Repository navigation
fix(dashboards): accept note widgets regardless of apps value - #8099
Merged
Merged
Conversation
2fe1cf4 made add-widget/update-widget validate widget.apps as a strict array of app ids. The note widget UI sends apps: "*", so creating or editing a note failed with 400 "Invalid parameter: widget.apps", and copying a dashboard silently dropped its notes. Notes show no app data, so whatever apps value arrives is now replaced with [] before saving on create, update and copy. On update the stored widget type is used when the request omits widget_type. Data widgets keep the strict validation and access checks. The note UI now sends apps: []. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Notes have always been stored with apps: "*". Keep that format instead of rewriting it to [], so existing note widgets need no transformation when migrating. Whatever apps value arrives for a note is stored as "*" on create, update and copy, and notes skip app id validation and access checks. The note UI sends "*" again, as before. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ar2rsawseen
approved these changes
Oct 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Creating a note widget on a dashboard fails with
400 Invalid parameter: widget.apps.Introduced by 2fe1cf4 (security(dashboards): scope copied widgets to the copier's app access), which validates
widget.appsas a strict array of 24-char hex app ids. Notes are stored withapps: "*", so:Fix
Notes show no app data. Whatever
appsvalue arrives for a note is stored as"*"— the format notes have always had, so existing note widgets need no transformation when migrating. Notes are never rejected overappsand skip app id validation and access checks:appsset to"*"beforeisWidgetValid; validation/access check only for non-note widgetswidget_typeis still recognised as a note via the stored typeappskept as"*"Data widgets keep the strict validation and app access checks from 2fe1cf4 (a number widget with
apps: "*"is still a 400).Also: note
contenthtmlis sanitized on partial updates of stored notes, and a missingcontenthtmlon create no longer passesundefinedto the sanitizer.Tests
New
Testing dashboards note widgetsblock inplugins/dashboards/tests.js: notes with"*",[], missing,null, string, array-like, invalid and unreadable ids are all accepted; edit with and withoutwidget_type; stored note hasapps: "*"; notes survive dashboard copy; data widget with"*"still rejected.Not yet run locally — run
npm run test:plugin -- dashboards.🤖 Generated with Claude Code