Repository navigation
fix(security): upgrade zotero-plugin-toolkit to 6.0.0 - #322
Closed
POBrien333 wants to merge 32 commits into
Closed
POBrien333 wants to merge 32 commits into
POBrien333 wants to merge 32 commits into
Conversation
The zotero-plugin-scaffold template() function calls str.matchAll(), which requires all build.define values to be strings. The author field was passing the full author object from package.json instead of just the name string, causing a TypeError. Changed author: pkg.author to author: pkg.author.name to fix this.
Rename the plugin from 'My Custom Styles' to 'Citation Styler Client Sync' and update the repository name to 'citationstyler-client-sync'. Changes: - Updated package.json: name, addonName, addonID, addonRef, addonInstance, prefsPrefix, and repository URL - Updated all localization IDs from 'mycustomstyles-*' to 'citationstyler-sync-*' - Updated all documentation (README.md, CLAUDE.md, doc/README-deAT.md) - Updated addon manifest references and preferences template - Updated TypeScript i10n type definitions - Updated .ftl localization file prefixes
Updated all user-visible plugin display strings across English and German locales to use the 'Citation Styler' brand name instead of 'My Custom Styles' or 'Meine Zitierstile'. This affects: - Zotero preferences sidebar label (prefs-title) - Preferences pane heading (citationstyler-sync-prefs-title) - Main window menu item (citationstyler-sync-menu-item-label) - Startup status messages (startup-begin, startup-finish) 'Citation Styler' is kept unchanged in German as a proper product name (standard practice for brand names across languages).
When a user verifies credentials but no styles are available, the previous message 'Could not load styles. Check your connection.' implied a connectivity issue and made users think they made a mistake. This can occur when styles haven't been configured on the server for their license. Changed the message to 'Style(s) not available. Please contact support at info@citationstyler.com.' to make it clear this may be a backend issue requiring support intervention, reducing customer confusion and support tickets.
… bump - Add src/utils/theme.ts with isDarkMode() and getColors() helpers - Update customStyles.ts and hooks.ts to use theme-aware colors for all JS-rendered UI - Add white favicon variant for dark mode sidebar icon - Rename prefs pane heading to 'Citation Styler Client Sync' and inject version number (e.g. v1.0.1) via JS - Bump zotero-plugin-scaffold from 0.8.2 to 0.8.5 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Add src/utils/logger.ts with in-memory log buffer (csLog, getFormattedLogs) - Replace ztoolkit.log calls with csLog throughout hooks.ts, license.ts, customStyles.ts - Add INFO/WARN breadcrumbs at key lifecycle points for richer diagnostics - Add 'Copy Logs' button in prefs alongside Verify/Clear buttons - Bump version to 1.0.2 - Add changelog to README Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Switch API_BASE from staging.citationstyler.com to citationstyler.com - Fix Prettier formatting across all recently modified files (lint CI fix) - Upgrade actions/upload-artifact from v4 to v5 (resolve Node.js 20 deprecation)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Zotero's style registry is not immediately queryable after zotero.Styles.install() resolves, so getStyleStatus() would still return "not-installed" on the next render() call. Track styles installed in the current session with a local Set and pass it to buildStyleRow so the button immediately reflects the correct state.
…dating fix: install button stays on Install after style is installed
chore: support Zotero 10 (bump strict_max_version to 10.*)
Toolkit 5.x registered the zotero://plugin and zotero://ztoolkit-debug protocol bridges, which let a web page trigger add-on installs or code execution via zotero:// links. 6.0.0 removes them. 6.0 drops the all-in-one ZoteroToolkit export, so replace it with a minimal BasicTool subclass covering what the plugin actually uses (getGlobal, log, unregisterAll). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Author
|
Opened against the wrong repository by mistake, sorry for the noise. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
A security scan of the built XPI flagged two
zotero://protocol bridges registered by zotero-plugin-toolkit 5.1.0-beta.13:zotero://plugin: a web page could make Zotero install add-ons without a prompt (medium)zotero://ztoolkit-debug: a link could run code if the user approved a prompt (medium)Toolkit 6.0.0 removes both.
Changes
zotero-plugin-toolkit^5.1.0-beta.13→^6.0.0ZoteroToolkit.src/utils/ztoolkit.tsnow uses a minimalBasicToolsubclass covering only what the plugin uses:getGlobal,log,basicOptions,unregisterAll. Unused UI log options and the ProgressWindow icon setup are removed.typings/global.d.tsderives its type fromcreateZToolkit, so it needed no change.Verification
npm run build(bundle +tsc --noEmit) passeszotero://plugin,ztoolkit-debugor_extensions[registrations (0 matches)🤖 Generated with Claude Code