FEAT: Expose editHtml permission in role management GUI (#452)#457
FEAT: Expose editHtml permission in role management GUI (#452)#457loocars wants to merge 2 commits into
Conversation
The editHtml permission (CVE-2024-47090) was hidden and never seeded into the perms table, so it could only be granted via manual SQL. Seed it on install and idempotently on update, and stop hiding it in the role management dialog so admins can grant HTML editing to other roles. Refs #452
Address review feedback: instead of a separate count-guarded block in updateDb(), add the permission through the versioned 'updates' mechanism like every other permission. Keyed at 1100500 (< CONST_VERSION) so it is applied once on upgrade and never re-runs into the UNIQUE(mod,act,obj) constraint on fresh installs, matching the existing Url permission pattern.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
Claude Code Review is paused for this repository. To reconnect it, an admin of this repository's GitHub organization (or the account owner, for personal repositories) who can also manage your Claude organization's Code Review settings needs to re-link GitHub in Code Review settings. This is a one-time step.
Tip: disable this comment in your organization's Code Review settings.
|
@claude review |
There was a problem hiding this comment.
Claude Code Review
Claude Code Review is paused for this repository. To reconnect it, an admin of this repository's GitHub organization (or the account owner, for personal repositories) who can also manage your Claude organization's Code Review settings needs to re-link GitHub in Code Review settings. This is a one-time step.
Tip: disable this comment in your organization's Code Review settings.
2 participants
The
editHtmlpermission introduced with CVE-2024-47090 was kept in the hiddensummarizePermslist and never seeded into thepermstable, so it could only be granted through manual SQL.This seeds
Map/editHtml/*on fresh installs and idempotently (count-guarded) on update — safe against theUNIQUE(mod,act,obj)constraint and installs that already added it manually — and stops hiding it in Manage Roles → Permissions. Default posture is unchanged: only Administrators have it (via their*/*/*wildcard), but an admin can now delegate HTML editing to another role from the GUI.Refs #452