From 855fc9c9c85720b5e0c6b9086083165492e2a864 Mon Sep 17 00:00:00 2001
From: erdgeist <erdgeist@erdgeist.org>
Date: Thu, 16 Jul 2026 17:15:54 +0200
Subject: Construct DOM elements using escaping helpers to prevent XSS

---
 public/javascripts/admin_search.js   | 30 ++++++++++++++----------------
 public/javascripts/related_assets.js |  9 +++------
 2 files changed, 17 insertions(+), 22 deletions(-)

(limited to 'public')

diff --git a/public/javascripts/admin_search.js b/public/javascripts/admin_search.js
index 7604bb7..d135503 100644
--- a/public/javascripts/admin_search.js
+++ b/public/javascripts/admin_search.js
@@ -72,24 +72,20 @@ function initSearchPicker(options) {
           found = false;
           for (var i = 0; i < data.length; i++) {
             (function(node) {
-              var link;
+              var anchor = $("<a>").attr("href", onSelect ? "#" : node.node_path);
+              anchor.append(document.createTextNode(node.title || ""));
+              anchor.append($("<span>", { "class": "result_path" }).text(node.unique_name || ""));
+              var link = $("<p>").append(anchor);
+
               if (onSelect) {
-                link = $(
-                  "<p><a href='#'>" + node.title +
-                    "<span class='result_path'>" + node.unique_name + "</span></a></p>"
-                );
-                link.find("a").bind("click", function() {
+                anchor.bind("click", function() {
                   onSelect(node);
                   results.slideUp();
                   results.empty();
                   return false;
                 });
-              } else {
-                link = $(
-                  "<p><a href='" + node.node_path + "'>" + node.title +
-                    "<span class='result_path'>" + node.unique_name + "</span></a></p>"
-                );
               }
+
               results.append(link);
               found = true;
             })(data[i]);
@@ -150,7 +146,9 @@ dashboard_search = {
           results.append("<p class='search_group_label'>Tags</p>");
           var tag_row = $("<div class='search_tag_row'></div>");
           data.tags.forEach(function(tag) {
-            tag_row.append("<a class='search_tag_pill' href='" + tag.tag_path + "'>" + tag.name + "</a>");
+            tag_row.append(
+              $("<a>", { "class": "search_tag_pill" }).attr("href", tag.tag_path).text(tag.name || "")
+            );
             found = true;
           });
           results.append(tag_row);
@@ -159,10 +157,10 @@ dashboard_search = {
         if (data.nodes.length) {
           results.append("<p class='search_group_label'>Pages</p>");
           data.nodes.forEach(function(node) {
-            results.append(
-              "<p><a href='" + node.node_path + "'>" + node.title +
-                "<span class='result_path'>" + node.unique_name + "</span></a></p>"
-            );
+            var anchor = $("<a>").attr("href", node.node_path);
+            anchor.append(document.createTextNode(node.title || ""));
+            anchor.append($("<span>", { "class": "result_path" }).text(node.unique_name || ""));
+            results.append($("<p>").append(anchor));
             found = true;
           });
         }
diff --git a/public/javascripts/related_assets.js b/public/javascripts/related_assets.js
index 803332f..3340fa7 100644
--- a/public/javascripts/related_assets.js
+++ b/public/javascripts/related_assets.js
@@ -15,12 +15,9 @@ related_assets = {
       renderResults: function(data, results) {
         var found = false;
         data.forEach(function(asset) {
-          var item = $(
-            "<a href='#' class='related_asset_result'>" +
-              "<img src='" + asset.thumb_url + "' alt=''>" +
-              "<span>" + asset.name + "</span>" +
-            "</a>"
-          );
+          var item = $("<a>", { href: "#", "class": "related_asset_result" });
+          item.append($("<img>", { src: asset.thumb_url, alt: "" }));
+          item.append($("<span>").text(asset.name || ""));
           item.bind("click", function() {
             related_assets.attach(asset.id, createUrl, list);
             return false;
-- 
cgit v1.3


From c810d1aa93a267dd8fcf8984c5d0b125629efa31 Mon Sep 17 00:00:00 2001
From: erdgeist <erdgeist@erdgeist.org>
Date: Fri, 17 Jul 2026 00:42:54 +0200
Subject: Cutover to new Recent Changes widget

---
 app/controllers/admin_controller.rb |  1 +
 app/views/admin/index.html.erb      | 25 ++++++++++++++++++++++++-
 public/stylesheets/admin.css        |  8 ++++++++
 3 files changed, 33 insertions(+), 1 deletion(-)

(limited to 'public')

diff --git a/app/controllers/admin_controller.rb b/app/controllers/admin_controller.rb
index 37fd78b..40cfbdc 100644
--- a/app/controllers/admin_controller.rb
+++ b/app/controllers/admin_controller.rb
@@ -7,6 +7,7 @@ class AdminController < ApplicationController
   def index
     @drafts = Node.drafts_and_autosaves(current_user_id: current_user.id).limit(5)
     @recent_changes = Node.recently_changed.limit(5)
+    @actions = NodeAction.order(:occurred_at => :desc, :id => :desc).limit(5)
   end
 
   def conventions
diff --git a/app/views/admin/index.html.erb b/app/views/admin/index.html.erb
index a9c0512..1b4a0a0 100644
--- a/app/views/admin/index.html.erb
+++ b/app/views/admin/index.html.erb
@@ -40,13 +40,36 @@
     <%= link_to "See all drafts →", drafts_nodes_path %>
   </div>
 
-  <div class="dashboard_widget">
+  <!--div class="dashboard_widget">
     <h3>Recent changes</h3>
     <ul>
       <%= render partial: "nodes/recent_change_item", collection: @recent_changes, as: :node %>
     </ul>
     <%= link_to "See all recent changes →", recent_nodes_path %>
+  </div-->
+
+  <div class="dashboard_widget">
+    <h3>Recent changes</h3>
+    <table id="node_action_list">
+      <% @actions.each do |action| %>
+        <tr class="node_action node_action--<%= action.action %>">
+          <td class="node_action_time"><%= raw(action.occurred_at.strftime("%Y-%m-%d %H:%M").gsub(" ", "<br/>")) %></td>
+          <td class="node_action_body">
+            <%= action_summary(action) %>
+            <% if action.node_id && params[:node_id].blank? %>
+              <%= link_to t("node_actions.node_history"), admin_log_path(:node_id => action.node_id), :class => "node_action_zoom" %>
+            <% end %>
+            <% if action.inferred_from %>
+              <span class="node_action_inferred" title="<%= action.inferred_from %>"><%= t("node_actions.backfilled") %></span>
+            <% end %>
+            <%= render "node_actions/change_details", :action_entry => action if action_details?(action) %>
+          </td>
+        </tr>
+      <% end %>
+    </table>
+    <%= link_to "See all recent changes →", admin_log_path %>
   </div>
+
 </div>
 
 <div id="dashboard_housekeeping">
diff --git a/public/stylesheets/admin.css b/public/stylesheets/admin.css
index c1273c6..0aa22f8 100644
--- a/public/stylesheets/admin.css
+++ b/public/stylesheets/admin.css
@@ -1499,6 +1499,14 @@ div#image_browser ul li {
    Action log
    ============================================================ */
 
+#dashboard_widget td.node_action_time {
+  white-space: wrap;
+}
+
+#node_action_list td.node_action_body {
+  border-bottom: 1px solid #f1f1f1;
+}
+
 #node_action_list td.node_action_time {
   white-space: nowrap;
   vertical-align: top;
-- 
cgit v1.3