web-mojo 2.5.16 → 2.5.17

package/CHANGELOG.md

@@ -2,6 +2,11 @@
 
 ## Unreleased
 
+### Forms · Fixed double-escaped form field text (labels, values, placeholders, …)
+
+- **`FormBuilder` HTML-escaped field text twice.** Every render method pre-escaped `label` / `placeholder` / `help` / `tooltip` / `error` (and the field `value` / `fieldValue`) with `escapeHtml()` and *then* rendered them through Mustache `{{…}}` (which escapes again), so e.g. a label `Verification & Compliance` rendered as the literal `Verification & Compliance`, and a value `Tom & Jerry` would submit as `Tom & Jerry`. Most visible on app-registered permission toggles (labels often contain `&`), but it affected text/email/number inputs, select, textarea, json, color, range, file, image, radio, checkbox, and switch fields.
+- **Fix:** the raw text is now handed to Mustache, which escapes it exactly once (and is attribute-safe — it escapes quotes). Pre-escaping is kept only where it's still needed: manually-built HTML strings (`attrs`, `optionsHTML`, the `header`/legend) injected via `{{{…}}}`. Regression tests in `test/unit/FormBuilder.escaping.test.js` cover switch, checkbox, input (label/placeholder/value), select, and tooltip text.
+
 ### Build · Clean up admin build warnings
 
 - **Fixed a malformed comment in `admin.css`** (`.runner-detailsPrint Styles */` — a stray `*/` with no opening `/*`) that produced an esbuild `Unexpected "/"` CSS-minify warning and could drop the following runner/task-details rules.

package/dist/admin-models.cjs.js

@@ -1,2 +1,2 @@
-"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const e=require("./chunks/admin-models-DOBTTiyR.js");exports.ActiveJobsList=e.ActiveJobsList,exports.Assistant=e.AssistantConversation,exports.AssistantConversation=e.AssistantConversation,exports.AssistantConversationList=e.AssistantConversationList,exports.AssistantSkill=e.AssistantSkill,exports.AssistantSkillList=e.AssistantSkillList,exports.BouncerDevice=e.BouncerDevice,exports.BouncerDeviceList=e.BouncerDeviceList,exports.BouncerSignal=e.BouncerSignal,exports.BouncerSignalList=e.BouncerSignalList,exports.BouncerSignature=e.BouncerSignature,exports.BouncerSignatureForms=e.BouncerSignatureForms,exports.BouncerSignatureList=e.BouncerSignatureList,exports.BundleByOptions=e.BundleByOptions,exports.BundleMinutesOptions=e.BundleMinutesOptions,exports.CommonBlockCountries=e.CommonBlockCountries,exports.CommonCategoryOptions=e.CommonCategoryOptions,exports.CommonEventFields=e.CommonEventFields,exports.CommonScopeOptions=e.CommonScopeOptions,exports.ComparatorOptions=e.ComparatorOptions,exports.DAY_LABELS=e.DAY_LABELS,exports.EmailDomain=e.EmailDomain,exports.EmailDomainForms=e.EmailDomainForms,exports.EmailDomainList=e.EmailDomainList,exports.EmailTemplate=e.EmailTemplate,exports.EmailTemplateForms=e.EmailTemplateForms,exports.EmailTemplateList=e.EmailTemplateList,exports.IPSet=e.IPSet,exports.IPSetForms=e.IPSetForms