Repository navigation
Conversation
Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.0 to 4.1.1. - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.0...4.1.1) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.1.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [min-document](https://github.com/Raynos/min-document) from 2.19.0 to 2.19.2. - [Commits](Raynos/min-document@v2.19.0...v2.19.2) --- updated-dependencies: - dependency-name: min-document dependency-version: 2.19.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [qs](https://github.com/ljharb/qs) from 6.11.2 to 6.14.1. - [Changelog](https://github.com/ljharb/qs/blob/main/CHANGELOG.md) - [Commits](ljharb/qs@v6.11.2...v6.14.1) --- updated-dependencies: - dependency-name: qs dependency-version: 6.14.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [lodash](https://github.com/lodash/lodash) from 4.17.21 to 4.17.23. - [Release notes](https://github.com/lodash/lodash/releases) - [Commits](lodash/lodash@4.17.21...4.17.23) --- updated-dependencies: - dependency-name: lodash dependency-version: 4.17.23 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [webpack](https://github.com/webpack/webpack) from 5.97.1 to 5.105.0. - [Release notes](https://github.com/webpack/webpack/releases) - [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md) - [Commits](webpack/webpack@v5.97.1...v5.105.0) --- updated-dependencies: - dependency-name: webpack dependency-version: 5.105.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
Updated all github actions
Standardize upgrade to ColdBox 8
Standardize upgrade to ColdBox 8
Bumps [svgo](https://github.com/svg/svgo) from 2.8.0 to 2.8.2. - [Release notes](https://github.com/svg/svgo/releases) - [Commits](svg/svgo@v2.8.0...v2.8.2) --- updated-dependencies: - dependency-name: svgo dependency-version: 2.8.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [underscore](https://github.com/jashkenas/underscore) from 1.13.6 to 1.13.8. - [Commits](jashkenas/underscore@1.13.6...1.13.8) --- updated-dependencies: - dependency-name: underscore dependency-version: 1.13.8 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [immutable](https://github.com/immutable-js/immutable-js) from 4.3.4 to 4.3.8. - [Release notes](https://github.com/immutable-js/immutable-js/releases) - [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md) - [Commits](immutable-js/immutable-js@v4.3.4...v4.3.8) --- updated-dependencies: - dependency-name: immutable dependency-version: 4.3.8 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [minimatch](https://github.com/isaacs/minimatch) from 3.1.2 to 3.1.5. - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](isaacs/minimatch@v3.1.2...v3.1.5) --- updated-dependencies: - dependency-name: minimatch dependency-version: 3.1.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [flatted](https://github.com/WebReflection/flatted) from 3.2.9 to 3.4.2. - [Commits](WebReflection/flatted@v3.2.9...v3.4.2) --- updated-dependencies: - dependency-name: flatted dependency-version: 3.4.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [yaml](https://github.com/eemeli/yaml) from 1.10.2 to 1.10.3. - [Release notes](https://github.com/eemeli/yaml/releases) - [Commits](eemeli/yaml@v1.10.2...v1.10.3) --- updated-dependencies: - dependency-name: yaml dependency-version: 1.10.3 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [picomatch](https://github.com/micromatch/picomatch) from 2.3.1 to 2.3.2. - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) --- updated-dependencies: - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [picomatch](https://github.com/micromatch/picomatch) from 2.3.1 to 2.3.2. - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](micromatch/picomatch@2.3.1...2.3.2) --- updated-dependencies: - dependency-name: picomatch dependency-version: 2.3.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [immutable](https://github.com/immutable-js/immutable-js) from 4.1.0 to 4.3.8. - [Release notes](https://github.com/immutable-js/immutable-js/releases) - [Changelog](https://github.com/immutable-js/immutable-js/blob/main/CHANGELOG.md) - [Commits](immutable-js/immutable-js@v4.1.0...v4.3.8) --- updated-dependencies: - dependency-name: immutable dependency-version: 4.3.8 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [svgo](https://github.com/svg/svgo) from 2.8.0 to 2.8.2. - [Release notes](https://github.com/svg/svgo/releases) - [Commits](svg/svgo@v2.8.0...v2.8.2) --- updated-dependencies: - dependency-name: svgo dependency-version: 2.8.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
