From 675e21d886bbab10485e0e962ae23f88a54f6954 Mon Sep 17 00:00:00 2001
From: JonKazama-Hellion <f.wathling@gmail.com>
Date: Thu, 16 Apr 2026 20:33:38 +0200
Subject: [PATCH] fix(release): fehlende Versionsnummern + bgUrl-Validierung

Drei Stellen hatten noch '2.0.0' statt '2.0.1': newtab.html About-Sektion,
data.js Export und app.js Backup-Export. FileReader-Upload in settings.js
validiert jetzt bgUrl via isValidBgUrl() (Defense-in-Depth).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 newtab.html        | 2 +-
 src/js/app.js      | 2 +-
 src/js/data.js     | 2 +-
 src/js/settings.js | 1 +
 4 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/newtab.html b/newtab.html
index ee988e6..df339a3 100644
--- a/newtab.html
+++ b/newtab.html
@@ -223,7 +223,7 @@
     <div class="panel-footer">
       <div class="about-block">
         <div class="about-logo" data-i18n="about.title">⬡ HELLION NEWTAB</div>
-        <div class="about-version">Version 2.0.0 · by Hellion Online Media</div>
+        <div class="about-version">Version 2.0.1 · by Hellion Online Media</div>
 
         <div class="about-links">
           <a href="https://hellion-media.de/impressum" target="_blank" class="about-link">
diff --git a/src/js/app.js b/src/js/app.js
index 920a9cd..9e143e4 100644
--- a/src/js/app.js
+++ b/src/js/app.js
@@ -105,7 +105,7 @@ async function checkBackupReminder() {
     const notesData = (widgetData && Array.isArray(widgetData.notes)) ? widgetData.notes : [];
     const calcHistory = (widgetData && widgetData.calculator) ? widgetData.calculator.history || [] : [];
     const timerPresets = (widgetData && widgetData.timer) ? widgetData.timer.presets || [] : [];
-    const data = { version: '2.0.0', exported: new Date().toISOString(), boards, settings, notes: notesData, calculator: calcHistory, timerPresets };
+    const data = { version: '2.0.1', exported: new Date().toISOString(), boards, settings, notes: notesData, calculator: calcHistory, timerPresets };
     const blob = new Blob([JSON.stringify(data, null, 2)], { type: 'application/json' });
     const url  = URL.createObjectURL(blob);
     const a    = document.createElement('a');
diff --git a/src/js/data.js b/src/js/data.js
index 46ff12c..4b7c14a 100644
--- a/src/js/data.js
+++ b/src/js/data.js
@@ -28,7 +28,7 @@ function initDataButtons() {
   btnExport.addEventListener('click', async () => {
     const widgetData = await Store.get('widgetStates');
     const data = {
-      version: '2.0.0',
+      version: '2.0.1',
       exported: new Date().toISOString(),
       boards,
       settings,
diff --git a/src/js/settings.js b/src/js/settings.js
index 9a9d50d..b74e276 100644
--- a/src/js/settings.js
+++ b/src/js/settings.js
@@ -200,6 +200,7 @@ function bindSettingsEvents() {
     if (!file) return;
     const reader = new FileReader();
     reader.onload = async ev => {
+      if (!isValidBgUrl(ev.target.result)) return;
       settings.bgUrl = ev.target.result;
       document.getElementById('bgLayer').style.backgroundImage = `url('${ev.target.result}')`;
       await saveSettings();