Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

do not let a page become a child of itself #4726

Merged
merged 2 commits into from
Sep 20, 2024
Merged

do not let a page become a child of itself #4726

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a341939
do not let a page become a child of itself
boutell Sep 12, 2024
fafd5ec
Merge branch 'main' into pro-6585
boutell Sep 20, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@

### Fixes

* The `@apostrophecms/page` module APIs no longer allow a page to become a child of itself. Thanks to [Maarten Marx](https://github.com/Pixelguymm) for reporting the issue.
* Uploaded SVGs now permit `<use>` tags granted their `xlink:href` property is a local reference and begins with the `#` character. This improves SVG support while mitgating XSS vulnerabilities.
* Default properties of object fields present in a widget now populate correctly even if never focused in the editor.

Expand Down
4 changes: 4 additions & 0 deletions modules/@apostrophecms/page/index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1458,6 +1458,10 @@ database.`);
const manager = self.apos.doc.getManager(moved.type);
await manager.emit('beforeMove', req, moved, target, position);
determineRankAndNewParent();
// Simple check to see if we are moving the page beneath itself
if (parent.path.split('/').includes(moved.aposDocId)) {
throw self.apos.error('forbidden', 'Cannot move a page under itself');
}
if (!moved._edit) {
throw self.apos.error('forbidden');
}
Expand Down
10 changes: 10 additions & 0 deletions test/pages.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -421,6 +421,16 @@ describe('Pages', function() {
assert.strictEqual(page.rank, 1);
});

it('is not able to move a page under itself', async function() {
await assert.rejects(
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Love that assert.rejects need to use it more, it's very awkward to write this kind of test correctly otherwise, often done wrong

apos.page.move(apos.task.getReq(), 'cousin:en:published', 'cousin:en:published', 'lastChild'),
{
name: 'forbidden',
message: 'Cannot move a page under itself'
}
);
});

it('is able to move root/cousin before root/parent/child', async function() {
// 'Cousin' _id === 4312
// 'Child' _id === 2341
Expand Down
Loading