…modules/contentbox/themes/default/yaml-1.10.3 Bump yaml from 1.10.2 to 1.10.3 in /modules/contentbox/themes/default
…svgo-2.8.2 Bump svgo from 2.8.0 to 2.8.2
…modules/contentbox/themes/default/immutable-4.3.8 Bump immutable from 4.1.0 to 4.3.8 in /modules/contentbox/themes/default
…js-yaml-4.1.1 Bump js-yaml from 4.1.0 to 4.1.1
…min-document-2.19.2 Bump min-document from 2.19.0 to 2.19.2
…qs-6.14.1 Bump qs from 6.11.2 to 6.14.1
…lodash-4.17.23 Bump lodash from 4.17.21 to 4.17.23
…modules/contentbox/themes/default/webpack-5.105.0 Bump webpack from 5.97.1 to 5.105.0 in /modules/contentbox/themes/default
…malization in BaseContent Adds three BDD specs to BaseContentTest.cfc: - initializes contentVersions to [] when not previously set - resets contentVersions to [] when it contains a simple value (BoxLang ORM edge case) - setContentVersions filters out simple values from a mixed array
…pages_action_dvega Fixed the issue when save and clone pages
- Add server-boxlang@1.json (pure BoxLang engine, mirrors coldbox-platform's config) since only the boxlang-cfml compat variant existed before. - box.json installPaths updated by `box install` for cbdebugger and route-visualizer devDependencies. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CoEgT3ggNEKM1nGjqB5Qd5
ContentBox's ORM event handler (modules/contentbox/models/system/EventHandler.cfc) implements the legacy CFIDE.orm.IEventHandler interface. Pure BoxLang doesn't ship that compatibility shim by default; without it, ORM's MappingGenerator fails to compile the class during entity scanning and the whole app 500s before ever reaching a route. bx-compat-cfml (already used by server-boxlang-cfml@1.json) provides it. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CoEgT3ggNEKM1nGjqB5Qd5
Pure BoxLang engine isn't the target for this environment; the boxlang-cfml compat server (which already includes bx-compat-cfml) is the one to use going forward. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CoEgT3ggNEKM1nGjqB5Qd5
…se handler ColdBox RestHandler.onEntityNotFoundException() throws MissingArgumentException on Adobe ColdFusion 2023 because the inline Elvis expression passed to setData() is dropped. Override it in the API v1 base handler, resolving the id into a local variable first, so adobe@2023 builds pass until a ColdBox release with the fix is the minimum version. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Lg4ySgho8Woxb5SQN9eqep
…6k6xi Fix entity not found handler for Adobe ColdFusion 2023
…TENTBOX-1516) Widen the contentbox-api-v1 firewall whitelist and drop the per-action secured="" annotations so that index/show on entries, pages, and contentStore no longer require authentication, since those actions already only return published content via findPublishedContent(). show() additionally now rejects (404) anonymous requests for content that is not published, is expired, or is password protected, since it resolves by raw id/slug with no visibility filtering otherwise. Every other endpoint (sites, menus, categories, comments, authors, all write verbs) remains fully authenticated. Adds PublicContentAccessSpec.cfc covering anonymous index/show, the draft-content 404 guard, write-verb rejection, and that admin-only resources stay locked.
…-box-setup-routing-4tto6x
Address Copilot findings on PR #696: - An anonymous request could read a site's published content even when the site itself is inactive, since baseContentHandler's preHandler() never checked isActive (SiteService.discoverSite() already applies that rule for the front-end). preHandler() now 404s an inactive site for any caller without full content access, exactly like an unknown site slug. - Removing entries/pages/contentStore's secured="" annotations meant any authenticated user, regardless of permission, skipped the visibility guard entirely and could read drafts/expired/password- protected content. show() now checks for ENTRIES_ADMIN/EDITOR-style permission (added as variables.contentType per handler) rather than merely being logged in. These actions are whitelisted out of the JWT firewall entirely, so prc.oCurrentAuthor is never populated for them by the framework; hasFullContentAccess() parses the incoming token itself via jwtAuth().parseToken() before checking permissions. Adds regression coverage for an authenticated admin still being able to view a draft. Also fixes three existing draft-content fixtures that were wrapped in withRollback(): the simulated test request runs its own ORM transaction and can't see an uncommitted row, so those tests were passing because the row was invisible, not because the visibility check ran. They now commit the fixture for real and clean up after.
