style(ui): portlet search boxes, import dialogs and content compare fixes#35341
style(ui): portlet search boxes, import dialogs and content compare fixes#35341
Conversation
…ixes - Set min-width w-80 consistently on all portlet search inputs (categories, tags, locales, plugins) - Simplify search placeholder text to "Search" across all four portlets - Unify dot-categories-import file upload template to match tags/plugins dropzone UI - Put import type radio buttons on the same row to reduce vertical overflow - Fix dot-content-compare previous version dropdown not showing selected value on load Closes #35274 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
Claude finished @hmoreras's task in 2m 38s —— View job PR Review
Three issues worth addressing: 1. Orphaned i18n key (
2. No way to deselect a file in the categories import dialog ( The old <p-button icon="pi pi-times" ... (onClick)="onFileClear()" ... />The new template drops it. Once a file is selected, users can replace it (re-click) but cannot return to the empty state — which disables the Import button via 3. Clickable dropzone div is not keyboard-accessible ( <div ... (click)="fileUpload.choose()">This div acts as a button but has no Everything else is clean. The |
github-actions
bot
added
Area : Backend
Verify that data.compare is shown as the selected version in the previous versions dropdown on first load. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
github-actions
bot
removed
Area : Documentation
hmoreras
removed
AI: Not Safe To Rollback
Area : Backend
hmoreras
requested review from
adrianjm-dotCMS,
dario-daza,
nicobytes,
oidacra and
zJaaal
|
Semgrep found 1 The application builds a file path from potentially untrusted data, which can lead to a path traversal vulnerability. An attacker can manipulate the path which the application uses to access files. If the application does not validate user input and sanitize file paths, sensitive files such as configuration or user data can be accessed, potentially creating or overwriting files. To prevent this vulnerability, validate and sanitize any input that is used to create references to file paths. Also, enforce strict file access controls. For example, choose privileges allowing public-facing applications to access only the required files. In Java, you may also consider using a utility method such as View Dataflow Graphflowchart LR
classDef invis fill:white, stroke: none
classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none
subgraph File0["<b>dotCMS/src/main/java/com/dotcms/rest/ContentResource.java</b>"]
direction LR
%% Source
subgraph Source
direction LR
v0["<a href=https://github.com/dotCMS/core/blob/ad334edd1e549f78c1c61c89b1e55957b8f45512/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1424 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1424] multipart</a>"]
end
%% Intermediate
subgraph Traces0[Traces]
direction TB
v2["<a href=https://github.com/dotCMS/core/blob/ad334edd1e549f78c1c61c89b1e55957b8f45512/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1424 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1424] multipart</a>"]
v3["<a href=https://github.com/dotCMS/core/blob/ad334edd1e549f78c1c61c89b1e55957b8f45512/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1428 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1428] multipartPUTandPOST</a>"]
v4["<a href=https://github.com/dotCMS/core/blob/ad334edd1e549f78c1c61c89b1e55957b8f45512/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1484 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1484] multipart</a>"]
v5["<a href=https://github.com/dotCMS/core/blob/ad334edd1e549f78c1c61c89b1e55957b8f45512/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1499 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1499] part</a>"]
v6["<a href=https://github.com/dotCMS/core/blob/ad334edd1e549f78c1c61c89b1e55957b8f45512/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1499 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1499] part</a>"]
v7["<a href=https://github.com/dotCMS/core/blob/ad334edd1e549f78c1c61c89b1e55957b8f45512/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1581 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1581] processFile</a>"]
v8["<a href=https://github.com/dotCMS/core/blob/ad334edd1e549f78c1c61c89b1e55957b8f45512/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1613 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1613] part</a>"]
v9["<a href=https://github.com/dotCMS/core/blob/ad334edd1e549f78c1c61c89b1e55957b8f45512/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1616 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1616] badFileName</a>"]
