fix: prevent Coordinates.init crash when coordll disabled#1014
Merged
Conversation
Check containerName (resolved) instead of raw repoName against CORE_CONTAINER to prevent bypass via registry alias. Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
- Stop mutating manifest with _pluginPath (caused validation warnings) - Use toolPluginPaths/componentPluginPaths maps instead - Normalize path.relative output to POSIX separators for JS imports Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
Prevents wrong import paths when an external plugin fails to register but its path was already stored in the lookup map. Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
…plugins docs+feat: update plugin docs, rename remove → uninstall, org--repo naming, relative paths
The .toolPanel's backdrop-filter creates a containing block for position:fixed descendants, and its overflow:hidden clips them. The Review panel was rendered but invisible, positioned off the right edge of the tool panel. Change #drawToolReview from position:fixed to position:absolute with full-size overlay (top/left 0, width/height 100%) so it covers the DrawTool content within the tool panel. Add position: relative and height:100% to #drawTool so it serves as the positioning context. Use flex column layout so the content area fills remaining space and scrolls independently. Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
Save the current toolPanelWidth before opening Review and set it to 390px (only if currently narrower). On close, restore the previous width via the Zustand uiStore. Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
The Zustand store update triggers a React re-render, but the jQuery-managed #toolPanel content may not reflect the width change immediately. Set the width directly on the #toolPanel element and update the drag handle position for instant visual feedback. Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
…y-plugins fix: copy plugins/ directory into Docker runtime stage
… is open Extract cleanupReview() in DrawTool_Publish.js to handle width restoration and review panel removal. Call it from both the close button handler and separateFromMMGIS() so the panel width is always restored when leaving DrawTool. Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
…sage Replace inline style assignments with a CSS class (.truncated) so the base styles from the stylesheet apply without needing !important. Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
…eview-panel fix: DrawTool Review panel hidden by tool panel backdrop-filter containment
…ll control chars in logs Fix 2: Add permissions: contents: read to secrets-detection.yaml and pin actions/checkout to SHA (matching bump-version.yml). Fix 3: Validate _source parameter entries in geodatasets routes to only allow alphanumeric characters, underscores, and dots before query construction. Fix 4: Simplify sanitizeForLog regex to strip ALL control characters (0x00-0x1F and 0x7F), closing the newline/carriage-return log injection gap. Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
Apply forceAlphaNumUnder per-segment (split by dot) to preserve nested JSON paths like 'properties.name' while sanitizing each path component. Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
Update inline copy and test expectations to reflect the new regex that strips ALL control characters (0x00-0x1F, 0x7F) including newlines, tabs, and carriage returns. Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
…feedback Fix 1A: Rewrite newTag HTML injection in DrawTool_Files.js using jQuery DOM construction (.attr(), .text(), .append()) instead of raw string interpolation in $.append(). Fix 1B: Remove inline value attributes from F_.sanitize() in single-quoted attribute contexts (DrawTool_Templater.js:671, DrawTool_Editing.js:684). Set values safely via jQuery .val() after DOM insertion. Add allowList parameter to Utils.forceAlphaNumUnder() to optionally preserve specific characters (e.g. dots for nested JSON paths). Simplify _source validation to use forceAlphaNumUnder(s, ['.']) and fall back to null if all entries are filtered out. Revise sanitizeForLog to preserve newlines and tabs for stack trace readability while now stripping carriage returns (0x0D) for log injection prevention. Update tests to match. Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
The initial Fix 1A only covered the 'add new tag' path. Three additional rendering paths (existing efolders, folders, tags at lines 910-958) also used raw string interpolation for tag names. Extract buildTagItemHtml() helper that uses jQuery DOM construction (.attr(), .text()) to safely render all tag items. Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
Add '-' to forceAlphaNumUnder allowList since JSONB property names commonly contain hyphens (e.g. start-time, image-url). Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
…-2-3-4 security: XSS prevention, CI hardening, geodataset validation, log sanitization
…, backend pagination - Rewrite jQuery Search.js as React Search.jsx with design-system components - Add GlobalSearchPanel.jsx: advanced filter builder in floating right panel with layer multi-select, filter builder (same data model as Filtering.js), paginated results list grouped by layer - Add 'All Layers (Fields)' cross-layer search with field:value syntax - Backend: add offset/limit query params to geodatasets_get endpoint - Update OpenAPI docs with offset/limit parameter specs - Make right panel float over map (not push splitscreens) - Update Reference-Mission blueprint with search variables for geodataset layers - Add unit tests (20 tests) for filter encoding and field parsing - Add E2E tests for search bar and advanced panel UI - Remove jQuery Search.js, Dropy/autocomplete dependencies from Search Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
…range - Add maybeShowTimeWarning helper that queries geodataset without time bounds, compares result extent to current slider, only shows warning if features exist outside the range - Fix case-sensitive regex search missing start_time/end_time columns Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
…ime warning Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
Adds searchGeneration ref that increments on each handleSearch call. tryHighlight and trySelect check the generation and bail if a newer search has started — prevents re-selecting a previous feature. Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
This reverts commit 3f9554b.
When a value only exists in geodataset layers, doWithSearch was still running on all vector layers in the group. If a vector layer happened to have a match (e.g. same search text), it would re-select that feature — overriding the resetLayerFills() and showing a stale selection. Now filters vecLayers by sourceLayers (same as geoSearchTargets). Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
When toggling geodataset layers on, addGeoJSONData / updateVectorLayer re-selects L_.activeFeature from a previous search — causing stale highlights. Clearing activeFeature at the start of select mode prevents layer reloads from re-selecting the old feature. Also filters vector layers by sourceLayers in group select mode so doWithSearch only runs on layers that actually have the clicked value. Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
…e, multi-field search, test corrections, variable naming Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
… query Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
…-search feat: Global Feature Search — unified panel, field search, operator selection, layer management
Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
…lowercase fix: lowercase COG colormap_name before passing to TiTiler
Co-Authored-By: tariq.k.soliman <tariqksoliman@gmail.com>
…nit-crash fix: prevent Coordinates.init crash when coordll disabled
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
With Devin: JPL-Devin#105
Purpose
coordinates.coordll: false,Coordinates.initcould delete thellstate and then hardcodemainType = 'll'referencing a now-missing state. This threw inrefreshDropdown(reading 'title') andconvertLngLat(reading 'coordOffset'), aborting the essence init chain soDescription.initnever ran (Description.L_stayed null), causing downstreamreading 'layers'/reading 'activeFeature'errors inDescription.js.Proposed Changes
Coordinates.init: before the "remove all unavailable state" deletion block, forcell.available = truewhen no state is available, so lon/lat is always present and the deletion can't emptystates.mainTypefallback: when the resolvedmainTypeisn't instates, fall back to'll'only if it still exists, otherwise toObject.keys(Coordinates.states)[0].refreshDropdown: early-returnfrom theforEachcallback whenCoordinates.states[state] == null, so a stalestateIndicesentry can't throw ons.title.convertLngLat: returnnewCoordsearly whencurrentState == null, avoiding reads ofcoordOffsetonundefined.