github/penpot
1
0
Fork 0
mirror of https://github.com/penpot/penpot.git synced 2026-09-08 13:09:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

🐛 Fix update-profile-props not rejecting plugin props at validation

Browse Source 
The schema:props schema still included :plugins as a valid key,
so the closed-map validation passed instead of rejecting it.
The system-managed-props denylist only silently stripped the key
after validation, never raised an error.

Derive schema:props-writeable from schema:props using sm/dissoc-key
to exclude system-managed keys, and use it in the update-profile-props
params schema. The original schema:props remains intact for get-profile
result validation.

AI-assisted-by: mimo-v2.5
This commit is contained in:
Andrey Antukh 2026-08-17 12:35:15 +00:00
parent 9289e676e1
commit 960209f1fa
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
backend/src/app/rpc/commands/profile.clj
View File

@ -78,6 +78,10 @@
[:map-of {:gen/max 10} :keyword [:map-of :keyword :string]]] [:map-of {:gen/max 10} :keyword [:map-of :keyword :string]]]
[:nudge {:optional true} schema:nudge]]) [:nudge {:optional true} schema:nudge]])
(def schema:props-writeable
"Props schema for user-writable fields (excludes system-managed keys)."
(reduce sm/dissoc-key schema:props system-managed-props))
(def schema:profile (def schema:profile
[:map {:title "Profile"} [:map {:title "Profile"}
[:id ::sm/uuid] [:id ::sm/uuid]
@ -463,7 +467,7 @@
(def ^:private (def ^:private
schema:update-profile-props schema:update-profile-props
[:map {:title "update-profile-props"} [:map {:title "update-profile-props"}
[:props schema:props]]) [:props schema:props-writeable]])
(defn update-profile-props (defn update-profile-props
[{:keys [::db/conn] :as cfg} profile-id props] [{:keys [::db/conn] :as cfg} profile-id props]