https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43091
Bug ID: 43091
Summary: Staff-only Vue island chunks are emitted into the OPAC
dist directory
Initiative type: ---
Sponsorship ---
status:
Product: Koha
Version: Main
Hardware: All
OS: All
Status: NEW
Severity: normal
Priority: P5 - low
Component: Architecture, internals, and plumbing
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
Depends on: 26355
Blocks: 41129
Target Milestone: ---
The intranet and OPAC islands builds share the same entry point,
koha-tmpl/intranet-tmpl/prog/js/vue/modules/islands.ts, which hardcodes every
island in its componentRegistry. The islandsExport() factory in
rspack.config.js (introduced by bug 26355) only varies the output path per
application, so the OPAC compilation emits a lazy chunk for every registered
island into koha-tmpl/opac-tmpl/bootstrap/js/vue/dist/:
- acquisitions-menu.[hash].esm.js
- vendor-menu.[hash].esm.js
- admin-menu.[hash].esm.js
On top of that, the OPAC islands.esm.js bundles the staff-side Pinia stores
(main, navigation, vendors) because hydrate() imports them unconditionally.
These chunks are never executed on the OPAC. hydrate() only fetches a chunk
when a matching custom element is present in the DOM, and no OPAC template
renders one, so this is not a security issue in itself. But it publishes
staff-interface code unauthenticated in the OPAC docroot, wastes build output,
and is a leak channel by construction: any future staff-side island whose
bundle contains something sensitive would land in the public web root by the
same mechanism.
The attached patch splits modules/islands.ts into shared machinery and
per-application entry points (islands-intranet.ts, islands-opac.ts). Each entry
declares its islands as a Map literal and feeds it through registerIsland(), so
core islands take the same registration path as plugin islands (bug 42150), and
passes its store definitions into hydrate() instead of the shared module
importing every store. The plugin import surface of islands.esm.js
(registerIsland, hydrate, the Vue re-exports used by the import map) is
preserved on both entries via star re-exports.
After the patch, the OPAC dist contains only islands.esm.js and the
patron-self-renewal chunk.
Referenced Bugs:
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=26355
[Bug 26355] Allow patron account renewals through the OPAC
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=41129
[Bug 41129] Migrate place_booking.js to a Vue island.
--
You are receiving this mail because:
You are watching all bug changes.
_______________________________________________
Koha-bugs mailing list -- [email protected]
To unsubscribe send an email to [email protected]
website : http://www.koha-community.org/
git : http://git.koha-community.org/
bugs : http://bugs.koha-community.org/
