Reserved/private SQL files (sqlpage/ prefix, dotfiles, .. traversal,
absolute paths) became directly routable over HTTP while their parsed
form was fresh in sql_file_cache. A trusted page loading such a file via
sqlpage.run_sql(...) loads it with privilege and caches it; a later
direct unprivileged request hit the fresh cache entry before the path
guard ran, returning 200 and executing the private SQL instead of 403.
The unprivileged path validation is extracted into
filesystem::validate_unprivileged_path and now enforced before
consulting the cache in both HTTP routing (AppFileStore::contains) and
the unprivileged FileCache::get_with_privilege path.
* Pagination component
* New pagination component
* Some changes
* Adding a warning about the use of LIMIT and OFFSET in the blog post
* Use icon_img for icons
* Correction of the icons size
* enhance pagination docs examples
* update pagination docs
---------
Co-authored-by: Olivier Auverlot <olivier.auverlot@icloud.com>
Co-authored-by: lovasoa <contact@ophir.dev>
* Adding an alias named contents to the html property of the shell-empty component
* Changes for the shell-empty documentation
* improve shell comoonent description
* shell-empty docs clarification
---------
Co-authored-by: Olivier Auverlot <olivier.auverlot@icloud.com>
Co-authored-by: lovasoa <contact@ophir.dev>
Add complete example with database schema, credential processing, and page protection. Update authentication migration to reference new login component. Enhance login template with default icons and autocomplete attributes. Make validate parameter optional with sensible default.
- Updated SQL queries in `create_session_token.sql` and `login.sql` to use consistent parameter naming conventions.
- Enhanced the login form in `login.sql` to include an error message for failed login attempts.
- Added a new parameter `error_message` in the migration file for better user feedback.
- Modified the Handlebars template to display the error message when applicable, improving user experience during authentication.
* A default edit and delete button can be included by specifying an "edit_url" or "delete_url"
* Custom Column based action buttons can be added in the table header using json object array in the custom_actions column.
* Custom action buttons can be defined on the row level by specifying _sqlpage_actions.
the form component now considers numbers and their string representation as equal when comparing the `value` parameter and the values from the `options` parameter in dropdowns
see https://github.com/sqlpage/SQLPage/discussions/1002
- Updated error messages to be more user-friendly and visually appealing in the browser.
- Introduced a new method for retrieving static files from the cache.
- Improved error reporting for invalid UTF-8 encoding in SQL files.
Ophir LOJKINE