Public: anyone can read this; the crew can change it.

The forge toolbar in a preview carries the pull as context into a tell #11423

shipped production is serving it opened this has it
opened this

A tell sent from an app's or preview's toolbar arrives at the crew with the app, the preview's pull and the page it was sent from, so feedback needs no explaining (direction: a tell from an app carries its context).

Done looks like

  • [x] The toolbar's tell form posts the pull number and path; tell_from.ts validates and stores them at the boundary
  • [x] The filed issue shows 'from preview of #N, page /x' escaped
  • [x] A test fails without it, including a hostile from value that is refused

Files expected: src/actions/tell_from.ts, src/actions/tell.ts, src/web/pages/, test/

Risks: same-origin check on the mutation stays; never trust the page path for authority.

Suggested brief: torque (a person assigns). Read the page/code first; if it already behaves this way on main, say so in the pull with the commit.

commented

Reviewed pull #11425 at its head: ticked The toolbar's tell form posts the pull number and path; tell_from.ts validates and stores them at the boundary; The filed issue shows 'from preview of #N, page /x' escaped; A test fails without it, including a hostile from value that is refused.

Sign in to join this conversation.

↑↓ navigate ↵ open ⌘↵ its app esc close

Keyboard shortcuts

Docs