| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
A review of all three products in Chromium found defects that only execution exposes.
pdf2txt 1.0.0 DID NOT RUN. Both the packaged file and the live demo contained a duplicated
const declaration inside fetchModels, so the inline script threw a SyntaxError at parse time and
no handler was ever bound: no extraction, no translation, no config. Proven by extracting both
inline scripts from the committed file and from spaces/chatstudio/pdf2txt.html and running
node --check (SyntaxError: Identifier 'config' has already been declared). The two published
versions of this product were dead on arrival.
pdf2txt 1.0.1 also stops writing the API key and the whole extracted document to localStorage
(sessionStorage for the key, nothing for the text), keeps paragraphs (hasEOL), splits chunks on
word boundaries, reports a non-JSON 200 or a missing response field instead of writing "undefined"
into the editor, re-enables Translate after a run, resets stopRequested, stops a workflow on a
failed step, warns on a PDF with no text layer, recognises .PDF, fixes an unterminated mobile
media query, stops the Fullscreen button covering line 1, and makes the drop zone and all 39
controls reachable and named.
shiftplanner 1.0.1 fixes seven demonstrated defects: the settings modal recursed until the stack
overflowed, "+ Worker" prefilled the last edited worker id and overwrote that person, date maths
was off by one west of UTC (local-noon Date formatted with toISOString), same-day and overnight
shift overlaps were never flagged, the generator sliders never reached state.settings, CSV export
could execute a formula and broke on a quote, and the header never wrapped (390 px viewport gave a
1139 px document). Plus four data-integrity guards: unparseable saved plans are copied to a
recovery key instead of silently overwritten, wrong-typed fields are normalised, unknown top-level
fields survive a save, and a storage event syncs another tab.
chat-widget 1.0.1 closes a critical attribute-injection XSS. escapeHtml() round-tripped through
textContent, which does not escape a double quote, so a reply containing
https://x.test/"onclick="alert(1)// produced a real <a onclick=...> and fired alert(1) when
clicked. Proven both ways: the 1.0.0 file fired a dialog, the fixed one renders only
href/target/rel and stays silent. The launcher also covered the Send button at 390 px, so the
widget could not be used on a phone at all.
Also in this commit:
- Landing pages and demos are generated (build-product-pages.py). The "Try the demo" button used
to point at spaces/chatstudio/pdf2txt.html (the dead copy above) and at a v2.1 shiftplanner with
no AI panel: a demo that was a different build than the ZIP. Demos are now built into
/demos/<slug>/ from products/<slug>/, with the ../vendor/ prefix rewritten, and the publish
wrapper regenerates them before every publish.
- publish-public-repo.py refuses to publish a subtree with uncommitted changes. It reads git, so
it silently republished the old tip while rc was 0 for every slug.
|
