summercms

Files

Jakub Zych 6b0ac15086 fix(10.1-04): refuse percent-encoded dot segments in plugin asset URLs

The URL parser resolves %2e%2e like .., so /{base}/assets/%2e%2e/api/...
passed assetAllowed and would load from outside the asset prefix. A
segment is now a dot segment after decoding %2e, in any case.

- tests/app/pluginAssets.test.ts covers the URL check, loadScript,
  loadStyles, activateStyles and loadControllerAssets
- modules/boardwalk/dist rebuilt

2026-09-29 02:52:14 +02:00

app

fix(10.1-04): refuse percent-encoded dot segments in plugin asset URLs

2026-09-29 02:52:14 +02:00

fixtures

feat(10.1-02): run registered toolbar actions and scope plugin CSS per controller

2026-09-29 02:13:26 +02:00

form

test(10-05): bring every SPA module, composable and component under Vitest

2026-09-27 17:53:57 +02:00

list

test(10-05): bring every SPA module, composable and component under Vitest