Fix resume book, analytics, and volunteer-admin bugs - #377
Conversation
cursor
Bot
changed the title
Stop decodeURIComponent from crashing Settings on a truncated filename, wait for the matching ZIP entry instead of the previous one, and keep volunteer accounts from counting as staff. Analytics now uses unexpired memberships and chronological bootcamp terms.
e3ed7d8 to
e3b1640
Compare
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
|
Visit the preview URL for this PR (updated for commit e3b1640): https://hacklytics2027--pr-377-5r5gny9r.web.app (expires Sun, 13 Sep 2026 22:14:47 GMT) 🔥 via Firebase Hosting GitHub Action 🌎 Sign: c48ba34db61581e25fe2978355160b5eefe0e83f |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit e3b1640. Configure here.
| export function searchNeedle(search: string | undefined) { | ||
| const needle = search?.replace(/[%_\\]/g, "").replace(/\s+/g, " ").trim(); | ||
| return needle || undefined; | ||
| } |
There was a problem hiding this comment.
Search strips underscore from queries
Medium Severity
searchNeedle deletes _ from the query instead of treating it as a literal. Resume search matches name, email, and major, and emails often contain _. A query like john_doe becomes johndoe and no longer matches the stored address, so staff cannot find those people in the book.
Reviewed by Cursor Bugbot for commit e3b1640. Configure here.
1 participant
Automated PR tracking changes from
hotfix-fix-main-review-issues-9d3dintodev.Note
Medium Risk
Changes who receives admin permissions and how membership analytics are computed; resume paths touch upload validation and staff-facing download security.
Overview
Tightens resume book and upload behavior: resume list search strips SQL
LIKEwildcards and caps explicit ID lists; the ZIP builder waits on named archive entries soindex.csvcannot unblock PDF appends early; uploads require a validContent-Length, and filenames use safer decode/display helpers plus RFC 5987Content-Dispositionfor Unicode PDFs.Admin portal changes:
isAdmin(and permissions) now require a staff role viaisStaffRole, so volunteer check-in accounts no longer read as full admins. Insights growth sorts bootcamp terms chronologically withcompareTermsand counts active members only whenmembershipEndDateis still in the future (not justisActive).Reviewed by Cursor Bugbot for commit e3b1640. Bugbot is set up for automated code reviews on this repo. Configure here.