golem15/summercms
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(10.1-01): render header and form partials into an allowlisted node tree

Browse Source 
- fields.yaml type: partial with a bare path name and config_list.yaml
  headerPartial resolve to {ConfigDir}/_{name}.htm, parsed at boot; the
  controller must implement pact.AdminPartialData
- html/template render against a curated view model, then x/net/html
  ParseFragment and a tag, attribute and URL allowlist with 64 KiB, 2000-node
  and depth-32 caps; the model type and trusted template types are refused
- GET .../partials/{name} with optional ?id= loaded through the form scope
- golang.org/x/net becomes a direct requirement (D-18), no new module
This commit is contained in:
Jakub Zych
2026-09-28 23:52:50 +02:00
parent 8b1cb244de
commit 771d2ccce0
16 changed files with 850 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

162
admin/openapi/admin.json
View File

@@ -365,6 +365,21 @@
],
"type": "object"
},
"cabana.Envelope-cabana_PartialView": {
"properties": {
"data": {
"$ref": "#/components/schemas/cabana.PartialView"
},
"meta": {
"$ref": "#/components/schemas/cabana.SuccessMeta"
}
},
"required": [
"data",
"meta"
],
"type": "object"
},
"cabana.Envelope-cabana_RelationMutationResult": {
"properties": {
"data": {
@@ -509,6 +524,10 @@
},
"type": "array"
},
"path": {
"description": "Path names the controller partial of a `type: partial` field: the\ntemplate {ConfigDir}/_{path}.htm (D-09).",
"type": "string"
},
"readOnly": {
"type": "boolean"
},
@@ -897,6 +916,10 @@
},
"type": "array"
},
"headerPartial": {
"description": "HeaderPartial names the controller partial rendered above the list\n(config_list.yaml headerPartial, D-11).",
"type": "string"
},
"messages": {
"allOf": [
{
@@ -1041,6 +1064,43 @@
],
"type": "object"
},
"cabana.PartialNode": {
"properties": {
"attrs": {
"additionalProperties": {
"type": "string"
},
"type": "object"
},
"children": {
"items": {
"$ref": "#/components/schemas/cabana.PartialNode"
},
"type": "array"
},
"tag": {
"type": "string"
},
"text": {
"type": "string"
}
},
"type": "object"
},
"cabana.PartialView": {
"properties": {
"nodes": {
"items": {
"$ref": "#/components/schemas/cabana.PartialNode"
},
"type": "array"
}
},
"required": [
"nodes"
],
"type": "object"
},
"cabana.RecordEnvelope": {
"properties": {
"data": {
@@ -2531,6 +2591,108 @@
]
}
},
"/{vendor}/{plugin}/{controller}/partials/{name}": {
"get": {
"description": "Renders a declared header partial or form partial with html/template against the controller's view model and returns it as an allowlisted node tree: no HTML string. Without id the view model gets no record; id is accepted only for form partials and is loaded through the controller's form scope.",
"parameters": [
{
"description": "Vendor",
"in": "path",
"name": "vendor",
"required": true,
"schema": {
"type": "string"
}
},
{
"description": "Plugin",
"in": "path",
"name": "plugin",
"required": true,
"schema": {
"type": "string"
}
},
{
"description": "Controller",
"in": "path",
"name": "controller",
"required": true,
"schema": {
"type": "string"
}
},
{
"description": "Partial name",
"in": "path",
"name": "name",
"required": true,
"schema": {
"type": "string"
}
},
{
"description": "Record id for a form partial",
"in": "query",
"name": "id",
"schema": {
"type": "integer"
}
}
],
"responses": {
"200": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/cabana.Envelope-cabana_PartialView"
}
}
},
"description": "OK"
},
"401": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/cabana.ErrorEnvelope"
}
}
},
"description": "Unauthorized"
},
"403": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/cabana.ErrorEnvelope"
}
}
},
"description": "Forbidden"
},
"404": {
"content": {
"application/json": {
"schema": {
"$ref": "#/components/schemas/cabana.ErrorEnvelope"
}
}
},
"description": "Not Found"
}
},
"security": [
{
"BackendBearer": []
}
],
"summary": "Render a controller partial",
"tags": [
"admin"
]
}
},
"/{vendor}/{plugin}/{controller}/schema/form": {
"get": {
"parameters": [