fix: remove incorrect CSS escaping on color values #7

Merged

andrew merged 1 commits from fix/css-color-escaping into main 2026-08-13 15:43:42 -04:00

Conversation 1 Commits 1 Files Changed 1

+2 -2

lyra commented 2026-08-13 12:07:27 -04:00

Member

Copy Link

Copy Source

Problem

The _style.html.twig template was using Twig's |e('css') escape filter on the bg_color, fg_color, and error_color environment variables. The CSS escaper converts # (ASCII 0x23) to its CSS escape sequence \23 , which breaks hex color parsing in the browser.

For example, background-color: #029386 was being rendered as background-color: \23 029386, so none of the custom theme colors were being applied.

Fix

Removed the |e('css') filter from all three color values in templates/_style.html.twig. These are admin-configured environment variables (set in .env / services.yaml), not user input, so CSS escaping is unnecessary and counterproductive here.

Verification

Spun up the PHP built-in server and confirmed the rendered HTML now outputs proper hex colors:

html { background-color: #029386; color: #ffffff; ... }
p { color: #ffb16d; ... }

Changed files

• templates/_style.html.twig — removed |e('css') from 3 color properties (2 insertions, 2 deletions)

## Problem The `_style.html.twig` template was using Twig's `|e('css')` escape filter on the `bg_color`, `fg_color`, and `error_color` environment variables. The CSS escaper converts `#` (ASCII 0x23) to its CSS escape sequence `\23 `, which breaks hex color parsing in the browser. For example, `background-color: #029386` was being rendered as `background-color: \23 029386`, so none of the custom theme colors were being applied. ## Fix Removed the `|e('css')` filter from all three color values in `templates/_style.html.twig`. These are admin-configured environment variables (set in `.env` / `services.yaml`), not user input, so CSS escaping is unnecessary and counterproductive here. ## Verification Spun up the PHP built-in server and confirmed the rendered HTML now outputs proper hex colors: ```html html { background-color: #029386; color: #ffffff; ... } p { color: #ffb16d; ... } ``` ## Changed files - `templates/_style.html.twig` — removed `|e('css')` from 3 color properties (2 insertions, 2 deletions)

lyra added 2 commits 2026-08-13 12:07:27 -04:00

feat: add self-bootstrapping dev server script (bin/dev.sh) ... c7585e720a

Manages a local PHP dev server for end-to-end development and testing.
Binds to 0.0.0.0:8773, accessible via Caddy at
https://preauth.lyra-dev.devgnome.com.

Features:
- Self-bootstrapping: installs PHP 8.4 + extensions (including APCu,
  which is critical for nonce cache, rate limiter, and session storage),
  Composer, and project dependencies if missing. Survives terminal
  resets/reboots.
- Enables apc.enable_cli=1 for console commands (matches Dockerfile)
- Subcommands: start, stop, status, restart
- Sets APP_SHARE_DIR to var/share for filesystem session persistence
- Clears dev cache on start

No database needed — preauth uses APCu + filesystem cache exclusively.

Port assignment: P-R-E = 7-7-3 → 8773

fix: remove incorrect CSS escaping on color values ... 235a7866b3

The Twig |e('css') filter was escaping '#' (0x23) to '\23 ' in hex
color values (bg_color, fg_color, error_color), causing browsers to
not recognize them as valid CSS colors. These are admin-configured
environment variables, not user input, so CSS escaping is unnecessary.

andrew approved these changes 2026-08-13 15:43:33 -04:00

andrew merged commit 235a7866b3 into main 2026-08-13 15:43:42 -04:00

andrew deleted branch fix/css-color-escaping 2026-08-13 15:43:42 -04:00

Sign in to join this conversation.

Reviewers

No Reviewers

andrew

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

andrew (Andrew) lyra

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: public/preauth#7