Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
|
✅ Shadcn registry validated — no registry changes detected. |
… prevent counter drift
…thorized access to pending/spam comments
… access to pending or spam comments
packages/stack/src/plugins/comments/client/hooks/use-comments.tsx
Outdated
Show resolved
Hide resolved
… and prevent unauthorized comment posting
…rePost hook, enhancing security and preventing client-side ID manipulation
…ormalizing parentId, ensuring accurate cache targeting
…rify access control for comment list and count requests
… retrieval and enhanced security checks
…oper resolution of user ID
… for improved moderation and comments page rendering
…r clarity and consistency
…icators in the comment thread component
… for moderation, my comments, and comment thread components
…rt and "Load more" functionality
…ort in smoke tests and enhance comment thread API queries
…verification and enhance security
| ); | ||
| } | ||
|
|
||
| return await listComments(adapter, ctx.query, options?.resolveUser); |
There was a problem hiding this comment.
Client-supplied currentUserId query parameter leaks pending comments
High Severity
The currentUserId accepted as an untrusted query parameter in GET /comments is used to fetch and return that user's pending comments. Any anonymous caller can pass ?currentUserId=victimId and see the victim's pending (pre-moderation) comment bodies. No server-side session validation is performed on this value, and the onBeforeList hook doesn't gate this path because the status filter remains "approved" (the default), so the non-approved status check at the top of the handler is skipped entirely. The currentUserId for this feature needs to be resolved server-side from the authenticated session, similar to how authorId is resolved in onBeforePost.
Additional Locations (1)
| ctx.error, | ||
| "Unauthorized: Cannot change comment status", | ||
| ); | ||
| } |
There was a problem hiding this comment.
Status change and delete endpoints lack default authorization
Medium Severity
PATCH /comments/:id/status and DELETE /comments/:id proceed without any authorization when onBeforeStatusChange or onBeforeDelete hooks are absent. This is inconsistent with the secure-by-default pattern used by onBeforeEdit and onBeforeListByAuthor, which return 403 when their hooks are not configured. A developer following the minimal setup without configuring these hooks would unknowingly expose unauthenticated moderation and deletion endpoints.
Additional Locations (1)
…r identification and pending comment visibility
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
| queryKey: queries.commentCount.byResource._def, | ||
| }); | ||
| }, | ||
| }); |
There was a problem hiding this comment.
Status mutations miss infinite thread cache invalidation
Low Severity
useUpdateCommentStatus and useApproveComment do not invalidate the ["commentsThread"] infinite query cache in their onSettled handlers, while useDeleteComment and useUpdateComment both do. When a comment's status changes (e.g., approved → spam), the CommentThread component's infinite-query cache retains the stale entry, so the comment remains visible in the thread until the staleTime expires or the user navigates away.
Additional Locations (1)
1 participant
Summary
Type of change
Checklist
pnpm buildpassespnpm typecheckpassespnpm lintpassesdocs/content/docs/) if consumer-facing types or behavior changedScreenshots
Note
Medium Risk
Adds a new API surface (comments CRUD/moderation endpoints) and wires it into multiple example apps, so regressions could affect request routing and access control if hooks are misconfigured.
Overview
Introduces a new
Commentsplugin with threaded replies, likes, editing, moderation routes, and an embeddableCommentThreadUI, including new public package exports/CSS entrypoints and a version bump to@btst/stack@2.8.0.Updates docs and examples to register the plugin on both backend and client, import its CSS, and embed comments via new slot overrides (e.g.
blog.postBottomSlot,kanban.taskDetailBottomSlot), plus addsPATCHhandling to the catch-all API route configs and expands Playwright coverage with a comprehensivesmoke.comments.spec.tssuite.Written by Cursor Bugbot for commit bfd236e. This will update automatically on new commits. Configure here.