Inline handlers built as onclick="fn('${esc(id)}')" were injectable:
esc() turns ' into ', which the browser decodes back to ' before
the JS runs, so an id like x');alert(1);// broke out of the string.
Ids can come from a restored backup file or a synced catalog. Add
SunSafe.jsArg (JSON.stringify + HTML escape) and use it in all 24
handlers across app-runtime.js and index.html, including the new
banquet-menu ones. Verified locally: an id containing a JS payload
is passed through as a plain string and nothing executes.
Also replace the Settings version label that still showed
v17.6.0 · 2026.09.07 with the current release, and bump the script
cache-busting string so the fix reaches browsers.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Add a new "Банкетное меню" catalog tab (category 6) alongside Боксы/
Премиум/Посуда for composing wedding/banquet/anniversary menus. Unlike
the other tabs, dishes here are priced and weighed per guest, grouped
by menu section (catalogSection), and clicking a checkbox doesn't add
to the order directly -- it toggles inclusion in a live summary panel
showing a running per-guest price table for the whole composed menu.
The item editor gets two new fields (menu section, weight per guest)
shown only for this category, reusing the existing generic item CRUD
(editBox/saveBox) rather than building a parallel admin UI.
Also re-bumped index.html's script cache-busting query string, which
the previous whitelist-fix commit changed the content of app-runtime.js
without updating -- the same stale-cache bug fixed earlier in the
session, now closed for directly-tagged scripts too.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The signature-offer-pdf-v18.js script tag's ?v= query string was never
updated across ~9 content commits since the file was created, so browsers
kept serving a stale cached copy indefinitely. All other script/style tags
shared an equally stale v17.7.3 tag. Bumped every tag in index.html to a
single fresh version string so all recent fixes (template selection,
merged addon card, controlLines/extraServices wiring) actually reach users
without a manual hard refresh.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The just-merged production-only commits were never run through QA
(they were pushed directly to the production branch), so several
version markers and hardcoded test strings had drifted out of sync
with each other:
- package.json was bumped to 17.8.0 but package-lock.json,
release-manifest.json and app-runtime.js's own VERSION constant were
never updated to match - reverted to 17.7.3 since no other release
artifact actually changed.
- service-worker.js's cache name legitimately moved to
v81-20260912-account-center-loader (real new modules need the cache
bust), but release-manifest.json's pwaCache field and two
release-check.mjs assertions still expected the old v78 name.
- edge-security-v1774.mjs and static-security.mjs asserted the old
employee role list (with "admin") and old PWA cache name that
production's own commits had already changed.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Introduce the first data layer, move order auto-completion to server cron with legacy/cloud compatibility, clean error telemetry, update PWA/versioning, and add regression coverage.
Fix Developer Console memory refresh freeze, auto-complete and fully pay orders one minute after scheduled time, persist offer template per client proposal, and add styled Menu SVG icon. Includes PWA cache update and regression coverage.
Fix platform developer gate during workspace loading and prevent SaaS click events from reaching Developer Console as DOM buttons. Add v17.6.3 regression tests and PWA cache bump.
