Add Telegram as a configurable social link (#257)#260
Merged
Conversation
Adds social_telegram alongside the existing five social profile links (facebook/twitter/instagram/linkedin/bluesky), wired through every sync point: ConfigStore defaults + DB-mapping whitelist, SettingsController save/load, the General - Social form input, the footer render in both frontend and user layouts, the Organization Schema.org sameAs, and the fresh-install seed in all four locale data files. It inherits the social hardening added in 0.7.37: the URL passes through HtmlHelper::sanitizePublicHttpUrl() at output so only a clean http(s) link renders, and the href escapes with htmlspecialchars. i18n placeholder in all four locales (key parity preserved). Implements the request in #257 by Himura2la (whose PR #258 predated the social hardening refactor). social-links.spec.js now covers six socials. Closes #257
📝 WalkthroughWalkthroughIl PR aggiunge ChangesSupporto social Telegram
Estimated code review effort: 2 (Simple) | ~10 minuti Sequence Diagram(s)sequenceDiagram
participant Amministratore
participant SettingsController
participant ConfigStore
participant Frontend
Amministratore->>SettingsController: salva URL Telegram
SettingsController->>ConfigStore: aggiorna app.social_telegram
ConfigStore-->>Frontend: restituisce URL configurato
Frontend->>Frontend: sanitizza URL
Frontend-->>Amministratore: mostra link Telegram nel footer
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@app/Controllers/SettingsController.php`:
- Line 135: Sanitize and validate the non-empty social_telegram value before
persisting or caching it in SettingsController using
HtmlHelper::sanitizePublicHttpUrl(). Reject the request when the value is not a
valid public HTTP(S) URL, while preserving empty values and the existing trimmed
input handling.
In `@app/Views/settings/index.php`:
- Around line 221-225: Sostituisci HtmlHelper::e() nel valore dell’input
social_telegram con htmlspecialchars(..., ENT_QUOTES, 'UTF-8'), mantenendo il
fallback a stringa vuota e l’escaping applicato direttamente all’attributo
value.
In `@installer/database/data_en_US.sql`:
- Line 231: Prevent the seed upsert from overwriting configured social_telegram
values with an empty default by separating this entry from the default upsert or
preserving the existing setting_value. Apply the same correction at
installer/database/data_en_US.sql:231-231,
installer/database/data_de_DE.sql:233-233,
installer/database/data_fr_FR.sql:233-233, and
installer/database/data_it_IT.sql:284-284.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: 8e294c7d-94c9-4c0c-bf52-d1ecc8584abb
📒 Files selected for processing (15)
app/Controllers/FrontendController.phpapp/Controllers/SettingsController.phpapp/Support/ConfigStore.phpapp/Views/frontend/layout.phpapp/Views/settings/index.phpapp/Views/user_layout.phpinstaller/database/data_de_DE.sqlinstaller/database/data_en_US.sqlinstaller/database/data_fr_FR.sqlinstaller/database/data_it_IT.sqllocale/de_DE.jsonlocale/en_US.jsonlocale/fr_FR.jsonlocale/it_IT.jsontests/social-links.spec.js
fabiodalez-dev
added a commit
that referenced
this pull request
Jul 17, 2026
Escape social settings inputs with htmlspecialchars (CodeRabbit on #260)
Himura2la
pushed a commit
to hackerembassy/Pinakes
that referenced
this pull request
Jul 17, 2026
…alchars, not HtmlHelper::e CodeRabbit flagged the Telegram input for using HtmlHelper::e() in a view, which the project rules forbid — but all six social inputs (facebook/twitter/ instagram/linkedin/bluesky/telegram) had the same pattern. Converted them all to htmlspecialchars(..., ENT_QUOTES, 'UTF-8') for consistency, not just the one CodeRabbit saw.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #257.
Adds
social_telegramnext to the existing five social profile links, so a library can link its Telegram channel/group in the footer the same way it links Facebook, Bluesky, etc. Wired through every sync point of the (fixed-key) social system:ConfigStoredefaults + the DB→runtime mapping whitelistSettingsControllersave + load (General → Social)frontend/layout.phpanduser_layout.phpsameAsdata_{it,en,de,fr}.sql)It inherits the social hardening that shipped in 0.7.37: the URL goes through
HtmlHelper::sanitizePublicHttpUrl()at output, so only a cleanhttp(s)value renders a link (ajavascript:/data:/scheme-less/credentialed value collapses to no link), and the href escapes withhtmlspecialchars(..., ENT_QUOTES). i18n placeholder added in all four locales with key parity preserved.Credit: this implements @Himura2la's request in #257. His PR #258 predated the social-hardening refactor in 0.7.37 (which changed how all socials load/render/validate), so a rebase would have been painful; I built it directly on the hardened base and folded the escaping/validation findings from #258 into it at the same time.
tests/social-links.spec.jsnow covers six socials — the Telegram footer render (valid https → link, malicious → no link) plus the static invariants (sanitize + escape count, whitelist, sameAs). PHPStan L5 = 0, social-links E2E 27 passed.Summary by CodeRabbit
Nuove funzionalità
Localizzazione