si/websitedev
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix(cms): implement v2 security and stability review findings
CI Pipeline with Test Management / 🧪 Run Tests & Generate Reports (push) Waiting to run
Details
CI Pipeline with Test Management / 🐳 Docker Integration Tests (push) Blocked by required conditions
Details
CI Pipeline with Test Management / 🏗️ Build Docker Image (push) Blocked by required conditions
Details
CI Pipeline with Test Management / 📊 Generate Test Summary (push) Blocked by required conditions
Details
Test Reporting & Gherkin Analysis / 🧪 Run Tests & Generate Reports (push) Waiting to run
Details
Test Reporting & Gherkin Analysis / 📊 Analyze Test Coverage (push) Blocked by required conditions
Details
Test Reporting & Gherkin Analysis / 🔄 Sync with Linear (push) Blocked by required conditions
Details
Test Reporting & Gherkin Analysis / ⚡ Performance Monitoring (push) Blocked by required conditions
Details

Browse Source 
Resolves:
- CSRF false positive checked (global POST protection)
- Publish mutex to prevent git lock / double deploy
- Basic Auth rate limit checked before credential evaluation
- Memory leak in rate limiter (added GC interval)
- XSS in Toast messages
- XSS in data-path attribute
- CI healthcheck port mismatch (3000 -> 8080)
- Added security headers (X-Frame-Options, X-Content-Type-Options)
This commit is contained in:
Do Siki
2026-08-20 11:35:01 +02:00
parent 768297031d
commit c5d5198fbf
12 changed files with 132 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/cms-pages.js
+2 -1
View File
@@ -1,3 +1,4 @@
function escHtml(s) { return String(s).replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;'); }
// Page templates for the Content Editor. Kept separate so content-editor.js
// stays focused on routing/handling and below the file-size limits.
@@ -91,7 +92,7 @@ const HTML = (activeFile, jsonData, message, csrfToken, fileLabels, clientJs, co
<body>
${isStaging() ? '<div class="environment-banner">⚠ STAGING / TESZTKÖRNYEZET — itt végzett publikálás csak a staging oldalt frissíti</div>' : ''}
${message ? `<div class="toast ${message.type === 'ok' ? 'ok' : 'err'}">${message.text}</div>` : ''}
${message ? `<div class="toast ${message.type === 'ok' ? 'ok' : 'err'}">${escHtml(message.text)}</div>` : ''}
<header>
<h1>mozdIT Content Editor</h1>