2.8.4 #3392
2.8.4 #3392
Conversation
Added a check to ensure the DXCC entity is an array and contains a 'name' key before assigning 'dxcc_name' to prevent undefined index errors.
Adds a check to ensure that if a QSO is not found or not accessible, the user is redirected to the dashboard with a notice. This prevents errors when attempting to access non-existent or unauthorized QSOs.
Wrapped assignments of 'dxcc_name' with checks to ensure the entity is an array and contains a 'name' key. This prevents potential errors if the entity lookup fails or returns unexpected data.
Added a check and error log for missing station_callsign during QRZ import. This helps identify records with incomplete data and prevents potential issues when processing QSOs.
Updated Logbooks controller to use profile_clean for station lookup and added a notice for missing stations. Enhanced Setup_model to count logbooks a user owns or has permissions for, ensuring accurate logbook statistics for users with shared access. Fixes #3389
This reverts commit 3c2d846.
Enhanced the QSO access logic to allow access if the QSO belongs to the user or is part of a user's active logbook, including shared permissions. Added a guard in the controller to prevent accessing missing or inaccessible QSOs, redirecting with a notice if access is denied.
Introduced an 'Embed Code' modal in the logbooks index to allow users to easily copy iframe code for embedding their logbook widget. Also added a 'Powered by Cloudlog' attribution to the widget view for better visibility and credit.
Introduces migration 240 to update the application version to 2.8.4 and trigger the version info dialog for users. Updates migration configuration to reflect the new version.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
This is the final PR Bugbot will review for you during this billing cycle
Your free Bugbot reviews will reset on January 5
Details
You are on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle.
To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.
| title="Get Embed Code" | ||
| data-bs-toggle="modal" | ||
| data-bs-target="#embedModal" | ||
| onclick="setEmbedCode('<?php echo $row->public_slug; ?>', '<?php echo addslashes($row->logbook_name); ?>')"> |
There was a problem hiding this comment.
Incomplete JavaScript escaping breaks embed modal for special characters
The addslashes() function is used to escape logbook_name for a JavaScript string in an onclick handler, but addslashes() only escapes quotes, backslashes, and NUL bytes. It does not escape newlines, carriage returns, or other control characters. If a logbook name contains any of these characters, the resulting JavaScript string literal would be syntactically invalid, causing the embed button to fail silently. Using json_encode() would properly escape all special characters for JavaScript context.
| $sharedQuery = $this->db->get($this->config->item('table_name')); | ||
| if ($sharedQuery->num_rows() == 1) { | ||
| return true; | ||
| } |
There was a problem hiding this comment.
Read-only users can delete/modify QSOs in shared logbooks
The expanded check_qso_is_accessible function now allows access when a user has only 'read' permission to a shared logbook. However, this function is used as a gatekeeper for destructive operations like delete() and paperqsl_update(). This means a user granted read-only access to a shared logbook can now delete or modify QSOs they shouldn't be able to change. The shared-logbook check uses check_logbook_is_accessible($activeLogbookId, 'read') but the calling code in Qso.php uses the result to authorize deletions and updates.
| title="Get Embed Code" | ||
| data-bs-toggle="modal" | ||
| data-bs-target="#embedModal" | ||
| onclick="setEmbedCode('<?php echo $row->public_slug; ?>', '<?php echo addslashes($row->logbook_name); ?>')"> |
There was a problem hiding this comment.
Incomplete JavaScript escaping breaks embed modal for special characters
The addslashes() function is used to escape logbook_name for a JavaScript string in an onclick handler, but addslashes() only escapes quotes, backslashes, and NUL bytes. It does not escape newlines, carriage returns, or other control characters. If a logbook name contains any of these characters, the resulting JavaScript string literal would be syntactically invalid, causing the embed button to fail silently. Using json_encode() would properly escape all special characters for JavaScript context.
This pull request introduces several improvements across the application, focusing on enhanced logbook sharing and permissions, improved error handling, and additional user interface features such as logbook embedding. It also includes a new migration to tag the application as version 2.8.4.
Logbook Sharing, Permissions, and Access Control:
Logbook_model::check_qso_is_accessibleto allow QSO access not only for the owner but also for users with read access to the active logbook, supporting shared logbooks and permissions.Setup_modelto count logbooks that the user either owns or has been granted permissions to, ensuring accurate reporting of accessible logbooks. [1] [2]delete_relationshipmethod inLogbooks.phpto useprofile_cleanfor station lookup and to provide user feedback if the station location is not found. [1] [2]User Interface Enhancements:
Error Handling and Data Validation:
Logbook.phpcontroller to guard against inaccessible or missing QSOs, preventing null dereference and redirecting users with a notice.station_callsignis missing in imported records.Database Migration:
240_tag_2_8_4.phpto tag the application as version 2.8.4 and reset the version dialog confirmation for users.Note
Logbook sharing and access
Logbook_model::check_qso_is_accessibleto allow access via active shared logbooks (read permission), not just ownershipSetup_modelcounts to include logbooks with granted permissionsLogbooks::delete_relationshipusingprofile_cleanand adds "not found" feedbackUI: embed widget
logbooks/index.phpto generate copyable<iframe>forwidgets/qsos/<public_slug>views/widgets/qsos.phpError handling and robustness
Logbook::view($id)against missing/inaccessibleget_qsoresultsQrzimport, default missing fields and log whenstation_callsignis absentMigration
application/migrations/240_tag_2_8_4.phpand bumpsconfig/migration.phpto240(version2.8.4)Written by Cursor Bugbot for commit 30ee758. This will update automatically on new commits. Configure here.