golem15/summercms
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs(17): match fix report headings to the review titles

Browse Source
This commit is contained in:
Jakub Zych
2026-10-12 21:50:05 +02:00
parent e990524732
commit 8e55dc2837
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
.planning/phases/17-blog-companions/17-REVIEW-FIX.md
View File

@@ -26,7 +26,7 @@ Paths outside `summercms.go` are relative to `/media/nvme/dev/golem15/summercms.
## Fixed Issues
### CR-01: Sitemap writes admin-supplied `javascript:` URLs into `<loc>` (stored XSS)
### CR-01: Sitemap writes admin-supplied `javascript:` URLs into `<loc>`, which sitemap.xsl renders as a clickable link on the public origin (stored XSS)
**Files modified:**
- `summercms.go`: `modules/signpost/signpost.go`, `modules/signpost/signpost_test.go`, `modules/signpost/README.md`, `docs/plugins/menu-item-types.md`
@@ -45,7 +45,7 @@ Paths outside `summercms.go` are relative to `/media/nvme/dev/golem15/summercms.
- **Framework.** `signpost.Registry.Pattern` now ignores an item override that is not a path: it must start with a single `/`, with no `//` or `/\` prefix, no surrounding whitespace and no control characters. The next layer then applies. The new helper `signpost.ValidItemPattern` is documented in the README and in `docs/plugins/menu-item-types.md`.
- **Design choice.** The review's `allowedSitemapURL` would also have refused relative paths such as `about`. That would reject PHP data that worked, so the rule I applied is wider: a relative or `/` path, or an absolute `http`/`https` URL. Any other scheme is refused, and so are protocol-relative `//host` and `/\host`, a bare `#fragment`, surrounding whitespace and control characters. `//evil.test/x` cannot leave the site, because `Url::to` puts it under the root host.
### WR-01: Moving a menu entry to another menu orphans its subtree; a parent from another menu overrides the chosen menu
### WR-01: Moving a menu entry to another menu orphans its subtree, and a parent from another menu silently overrides the chosen menu
**Files modified:** `sm-menu-plugin`: `models/menu_entry.go`, `controllers/menuentries.go`, `lang/en/lang.yaml`, `lang/pl/lang.yaml`, `README.md`, `menu_smoke_test.go`
**Commit:** `7255d34` (sm-menu-plugin)
@@ -56,7 +56,7 @@ Paths outside `summercms.go` are relative to `/media/nvme/dev/golem15/summercms.
- **UI text.** The `menu_comment` help text explains both behaviours.
- **Design choice.** I chose refusal over scoping the parent options, because `RelationExtendOptionsQuery` gets no record context.
### WR-02: Reorder page sends overlapping saves; out-of-order completion leaves an older tree
### WR-02: Reorder page sends overlapping saves; out-of-order completion leaves the database on an older tree than the screen shows
**Files modified:** `summercms.go`: `admin/src/views/ReorderView.vue`, `admin/tests/views/ReorderView.test.ts`, `docs/backend/lists-and-filters.md`
**Commits:** `e1ac983`, plus `27bb13b` (dist rebuild)
@@ -67,7 +67,7 @@ Paths outside `summercms.go` are relative to `/media/nvme/dev/golem15/summercms.
- **Failures.** A failed save does not restore the old tree if a later save is waiting or a move is still in its 400 ms debounce, because that later save carries the whole tree. A 409 drops a queued save of the same set and reloads.
- **Tests.** Two new specs cover a failure with a queued move and a late response after a partition switch. Both fail against the old code.
### WR-03: A registry menu entry or sitemap row saved without a reference passes validation and then disappears
### WR-03: A registry menu entry or sitemap row saved without a reference passes validation and then silently disappears
**Files modified:**
- `sm-menu-plugin`: `controllers/menuentries.go`, `lang/en/lang.yaml`, `lang/pl/lang.yaml`, `README.md`, `menu_smoke_test.go`
@@ -80,7 +80,7 @@ Paths outside `summercms.go` are relative to `/media/nvme/dev/golem15/summercms.
- **Sitemap rows.** The definitions controller refuses the same case per row (`data.<i>.reference`). It reuses the PHP phrase `golem15.sitemap::lang.item.reference_required`.
- **Not changed.** `cabana.amongOptions` is left as it is. Required-ness is per type, which the plugins know and cabana does not.
### WR-04: `journal-post` resolves unpublished posts, exposing drafts on the anonymous menu API and in sitemap.xml
### WR-04: `journal-post` resolves unpublished posts, exposing draft titles and URLs on the anonymous menu API and in sitemap.xml
**Files modified:** `sm-journal-plugin`: `classes/menu_item_types.go`, `menu_item_types_test.go`, `menu_item_types_smoke_test.go`, `README.md`
**Commit:** `31d901c` (sm-journal-plugin)