[#40359] - [5.0] Joomla Dialog for Aricles, Categories batch and Finder Index with Statistic
- Fixed in Code Base
- 5 Sep 2023
- Medium
- Build: 5.0-dev
- # 40359
- Diff
- Fedik:popup-batch
User tests: Successful: Unsuccessful:
Summary of Changes
An implementation of Joomla Dialog for for Aricles, Categories batch and Finder Index with Statistic.
Depends from #40150
It works but not fully finished.
It still will be need some stilyng for batch modals and solution for 'onclose' ?
Testing Instructions
Apply patch then apply #40150, run npm install.
Check Article, Categories batch, and Finder Index wtih Statistic popups. Versions popup
Actual result BEFORE applying this Pull Request
Works
Expected result AFTER applying this Pull Request
Works
Link to documentations
Please select:
- Documentation link for docs.joomla.org:
- No documentation changes for docs.joomla.org needed
- Pull Request link for manual.joomla.org: joomla/Manual#184
- No documentation changes for manual.joomla.org needed
joomla-cms-bot
- | Category | ⇒ | Administration com_content com_finder Repository NPM Change Layout Libraries |
| Status | New | ⇒ | Pending |
| Labels |
Added:
NPM Resource Changed
PR-5.0-dev
|
||
| Category | Administration com_content com_finder Repository NPM Change Layout Libraries | ⇒ | Administration com_content com_finder Repository NPM Change JavaScript Layout Libraries |
That needs to be killed, it's not CSP strict ...
I am fine with removing.
I have fixed it for Finder, however it still may be an issue for extensions.
however it still may be an issue for extensions.
If Joomla is serious about security, those vectors should be removed. My 2c
| Category | Administration com_content com_finder Repository NPM Change Layout Libraries JavaScript | ⇒ | Administration com_categories com_content com_finder Repository NPM Change JavaScript Layout Libraries |
| Labels |
Added:
?
|
||
| Title |
|
||||||
| Title |
|
||||||
| Labels |
Added:
Feature
Removed: ? |
||
i think the b/c plugin still has a reference to this es5?
hmhm, what to reference?
hmm I think I comment on the wrong PR
| Status | Pending | ⇒ | Fixed in Code Base |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2023-09-05 06:48:30 |
| Closed_By | ⇒ | HLeithner |
thanks, documentation update please
There it is joomla/Manual#184
That needs to be killed, it's not CSP strict and by default it's an XSS vulnerability as users could execute any arbitrary code using that event. In sort all the inline events should be considered harmful and removed ASAP...