,exports.IPSetKindBadgeOptions=e.IPSetKindBadgeOptions,exports.IPSetKindOptions=e.IPSetKindOptions,exports.IPSetList=e.IPSetList,exports.IPSetSourceOptions=e.IPSetSourceOptions,exports.Incident=e.Incident,exports.IncidentEvent=e.IncidentEvent,exports.IncidentEventForms=e.IncidentEventForms,exports.IncidentEventList=e.IncidentEventList,exports.IncidentForms=e.IncidentForms,exports.IncidentHistory=e.IncidentHistory,exports.IncidentHistoryList=e.IncidentHistoryList,exports.IncidentList=e.IncidentList,exports.IncidentRule=e.IncidentRule,exports.IncidentRuleList=e.IncidentRuleList,exports.IncidentRuleSet=e.IncidentRuleSet,exports.IncidentRuleSetList=e.IncidentRuleSetList,exports.IncidentStats=e.IncidentStats,exports.Job=e.Job,exports.JobEvent=e.JobEvent,exports.JobEventList=e.JobEventList,exports.JobForms=e.JobForms,exports.JobList=e.JobList,exports.JobLog=e.JobLog,exports.JobLogList=e.JobLogList,exports.JobRunner=e.JobRunner,exports.JobRunnerForms=e.JobRunnerForms,exports.JobRunnerList=e.JobRunnerList,exports.JobsEngineStats=e.JobsEngineStats,exports.LoginEvent=e.LoginEvent,exports.LoginEventList=e.LoginEventList,exports.Mailbox=e.Mailbox,exports.MailboxForms=e.MailboxForms,exports.MailboxList=e.MailboxList,exports.MatchByOptions=e.MatchByOptions,exports.PhoneConfig=e.PhoneConfig,exports.PhoneConfigForms=e.PhoneConfigForms,exports.PhoneConfigList=e.PhoneConfigList,exports.PhoneNumber=e.PhoneNumber,exports.PhoneNumberList=e.PhoneNumberList,exports.Phonehub=e.Phonehub,exports.PublicMessage=e.PublicMessage,exports.PublicMessageCategoryOptions=e.PublicMessageCategoryOptions,exports.PublicMessageKindOptions=e.PublicMessageKindOptions,exports.PublicMessageList=e.PublicMessageList,exports.PublicMessageMetadataLabels=e.PublicMessageMetadataLabels,exports.PublicMessageSeverityOptions=e.PublicMessageSeverityOptions,exports.PublicMessageStatusOptions=e.PublicMessageStatusOptions,exports.PushConfig=e.PushConfig,exports.PushConfigForms=e.PushConfigForms,exports.PushConfigList=e.PushConfigList,exports.PushDelivery=e.PushDelivery,exports.PushDeliveryList=e.PushDeliveryList,exports.PushDevice=e.PushDevice,exports.PushDeviceList=e.PushDeviceList,exports.PushTemplate=e.PushTemplate,exports.PushTemplateForms=e.PushTemplateForms,exports.PushTemplateList=e.PushTemplateList,exports.RelatedIncidentsList=e.RelatedIncidentsList,exports.Rule=e.Rule,exports.RuleForms=e.RuleForms,exports.RuleList=e.RuleList,exports.RuleSet=e.RuleSet,exports.RuleSetForms=e.RuleSetForms,exports.RuleSetList=e.RuleSetList,exports.S3Bucket=e.S3Bucket,exports.S3BucketForms=e.S3BucketForms,exports.S3BucketList=e.S3BucketList,exports.SMS=e.SMS,exports.SMSList=e.SMSList,exports.ScheduledTask=e.ScheduledTask,exports.ScheduledTaskForms=e.ScheduledTaskForms,exports.ScheduledTaskList=e.ScheduledTaskList,exports.SentMessage=e.SentMessage,exports.SentMessageForms=e.SentMessageForms,exports.SentMessageList=e.SentMessageList,exports.SimilarJobsList=e.SimilarJobsList,exports.TaskResult=e.TaskResult,exports.TaskResultList=e.TaskResultList,exports.Ticket=e.Ticket,exports.TicketCategories=e.TicketCategories,exports.TicketForms=e.TicketForms,exports.TicketList=e.TicketList,exports.TicketNote=e.TicketNote,exports.TicketNoteList=e.TicketNoteList,exports.ValueTypeOptions=e.ValueTypeOptions;