v10["<a href=https://github.com/dotCMS/core/blob/ad334edd1e549f78c1c61c89b1e55957b8f45512/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1617 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1617] filename</a>"]
end
v2 --> v3
v3 --> v4
v4 --> v5
v5 --> v6
v6 --> v7
v7 --> v8
v8 --> v9
v9 --> v10
%% Sink
subgraph Sink
direction LR
v1["<a href=https://github.com/dotCMS/core/blob/ad334edd1e549f78c1c61c89b1e55957b8f45512/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1632 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1632] tmpFolder.getAbsolutePath() + File.separator + filename</a>"]
end
end
%% Class Assignment
Source:::invis
Sink:::invis
Traces0:::invis
File0:::invis
%% Connections
Source --> Traces0
Traces0 --> Sink
If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 1
Detected user input controlling a file path. An attacker could control the location of this file, to include going backwards in the directory with '../'. To address this, ensure that user-controlled variables in file paths are sanitized. You may also consider using a utility method such as org.apache.commons.io.FilenameUtils.getName(...) to only retrieve the file name from the path. View Dataflow Graphflowchart LR
classDef invis fill:white, stroke: none
classDef default fill:#e7f5ff, color:#1c7fd6, stroke: none
subgraph File0["<b>dotCMS/src/main/java/com/dotcms/rest/ContentResource.java</b>"]
direction LR
%% Source
subgraph Source
direction LR
v0["<a href=https://github.com/dotCMS/core/blob/ad334edd1e549f78c1c61c89b1e55957b8f45512/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1424 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1424] multipart</a>"]
end
%% Intermediate
subgraph Traces0[Traces]
direction TB
v2["<a href=https://github.com/dotCMS/core/blob/ad334edd1e549f78c1c61c89b1e55957b8f45512/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1424 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1424] multipart</a>"]
v3["<a href=https://github.com/dotCMS/core/blob/ad334edd1e549f78c1c61c89b1e55957b8f45512/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1428 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1428] multipartPUTandPOST</a>"]
v4["<a href=https://github.com/dotCMS/core/blob/ad334edd1e549f78c1c61c89b1e55957b8f45512/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1484 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1484] multipart</a>"]
v5["<a href=https://github.com/dotCMS/core/blob/ad334edd1e549f78c1c61c89b1e55957b8f45512/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1499 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1499] part</a>"]
v6["<a href=https://github.com/dotCMS/core/blob/ad334edd1e549f78c1c61c89b1e55957b8f45512/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1499 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1499] part</a>"]
v7["<a href=https://github.com/dotCMS/core/blob/ad334edd1e549f78c1c61c89b1e55957b8f45512/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1581 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1581] processFile</a>"]
v8["<a href=https://github.com/dotCMS/core/blob/ad334edd1e549f78c1c61c89b1e55957b8f45512/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1613 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1613] part</a>"]
v9["<a href=https://github.com/dotCMS/core/blob/ad334edd1e549f78c1c61c89b1e55957b8f45512/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1616 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1616] badFileName</a>"]
v10["<a href=https://github.com/dotCMS/core/blob/ad334edd1e549f78c1c61c89b1e55957b8f45512/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1617 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1617] filename</a>"]
end
v2 --> v3
v3 --> v4
v4 --> v5
v5 --> v6
v6 --> v7
v7 --> v8
v8 --> v9
v9 --> v10
%% Sink
subgraph Sink
direction LR
v1["<a href=https://github.com/dotCMS/core/blob/ad334edd1e549f78c1c61c89b1e55957b8f45512/dotCMS/src/main/java/com/dotcms/rest/ContentResource.java#L1631 target=_blank style='text-decoration:none; color:#1c7fd6'>[Line: 1631] new File(<br> tmpFolder.getAbsolutePath() + File.separator + filename)</a>"]
end
end
%% Class Assignment
Source:::invis
Sink:::invis
Traces0:::invis
File0:::invis
%% Connections
Source --> Traces0
Traces0 --> Sink
If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. |
|
