Changes in script.js

ad1073d40e87e01426f7a3b1bf49fa2e56d38cf1 - Show full reply tree in orphan drawer

Tue, 16 Jun 2026 20:05:00 +0000

Show full reply tree in orphan drawerbuildThreadEntry alone was called per orphan, so only the rootmessage appeared in the drawer. Now each orphaned thread renderswith its complete reply tree (read-only: no Reply/Edit/Deletebuttons on replies). A .ann-orphan-thread wrapper groups eachthread visually, mirroring the inline panel styling.Co-Authored-By: Claude Sonnet 4.6 List of files: /plugin/annotations/script.js

72d60f2d94b24cb66fabf596a2ec440f459ba88f - Add clear-resolved to admin overview; make orphaned annotations read-only

Mon, 15 Jun 2026 03:37:57 +0000

Add clear-resolved to admin overview; make orphaned annotations read-onlyAdmin panel now shows a Resolved column alongside Normal and Orphaned, withper-page and wiki-wide "clear resolved" actions mirroring the existing orphanclears. The counts deliberately overlap: a resolved annotation is counted inboth its anchoring facet (Normal or Orphaned) and the Resolved column, so eachclear button removes exactly what its label says.helper::pageCounts() gains the resolved key; clearResolvedAll() mirrorsclearOrphanedAll(). In the front-end, orphaned annotation threads are nowread-only — Resolve/Reopen and Edit are suppressed, leaving only Delete.Co-Authored-By: Claude Sonnet 4.6 List of files: /plugin/annotations/script.js

49d7ec0a0f9385eb9dab3ae4b2747fe04548a000 - Fix stored XSS in JSINFO embed and self-deadlocking write lock

Wed, 03 Jun 2026 17:37:45 +0000

Fix stored XSS in JSINFO embed and self-deadlocking write lockTwo serious bugs found during review, plus three minor fixes:- Stored XSS: the inline-embedded annotation payload was encoded with JSON_UNESCAPED_SLASHES and appended into the page's inline " closed the script element and injected arbitrary HTML, executing in every viewer's browser. Anyone who can annotate (AUTH_READ + login) could exploit it. Add JSON_HEX_TAG so < and > are escaped, neutralising every tag-based breakout.- Write lock: mutate() held io_lock($file) and then called io_saveFile($file), which takes io_lock($file) again internally. The inner lock collided with the outer, busy-waiting ~3s for the stale-lock timeout on every create/edit/delete/resolve/clear and defeating mutual exclusion. Lock on a sentinel key ($file.lock) instead, leaving io_saveFile's own lock uncontended (matches DokuWiki TaskRunner idiom).- style.css: the :root colour fallbacks were self-referential (var(--x) of themselves), i.e. cyclic and invalid, not a fallback. Replace with the literal config-default triplets.- action.php: drop hsc() from a JSON error string (wrong context).- script.js: refresh the open orphan drawer after a thread mutation so an edited body shows there too.Co-Authored-By: Claude Opus 4.8 List of files: /plugin/annotations/script.js

86c7806d6d41bce7c6d00acbee1316c62845cabb - Add config, selection guards, annotation overlap detection, and glow button

Wed, 03 Jun 2026 09:48:21 +0000

Add config, selection guards, annotation overlap detection, and glow button- Config: color_open / color_resolved (hex, drives CSS vars); embed_max_bytes, context_length, body_cap move from constants to conf/default + metadata. action.php injects --ann-open-rgb / --ann-resolved-rgb as CSS custom props; style.css escapes every rgba(var(…)) with LESS ~"…" so lesserphp doesn't bake them to #000000 at compile time.- Selection guards: Annotate button suppressed inside .ann-* UI, #dw__toc, .docInfo, .secedit; the old endpoint-only isInsideHighlight is replaced by selectionHitsHighlight (range.intersectsNode over all highlight spans) so a selection overrunning an existing annotation on either side opens it instead of offering a new overlapping one.- Glow: static amber box-shadow on .ann-tooltip .ann-btn (no animation).- Removed email line from plugin.info.txt; updated GeneralTest accordingly.- context_length fed to JS via JSINFO.annotations.contextLen so capture and PHP trimming stay in sync.- conf/ + lang/*/settings.php + README/DESIGN updated.Co-Authored-By: Claude Sonnet 4.6 List of files: /plugin/annotations/script.js

d6f8bd9dcd308737e8794506fbcba91cf8b0c4fd - Add spinner to Clear buttons; close orphan drawer when last orphan removed

Wed, 03 Jun 2026 08:28:13 +0000

Add spinner to Clear buttons; close orphan drawer when last orphan removed- doClearResolved and doClearOrphaned now accept a btn param and call setBusy so they spin consistently with all other AJAX buttons; both also gain a .catch that resets the spinner and alerts on failure.- New syncOrphanDrawer() rebuilds or removes the open orphan drawer after any mutation so deleted entries disappear live. Hooked into doDeleteAnnotation (one-by-one), doClearOrphaned, and doClearResolved.Co-Authored-By: Claude Sonnet 4.6 List of files: /plugin/annotations/script.js

108f92bd856af52ccb9e86517ad03d96f4a9273a - Eliminate load round-trip by embedding annotations in JSINFO