+"use strict";Object.defineProperty(exports,Symbol.toStringTag,{value:"Module"});const e=require("./chunks/admin-models-CI9bXwXg.js");exports.ActiveJobsList=e.ActiveJobsList,exports.Assistant=e.AssistantConversation,exports.AssistantConversation=e.AssistantConversation,exports.AssistantConversationList=e.AssistantConversationList,exports.AssistantSkill=e.AssistantSkill,exports.AssistantSkillList=e.AssistantSkillList,exports.BouncerDevice=e.BouncerDevice,exports.BouncerDeviceList=e.BouncerDeviceList,exports.BouncerSignal=e.BouncerSignal,exports.BouncerSignalList=e.BouncerSignalList,exports.BouncerSignature=e.BouncerSignature,exports.BouncerSignatureForms=e.BouncerSignatureForms,exports.BouncerSignatureList=e.BouncerSignatureList,exports.BundleByOptions=e.BundleByOptions,exports.BundleMinutesOptions=e.BundleMinutesOptions,exports.CommonBlockCountries=e.CommonBlockCountries,exports.CommonCategoryOptions=e.CommonCategoryOptions,exports.CommonEventFields=e.CommonEventFields,exports.CommonScopeOptions=e.CommonScopeOptions,exports.ComparatorOptions=e.ComparatorOptions,exports.DAY_LABELS=e.DAY_LABELS,exports.EmailDomain=e.EmailDomain,exports.EmailDomainForms=e.EmailDomainForms,exports.EmailDomainList=e.EmailDomainList,exports.EmailTemplate=e.EmailTemplate,exports.EmailTemplateForms=e.EmailTemplateForms,exports.EmailTemplateList=e.EmailTemplateList,exports.IPSet=e.IPSet,exports.IPSetForms=e.IPSetForms,exports.IPSetKindBadgeOptions=e.IPSetKindBadgeOptions,exports.IPSetKindOptions=e.IPSetKindOptions,exports.IPSetList=e.IPSetList,exports.IPSetSourceOptions=e.IPSetSourceOptions,exports.Incident=e.Incident,exports.IncidentEvent=e.IncidentEvent,exports.IncidentEventForms=e.IncidentEventForms,exports.IncidentEventList=e.IncidentEventList,exports.IncidentForms=e.IncidentForms,exports.IncidentHistory=e.IncidentHistory,exports.IncidentHistoryList=e.IncidentHistoryList,exports.IncidentList=e.IncidentList,exports.IncidentRule=e.IncidentRule,exports.IncidentRuleList=e.IncidentRuleList,exports.IncidentRuleSet=e.IncidentRuleSet,exports.IncidentRuleSetList=e.IncidentRuleSetList,exports.IncidentStats=e.IncidentStats,exports.Job=e.Job,exports.JobEvent=e.JobEvent,exports.JobEventList=e.JobEventList,exports.JobForms=e.JobForms,exports.JobList=e.JobList,exports.JobLog=e.JobLog,exports.JobLogList=e.JobLogList,exports.JobRunner=e.JobRunner,exports.JobRunnerForms=e.JobRunnerForms,exports.JobRunnerList=e.JobRunnerList,exports.JobsEngineStats=e.JobsEngineStats,exports.LoginEvent=e.LoginEvent,exports.LoginEventList=e.LoginEventList,exports.Mailbox=e.Mailbox,exports.MailboxForms=e.MailboxForms,exports