Semgrep found 2 Risk: Affected versions of next are vulnerable to Allocation of Resources Without Limits or Throttling. A specially crafted HTTP request to a Next.js App Router Server Function endpoint can trigger excessive CPU consumption during React Server Components deserialization, leading to denial of service. Fix: Upgrade this library to at least version 15.5.15 at core/core-web/yarn.lock:17765. Reference(s): GHSA-q4gf-8mx6-v5v3 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 2 Risk: Affected versions of vite are vulnerable to Exposure of Sensitive Information to an Unauthorized Actor / Missing Authentication for Critical Function. This occurs because the Vite Dev Server WebSocket improperly exposes the fetchModule method, allowing unauthenticated remote attackers to bypass filesystem restrictions and read arbitrary files from the host machine Manual Review Advice: A vulnerability from this advisory is reachable if you enable vite dev server using Fix: Upgrade this library to at least version 7.3.2 at core/core-web/yarn.lock:22638. Reference(s): GHSA-p9ff-h696-f583, CVE-2026-39363 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 2 Risk: Affected versions of vite are vulnerable to Improper Access Control / Incorrect Behavior Order. Vite's dev server can bypass Manual Review Advice: A vulnerability from this advisory is reachable if you enable vite dev server using Fix: Upgrade this library to at least version 7.3.2 at core/core-web/yarn.lock:22638. Reference(s): GHSA-v2wj-q39q-566r, CVE-2026-39364 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 2
Risk: Affected versions of handlebars are vulnerable to Improper Control of Generation of Code ('Code Injection') / Improper Encoding or Escaping of Output / Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). The Handlebars CLI precompiler allows arbitrary JavaScript injection by embedding unescaped template filenames and CLI option values such as Manual Review Advice: A vulnerability from this advisory is reachable if you execute templates through the Handlebars CLI precompiler Fix: Upgrade this library to at least version 4.7.9 at core/dotcms-postman/yarn.lock:303. Reference(s): GHSA-xjpj-3mr7-gcpf, CVE-2026-33941 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 2 Risk: Affected versions of @angular/compiler and @angular/core are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Angular's runtime/compiler can be vulnerable to XSS when a security-sensitive attribute (e.g., Manual Review Advice: A vulnerability from this advisory is reachable if you enable internationalization for the sensitive attribute by adding i18n- while it receives untrusted data Fix: Upgrade this library to at least version 21.2.4 at core/core-web/yarn.lock:560. Reference(s): GHSA-g93w-mfhg-p222, CVE-2026-32635 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 1 Risk: Affected versions of storybook are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') / Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') / Missing Origin Validation in WebSockets. Storybook's dev server WebSocket endpoint does not validate the Manual Review Advice: A vulnerability from this advisory is reachable if you visit a malicious website while your local Storybook dev server is running Fix: Upgrade this library to at least version 10.2.10 at core/core-web/yarn.lock:21348. Reference(s): GHSA-mjf5-7g4m-gx5w, CVE-2026-27148 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 1 Risk: Affected versions of rollup are vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Rollup is vulnerable to arbitrary file write via path traversal: chunk/asset names derived from user-controlled inputs (e.g., CLI named inputs, manual chunk aliases, or malicious plugins) are insufficiently sanitized, allowing Manual Review Advice: A vulnerability from this advisory is reachable if you are running Fix: Upgrade this library to at least version 4.59.0 at core/core-web/yarn.lock:20379. Reference(s): GHSA-mw96-cpmx-2vgc, CVE-2026-27606 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 2 Risk: Affected versions of next are vulnerable to Deserialization of Untrusted Data / Uncontrolled Resource Consumption. A flaw in React Server Components' deserialization allows an attacker to send a specially crafted HTTP request to any App Router Server Function endpoint in Next.js, triggering excessive CPU usage, out-of-memory conditions, or a server crash and resulting in a denial of service. Fix: Upgrade this library to at least version 15.0.8 at core/core-web/yarn.lock:17765. Reference(s): GHSA-h25m-26qc-wcjf, CVE-2026-23864 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 2 Risk: Affected versions of next are vulnerable to Dependency on Vulnerable Third-Party Component / Deserialization of Untrusted Data / Uncontrolled Resource Consumption. An attacker can send a specially crafted HTTP request to any Server Function endpoint (as used by