Ship CSRF-drift + markdown fixes to production #25

Merged

jared merged 5 commits from development into main 2026-07-15 16:54:01 -04:00

Conversation 0 Commits 5 Files Changed 4

+49 -13

jared commented 2026-07-15 16:53:56 -04:00

Owner

Copy Link

Copy Source

Ship pending development commits to production:

• 7a537f4 CSRF token-drift fix for add_comment/update_ticket (fixes a live prod 'Invalid CSRF token' bug)
• 5dea47c markdown double-parse fix
• 8f7c669 markdown code-block/language-tag parser
• 53d3670 markdown reload whitespace fix (headings/tables no longer break on refresh)
• d535557 strip trailing whitespace that was failing phpcs/CI

Green on development/beta.

🤖 Generated with Claude Code

Ship pending development commits to production: - 7a537f4 CSRF token-drift fix for add_comment/update_ticket (fixes a live prod 'Invalid CSRF token' bug) - 5dea47c markdown double-parse fix - 8f7c669 markdown code-block/language-tag parser - 53d3670 markdown reload whitespace fix (headings/tables no longer break on refresh) - d535557 strip trailing whitespace that was failing phpcs/CI Green on development/beta. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

jared added 5 commits 2026-07-15 16:53:56 -04:00

Fix CSRF token drift in add_comment and update_ticket endpoints 7a537f46bc

Fix double-parsing of markdown comments on page load 5dea47cd01

Fix markdown code block parser to support language tags and UI classes 8f7c669b8f

Fix markdown comments breaking on reload (template whitespace parsed as code) ... 53d3670c7f

Stored markdown comments rendered fine in the live preview (parses the raw
textarea value) but broke after refresh: the server template emitted the
comment text on an indented line, so the on-load renderer parsed
element.textContent with ~20 spaces of leading indentation. Markdown treats
4+ leading spaces as a code block, so the first line (e.g. a heading or
table row) was mis-parsed and blocks got wrapped in <p>, producing invalid
HTML that broke the page layout.

- markdown.js: trim the text before parseMarkdown in both on-load renderers
  so template indentation can't be parsed as a leading code block.
- TicketView.php: emit the comment text inline (no surrounding whitespace)
  so the element's textContent is exactly the stored markdown.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Strip trailing whitespace failing phpcs (unblocks CI/deploy) ... d535557e5a

CI has been red since the CSRF-drift changes landed a trailing space on the
'success' => false line in these two endpoints, which blocks the deploy job
(and therefore beta/prod). No logic change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

jared merged commit 20e4352f24 into main 2026-07-15 16:54:01 -04:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

bug

Something is not working

duplicate

This issue or pull request already exists

enhancement

New feature

help wanted

Need some help

invalid

Something is wrong

question

More information is needed

wontfix

This won't be fixed

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

cole (Cole Keller) jared (Jared Vititoe) nathan (Nathan Vititoe)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: LotusGuild/tinker_tickets#25