Conversation
Complete modernization of the addon. Highlights: - Data model v2: article items store only the article id (names/URLs resolve live per language); idempotent v1 migration with structure_legacy backup - New item types: media (mediapool file by name) and text (label + optional HTML body for mega menus, overridable text.php fragment), group->text rename with decode alias; in-place type conversion in the editor - Per-item per-language visibility (hiddenIn) and per-navigation maxDepth (admin-set, server-enforced) - Vue 3 backend editor (vendored 3.5.13, no build step, no CDN, no jQuery): native drag & drop, keyboard controls, article combobox with live search, smart link input (URL/email/phone), linkmap + mediapool popup bridges - Security: CSRF on all mutations, consistent escaping, URL scheme allowlist, page-scoped assets, offline-article filtering - Fragment-based rendering with active/activePath; deprecated get()/ getStructure() kept as BC shims; REX_NAVBUILDER[] still works - yform/phpmailer dependencies removed; de/en translations; German README Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Bind selection handlers to the popup windows returned by the core open functions, preventing missed callbacks and duplicate handlers when popups are reused.
Allow media entries to open in a new window, including editor controls, rendering, validation, and documentation.
Data loss: structure columns are MEDIUMTEXT with a byte guard in save() (a legal tree overflowed TEXT's 64KB and truncated JSON decoded as an empty navigation), strict decode rejects unparseable JSON, updating a deleted row is refused, a failed save returns the posted tree verbatim (including the refused item) and keeps the posted name, and page-Save applies every open edit form first — an invalid form blocks the submit. Upgrade path: update.php preflights v1 names (aborts on >191 chars, logs non-slug names) and the migration reports its dropped-item count; the silent item-overflow drop is logged now. Hardening: navbuilder[] permission on the autocomplete API, mediapool declared as dependency, CSP nonce on the init script, request-ID guard against out-of-order autocomplete responses. Structure: pure editor logic extracted to navbuilder-core.js (frozen window.NavBuilderCore, Node-testable) — which caught that the client refused host:port urls the server accepts; PHPUnit suite for the schema surface with REDAXO stubs; CI workflow (PHP lint + PHPUnit, node checks + tests); unused Navigation::all() removed; Vue bumped to 3.5.41. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Adopted from block_peek: builds a cleaned release archive (dev tooling excluded), attaches it to the GitHub release, then publishes to redaxo.org via installer-action. No composer step — the addon has no runtime dependencies. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The seo blob may store non-ASCII raw or as \u-escapes depending on the writer's json_encode flags — search now tries both forms. url 2.x stores scheme-relative URLs; the `absolute` shape borrows the configured server's scheme so sitemap/feed consumers get a full URL. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
NavBuilder 2.0
Vollständige Modernisierung des Addons — Datenmodell, Backend-UI, Frontend-Rendering und Sicherheit.
Breaking Changes (mit automatischer Migration)
update.phpmigriert alle v1-Datensätze automatisch (idempotent) und sichert das ursprüngliche JSON in einerstructure_legacy-Spalte.group→text(ein Decode-Alias hält Altdaten funktionsfähig),getStructure()/get()sind deprecated, funktionieren aber weiter als BC-Shims.yformundphpmailerentfernt. Benötigt REDAXO ≥ 5.18, PHP ≥ 8.1.Neu
media(Medienpool-Datei, per Dateiname gespeichert, umbenennungssicher) undtext(Beschriftung + optionaler HTML-Inhalt für Mega-Menüs, gerendert über ein überschreibbaresfragments/navbuilder/text.php).hiddenIn) sowie maximale Tiefe pro Navigation (von Admins gesetzt, serverseitig erzwungen).rex_navbuilder::render()/::tree()) mitactive/activePath, überschreibbaren Fragmenten undNAVBUILDER_INIT-Extension-Point (z. B. um einen WYSIWYG-Editor an Text-Einträge anzubinden).Behoben / Sicherheit
rex_escape), URL-Schema-Allowlist (javascript:etc. wird abgelehnt)getStructure()nach außenCloses #22, closes #23, closes #7.
Die Version bleibt bis zum Tagging
2.0.0-dev.🤖 Generated with Claude Code