- Settings.BeforeValidate answers a cabana validation error on
frontend_url, so the settings save is a 422 and the row is unchanged
- sitemap:import-winter stops on a frontend_url that
models.AllowedFrontendURL refuses, before the dry-run branch and before
any database use; the value is printed quoted
- errors.frontend_url phrase in en and pl
- TestSettingsBeforeValidate, TestWinterSettingsFrontendURL and the save
and import refusals in the Postgres smokes
- models.AllowedFrontendURL: empty, or an absolute http(s) URL with a host
and without whitespace, control characters, a double quote, <, > or &
- classes.Rewrite leaves the document unchanged for a refused value,
inserts through EscapeText/EscapeAttr and keeps a loc or href that would
not stay an http(s) URL
- TestRewriteUnsafeFrontendURL, TestAllowedFrontendURL and a stored-row
check in TestSitemapImportSmoke
The anonymous route resolved every registry item on each request with no
throttle and no cache.
- surf bucket sitemap-xml: 60 requests a minute per client IP.
- The generated XML is cached for golem15.sitemap.cache_seconds (default
60, 0 off), keyed by root URL, definition and settings so a save shows
at once; one generation runs at a time.
A registry row saved without a reference resolved to nothing and was
left out of /sitemap.xml without a word. The definitions form now
refuses it on the row (data.<i>.reference, item.reference_required).
The admin smoke test also covers the CR-01 row refusals.
A url item stored as javascript://%0aalert(1)%0a//x passed Url::to and
reached <loc>, which sitemap.xsl renders as a link on the site origin.
- The definitions form refuses, per row, a url that is not a path or an
http(s) URL (classes.AllowedItemURL) and a urlPattern that is not a
path (signpost.ValidItemPattern), keyed data.<i>.url / .urlPattern.
- Generator.addItem drops a loc or alternate that is not http(s).
- sitemap:import-winter drops such url items and clears such patterns
with a report line; sitemap:import refuses such an entry.
- a Winter cms-page or static-page item whose reference is named by
--page-url reference=/path becomes a url item with that URL (reported
as remapped) instead of being dropped
- smoke test and README cover the flag
- definitions singleton controller (theme default, first or create) with a
repeater on data: type dropdown (url plus registry types), reference
dependsOn type through signpost.ReferenceOptions
- Settings page entries: Sitemap (link to the controller) and Sitemap
settings (form), both behind golem15.sitemap.access_definitions
- en and pl phrasebooks with the PHP keys
- README with the PHP parity rules, tiers, hooks, commands and the Winter
YAML adaptations
- TestSitemapAdminSmoke: singleton, PHP-keyed rows, 422 on a foreign
reference, settings save, 403 without the permission
