Mirrors/super-productivity
1
0
Fork 0
mirror of https://github.com/johannesjo/super-productivity.git synced 2026-07-17 16:37:43 +00:00
Code Issues Projects Releases Wiki Activity
super-productivity/packages
History
Johannes Millan 22e5884371
fix(caldav): discover calendars via principal/calendar-home-set #8259 (#8278) 
* fix(caldav): discover calendars via principal/calendar-home-set #8259

The CalDAV Events plugin populated its calendar dropdowns with a single
Depth:1 PROPFIND on the exact URL the user entered, keeping only
responses whose resourcetype is <calendar>. Users paste the advertised
CalDAV root (Nextcloud /remote.php/dav, Fastmail /dav/), where calendars
live one or two collection levels deeper, so the request succeeds but
lists no calendars. The dialog then showed a green 'Options loaded' tick
with empty dropdowns (loadOptions resolved with an empty array, no
error), and the Schedule showed no events because no calendar could be
selected.

Rewrite discoverCalendars to do RFC 4791 service discovery: try the
entered URL directly (back-compat for a pasted calendar-home), else
PROPFIND current-user-principal, then calendar-home-set, then enumerate
the home collection.

Discovery now follows server-controlled hrefs, so harden resolveHref to
resolve via the URL constructor and refuse any off-origin target (the
SSRF boundary, since credentials attach to every request), and drop
untrusted server data from thrown error messages. De-duplicate the XML
parse-error guard into a shared parseXmlDoc.

Add discovery test coverage (previously none), including cross-origin
href refusal.

* test(caldav): assert request origin instead of URL substring

CodeQL flagged the cross-origin discovery test's url.includes('evil...')
check (js/incomplete-url-substring-sanitization). Parse each requested
URL and assert its origin equals the entered server origin instead — a
stronger, alert-free assertion that no credentialed request escaped
off-origin.
2026-06-12 13:01:32 +02:00
..
plugin-api fix(plugins): harden nodeExecution grants (#8205) 2026-06-09 18:16:41 +02:00
plugin-dev fix(caldav): discover calendars via principal/calendar-home-set #8259 (#8278) 2026-06-12 13:01:32 +02:00
shared-schema chore(deps): bump vitest from 3.2.4 to 4.1.6 (#7687) 2026-05-20 12:50:58 +02:00
super-sync-server feat(focus-mode): focus screen UX overhaul (#7586) 2026-06-12 11:59:56 +02:00
sync-core feat: migrate to capacitor 8 2026-05-23 20:42:00 +02:00
sync-providers Merge master and address PR review findings 2026-06-10 19:17:54 +02:00
vite-plugin chore(deps): bump the npm_and_yarn group across 1 directory with 9 updates (#7259) 2026-04-18 20:35:50 +02:00
build-packages.js fix(plugin): refresh procrastination buster i18n #5102 (#8145) 2026-06-08 20:44:43 +02:00
README.md feat: cleanup and update plugins 2 2025-06-29 06:36:02 +02:00

README.md

Super Productivity Packages

This directory contains plugin packages and the plugin API for Super Productivity.

Structure

  • plugin-api/ - TypeScript definitions for the plugin API
  • plugin-dev/ - Plugin development examples and tools
    • api-test-plugin/ - Basic API test plugin
    • procrastination-buster/ - Example SolidJS-based plugin
    • yesterday-tasks-plugin/ - Simple plugin showing yesterday's tasks
    • boilerplate-solid-js/ - Template for creating new SolidJS plugins (not built)
    • sync-md/ - Markdown sync plugin (not built)

Building Packages

All packages are built automatically when running the main build process:

npm run build:packages

This command:

  1. Builds the plugin-api TypeScript definitions
  2. Builds plugins that require compilation (e.g., procrastination-buster)
  3. Copies plugin files to src/assets/ for inclusion in the app

Development

To work on a specific plugin:

cd plugin-dev/[plugin-name]
npm install
npm run dev

Adding a New Plugin

  1. Create a new directory in plugin-dev/
  2. Add the plugin configuration to /packages/build-packages.js
  3. Run npm run build:packages to test the build

Notes

  • The boilerplate-solid-js and sync-md plugins are development templates and are not included in production builds
  • Plugin files are automatically copied to src/assets/ during the build process
  • The build script handles dependency installation automatically