Skip to content

Render stored values as text and tighten content embeds - #742

Merged
justinaskav merged 2 commits into
fix/duty-pickerfrom
fix/xss-sinks
Nov 6, 2026
Merged

justinaskav merged 2 commits into
fix/duty-pickerfrom
fix/xss-sinks

Conversation

@justinaskav

Copy link
Copy Markdown
Member

Stored values are rendered as text, and embedded content is tightened.

  • Notification bodies (card, bell, toast), Gantt tooltips and search result summaries render as plain text. HTML-to-text helpers parse inertly.
  • Rich-content blocks: every field shown as HTML is normalised on save through an explicit per-type map, plus the existing generic html pass. A migration re-normalises existing content parts (timestamps preserved; not reversible).
  • Spotify, Mixcloud and social embeds accept only https URLs on the provider hosts, validated on save and resolved on render; unsupported URLs render nothing.

Who made what: Codex wrote the change and tests; Claude reviewed it, restored the generic html pass, and ran Pest, Vitest and Pint.

Check by hand: Spotify/Mixcloud/Facebook/Instagram blocks still play; notification bell and toast on a phone; the Gantt tooltip on the representation timeline.

Deploy: runs one data migration over content_parts.

🤖 Generated with Claude Code

@justinaskav
justinaskav added this pull request to stack #747 November 6, 2026 20:35
@codecov

codecov Bot commented Nov 6, 2026 •

Copy link
Copy Markdown

Bundle Report

Changes will decrease total bundle size by 519 bytes (-0.01%) ⬇️. This is within the configured threshold ✅

Detailed changes
Bundle name Size Change
vusa-frontend-esm 7.84MB -519 bytes (-0.01%) ⬇️

Affected Assets, Files, and Routes:

view changes for bundle: vusa-frontend-esm

Assets Changed:

Asset Name Size Change Total Size Change (%)
assets/RichContentFormElement-*.js -65 bytes 170.41kB -0.04%
assets/TimelineGanttChart-*.js 35 bytes 91.04kB 0.04%
assets/AdminLayout-*.js -26 bytes 79.87kB -0.03%
assets/ShowInstitution-*.js -34 bytes 32.2kB -0.11%
assets/Search-*.js -69 bytes 16.82kB -0.41%
assets/RCSpotifyEmbed-*.js 85 bytes 8.73kB 0.98%
assets/ShowNotifications-*.js -26 bytes 7.88kB -0.33%
assets/String-*.js 151 bytes 4.58kB 3.41%
assets/RCSocialEmbed-*.js -279 bytes 4.18kB -6.26%
assets/SocialEmbedPreview-*.js -2 bytes 3.53kB -0.06%
assets/matches-*.js -99 bytes 3.2kB -3.0%
assets/NotificationToast-*.js -26 bytes 1.56kB -1.64%
assets/embedUrl-*.js -230 bytes 1.25kB -15.53%
assets/html-*.js 66 bytes 198 bytes 50.0% ⚠️

Files in assets/RichContentFormElement-*.js:

  • ./resources/js/Components/RichContent/Editor/blockSummary.ts → Total Size: 3.67kB

Files in assets/TimelineGanttChart-*.js:

  • ./resources/js/Components/Graphs/renderers/GanttTooltip.ts → Total Size: 9.55kB

  • ./resources/js/Components/Graphs/renderers/renderActivityRequests.ts → Total Size: 3.98kB

Files in assets/AdminLayout-*.js:

  • ./resources/js/Components/NotificationsIndicator.vue → Total Size: 244 bytes

Files in assets/ShowInstitution-*.js:

  • ./resources/js/Components/Public/ContactWithPhoto.vue → Total Size: 148 bytes

Files in assets/Search-*.js:

  • ./resources/js/Components/Public/Search/UnifiedResultItem.vue → Total Size: 158 bytes

Files in assets/RCSpotifyEmbed-*.js:

  • ./resources/js/Components/RichContent/RCSpotifyPromoDisplay.vue → Total Size: 168 bytes

  • ./resources/js/Components/RichContent/RCSpotifyEmbed.vue → Total Size: 147 bytes

  • ./resources/js/Components/RichContent/RCMixcloudEmbed.vue → Total Size: 150 bytes

Files in assets/RCSocialEmbed-*.js:

  • ./resources/js/Components/RichContent/RCSocialEmbed.vue → Total Size: 229 bytes

Files in assets/SocialEmbedPreview-*.js:

  • ./resources/js/Components/RichContent/Types/SocialEmbedPreview.vue → Total Size: 250 bytes

Files in assets/NotificationToast-*.js:

  • ./resources/js/Components/Notifications/NotificationToast.vue → Total Size: 158 bytes

@codecov

codecov Bot commented Nov 6, 2026 •

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 93.06931% with 7 lines in your changes missing coverage. Please review.
✅ All tests successful. No failed tests found.

Files with missing lines Patch % Lines
...omponents/RichContent/Types/SocialEmbedPreview.vue 42.85% 4 Missing ⚠️
app/Rules/ContentEmbedUrl.php 85.71% 2 Missing ⚠️
...ces/js/Components/Graphs/renderers/GanttTooltip.ts 80.00% 0 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

@justinaskav
justinaskav removed this pull request from stack #747 November 6, 2026 20:46
@justinaskav
justinaskav changed the base branch from dev to fix/duty-picker November 6, 2026 20:46
@justinaskav
justinaskav added this pull request to stack #748 November 6, 2026 20:47
justinaskav and others added 2 commits November 6, 2026 22:49
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@justinaskav
justinaskav merged commit 0446af0 into dev Nov 6, 2026
30 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant