From eaede83f6dea06a467584a9d6dafe35f90fe46b3 Mon Sep 17 00:00:00 2001 From: Thomas Camlong Date: Mon, 3 Aug 2026 16:45:16 +0200 Subject: [PATCH] fix: allow [homarr_base] template variables in app href validation --- packages/validation/src/app.ts | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/packages/validation/src/app.ts b/packages/validation/src/app.ts index 21a4335be..e3b94218b 100644 --- a/packages/validation/src/app.ts +++ b/packages/validation/src/app.ts @@ -5,6 +5,10 @@ export const appHrefSchema = z .trim() .url() .regex(/^(?!javascript)[a-zA-Z]*:\/\//i) // javascript: is not allowed, i for case insensitive (so Javascript: is also not allowed) + .or(z.string().trim().includes("[homarr_base]")) + .or(z.string().trim().includes("[homarr_hostname]")) + .or(z.string().trim().includes("[homarr_domain]")) + .or(z.string().trim().includes("[homarr_protocol]")) .or(z.literal("")) .transform((value) => (value.length === 0 ? null : value)) .nullable();