super-productivity/src
Johannes Millan cbd0641681
fix(sync): sanitize invalid LWW projectId to the current project (#9025) (#9041)
On the LWW conflict-apply path, an invalid projectId destination was
handled inconsistently with the local handleUpdateTask strip. Unknown or
non-string ids fell back to the task's current project, but an explicit
null orphaned the task from every list (projectId = undefined). So a null
destination replayed via a disjoint-merge patch diverged: a passive client
kept the task in its project, while a conflict client orphaned it.

Sanitize any invalid destination — null/undefined, non-string, or unknown
project — to the task's current project, in every mode, mirroring the local
strip. Tasks use '' for "no project", so a null is a malformed value to
sanitize (not a signal to clear); this also matches how #9001 already
handled unknown/non-string ids. '' remains a valid no-project assignment.

The same synthetic LWW-TASK action is processed by a twin handler in
section-shared.reducer, which had the same null bug and would otherwise
strip the task from its current-project section while the task slice kept
it. Both handlers now leave the task in its current project for any invalid
destination.

Tests:
- lww-update / section-shared specs: null and unknown destinations retain
  the current project and section, in patch and replace modes; the "current
  project itself deleted -> undefined" fallback is covered.
- New integration spec composes section -> crud -> lww in registry order and
  asserts the normal-replay and LWW-patch paths converge on the same
  projectId, project.taskIds and section membership. Verified to fail on the
  pre-fix code (LWW path orphaned the task from both project and section).
2026-07-15 14:45:00 +02:00
..
app fix(sync): sanitize invalid LWW projectId to the current project (#9025) (#9041) 2026-07-15 14:45:00 +02:00
assets fix(sync): file-based provider atomicity & conflict UX (#8960) (#9004) 2026-07-14 19:23:24 +02:00
environments 18.14.0 2026-07-10 17:23:35 +02:00
static fix(security): harden XSS sinks and add Origin check (#7413) 2026-05-06 21:37:06 +02:00
styles fix(android): keep material icons aligned with system font scaling (#8992) 2026-07-14 12:38:12 +02:00
test-helpers build: improve testing setup to give indication about which test hangs 2025-07-18 12:11:05 +02:00
typings refactor: improve typing 2025-09-16 18:04:40 +02:00
_common.scss refactor: modernize scss syntax and get rid of most of the warnings 2025-09-04 20:29:24 +02:00
favicon.ico
hammer-config.class.ts feat: replace hammerjs with custom swipe and pan directives 2025-08-10 12:56:11 +02:00
index.html fix(security): stored XSS → RCE chain — note image, plugin nodeExecution, CSP (GHSA-78rv-m663-4fph) (#8178) 2026-06-08 20:20:17 +02:00
karma.conf.js chore(task-repeat): revert RRULE Phase 1 from master (#7948) Develop the full RFC-5545 RRULE epic on the long-running feat/rrule-epic branch and merge once complete and testable in final form, rather than landing 13 phases into master one half-state at a time. Work preserved on feat/rrule-epic. Not yet shipped (post-v18.9.1), so no user impact. 2026-06-09 13:56:38 +02:00
main.ts feat(sync): conflict journal + disjoint-field auto-merge + review UI (#8874) 2026-07-11 17:48:46 +02:00
manifest.json
polyfills.ts fix(schedule): indicate tasks beyond available time 2026-05-11 14:30:55 +02:00
styles.scss fix(android): reserve full system-bar inset for the mobile bottom nav (#8792) (#8799) 2026-07-06 18:34:24 +02:00
test.ts chore: remove unused eslint-disable directives 2026-06-10 17:35:37 +02:00
tsconfig.app.json fix(build): exclude test helpers from production build 2026-02-25 16:46:51 +01:00
tsconfig.spec.json chore(ui): removes dead utilities and op-log leftovers [#8260 - Tier A] (#8892) 2026-07-11 13:05:34 +02:00
tsconfig.worker.json build: update configuration files 2025-06-27 10:25:00 +02:00