admin/raven
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

case 4719 - report templates no longer hold the renderer's token or download key

Browse Source 
The report page gets placeholders for the token and download key; request
interception (ReportApiRelay, now in every kind of install) puts the real
values only on the page's requests to ayApiUrl, then relays them (IIS) or
lets the browser continue. Requests to other addresses go out unchanged,
without credentials. Notification reports keep their rights. Report
scripting manual and changelog updated. F20 fixed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
John Cardinal
2026-10-25 20:04:55 -07:00
parent 2f616cba7a
commit a807693187
6 changed files with 85 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
devdocs/modernization/NET10-PORT.md
View File

@@ -186,7 +186,7 @@ John's "next release" cases for AyaNova (exported 2026-10-24). Each is its own s
| 4716 | Pick-list search text as SQL parameters | F18, and F43 (unit pick-list variant parsed as a number, found during 4712, test `FetchUnitPickListCustomerVariant`). **Done** (`@plq`/`@pltag` parameters; test `FetchUserPickListAutoCompleteApostrophe` fails on the old code, passes now; 9/9 pick-list tests) |
| 4717 | KPI interval allowlist | F26. **Done** (`KPIFetcher.DateTruncUnitOrNull` in the 7 KPIs reading `interval`; test `KpiInterval`) |
| 4718 | Report and translation import need create rights | F19, F24. **Done** (contact and Service 403, BizAdmin 202; test `ImportRights`) |
| 4719 | Report page network restricted; notification reports not run as SuperUser | F20 |
| 4719 | Report page network restricted; notification reports not run as SuperUser | F20. **Done**, plan changed with John: 1 report templates changeable only by BizAdmin (`2f616cba`, test `ReportEditRights`); 2 the page holds placeholders for the token and download key, the server adds the real ones only on requests to `ayApiUrl` (interception in every kind of install; test `ReportRenderCredentials`; 22 stock reports unchanged locally; IIS VM user and notification reports); outside addresses not blocked (customer templates may load their own content), notification reports keep their rights (customers write from reports). Visible: templates calling the API by another address need changing (manual and changelog); attachment links printed into reports carry no download key (manual only, John: such links pointed at 127.0.0.1 unless the override was set, so rarely worked) |
| 4720 | Restricted roles filtered in report/export data | F27. **Done** (partial fetch filtered like the full one; BizObjectFactory passed UserType.Service for everyone, now the real type; test `RestrictedReportData`) |
| 4721 | Client escaping of record text | F33. **Done** (raven-client: `escapeHtml` helper for the warranty summary; address dialog as text; search excerpt escaped with the terms highlighted as plain text; dialog messages through DOMPurify. The excerpt is not encoded on the server as well: the client escaping covers it. John checked search, warranty info with `<b>` in a vendor name, the address dialog and confirmation dialogs) |
| 4722 | DOMPurify and Vuetify upgrades (raven-client) | F34. **Done** (raven-client `44411ec1`: DOMPurify 2.5.9, Vuetify 2.7.2, builds on Node 12.22.9; Vuetify 2.7's calendar `eventSummary()` returns an element, so the six calendar event templates render it with a new `gz-vnodes` component instead of `v-html`. John checked wiki, schedules (drag, stretch, lock icons), date pickers, lists, dialogs and the reminder and review widgets. John also checked the scheduled work order widget as a Tech user. Still to do: Cypress on `devtestn10` at the final gate) |