Skip to content

Fix BUG_AUDIT issues: auth, admin settings, demo hardening, and listing assignment - #1399

Merged
fatihalp merged 8 commits into
openclassify:masterfrom
m1000rr:bug-audit-fixes
May 30, 2026
Merged

Fix BUG_AUDIT issues: auth, admin settings, demo hardening, and listing assignment#1399
fatihalp merged 8 commits into
openclassify:masterfrom
m1000rr:bug-audit-fixes

Conversation

@m1000rr

@m1000rr m1000rr commented May 30, 2026

Copy link
Copy Markdown
Contributor

Summary

Ports bug-audit fixes from a fork branch with unrelated git history onto current upstream master. Changes are split across 7 commits covering UI fixes, admin settings stability, auth password masking, and demo/listing hardening.

  • Fix account dropdown logout clicks being intercepted by the category row
  • Fix account menu stacking/overflow on desktop
  • Fix auth password fields not masking (Alpine.js bootstrap + type="password" fallbacks)
  • Fix admin General Settings page server error (settings config + demo middleware)
  • Add settings migration for missing general.media_disk keys on production
  • Harden demo provisioning (Turnstile requirements, capacity limits, runtime error messages)
  • Harden privileged listing assignment via applyAdminFormData() in Filament admin
  • Fix category breadcrumb queries for deep trees without eager-loaded parents
  • Isolate demo media uploads via DemoStoragePath + LocalMedia::managedDirectory()

Notes for reviewers

  • Adapted for upstream module structure (LocalMedia instead of removed S3 MediaStorage, listing Filament resources under Modules/Listing/Filament/Admin/...).
  • Filament default panel registration fix was skipped — already present on upstream.
  • English General Settings labels commit was skipped — already present on upstream.

Test plan

  • Login/register/reset password: fields mask by default, show/hide toggle works
  • Desktop header: account menu opens, logout works without category row intercepting clicks
  • Admin → General Settings loads and saves without 500 error
  • Run php artisan settings:migrate on a DB missing general.media_disk
  • Demo mode: Turnstile required in non-local env; capacity limit returns readable error
  • Admin → create/edit listing: assign user/status/slug without mass-assignment bypass
  • Category pages: breadcrumb trail correct for nested categories
  • Demo uploads land under demo/{uuid}/... paths

m1000rr and others added 8 commits May 30, 2026 08:23
…row.

Raise header menu stacking order and disable category row pointer events while account or location menus are open so logout submits reliably.

Co-authored-by: Cursor <cursoragent@cursor.com>
…acking.

Add a body class fallback to disable category link pointer events while header menus are open.

Co-authored-by: Cursor <cursoragent@cursor.com>
…flow stacking.

Keep the dropdown opening downward with right alignment, visible nav overflow while open, and disabled category link clicks so logout stays usable without clipping the trigger.

Co-authored-by: Cursor <cursoragent@cursor.com>
Start Alpine.js in the frontend bundle and add type=password fallbacks so show/hide toggles work on auth pages without Livewire.

Co-authored-by: Cursor <cursoragent@cursor.com>
Register GeneralSettings in Spatie config, run settings migrations during seeding, and keep Filament admin on the public schema when demo mode is active.

Co-authored-by: Cursor <cursoragent@cursor.com>
…ion.

Backfills media_disk and site_logo_disk when older general settings rows exist without them.

Co-authored-by: Cursor <cursoragent@cursor.com>
Port demo storage isolation, privileged listing assignment, and category breadcrumb fixes onto upstream module structure.

Co-authored-by: Cursor <cursoragent@cursor.com>
@fatihalp
fatihalp merged commit 6e6d785 into openclassify:master May 30, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants