Pre-release fixes for 17.0.0 by Lantzify · Pull Request #67 · Lantzify/uSupport

Lantzify · 2026-11-13T13:35:08Z

Last fixes before publishing the 17.0.0 release.

Security

Stored XSS: ticket summaries and comments were rendered with unsafeHTML, and IHtmlSanitizer is a no-op (NoopHtmlSanitizer) in Umbraco 17. Any backoffice user could post HTML that runs script when an admin opens the ticket. The HTML now goes through the backoffice's sanitizeHTML before it is rendered, which also covers data stored by v13.
Internal comments: the active/resolved list, get-by-id and history endpoints returned internal comments to every backoffice user. They are now stripped for users without the uSupport section.

Upgrade from 2.x

New migration step uSupport-17-content-picker-values converts v13 content picker values (int id or document UDI) to the document key the v17 picker reads. Only applies to ticket types on a Umbraco.ContentPicker data type; already-converted values are left alone. Unit tested.

Fixes

Stray } and hardcoded English in the ticket title/summary labels (ticket view + open-ticket modal).
Email times were 12-hour without AM/PM (hh:mm → HH:mm).
Update email "View ticket" button linked to /umbraco instead of the ticket.
GetAll statuses query was enumerated after its scope was disposed.
Settings error message pointed at appsettings for TicketUpdateEmail, which lives in the DB since 2.4.0.

Housekeeping

npm overrides for dompurify and js-yaml clear the dependabot alerts (both dev-only, not bundled).
actions/setup-dotnet (10.0.x) added to the release and E2E workflows.
version added to umbraco-package.json, unused ja key removed, typos fixed.

Testing

dotnet test src/uSupport.Tests (19 passing, 9 new)
npm run build in src/uSupport/Client
E2E (runs on this PR)
Manual: XSS payload in a summary doesn't execute for admin; editor API response has no internalComment
Upgrade a v13 site with uSupport 2.4.1 data; "Page error" tickets still show their page

🤖 Generated with Claude Code

…ed ticket id to preview delete

- Sanitize ticket summary and comment HTML before rendering (IHtmlSanitizer is a no-op in Umbraco 17) - Hide internal comments and their history from users without the uSupport section - Migrate v13 content picker values (int id / UDI) to document keys, with tests - Fix stray brace and hardcoded English in ticket title/summary labels - Email times in 24-hour format, update email "View ticket" links to the ticket - Materialize statuses before the scope is disposed - Override dompurify and js-yaml to clear dependabot alerts - Setup .NET 10 explicitly in release and E2E workflows - Add version to umbraco-package.json, remove unused ja key, fix typos Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude · 2026-11-13T13:35:46Z

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

Copilot

🟡 Changes recommended

The migration can overwrite numeric text values with GUIDs because it relies on stale legacy editor fields, and update-email links lead some ticket authors to a section they cannot access.

2 open issues

1 file not reviewed

src/uSupport/Client/package-lock.json: Generated file

What changed in this PR

Prepares uSupport for its Umbraco 17 release with security hardening, legacy-data migration, and backoffice refinements.

Changes:

Sanitizes rendered ticket HTML and restricts internal-comment visibility.
Adds legacy content-picker conversion, ticket-type validation, and UI/email fixes.
Expands tests and updates release workflows, dependencies, and package documentation.

