Files
coolify/resources/js/modal-confirmation.js
T
Andras Bacsai 6a59008cda fix(dns): lock DNS modal state and unquote modal confirmation args
Mark DNS proposals, conflicts and server IP properties as #[Locked] so
clients cannot tamper with them. Re-resolve the zone per hostname,
lowercase hostnames, validate record content server-side and use the
resource's team id for DNS lookups and jobs.

Move modal-confirmation submitAction parsing into a tested JS helper
that strips quotes and keeps commas, parentheses and escaped quotes
inside quoted arguments. Pass the hostname to replaceManagedDnsRecord
through it instead of Js::from.

Rework member-permission tests to open the real DNS dialog rather than
setting locked properties directly.
2026-09-30 10:23:51 +02:00

52 lines
1.7 KiB
JavaScript

/**
* Splits the submitAction of the modal-confirmation component, such as
* `replaceManagedDnsRecord('app.example.com', 4)`, into the Livewire method and its arguments.
* Quoted arguments ('…' or "…") lose their quotes; other arguments stay text, as before.
*/
export function parseSubmitAction(submitAction) {
const open = submitAction.indexOf('(');
if (open === -1) {
return { method: submitAction.trim(), params: [] };
}
const close = submitAction.lastIndexOf(')');
const argumentText = submitAction.slice(open + 1, close > open ? close : undefined);
const params = [];
let current = '';
let quote = null;
let quoted = false;
const finish = () => {
const value = quoted ? current : current.trim();
if (value !== '' || quoted) {
params.push(value);
}
current = '';
quoted = false;
};
for (let index = 0; index < argumentText.length; index++) {
const character = argumentText[index];
if (quote) {
if (character === '\\' && index + 1 < argumentText.length) {
current += argumentText[++index];
} else if (character === quote) {
quote = null;
} else {
current += character;
}
} else if ((character === "'" || character === '"') && current.trim() === '') {
quote = character;
quoted = true;
current = '';
} else if (character === ',') {
finish();
} else if (!quoted) {
current += character;
}
}
finish();
return { method: submitAction.slice(0, open).trim(), params };
}