.MailboxList=e.MailboxList,exports.MatchByOptions=e.MatchByOptions,exports.PhoneConfig=e.PhoneConfig,exports.PhoneConfigForms=e.PhoneConfigForms,exports.PhoneConfigList=e.PhoneConfigList,exports.PhoneNumber=e.PhoneNumber,exports.PhoneNumberList=e.PhoneNumberList,exports.Phonehub=e.Phonehub,exports.PublicMessage=e.PublicMessage,exports.PublicMessageCategoryOptions=e.PublicMessageCategoryOptions,exports.PublicMessageKindOptions=e.PublicMessageKindOptions,exports.PublicMessageList=e.PublicMessageList,exports.PublicMessageMetadataLabels=e.PublicMessageMetadataLabels,exports.PublicMessageSeverityOptions=e.PublicMessageSeverityOptions,exports.PublicMessageStatusOptions=e.PublicMessageStatusOptions,exports.PushConfig=e.PushConfig,exports.PushConfigForms=e.PushConfigForms,exports.PushConfigList=e.PushConfigList,exports.PushDelivery=e.PushDelivery,exports.PushDeliveryList=e.PushDeliveryList,exports.PushDevice=e.PushDevice,exports.PushDeviceList=e.PushDeviceList,exports.PushTemplate=e.PushTemplate,exports.PushTemplateForms=e.PushTemplateForms,exports.PushTemplateList=e.PushTemplateList,exports.RelatedIncidentsList=e.RelatedIncidentsList,exports.Rule=e.Rule,exports.RuleForms=e.RuleForms,exports.RuleList=e.RuleList,exports.RuleSet=e.RuleSet,exports.RuleSetForms=e.RuleSetForms,exports.RuleSetList=e.RuleSetList,exports.S3Bucket=e.S3Bucket,exports.S3BucketForms=e.S3BucketForms,exports.S3BucketList=e.S3BucketList,exports.SMS=e.SMS,exports.SMSList=e.SMSList,exports.ScheduledTask=e.ScheduledTask,exports.ScheduledTaskForms=e.ScheduledTaskForms,exports.ScheduledTaskList=e.ScheduledTaskList,exports.SentMessage=e.SentMessage,exports.SentMessageForms=e.SentMessageForms,exports.SentMessageList=e.SentMessageList,exports.SimilarJobsList=e.SimilarJobsList,exports.TaskResult=e.TaskResult,exports.TaskResultList=e.TaskResultList,exports.Ticket=e.Ticket,exports.TicketCategories=e.TicketCategories,exports.TicketForms=e.TicketForms,exports.TicketList=e.TicketList,exports.TicketNote=e.TicketNote,exports.TicketNoteList=e.TicketNoteList,exports.ValueTypeOptions=e.ValueTypeOptions;
 //# sourceMappingURL=admin-models.cjs.js.map

package/dist/admin-models.es.js

@@ -1,2 +1,2 @@
-import{a0 as s,g as a,g as e,A as t,aj as i,ak as n,a9 as o,aa as u,a7 as l,a8 as r,ap as c,aq as m,ab as L,B as S,d,ah as g,C as P,ar as b,as as p,at as h,au as I,r as F,av as k,E as v,u as M,aw as T,v as B,ac as C,af as E,ad as R,ax as O,ag as J,ae as y,h as D,p as A,ay as f,I as x,k as N,f as K,e as H,b as j,az as V,aA as Y,aB as _,aC as q,aD as w,J as z,aE as G,a4 as Q,a6 as U,a1 as W,aF as X,a2 as Z,_ as $,Z as ss,a3 as as,$ as es,aG as ts,L as is,t as ns,aH as os,s as us,M as ls,O as rs,Q as cs,U as ms,G as Ls,H as Ss,aI as ds,x as gs,aJ as Ps,y as bs,D as ps,z as hs,aK as Is,F as Fs,aL as ks,aM as vs,W as Ms,Y as Ts,V as Bs,aN as Cs,P as Es,aO as Rs,aP as Os,X as Js,i as ys,n as Ds,aQ as As,c as fs,R as xs,m as Ns,q as Ks,aR as Hs,aS as js,ai as