File	Description
`umbraco-marketplace.json`	Corrects marketplace description wording.
`umbraco-marketplace-readme.md`	Corrects introductory wording.
`src/uSupport/Views/Partials/uSupport/Emails/UpdateTicketEmail.cshtml`	Updates timestamps and ticket link.
`src/uSupport/Views/Partials/uSupport/Emails/NewTicketEmail.cshtml`	Uses 24-hour timestamps.
`src/uSupport/uSupport.csproj`	Corrects package description wording.
`src/uSupport/Services/uSupportTicketStatusService.cs`	Materializes statuses before scope disposal.
`src/uSupport/Services/uSupportSettingsService.cs`	Corrects email-setting error guidance.
`src/uSupport/Migrations/uSupportMigrationPlan.cs`	Registers the picker-value migration.
`src/uSupport/Migrations/Updates/17.0.0/MigrateContentPickerValues.cs`	Converts legacy picker values to document keys.
`src/uSupport/Migrations/Create/uSupportTicketTypeTable.cs`	Corrects seeded property description.
`src/uSupport/Helpers/uSupportTypeHelper.cs`	Includes ticket numbers in deletion previews.
`src/uSupport/Dtos/PreviewDeleteItemDto.cs`	Adds the deletion-preview ticket-number field.
`src/uSupport/Controllers/uSupportTicketTypeController.cs`	Validates property names when selecting data types.
`src/uSupport/Controllers/uSupportTicketController.cs`	Filters internal comments from unauthorized responses.
`src/uSupport/Client/src/tickets/workspace/views/ticket.view.element.ts`	Sanitizes summaries and localizes labels.
`src/uSupport/Client/src/tickets/modals/open-ticket.modal.element.ts`	Sanitizes summaries and localizes modal labels.
`src/uSupport/Client/src/tickets/components/comments.element.ts`	Sanitizes rendered comments.
`src/uSupport/Client/src/ticket-types/ticket-type-editor.element.ts`	Marks configured property names as required.
`src/uSupport/Client/src/shared/lookup-actions.ts`	Shows ticket numbers and fixes confirmation punctuation.
`src/uSupport/Client/src/localization/ja.ts`	Removes an unused translation key.
`src/uSupport/Client/src/dashboards/manifest.ts`	Raises the Support dashboard’s display priority.
`src/uSupport/Client/src/api/types.gen.ts`	Refreshes generated response and error types.
`src/uSupport/Client/src/api/sdk.gen.ts`	Updates generated client error typing.
`src/uSupport/Client/public/umbraco-package.json`	Declares package version 17.0.0.
`src/uSupport/Client/package.json`	Adds dependency security overrides.
`src/uSupport/Client/package-lock.json`	Updates resolved development dependencies.
`src/uSupport.Tests/Migrations/MigrateContentPickerValuesTests.cs`	Tests picker conversion and unchanged-value cases.
`src/uSupport.E2E/tests/helpers.ts`	Adds ticket-type test fixtures.
`src/uSupport.E2E/tests/admin/types/create.types.spec.ts`	Tests type creation with and without properties.
`README.md`	Adds the E2E badge and corrects wording.
`.github/workflows/main.yml`	Installs .NET 10 for releases.
`.github/workflows/e2e.yml`	Installs .NET 10 and enables PR-triggered E2E runs.

_{Review effort: Balanced}

+			// Left join: a type whose data type was deleted fell back to the default content picker in AddDataTypeKeyToTicketTypes
+			var tickets = Database.Fetch<uSupportTicketSchema>(new Sql(
+				$"SELECT t.Id, t.PropertyValue FROM {TicketTableAlias} t " +
+				$"INNER JOIN {TicketTypeTableAlias} tt ON t.TypeId = tt.Id " +
+				"LEFT JOIN umbracoDataType dt ON dt.nodeId = tt.PropertyId " +
+				"WHERE tt.PropertyView = 'contentpicker' AND t.PropertyValue IS NOT NULL " +
+				"AND (dt.propertyEditorAlias IS NULL OR dt.propertyEditorAlias = 'Umbraco.ContentPicker')"));


 					<tr>
 						<td style="padding: 32px 40px 40px; text-align: center;">
-							<a href="@baseUrl/umbraco" target="_blank" style="display: inline-block; text-decoration: none; color: #ffffff; font-size: 15px; font-weight: 600; padding: 14px 36px; background: linear-gradient(135deg, #1ba098 0%, #16c9b8 100%); border-radius: 8px; box-shadow: 0 2px 8px rgba(27, 160, 152, 0.25);">
+							<a href="@baseUrl/umbraco/section/usupport/workspace/usupport-ticket/edit/@Model.Id" target="_blank" style="display: inline-block; text-decoration: none; color: #ffffff; font-size: 15px; font-weight: 600; padding: 14px 36px; background: linear-gradient(135deg, #1ba098 0%, #16c9b8 100%); border-radius: 8px; box-shadow: 0 2px 8px rgba(27, 160, 152, 0.25);">


- Content picker migration now selects types by their current DataTypeKey editor (Umbraco.ContentPicker) instead of the legacy PropertyId/PropertyView, which the v17 type editor never updates - Update email links to the Content section's Support dashboard with ?ticket=<id>, which opens the read-only ticket modal, so authors without the uSupport section can open their ticket Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude · 2026-11-13T13:46:44Z

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

Lantzify and others added 4 commits November 13, 2026 13:33

Updated e2e tests with types

4fc2a52

Stops user from creating type when selected property and no name, add…

ca1b89d

…ed ticket id to preview delete

Merge remote-tracking branch 'origin/v17/main' into v17/dev

85793fe

Copilot AI balanced review requested due to automatic review settings November 13, 2026 13:35

Copilot started reviewing on behalf of Lantzify November 13, 2026 13:35

View session

Copilot AI reviewed Nov 13, 2026

View reviewed changes

Lantzify merged commit f853d2b into v17/main Nov 13, 2026
6 checks passed

Navigation Menu

Repository navigation

Pre-release fixes for 17.0.0 - #67

Pre-release fixes for 17.0.0#67
Lantzify merged 5 commits into
v17/mainfrom
v17/dev

Lantzify commented Nov 13, 2026

Uh oh!

claude Bot commented Nov 13, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

claude Bot commented Nov 13, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Lantzify commented Nov 13, 2026

Security

Upgrade from 2.x

Fixes

Housekeeping

Testing

Uh oh!

claude Bot commented Nov 13, 2026

Code review

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

claude Bot commented Nov 13, 2026

Code review

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants