golem15/summercms
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(10.1-02): render header and form partials through an allowlisted node renderer

Browse Source 
- partialNodes rebuilds the server node tree with h() under the server's tag, attribute and URL lists
- PartialHost owns the skeleton, empty and failure states and keeps nodes visible on refetch
- type: partial is a valueless group-labelled field rendered on create and update
- ListView shows headerPartial above the list card and refetches it after bulk delete
- summer-partial and summer-stats style kit in main.css, documented in the cabana README; dist rebuilt
This commit is contained in:
Jakub Zych
2026-09-29 02:10:18 +02:00
parent 107d820109
commit 9df9fae930
20 changed files with 870 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

151
admin/tests/fixtures/extension.partial.json vendored Normal file
View File

@@ -0,0 +1,151 @@
{
"data": {
"nodes": [
{
"tag": "dl",
"attrs": {
"class": "summer-stats"
},
"children": [
{
"tag": "div",
"attrs": {
"class": "summer-stat"
},
"children": [
{
"tag": "dt",
"attrs": {
"class": "summer-stat__label"
},
"children": [
{
"text": "All widgets"
}
]
},
{
"tag": "dd",
"attrs": {
"class": "summer-stat__value"
},
"children": [
{
"text": "12"
}
]
}
]
},
{
"tag": "div",
"attrs": {
"class": "summer-stat"
},
"children": [
{
"tag": "dt",
"attrs": {
"class": "summer-stat__label"
},
"children": [
{
"text": "Small"
}
]
},
{
"tag": "dd",
"attrs": {
"class": "summer-stat__value"
},
"children": [
{
"text": "5"
}
]
}
]
}
]
},
{
"tag": "script",
"children": [
{
"text": "window.hijacked = true"
}
]
},
{
"tag": "p",
"attrs": {
"id": "hijack",
"style": "color:red",
"data-note": "kept"
},
"children": [
{
"tag": "a",
"attrs": {
"href": "javascript:alert(1)",
"onclick": "alert(1)",
"class": "danger-link"
},
"children": [
{
"text": "Unsafe link"
}
]
},
{
"text": " "
},
{
"tag": "a",
"attrs": {
"href": "/admin-test/acme/demo/widgets",
"title": "All widgets"
},
"children": [
{
"text": "Safe link"
}
]
},
{
"text": " "
},
{
"tag": "a",
"attrs": {
"href": "//evil.example.test/x"
},
"children": [
{
"text": "Protocol-relative link"
}
]
}
]
},
{
"tag": "custom-box",
"children": [
{
"tag": "p",
"attrs": {
"class": "unwrapped"
},
"children": [
{
"text": "Use <b>bold</b> & <i>italic</i>"
}
]
}
]
}
]
},
"meta": {}
}