Vs,K as Ys,N as _s,am as qs,al as ws,aT as zs,S as Gs,aU as Qs,w as Us,a5 as Ws,aV as Xs,aW as Zs,j as $s,o as sa,l as aa,T as ea,ao as ta,an as ia,aX as na}from"./chunks/admin-models-DZuzX9qA.js";export{s as ActiveJobsList,a as Assistant,e as AssistantConversation,t as AssistantConversationList,i as AssistantSkill,n as AssistantSkillList,o as BouncerDevice,u as BouncerDeviceList,l as BouncerSignal,r as BouncerSignalList,c as BouncerSignature,m as BouncerSignatureForms,L as BouncerSignatureList,S as BundleByOptions,d as BundleMinutesOptions,g as CommonBlockCountries,P as CommonCategoryOptions,b as CommonEventFields,p as CommonScopeOptions,h as ComparatorOptions,I as DAY_LABELS,F as EmailDomain,k as EmailDomainForms,v as EmailDomainList,M as EmailTemplate,T as EmailTemplateForms,B as EmailTemplateList,C as IPSet,E as IPSetForms,R as IPSetKindBadgeOptions,O as IPSetKindOptions,J as IPSetList,y as IPSetSourceOptions,D as Incident,A as IncidentEvent,f as IncidentEventForms,x as IncidentEventList,N as IncidentForms,K as IncidentHistory,H as IncidentHistoryList,j as IncidentList,V as IncidentRule,Y as IncidentRuleList,_ as IncidentRuleSet,q as IncidentRuleSetList,w as IncidentStats,z as Job,G as JobEvent,Q as JobEventList,U as JobForms,W as JobList,X as JobLog,Z as JobLogList,$ as JobRunner,ss as JobRunnerForms,as as JobRunnerList,es as JobsEngineStats,ts as LoginEvent,is as LoginEventList,ns as Mailbox,os as MailboxForms,us as MailboxList,ls as MatchByOptions,rs as PhoneConfig,cs as PhoneConfigForms,ms as PhoneConfigList,Ls as PhoneNumber,Ss as PhoneNumberList,ds as Phonehub,gs as PublicMessage,Ps as PublicMessageCategoryOptions,bs as PublicMessageKindOptions,ps as PublicMessageList,hs as PublicMessageMetadataLabels,Is as PublicMessageSeverityOptions,Fs as PublicMessageStatusOptions,ks as PushConfig,vs as PushConfigForms,Ms as PushConfigList,Ts as PushDelivery,Bs as PushDeliveryList,Cs as PushDevice,Es as PushDeviceList,Rs as PushTemplate,Os as PushTemplateForms,Js as PushTemplateList,ys as RelatedIncidentsList,Ds as Rule,As as RuleForms,fs as RuleList,xs as RuleSet,Ns as RuleSetForms,Ks as RuleSetList,Hs as S3Bucket,js as S3BucketForms,Vs as S3BucketList,Ys as SMS,_s as SMSList,qs as ScheduledTask,ws as ScheduledTaskForms,zs as ScheduledTaskList,Gs as SentMessage,Qs as SentMessageForms,Us as SentMessageList,Ws as SimilarJobsList,Xs as TaskResult,Zs as TaskResultList,$s as Ticket,sa as TicketCategories,aa as TicketForms,ea as TicketList,ta as TicketNote,ia as TicketNoteList,na as ValueTypeOptions};