Next.js' App Router) that, when deserialized by the React Server Components runtime, enters an infinite loop—hanging the server process, exhausting CPU, and resulting in a denial-of-service. Fix: Upgrade this library to at least version 14.2.35 at core/core-web/yarn.lock:17765. Reference(s): GHSA-5j59-xgg2-r9c4, CVE-2025-67779 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 2 Risk: Affected versions of next are vulnerable to Dependency on Vulnerable Third-Party Component / Deserialization of Untrusted Data / Uncontrolled Resource Consumption. A flaw in Next.js's App Router deserialization allows an attacker to send a specially crafted HTTP request body that, when parsed by the server, triggers excessive CPU work or an infinite loop. By targeting any App Router endpoint with this malicious payload, the server process can hang and become unresponsive, resulting in a denial-of-service. Fix: Upgrade this library to at least version 14.2.34 at core/core-web/yarn.lock:17765. Reference(s): GHSA-mwv6-3258-q52c If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 2
Risk: Affected versions of playwright are vulnerable to Improper Verification of Cryptographic Signature. The macOS browser reinstall scripts in Playwright use Fix: Upgrade this library to at least version 1.55.1 at core/e2e/dotcms-e2e-node/frontend/yarn.lock:904. Reference(s): GHSA-7mvr-c777-76hp, CVE-2025-59288 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 1 Risk: Affected versions of rollup are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Manual Review Advice: A vulnerability from this advisory is reachable if you use Rollup to bundle JavaScript with Fix: Upgrade this library to at least version 4.22.4 at core/core-web/yarn.lock:20379. Reference(s): GHSA-gcx4-mw62-g8wm, CVE-2024-47068 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 2 Risk: Affected versions of axios are vulnerable to Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') / Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') / Server-Side Request Forgery (SSRF). Axios can be used as a gadget for header injection: if another dependency enables prototype pollution, polluted properties can be merged into Axios request headers and written without CRLF sanitization, allowing request smuggling/SSRF that can reach internal services such as AWS IMDSv2 and potentially lead to credential theft or broader compromise. Fix: Upgrade this library to at least version 1.15.0 at core/core-web/yarn.lock:10238. Reference(s): GHSA-fvcv-3m26-pcqx, CVE-2026-40175 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 2 Risk: Affected versions of axios are vulnerable to Server-Side Request Forgery (SSRF) / Unintended Proxy or Intermediary ('Confused Deputy'). Axios does not normalize hostnames before applying Manual Review Advice: A vulnerability from this advisory is reachable if you have Fix: Upgrade this library to at least version 1.15.0 at core/core-web/yarn.lock:10238. Reference(s): GHSA-3p68-rc4w-qgx5, CVE-2025-62718 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. Semgrep found 1 Risk: webpack 5.x before 5.76.0 is vulnerable to Improper Access Control due to ImportParserPlugin.js mishandling the magic comment feature. Due to this, webpack does not avoid cross-realm object access and an attacker who controls a property of an untrusted object can obtain access to the real global object. Manual Review Advice: A vulnerability from this advisory is reachable if you host an application utilizing webpack and an attacker can control a property of an untrusted object Fix: Upgrade this library to at least version 5.76.0 at core/core-web/yarn.lock:23001. Reference(s): GHSA-hc6q-2mpp-qw7j, CVE-2023-28154 If this is a critical or high severity finding, please also link this issue in the #security channel in Slack. |
github-merge-queue
bot
removed this pull request from the merge queue due to failed status checks
2 participants
What does this PR do?
Addresses several UI inconsistencies across recently migrated portlets.
Changes
w-80(320px) width on all search inputs; simplified placeholder text toSearchacross all four portlets", such as...."text from the instructions copy, ending the sentence with a periodp-fileuploaddropzone template to match the tags/plugins pattern (icon, layout,#content-only approach); addedshrink-0to the icon container to prevent oval distortion when dialog space is constrained; put Import Type radio buttons on the same row (gap-3) to reduce vertical overflowp-selectdropdown not showing a selected value on first load by binding[ngModel]="data.compare"and addingdataKey="inode"for reliable object matchingCloses
Closes #35274