Skip to content

feat(#3713): add template search on GUI#3945

Open
sickwell6988 wants to merge 3 commits into
developfrom
feat/template-search
Open

feat(#3713): add template search on GUI#3945
sickwell6988 wants to merge 3 commits into
developfrom
feat/template-search

Conversation

@sickwell6988

@sickwell6988 sickwell6988 commented Jun 11, 2026

Copy link
Copy Markdown
Collaborator

Add a client-side search for Task Templates with a search field, live case-insensitive filtering, live result count and an empty-state message]

Screenshot 2026-06-11 at 22 08 12 telegram-cloud-photo-size-2-5285162085178349710-y telegram-cloud-photo-size-2-5285162085178349712-y

Add a client-side search for Task Templates with a search field, live case-insensitive filtering, live result count and an empty-state message
Add a client-side search for Task Templates with a search field, live case-insensitive filtering, live result count and an empty-state message

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Security review — PR #3945

Scope: feat(#3713): add template search on GUI (client-side template name filter in Templates.vue + i18n strings).

Prior automation threads: None found; nothing to reconcile.

Outcome: No medium, high, or critical vulnerabilities identified in the added/modified code.

What was reviewed

  • Attack surface: New search state bound to a v-text-field; used only for client-side filtering (filterByName, filteredItems) and UI copy (noResultsText, xOfYTemplates).
  • Backend / auth: No API, permission, or routing changes. Templates are still loaded via existing authenticated endpoints in ItemListPageBase; search does not fetch or expose additional data.
  • XSS (primary candidate): noResultsText interpolates user input into noTemplatesMatchSearch, but the result is passed to Vuetify v-data-table :no-results-text, which renders it as a plain text child in a <td> (not v-html). Vue text rendering escapes HTML, so a payload like <img onerror=alert(1)> is displayed literally, not executed. The xOfYTemplates counter only passes numeric counts.
  • Other classes: No injection sinks, SSRF, path traversal, deserialization, secret logging, or dependency changes in this diff.

No action required from a security standpoint for this change set.

Open in Web View Automation 

Sent by Cursor Automation: Find vulnerabilities

@sickwell6988 sickwell6988 requested a review from fiftin June 11, 2026 15:07
@sickwell6988

Copy link
Copy Markdown
Collaborator Author

#3713 - covers partially this

@sickwell6988

Copy link
Copy Markdown
Collaborator Author

Decided not to modify API, just modify GUI

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant