From 628f794b3708f85db68e38fd61d746ee88d9ebca Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20B=C3=B6hmer?= <mail@jan-boehmer.de>
Date: Tue, 24 Feb 2026 22:53:50 +0100
Subject: [PATCH] Improved HTML sandbox page

---
 templates/attachments/html_sandbox.html.twig |  7 +++++--
 translations/messages.en.xlf                 | 12 ++++++++++++
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/templates/attachments/html_sandbox.html.twig b/templates/attachments/html_sandbox.html.twig
index 6706da7d..11367bdf 100644
--- a/templates/attachments/html_sandbox.html.twig
+++ b/templates/attachments/html_sandbox.html.twig
@@ -4,8 +4,10 @@
     <meta charset="UTF-8">
     <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
 
+    <link rel="icon" href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><text y='.9em' font-size='90'>️⚠️️</text></svg>">
+
     {# The content block is already escaped. so we must not escape it again. #}
-    <title></title>
+    <title>{% trans %}attachment.sandbox.title{% endtrans %}: {{ attachment.filename }}</title>
 
     <style>
         /* Reset margins and stop the page from scrolling */
@@ -54,7 +56,8 @@
 
                 <br>
                 <small>
-                    {% trans%}[Attachment]{% endtrans%}: {{ attachment.name }} /  {{ attachment.filename ?? "" }} ({% trans%}id.label{% endtrans %}: {{ attachment.id }})
+                    {% trans%}[Attachment]{% endtrans%}: <b>{{ attachment.name }}</b> /  <b>{{ attachment.filename ?? "" }}</b> ({% trans%}id.label{% endtrans %}: {{ attachment.id }})
+                    <a href="{{ path("attachment_view", {id: attachment.id}) }}" style="color: white; margin-left: 15px;">{% trans%}attachment.sandbox.as_plain_text{% endtrans %}</a>
                     <a href="{{ path("homepage") }}" style="color: white; margin-left: 15px;">{% trans%}attachment.sandbox.back_to_partdb{% endtrans %}</a>
                 </small>
             </header>
diff --git a/translations/messages.en.xlf b/translations/messages.en.xlf
index e8475aab..7bf613ae 100644
--- a/translations/messages.en.xlf
+++ b/translations/messages.en.xlf
@@ -12617,5 +12617,17 @@ Buerklin-API Authentication server:
         <target>⚠️ When enabled, user uploaded HTML attachments can be viewed directly in the browser. Many potential malicious functions are restricted, still this is a potential security risk and should only be enabled, if you trust the users who can upload files.</target>
       </segment>
     </unit>
+    <unit id="BQo2xWi" name="attachment.sandbox.title">
+      <segment>
+        <source>attachment.sandbox.title</source>
+        <target>HTML [Attachment]</target>
+      </segment>
+    </unit>
+    <unit id="sJ6v9uJ" name="attachment.sandbox.as_plain_text">
+      <segment>
+        <source>attachment.sandbox.as_plain_text</source>
+        <target>View as plain text</target>
+      </segment>
+    </unit>
   </file>
 </xliff>