Aller au contenu principal
Jahia Store
FR

Jahia Statuspage.io

community
Télécharger 1.0.1

Informations

Identifiant du module
jahia-statuspage-io
Identifiant de groupe
org.jahia.community
Statut
community
Catégorie
Admin Features
Auteur
Florent BOURASSE
Site web du développeur
http://www.jahia.com
Nécessite Jahia
8.2.2.1
Mis à jour
2026-07-09
Source
scm:git:git@github.com:Jahia/jahia-statuspage-io.git

A Jahia module that embeds the Jahia status page widget in two ways:

  • Back office — injected automatically into the Jahia administration interface via the UI Extender registry
  • Website — available as a draggable jnt:statuspageIoWidget component that editors can drop onto any page in jContent

The Statuspage.io page ID is configurable at runtime through an OSGi configuration, a GraphQL API, and a dedicated administration panel.

Captures d'écran

Versions

Highlights

  • Hardens the Statuspage.io pageId input/output path against JavaScript injection in the rendered widget.
  • Brings the admin configuration UI into WCAG 2.1 AA compliance (contrast, focus, live regions, programmatic labeling).
  • Fixes a regression that prevented administrators from clearing pageId, plus a broken label/input association in the config panel.

Changes

Fixes

  • Security: validate Statuspage.io pageId to prevent JS injection (bd6c6ce)
    • Enforce DNS-subdomain-label format ([a-z0-9-], 1-63 chars) in StatuspageIoConfigServiceImpl.updatePageId so attacker-controlled values cannot be persisted and later interpolated into an iframe URL or inline <script> string literal.
    • In statuspageIoWidget.jsp, re-validate the stored pageId character-by-character before injecting it into the inline script, and validate event.origin in the postMessage listener (parity with banner.js).
  • Allow empty pageId and fix label association (cf538ca)
    • Permit empty pageId in updatePageId so admins can clear the configuration without tripping the DNS-label regex; null still throws.
    • Rename the input id to statuspageio-pageId-input so the <label>'s htmlFor targets the inner <input> rather than the MUI wrapper.
  • WCAG 2.1 AA fixes per audit (883516e, follow-up to ecf4f33)
    • CRIT-1: Replace dynamic-role live region with two always-in-DOM regions (role=status + role=alert) so assistive tech never sees role mutations.
    • CRIT-2: Remove setSaveStatus(null) race from handleSave; use a saveAttempt counter as the live-region key to force re-announcement on repeated saves.
    • MAJ-1: Darken text color #5c6370 -> #4f5660 for AA contrast.
    • MAJ-2: Link color #00a0e3 -> #0072b1 for AA contrast on light backgrounds.
    • MAJ-3: Add :focus-visible outline rule (2px solid #0072b1, offset 2px).
    • MAJ-4: Convert px font sizes to rem (13px->0.8125rem25px->1.5625rem); replace line-height:85px with unitless 1.4.
    • MAJ-5: Add aria-label fallback to Page ID input for programmatic labeling.
    • MAJ-6: Add required + aria-required=true to Page ID input.
    • MAJ-7: Add useEffect to update document.title on mount.
    • MAJ-8: Banner dismissFrame: move focus to document.body before hiding; set display:none after the 1s transition to fully remove from the a11y tree.

Full Changelog1_0_0...1_0_1

Nécessite Jahia 8.2.2.1Mis à jour 2026-05-19
Nécessite Jahia 8.2.2.1Mis à jour 2026-03-27