…istency Adobe ColdFusion doesn't apply an ORM property's `default` attribute to a freshly new()'d entity the way Lucee/BoxLang do, so Site.getIsActive() came back falsy on Adobe CF for sites created without an explicit isActive key (e.g. the installer's default site fixture). This broke the new preHandler() active-site check for anonymous API callers on Adobe CF CI jobs only. Author.cfc already works around the same engine quirk by setting variables.isActive in init(); Site.cfc now does the same. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CoEgT3ggNEKM1nGjqB5Qd5
…flag The "I want to edit a site" test PUT isActive:false onto the real "default" site (used as a fixture by nearly every other API spec), relying on withRollback() to undo it. That undo isn't reliable for an UPDATE on every engine, so on Adobe CF the default site was being left permanently inactive mid test-run, which the new preHandler() active-site check then (correctly) enforced against every later anonymous request for it. Edit a disposable site instead, same pattern the delete-site test already uses, so the shared fixture is never at risk. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CoEgT3ggNEKM1nGjqB5Qd5
…ORM directly The finally block called siteService.delete() on the testSite reference captured before the PUT ran. That PUT executed in a separate simulated request with its own ORM session, leaving testSite stale, which made Hibernate throw "An exception occurred when committing the transaction" on Adobe CF when deleting it directly. The adjacent delete-site test avoids this by going through the HTTP API instead of the ORM service; do the same here for cleanup. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CoEgT3ggNEKM1nGjqB5Qd5
…s-77caf fixture That test PUT new content onto "disk-queues-77caf" under withRollback(), the same pattern already found unreliable for undoing an UPDATE on Adobe CF (Site.cfc/SitesSpec). This spec bundle runs before PublicContentAccessSpec, and on Adobe CF the fixture was coming out of this test no longer publicly visible, breaking the new anonymous-show visibility check for a slug used across the whole suite. Edit a disposable entry instead, created and torn down through the API, so the shared fixture is never at risk. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CoEgT3ggNEKM1nGjqB5Qd5
…onymous-show test Even after isolating EntriesSpec's edit test (71f76de), the anonymous "show a published entry" assertion still 404'd on Adobe CF for disk-queues-77caf specifically, while the equivalent page/contentStore assertions passed. That slug is referenced by several other specs' uniqueness-validation tests (duplicate-slug checks in EntriesSpec's create/edit stories), any of which could still be leaving it in a bad state on Adobe without an isolated repro to pin down which one. Rather than keep chasing it spec by spec, test anonymous visibility against a disposable published entry this test owns end to end, same pattern already used for the draft-entry case in this file. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CoEgT3ggNEKM1nGjqB5Qd5
cbSecurity's own CBSecurity.has() already does exactly what hasFullContentAccess() was hand-rolling: an "any of these permissions" check against the currently authenticated user, via the cbSecure() mixin alongside jwtAuth(). jwtAuth().parseToken() logs the resolved author into cbSecurity's SecurityService as a side effect, so cbSecure().has() sees it correctly. Drops the manual listToArray()/loop and the direct prc.oCurrentAuthor dependency, so hasFullContentAccess() no longer needs prc at all. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01CoEgT3ggNEKM1nGjqB5Qd5
…-routing-4tto6x Allow anonymous read access to already-public content (CONTENTBOX-1516)
The projection used "email", but the cbSubscriber property is subscriberEmail. cborm 4 never evaluated it because count() replaced the projection; bx-orm 2 checks projection paths when they are added, so the Subscribers admin page returned a 500. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SnmFsqBfa9SR4V1rRXw57X
bx-orm@be is the bx-orm 2 (Hibernate 7) pre-release line, which needs cborm 6. development ships cborm 4, so the boxlang-cfml@be job failed at startup (Session.createCriteria() no longer exists). Use the stable bx-orm like the boxlang-cfml@1 server. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SnmFsqBfa9SR4V1rRXw57X
…property Fix the property name in getUniqueSubscriberCount(); use stable bx-orm on the BE test server
…t fixtures The MySQL and MSSQL fixtures typed parent-page and parent-page/child-1 as Page in cb_content but had no cb_page rows for them. Hibernate 5 counted pages through cb_page and skipped them; Hibernate 7 counts from cb_content alone, so the pages API reported 5 records while listing 4. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SnmFsqBfa9SR4V1rRXw57X
Add the missing cb_page rows for parent-page and its child in the test fixtures
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.