From d07f568ba259e28a83691def1a324c4a64cc2622 Mon Sep 17 00:00:00 2001 From: Eva Marco Date: Thu, 12 Feb 2026 17:01:36 +0100 Subject: [PATCH] :bug: Avoid modifying shape by apply negative tokens to border radius (#8336) --- CHANGES.md | 1 + .../data/workspace/tokens/application.cljs | 31 ++++++++++--------- 2 files changed, 17 insertions(+), 15 deletions(-) diff --git a/CHANGES.md b/CHANGES.md index 41e8413c55..013fd00c38 100644 --- a/CHANGES.md +++ b/CHANGES.md @@ -5,6 +5,7 @@ ### :bug: Bugs fixed +- Fix modifying shapes by apply negative tokens to border radius [Taiga #13317](https://tree.taiga.io/project/penpot/issue/13317) - Fix security issue (Path Traversal Vulnerability) on fonts related RPC method diff --git a/frontend/src/app/main/data/workspace/tokens/application.cljs b/frontend/src/app/main/data/workspace/tokens/application.cljs index c58b8c8135..80421642b1 100644 --- a/frontend/src/app/main/data/workspace/tokens/application.cljs +++ b/frontend/src/app/main/data/workspace/tokens/application.cljs @@ -49,26 +49,27 @@ ([value shape-ids attributes] (update-shape-radius-all value shape-ids attributes nil)) ([value shape-ids _attributes page-id] ; The attributes param is needed to have the same arity that other update functions (when (number? value) - (dwsh/update-shapes shape-ids - (fn [shape] - (ctsr/set-radius-to-all-corners shape value)) - {:reg-objects? true - :ignore-touched true - :page-id page-id - :attrs ctt/border-radius-keys})))) + (let [value (max 0 value)] + (dwsh/update-shapes shape-ids + (fn [shape] + (ctsr/set-radius-to-all-corners shape value)) + {:reg-objects? true + :ignore-touched true + :page-id page-id + :attrs ctt/border-radius-keys}))))) (defn update-shape-radius-for-corners ([value shape-ids attributes] (update-shape-radius-for-corners value shape-ids attributes nil)) ([value shape-ids attributes page-id] (when (number? value) - (dwsh/update-shapes shape-ids - (fn [shape] - (ctsr/set-radius-for-corners shape attributes value)) - {:reg-objects? true - :ignore-touched true - :page-id page-id - :attrs ctt/border-radius-keys})))) - + (let [value (max 0 value)] + (dwsh/update-shapes shape-ids + (fn [shape] + (ctsr/set-radius-for-corners shape attributes value)) + {:reg-objects? true + :ignore-touched true + :page-id page-id + :attrs ctt/border-radius-keys}))))) (defn update-opacity ([value shape-ids attributes] (update-opacity value shape-ids attributes nil)) ([value shape-ids _attributes page-id] ; The attributes param is needed to have the same arity that other update functions