Wed, 03 Jun 2026 05:41:55 +0000

Eliminate load round-trip by embedding annotations in JSINFOaction.php now reads the annotation list once during page render andships it inline as JSINFO.annotations.annotations, so script.js rendersimmediately at DOMContentLoaded with no second AJAX bootstrap (~300 mssaved per view). The embedded list also removes the double file readthat existed before (getStats called getAnnotations internally, then theclient fetched the same file again).helper.php adds statsFor(array) so action.php can derive stats from thealready-loaded list instead of re-reading through getStats(). getStatsnow delegates to it.script.js uses the embedded list when present; falls back to the GETload endpoint only when the list was too large to embed (>128 KB cap).Adds a window.load repositionMarkers call so gutter markers re-alignafter late-loading images shift the layout.Co-Authored-By: Claude Sonnet 4.6 List of files: /plugin/annotations/script.js

563f3b4cdab433de36fec30ddf346093d60b9ccd - Rework annotation UI: threaded replies, polish, and fixes

Wed, 03 Jun 2026 05:12:58 +0000

Rework annotation UI: threaded replies, polish, and fixesBuilds the threaded-reply UI on the new parentId backend and tidies upthe front-end overlay.Threaded replies:- Render replies as an indented tree (buildReplyTree / appendReplyTree) with an inline "reply to this reply" form on each entry.Fixes:- Keep gutter markers aligned with their highlights. A marker lives in document.body at absolute coordinates, so opening or closing a panel, or resizing the window, used to leave it stranded away from its text; repositionMarkers() now re-aligns them on those events.- Stop stealing focus when a panel is re-opened after an action (resolve, edit, delete), which previously jumped the viewport down to the reply box.- Preserve panel position after replies and edits by merging the client render state (_highlightEl, _markerEl, _range) onto server responses.Polish:- Show a busy spinner on buttons while an AJAX request is in flight.- Layout: position the counter bar and orphan drawer correctly around the floated TOC; fix highlight hover colours and the marker column position.Cleanup / dedup:- Fold the four near-identical thread mutation handlers (reply, edit, edit-reply, delete-reply) into one submitThreadAction() helper.- De-duplicate wrapHighlight()'s two branches and make its title null-safe.- Remove the unused refreshAnnotation() left over from before the server returned the full annotation.Co-Authored-By: Claude Opus 4.8 List of files: /plugin/annotations/script.js

da56206cc13612db0df36be97c0f01d8f3c5e9f4 - Fix highlight off-by-one, localise the UI, add tests

Tue, 02 Jun 2026 16:47:05 +0000

Fix highlight off-by-one, localise the UI, add testsAnchoring (the core bug):- Replace buildNormToRaw with normalizeWithMap so the normalised search string and the normalised->raw index map are built in one pass and share the same trimming. DokuWiki indents its content markup, so the collected text starts with a whitespace text node; the old untrimmed map shifted every highlight by a character. Verified on the live wiki: a quote now re-anchors exactly, including across element boundaries.- Locate all matches first, then wrap last-to-first, so wrapping (which splits text nodes) never disturbs a not-yet-wrapped offset.- Fix a pre-existing orphan double-count: renderAll passed an orphan total into updateCounter, which then recounted it from the _orphaned flags.Localisation:- Move front-end strings to $lang['js'] (exposed as LANG.plugins.annotations) and read them via t()/fmt() with English fallbacks.- Add de, ru and ja translations alongside en.Conventions / cleanup:- action.php: read request data via $INPUT; pass the CSRF token straight to checkSecurityToken($token) instead of poking $_POST/$_REQUEST; unify admin detection on auth_isadmin().- helper.php: write annotation files with JSON_UNESCAPED_UNICODE | _SLASHES.- Drop the dead ann-highlight-orphaned constant; set panel data-status so the resolved accent in style.css applies.Tests:- Add _test/GeneralTest.php (manifest + conf invariant) and _test/HelperTest.php (permission rules, CRUD, input cleaning, findOrphaned). 15 tests pass.Docs: sync DESIGN.md and README.md; bump plugin.info.txt date.Co-Authored-By: Claude Opus 4.8 List of files: /plugin/annotations/script.js

50325813c370b7edc1061ded0adc1a54b9c92cb7 - Fix anchor capture when starting a new annotation

Sat, 23 May 2026 05:03:53 +0000

Fix anchor capture when starting a new annotationBrowsers collapse the text selection before the tooltip button's clickhandler runs, so captureAnchor() saw an empty selection and newannotations were silently lost. Capture the anchor on the button'smousedown -- while the selection is still intact -- into a module-level_pendingAnchor that the click handler consumes. Don't replace analready-showing tooltip (which would orphan the button mid-click), andkeep the new-annotation form alive through the mouseup that follows theclick instead of tearing it down with the tooltip.Co-Authored-By: Claude Opus 4.8 List of files: /plugin/annotations/script.js

7d2714c77fd8ba61fdbfa0765e160acc24014017 - Expose current user, admin flag and CSRF token to the front-end

Sat, 23 May 2026 04:48:12 +0000

Expose current user, admin flag and CSRF token to the front-endDokuWiki's JSINFO carries no user identity, so script.js could not tellwho was logged in and could not gate the edit/delete/resolve UI. Injectuser, isAdmin and the security token into JSINFO.annotations fromaction.php, and read them from there instead of the non-existentJSINFO.userinfo object and the #dw__token hidden field.Co-Authored-By: Claude Opus 4.8 List of files: /plugin/annotations/script.js

b8076f00444ff4b3b435c7112dca9c194858e3f7 - Fix JSINFO injection timing and gutter marker positioning

Sat, 23 May 2026 04:36:01 +0000

Fix JSINFO injection timing and gutter marker positioninghandleMetaHeader() wrote the annotation payload to $JSINFO, buttpl_metaheaders() has already serialised JSINFO into the inline