Skip to content

docs(theme): bring the bootstrap theme README in line with the files it ships - #3474

Merged
marevol merged 1 commit into
mainfrom
docs/bootstrap-theme-readme
Sep 23, 2026
Merged

marevol merged 1 commit into
mainfrom
docs/bootstrap-theme-readme

Conversation

@marevol

@marevol marevol commented Sep 23, 2026

Copy link
Copy Markdown
Contributor

Summary

The README of the bundled bootstrap theme described an earlier state of the theme. This updates only the statements the current tree contradicts. Documentation only.

Changes

  • Layout: lists every module under assets/, the two logos and the help/ directory. i18n/ and help/ each ship 16 locales (SUPPORTED in i18n.js), not just en/ja. The stylesheet note now says css/bootstrap.min.css, relative like every other URL in the theme since the context-path change.
  • API endpoints: the table now matches what each module calls. Favorites are read with GET /favorites (there is no GET /documents/{id}/favorite), the cache view calls GET /cache/{id} from cache.js, clicks are logged through go/ rather than a POST /click, and POST /auth/password, GET /related-queries, GET /related-content and DELETE /chat/sessions/{id} were missing.
  • Streaming chat example: the request body field is message (as ChatRequestBody and chat.js use), and answer text arrives in chunk events as data.content, not message events with data.token.
  • XSS-safety: the section said innerHTML is only used for empty-string clears. Highlighted titles and snippets, notifications, help sections and chat Markdown are assigned as HTML after the whitelist sanitizer in format.js; the section now describes that.

The {{themePath}} sections added in #3470 already match the tree and are unchanged.

…it ships

The README of the bundled bootstrap theme described an earlier state of
the theme. This updates the statements the current tree contradicts:

- Layout: list every module under assets/, the logos, and the help/
  directory; i18n/ and help/ each carry 16 locales, not en/ja only.
  The stylesheet base is css/bootstrap.min.css, relative like every
  other URL in the theme.
- API table: the endpoints each module actually calls. Favorites are
  read with GET /favorites, the cache view calls GET /cache/{id},
  clicks are logged through go/ rather than an API call, and the
  password change, related queries/content and chat session deletion
  were missing.
- Streaming chat example: the request field is "message" and answer
  text arrives in "chunk" events as data.content.
- XSS-safety: server-supplied HTML (highlighted titles and snippets,
  notifications, help sections, chat Markdown) is assigned only after
  the whitelist sanitizer in format.js; it is not true that innerHTML
  is used only for empty-string clears.
@marevol marevol added this to the 15.9.0 milestone Sep 23, 2026
@marevol marevol self-assigned this Sep 23, 2026
@marevol marevol added the task label Sep 23, 2026
@marevol
marevol merged commit d3c5a80 into main Sep 23, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant