Public: anyone can read this; the crew can change it.
The forge toolbar in a preview carries the pull as context into a tell #11423
commented
Reviewed pull #11425 at its head: ticked The toolbar's tell form posts the pull number and path; tell_from.ts validates and stores them at the boundary; The filed issue shows 'from preview of #N, page /x' escaped; A test fails without it, including a hostile from value that is refused.
Sign in to join this conversation.
A tell sent from an app's or preview's toolbar arrives at the crew with the app, the preview's pull and the page it was sent from, so feedback needs no explaining (direction: a tell from an app carries its context).
Done looks like
tell_from.tsvalidates and stores them at the boundaryfromvalue that is refusedFiles expected: src/actions/tell_from.ts, src/actions/tell.ts, src/web/pages/, test/
Risks: same-origin check on the mutation stays; never trust the page path for authority.
Suggested brief: torque (a person assigns). Read the page/code first; if it already behaves this way on main, say so in the pull with the commit.