feature/AB#32346 - Standardize blank applicant names#2235
Merged
JamesPasta merged 6 commits intodevfrom Apr 8, 2026
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Standardizes how blank applicant names are displayed across list views and adds convenient navigation to applicant details from additional contexts.
Changes:
- Replaces the blank/unknown applicant placeholder text with a standardized “(Applicant Name)” value.
- Adds DataTables rendering for applicant name to safely display and optionally link to applicant details.
- Allows
/GrantApplicants/Detailsto resolveApplicantIdfrom anApplicationIdquery parameter (used by payments).
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/GrantApplications/Index.js | Standardizes blank applicant display value in grant applications list. |
| applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/Applicants/Index.js | Adds applicant-name rendering with standardized placeholder and safe linking to details. |
| applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/Applicants/Details.cshtml.cs | Adds ApplicationId query support to resolve ApplicantId before loading details. |
| applications/Unity.GrantManager/modules/Unity.Payments/src/Unity.Payments.Web/Pages/PaymentRequests/Index.js | Standardizes blank payee/applicant display and links to applicant details via ApplicationId. |
Comments suppressed due to low confidence (1)
applications/Unity.GrantManager/src/Unity.GrantManager.Web/Pages/GrantApplications/Index.js:609
- If the user lacks
GrantApplicationManagement.Applicants.ViewList, thedisplayrendering path returnsapplicantNamewithout HTML-escaping, which DataTables will inject as HTML. Since applicant names can include user-entered content, this is an XSS risk. Escape the display text in all cases, and only create the<a>link when the permission is granted and the id is a valid GUID.
render: function(data, type, row) {
let applicantName = (typeof data !== 'string' || data.trim() === '') ? '(Applicant Name)' : data;
if (type === 'sort' || type === 'filter') {
return applicantName;
}
if (type === 'display' && abp.auth.isGranted('GrantApplicationManagement.Applicants.ViewList')) {
const safeApplicantName = $.fn.dataTable.render.text().display(applicantName);
const applicantId = row?.applicant?.id;
const isGuid = applicantId && guidPattern.test(applicantId);
if (isGuid) {
return `<a href="/GrantApplicants/Details?ApplicantId=${encodeURIComponent(applicantId)}">${safeApplicantName}</a>`;
}
return safeApplicantName;
}
return applicantName;
},
1 similar comment
…bcgov/Unity into feature/AB#32346-applicant-name
JamesPasta
approved these changes
Apr 8, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull request overview
Standardizes how blank applicant names are displayed across list views and adds convenient navigation to applicant details from additional contexts.
Changes:
/GrantApplicants/Detailsto resolveApplicantIdfrom anApplicationIdquery parameter (used by payments).