The loginRedirect cookie value was used directly in res.redirect() and
window.location.replace() without validation, allowing redirection to
arbitrary external URLs. Added validation to ensure the redirect target
is a relative path before use.
Co-authored-by: kolega.dev <faizan@kolega.ai>
This commit resolves the recurring issue where password managers
incorrectly autofill the header search bar when viewing the user
profile page.
This is achieved by wrapping the password change fields in a <form>
element, properly scoping them for browser autofill logic, and using
modern, standard `autocomplete` attributes. This addresses the root
cause of the issue, whereas previous attempts tried to mitigate the
symptom in the search bar.
Fixes#2324Closes#3327
After 'Multilingual Namespacing' is enable, lang_code should be add to
the image path, but if the image path has lang_code prefix, it will return 404
So the pasted image are storage in /assets/$lang/$md_path
In Chromium kernel the paste event will be released after callback return
Since the callback async function, the files must be get before 'await' keyword
* feat: Add link to admin area on welcome page
See: #1259
* fix: remove trailing slash from welcome admin button
* fix: welcome page admin button link
Co-authored-by: Nicolas Giard <github@ngpixel.com>
* First take on removing erroneous path characters
Paths should not accept trailing slashes or hashtags. This is a first attempt at nullifying those.
* Use rules to verify path before acceptance
Use Regex and rules to verify paths before acceptance
* Rules to prevent any leading or trailing slashes
* Complex slug for regex on path, but it elminates special chars
* Added yarn.lock to .gitignore
* Maybe we do want yarn.lock afterall
* Adding yarn.lock
* Move Regex pattern outside of export
At present, the user that are not in the administrator group have no access to edit scripts and styles in page editor panel. This commit add configuration in group rule manage webpage so that users' permission on writing styles and writing scripts can be modified.