DasPoschi/hermes-webui
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

harden(#4063): stamp disclosure-state snapshot with session id (Opus belt-and-suspenders)

Browse Source 
_captureWorklogDetailDisclosureState stamps state._sid; _restoreWorklogDetailDisclosureState
skips restore on sid mismatch. Cross-session isolation no longer depends solely on the
sessions.js #msgInner wipe invariant — a future change to that loading-placeholder
behavior can't silently replay one session's collapse state onto another.
This commit is contained in:
nesquena-hermes
2026-06-13 04:47:36 +00:00
parent c9930d2a3d
commit 2bd8b40b15
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
static/ui.js
View File

@@ -6733,6 +6733,12 @@ function _worklogDetailDisclosureKeyForElement(el, counts){
function _captureWorklogDetailDisclosureState(root){
const state=new Map();
if(!root||!root.querySelectorAll) return state;
// Stamp the capturing session so a restore can't replay one session's
// disclosure state onto another. Cross-session switches currently wipe
// #msgInner (sessions.js loading placeholder) so the capture is normally
// empty, but the ordinal/derived keys carry no session id — this stamp makes
// the isolation explicit instead of depending on that wipe invariant. (Opus #4063.)
try{ state._sid=S.session?S.session.session_id:null; }catch(_){ state._sid=null; }
const counts=Object.create(null);
root.querySelectorAll(_worklogDetailDisclosureSelector).forEach(el=>{
const key=_worklogDetailDisclosureKeyForElement(el, counts);
@@ -6742,6 +6748,8 @@ function _captureWorklogDetailDisclosureState(root){
}
function _restoreWorklogDetailDisclosureState(root, state){
if(!root||!root.querySelectorAll||!state||!state.size) return;
// Don't restore a snapshot captured under a different session.
try{ if(state._sid!==undefined && state._sid!==(S.session?S.session.session_id:null)) return; }catch(_){ /* fall through */ }
const counts=Object.create(null);
root.querySelectorAll(_worklogDetailDisclosureSelector).forEach(el=>{
const key=_worklogDetailDisclosureKeyForElement(el, counts);