- Rebuild the widget server-backed: it renders only when GET state
allows (logged-in FE user of the configured group), so the script
tag is safe on public pages; form with mini rich text (bold/italic/
list), file attachment chips and Ctrl+V image paste - a paste lazily
creates the draft feedback, uploads and inserts the image inline
- Note pad badge mirrors the server item count; the pad button links
to the overview page via new extension setting overviewPid, exposed
as overviewUrl in GET state (slug lookup)
- Embed /fileadmin images of notes into the feedback mail as CID
parts: relative srcs are dead in mail clients and dev sits behind
basic auth; attachment links stay absolute URLs
- public/widget-test.html: dev test page, doubles as the reference
implementation of the React login flow (fetch felogin JSON form
incl. __RequestToken, urlencoded POST to /_json + form.action)
- Docs section 5x (fe_comment v2 incl. CSRF login lesson,
templateRootPaths.10 collision, cache:flush before extension:setup)
orasche
d496877a53