cfieldsTprojectAssign (#1819): verification trail for the raw {count} Assign/Unassign toast
#1818: verification trail for the stuck-busy cfieldsTprojectAssign fix
Refs #1818
cfieldsTprojectAssign: #1817 addendum — ?action=projects 500 verification trail
Records the fix+verification for the undefined testproject::get_list() fatal:
root cause, the correction to the original session claim, the rights matrix
(admin vs project-scoped vs no-rights vs 401/403), the browser proof the
project switcher is populated and usable, and the regression suite. Two
screenshots. Refs #1817
docs(#1821): correct the DataTables provenance (CDN 1.13.7, not the vendored 1.9.4) after code review
Modernize: cfieldsTprojectAssign - add the code-review finding (Refs #1816)
No BLOCKER across authorization/IDOR, CSRF/session, XSS, legacy parity and
i18n; one MINOR fixed in cadb3ccd1 - the save route tested the submitted
location when COUNTING a change but wrote it unconditionally, so a crafted
code answered {"changed":{"location":0}} and persisted anyway. The server
also now applies the same supports_location condition the client uses, so a
crafted row cannot set a location on an execution-only field.
Lesson recorded for the other BFFs: 'what I counted' and 'what I wrote'
being different variables is silent by construction.
docs(#1821): document why toggleAll()'s invalidateSearch() was removed, not relocated + regression suite
Modernize: Custom Fields -> Test Project cfieldsTprojectAssign (Refs #1816)
49/49 suite PASS. New Dashio screen + POST-only BFF replacing
lib/cfields/cfieldsTprojectAssign.php, now a session-guarded 302/405 shim.
Closes 4 legacy holes: cross-project authorization (a project role on A
was honored for B), unproven cfield_id[], unproven addressed project, and
state changes on GET.
6 bugs found by the browser pass, each fixed separately: #1817 (a
nonexistent testproject::get_list() made the switcher answer an empty
HTTP 500), #1818 (a stuck busy flag made every button a silent no-op, so a
discarded Save looked saved), #1819 (raw {count} in the toast), #1820 (two
missing audit_cfield_* locale labels warning on every save), #1821 (dead
Check/uncheck all - an invalidateSearch() call on an object without that
method), #1822 (duplicate assign served a DB error page as HTTP 200).
#1823 filed not fixed: missing translation data, not a screen defect.