Read user.badges.max.slots from config instead of hardcoded 5. InfoStand
layout adapts: 5 slots shows group badge, 6 slots replaces group with
6th badge. Double-click on InfoStand badge removes it. Badge received
toast now directly equips the badge via toggleBadge and closes.
New unseen badges pulse with a gold glow instead of a flat green
background. When a badge is received, a bubble notification appears
with the badge image, name, and a "Wear" button that opens inventory.
Fix slot 0 drag bug ('0' is falsy), prevent badge duplication from stale
props fallback in InfoStand, add sparse slot support, fix race condition
with pending server updates. Add drag preview, glow animations, drop
settle effect, and remove-badge indicator overlay.
dangerouslySetInnerHTML is needed for compatibility with existing
external_texts keys that contain HTML markup (e.g. <b>Created:</b>).
Only the missing friends count line is added.
- Remove dangerouslySetInnerHTML for creation date and last login fields
which caused corrupted display
- Use separate LocalizeText keys with safe React rendering instead
- Add missing friends count display
New external_texts keys required:
extendedprofile.created.title, extendedprofile.last.login.title,
extendedprofile.friends.count
- add the new :wired inspection/monitor panel with furni, user and global tabs
- add live variables, previews, inline editing and keep-selected behavior
- add global room diagnostics placeholders, monitor artwork and server/client timezone display
- add editor support for wf_xtra_text_output_furni_name and related UI texts/assets
- XSS fix: Created SanitizeHtml.ts utility using DOMPurify (already in package.json but never used). Wrapped all 21 dangerouslySetInnerHTML calls in catalog views with SanitizeHtml() — only allows safe tags (b, i, u, br, span, div, p, a, strong, em, img)
- Race condition fix: Added 10-second timeout fallbacks on purchase flags in CatalogPurchaseWidgetView and CatalogGiftView so the flag auto-resets even if the server never responds
Life