Commit Graph
8 Commits
Author SHA1 Message Date
Oleg Isonen dcdac0eaa7 feat: Project settings dialog accessible from dashboard (#5514)
## Description

1. What is this PR about (link the issue and add a short description)

## Steps for reproduction

1. click button
2. expect xyz

## Code Review

- [ ] hi @kof, I need you to do
  - conceptual review (architecture, feature-correctness)
  - detailed review (read every line)
  - test it on preview

## Before requesting a review

- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")

## Before merging

- [ ] tested locally and on preview environment (preview dev login:
0000)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
2025-12-15 17:23:16 +01:00
Bogdan Chadkin e06de5322b refactor: add server as storage to sync engine (#4475)
Another layer in sync engine is composable storage.

Now you can specify a chain of storages. Each can listen transactions to
update some state. Though subscription for state is invoked one by one
until non-undefined is provided.

See tests to understand API.

Here I also migrated our server data loading and synchronization to this
storage api.
2024-12-03 21:43:39 +07:00
Ivan Starkov 9348ce0af0 fix: Image upload via share link (#4083)
## Description

Use authToken token implicitly. Except queue cases like image upload and
patches.

## Steps for reproduction

Open any project with build or admin share link, upload image.

https://p-a82eaa2b-698e-4d3f-aa46-d4f3eee05fe0-dot-img-fix.development.webstudio.is/?authToken=a74ddf79-2638-47af-9dd1-e62f78187a8d&mode=edit

<img width="1025" alt="image"
src="https://github.com/user-attachments/assets/1de48271-f8c3-4df8-aa51-e61d74eb5c32">


## Code Review

- [ ] hi @kof, I need you to do
  - conceptual review (architecture, feature-correctness)
  - detailed review (read every line)
  - test it on preview

## Before requesting a review

- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")

## Before merging

- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
2024-09-07 18:43:03 +03:00
Ivan Starkov 766d7eb95f chore: Add CSRF protection to prevent Canvas script execution vulnerability (#4047)
## Description

how it works
https://github.com/webstudio-is/webstudio-saas/issues/317#issuecomment-2317121292

- attack example
https://p-845e975a-4e84-4186-b312-431f3a6f99ea-dot-main.development.webstudio.is/
- attack fixed
https://p-845e975a-4e84-4186-b312-431f3a6f99ea-dot-csrf.staging.webstudio.is/

corresponding PR #4060 (Add postMessage token to secure against Canvas
script execution)

Additionally

csp on iframe (see comments)
destination checks - to prevent including loaders/pages into iframes

<img width="1015" alt="image"
src="https://github.com/user-attachments/assets/2d8c6840-e195-424e-942f-8b8d05203e18">


## Steps for reproduction

1. click button
2. expect xyz

## Code Review

- [ ] hi @kof, I need you to do
  - conceptual review (architecture, feature-correctness)
  - detailed review (read every line)
  - test it on preview

## Before requesting a review

- [ ] made a self-review
- [ ] added inline comments where things may be not obvious (the "why",
not "what")

## Before merging

- [ ] tested locally and on preview environment (preview dev login:
5de6)
- [ ] updated [test
cases](https://github.com/webstudio-is/webstudio/blob/main/apps/builder/docs/test-cases.md)
document
- [ ] added tests
- [ ] if any new env variables are added, added them to `.env` file
2024-09-04 17:08:08 +03:00
Bogdan Chadkin ffccbf38b0 refactor: load compact data into builder (#3922)
Load only arrays instead of maps from server
and convert data to map on client.

This reduces download size and server cpu usage.

340 kB -> 269 kB
218 kB -> 170 kB
22%
2024-08-14 00:12:15 +02:00
Bogdan Chadkin 9e23dc9580 feat: switch to overflow longhands (#3588)
Ref https://github.com/webstudio-is/webstudio/issues/2647

Here refactored overflow UI to update "overflow-x" and "overflow-y"
longhands instead of "overflow" shorthand.

Removed "overflow" from advanced panel suggestions.

Added support for expanding overflow shorthand for webflow copy paste.

And implemented very basic migrations utility
which always run after data is loaded from server
and sends patch for expanding overflow longhands.
Patch is not sent when no properties are modified. Though eventually we
will need to support versioning to avoid executing old migrations.

<img width="279" alt="Screenshot 2024-06-18 at 19 33 21"
src="https://github.com/webstudio-is/webstudio/assets/5635476/ce44385e-3316-4e34-bc9c-5f790cbdcd4f">
2024-06-20 11:51:00 +03:00
Bogdan Chadkin 5848b51834 fix: pass auth token to data loader (#3499)
Broken since refactoring to loading builder data client side.
2024-06-05 13:47:50 +03:00
Bogdan Chadkin 1b0fc0eadc refactor: move builder data loading to client side (#3464)
To synchronize data between tabs it should be consistent and be easily
accessible. Loading from server creates huge latency and data can be
changed by loading from another tab.

Here moved data loading to client side so it can be shared through
IndexedDB.

Added new `/rest/data/:buildId` endpoint and defined global setter and
getter for current state.
2024-06-01 14:46:29 +03:00