearance/langs/tr_TR.json b/app/appearance/langs/tr_TR.json index 24583231b..634f95fde 100644 --- a/app/appearance/langs/tr_TR.json +++ b/app/appearance/langs/tr_TR.json @@ -128,6 +128,8 @@ "click": "Tıkla", "allowHTMLBLockScript": "HTML bloklarındaki betiklerin çalıştırılmasına izin ver", "allowHTMLBLockScriptTip": "Etkinleştirildiğinde, HTML bloğundaki betikler filtrelenmez. XSS saldırısı riski olduğunu unutma", + "allowSVGScript": "SVG içindeki betiklerin çalıştırılmasına izin ver", + "allowSVGScriptTip": "Etkinleştirildiğinde SVG içindeki kod güvenlik filtresinden geçirilmez, potansiyel XSS saldırılarına karşı dikkatli olun", "autoLaunchMode0": "Otomatik başlatma", "autoLaunchMode1": "Açılışta otomatik başlat", "autoLaunchMode2": "Açılışta otomatik başlat ve ana arayüzü küçült", diff --git a/app/appearance/langs/zh_CHT.json b/app/appearance/langs/zh_CHT.json index c66ea316d..7c7fbed2c 100644 --- a/app/appearance/langs/zh_CHT.json +++ b/app/appearance/langs/zh_CHT.json @@ -128,6 +128,8 @@ "click": "點擊", "allowHTMLBLockScript": "允許執行 HTML 塊內腳本", "allowHTMLBLockScriptTip": "啟用後將不對 HTML 塊中的程式碼進行安全過濾,請注意潛在的 XSS 攻擊風險", + "allowSVGScript": "允許執行 SVG 內腳本", + "allowSVGScriptTip": "啟用後將不對 SVG 中的程式碼進行安全過濾,請注意潛在的 XSS 攻擊風險", "autoLaunchMode0": "不自動啟動", "autoLaunchMode1": "開機自動啟動", "autoLaunchMode2": "開機後自動啟動並最小化主介面", diff --git a/app/appearance/langs/zh_CN.json b/app/appearance/langs/zh_CN.json index d524e54ac..da03462dc 100644 --- a/app/appearance/langs/zh_CN.json +++ b/app/appearance/langs/zh_CN.json @@ -128,6 +128,8 @@ "click": "点击", "allowHTMLBLockScript": "允许执行 HTML 块内脚本", "allowHTMLBLockScriptTip": "启用后将不对 HTML 块中的代码进行安全过滤,请注意潜在的 XSS 攻击风险", + "allowSVGScript": "允许执行 SVG 内脚本", + "allowSVGScriptTip": "启用后将不对 SVG 中的代码进行安全过滤,请注意潜在的 XSS 攻击风险", "autoLaunchMode0": "不自动启动", "autoLaunchMode1": "开机后自动启动", "autoLaunchMode2": "开机后自动启动并最小化主界面", diff --git a/app/src/config/editor.ts b/app/src/config/editor.ts index 666753eef..3a75dc029 100644 --- a/app/src/config/editor.ts +++ b/app/src/config/editor.ts @@ -305,6 +305,14 @@ export const editor = { +