+import{a0 as s,g as a,g as e,A as t,aj as i,ak as n,a9 as o,aa as u,a7 as l,a8 as r,ap as c,aq as m,ab as L,B as S,d,ah as g,C as P,ar as b,as as p,at as h,au as I,r as F,av as k,E as v,u as M,aw as T,v as B,ac as C,af as E,ad as R,ax as O,ag as J,ae as y,h as D,p as A,ay as f,I as x,k as N,f as K,e as H,b as j,az as V,aA as Y,aB as _,aC as q,aD as w,J as z,aE as G,a4 as Q,a6 as U,a1 as W,aF as X,a2 as Z,_ as $,Z as ss,a3 as as,$ as es,aG as ts,L as is,t as ns,aH as os,s as us,M as ls,O as rs,Q as cs,U as ms,G as Ls,H as Ss,aI as ds,x as gs,aJ as Ps,y as bs,D as ps,z as hs,aK as Is,F as Fs,aL as ks,aM as vs,W as Ms,Y as Ts,V as Bs,aN as Cs,P as Es,aO as Rs,aP as Os,X as Js,i as ys,n as Ds,aQ as As,c as fs,R as xs,m as Ns,q as Ks,aR as Hs,aS as js,ai as Vs,K as Ys,N as _s,am as qs,al as ws,aT as zs,S as Gs,aU as Qs,w as Us,a5 as Ws,aV as Xs,aW as Zs,j as $s,o as sa,l as aa,T as ea,ao as ta,an as ia,aX as na}from"./chunks/admin-models-C7I47DbC.js";export{s as ActiveJobsList,a as Assistant,e as AssistantConversation,t as AssistantConversationList,i as AssistantSkill,n as AssistantSkillList,o as BouncerDevice,u as BouncerDeviceList,l as BouncerSignal,r as BouncerSignalList,c as BouncerSignature,m as BouncerSignatureForms,L as BouncerSignatureList,S as BundleByOptions,d as BundleMinutesOptions,g as CommonBlockCountries,P as CommonCategoryOptions,b as CommonEventFields,p as CommonScopeOptions,h as ComparatorOptions,I as DAY_LABELS,F as EmailDomain,k as EmailDomainForms,v as EmailDomainList,M as EmailTemplate,T as EmailTemplateForms,B as EmailTemplateList,C as IPSet,E as IPSetForms,R as IPSetKindBadgeOptions,O as IPSetKindOptions,J as IPSetList,y as IPSetSourceOptions,D as Incident,A as IncidentEvent,f as IncidentEventForms,x as IncidentEventList,N as IncidentForms,K as IncidentHistory,H as IncidentHistoryList,j as IncidentList,V as IncidentRule,Y as IncidentRuleList,_ as IncidentRuleSet,q as IncidentRuleSetList,w as IncidentStats,z as Job,G as JobEvent,Q as JobEventList,U as JobForms,W as JobList,X as JobLog,Z as JobLogList,$ as JobRunner,ss as JobRunnerForms,as as JobRunnerList,es as JobsEngineStats,ts as LoginEvent,is as LoginEventList,ns as Mailbox,os as MailboxForms,us as MailboxList,ls as MatchByOptions,rs as PhoneConfig,cs as PhoneConfigForms,ms as PhoneConfigList,Ls as PhoneNumber,Ss as PhoneNumberList,ds as Phonehub,gs as PublicMessage,Ps as PublicMessageCategoryOptions,bs as PublicMessageKindOptions,ps as PublicMessageList,hs as PublicMessageMetadataLabels,Is as PublicMessageSeverityOptions,Fs as PublicMessageStatusOptions,ks as PushConfig,vs as PushConfigForms,Ms as PushConfigList,Ts as PushDelivery,Bs as PushDeliveryList,Cs as PushDevice,Es as PushDeviceList,Rs as PushTemplate,Os as PushTemplateForms,Js as PushTemplateList,ys as RelatedIncidentsList,Ds as Rule,As as RuleForms,fs as RuleList,xs as RuleSet,Ns as RuleSetForms,Ks as RuleSetList,Hs as S3Bucket,js as S3BucketForms,Vs as S3BucketList,Ys as SMS,_s as SMSList,qs as ScheduledTask,ws as ScheduledTaskForms,zs as ScheduledTaskList,Gs as SentMessage,Qs as SentMessageForms,Us as SentMessageList,Ws as SimilarJobsList,Xs as TaskResult,Zs as TaskResultList,$s as Ticket,sa as TicketCategories,aa as TicketForms,ea as TicketList,ta as TicketNote,ia as TicketNoteList,na as ValueTypeOptions};
 //# sourceMappingURL=admin-models.es.js.map