[OpenNMS/opennms] 3139a2: NMS-19851: fix adversarial review findings on the ...

  Branch: refs/heads/jira/NMS-19851-configurable-dashboard
  Home:   https://github.com/OpenNMS/opennms
  Commit: 3139a2df5ee74d1d5fd6e63acd7d7fee3b66c8d8
      https://github.com/OpenNMS/opennms/commit/3139a2df5ee74d1d5fd6e63acd7d7fee3b66c8d8
  Author: Jose Anes <[email protected]>
  Date:   2026-07-31 (Fri, 31 Jul 2026)

  Changed paths:
    A opennms-webapp-rest/127.0.0.1.tm3.epoch
    M opennms-webapp-rest/src/main/java/org/opennms/web/rest/v2/NewsFeedRestService.java
    A opennms-webapp-rest/tmlog3.log
    M opennms-webapp/src/main/webapp/WEB-INF/applicationContext-spring-security.xml
    M opennms-webapp/src/main/webapp/WEB-INF/web.xml
    M ui/src/components/Dashboard/DashboardFilterControl.vue
    M ui/src/components/Dashboard/DashboardGrid.vue
    M ui/src/components/Dashboard/DashboardToolbar.vue
    A ui/src/components/Dashboard/filter.ts
    M ui/src/components/Dashboard/panels/AvailabilityPanel.vue
    M ui/src/components/Dashboard/panels/HtmlContentPanel.vue
    M ui/src/components/Dashboard/panels/MetricChartPanel.vue
    M ui/src/components/Dashboard/panels/NodesWithAlarmsPanel.vue
    M ui/src/components/Dashboard/panels/OutagesPanel.vue
    M ui/src/components/Dashboard/panels/SituationsPanel.vue
    M ui/src/components/Dashboard/panels/TopnPanel.vue
    M ui/src/components/Dashboard/severity.ts
    M ui/src/containers/Dashboard.vue
    M ui/src/services/dashboardService.ts
    M ui/src/services/outageService.ts
    M ui/src/services/situationService.ts
    M ui/src/services/topnService.ts
    M ui/src/stores/dashboardStore.ts
    A ui/tests/components/Dashboard/HtmlContentPanel.test.ts
    A ui/tests/components/Dashboard/filter.test.ts
    M ui/tests/services/dashboardService.test.ts
    A ui/tests/services/topnService.test.ts
    M ui/tests/stores/dashboardStore.test.ts

  Log Message:
  -----------
  NMS-19851: fix adversarial review findings on the dashboard

Correctness: the grid now applies a loaded layout (a layout-revision watch
rebuilds geometry, and geometry is only written back while editing, so a
saved arrangement is no longer overwritten by defaults on open); a failed
load keeps the current layout instead of fabricating the default that a
Save would then persist; a partial/corrupt stored document is normalized
so it can't crash every user's homepage; route re-entry preserves unsaved
edits. Top-N maps measurements to sources by the label index the backend
returns (not position, which is hash-ordered); Nodes-with-Alarms counts
only unacknowledged WARNING+ alarms; Top-N and the metric chart guard
against stale concurrent responses.

Security: the HTML-content iframe only loads validated same-origin http(s)
URLs (a persisted javascript:/data: URL no longer executes); the app-wide
fullscreen Permissions-Policy relaxation is reverted (the toolbar falls
back to CSS maximize); the dashboard security rules no longer shadow the
/api/v2 GET catch-all; Edit/Save are admin-only, matching the layout PUT.

Features: the global filter (surveillance categories resolved to node ids,
plus IP match) now constrains the node-scoped panels; a custom timeframe
gains a real date-range picker and panels react to from/to; the newsfeed
honors opennms.newsFeedPanel.show=false without any outbound request.

Adds tests for the store, service normalization/errors, the filter helper,
Top-N mapping, and the iframe URL guard.



To unsubscribe from these emails, change your notification settings at https://github.com/OpenNMS/opennms/settings/notifications


_______________________________________________
Please read the OpenNMS Mailing List FAQ:
http://www.opennms.org/wiki/index.php?page=MailingListFaq
opennms-cvs mailing list

To *unsubscribe* or change your subscription options, see the bottom of this page:
https://lists.sourceforge.net/lists/listinfo/opennms-cvs