fix: allow undo of clear authorship colors without disconnect

[deepshekhardas]

Summary

Allows users to undo/redo clear authorship operations without being disconnected.

Changes

1. Server-side fix (): Author validation now distinguishes between:

   • ops (attribute changes on existing text) — allows restoring other authors' attributes
   • / ops — still rejects if attributed to another author

2. Client-side workaround removed (): Removed the stopgap that prevented events from being pushed onto the undo stack.

3. Security fix: op rejection prevents pool injection attack where fabricated author IDs could be smuggled into the pad pool.

Tests

• 6 backend tests covering multi-author undo, clear with empty author, restore own author, impersonation rejection, fabricated author rejection, and op pool injection prevention.
• 2 frontend Playwright tests for multi-user and single-user undo flows.

Fixes ether#2802

---

Summary by cubic

Enables undo/redo of “Clear authorship colors” without disconnecting the user. The server now allows '=' ops to restore existing author IDs and rejects '+'/'-' ops with foreign authors to prevent impersonation and pool injection.

• Bug Fixes
  • Removed client workaround that blocked clear-authorship events from the undo stack; added backend and Playwright coverage for multi-user undo.
  • Timeslider: Skip identity changesets to prevent playback errors.
  • Lists: Handle pasted bare
  • (defaults to bullet), reset numbering when switching bullet↔numbered lists, and correctly recognize indented lines to keep numbering stable.
  • Pad delete: Wait for server confirmation and await pad.remove(); fixes race that could leave pads undeleted.
  • Group delete: Ignore null session entries left after deleteSession to avoid “sessionID does not exist”.
  • Editor: PageDown now advances by a full page of lines.

^{Written for commit 02f11dd. Summary will update on new commits.}

[cubic-dev-ai]

12 issues found across 131 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="admin/src/localization/i18n.ts">

<violation number="1" location="admin/src/localization/i18n.ts:31">
P2: Return immediately after the error callback to avoid invoking the backend callback twice when parsing fails.</violation>
</file>

<file name="admin/src/utils/Toast.tsx">

<violation number="1" location="admin/src/utils/Toast.tsx:11">
P3: Remove the debug `console.log()` from the component render path.</violation>
</file>

<file name="src/tsconfig.json">

<violation number="1" location="src/tsconfig.json:6">
P2: `compilerOptions.types` is declared twice; the later entry overrides the earlier one, leaving the first added config ineffective.</violation>
</file>

<file name="src/static/js/pluginfw/installer.ts">

<violation number="1" location="src/static/js/pluginfw/installer.ts:183">
P1: Avoid writing untrusted plugin names/keys into a normal object literal; this allows prototype-pollution keys (for example `__proto__`) to be assigned.</violation>
</file>

<file name="admin/src/pages/HelpPage.tsx">

<violation number="1" location="admin/src/pages/HelpPage.tsx:12">
P2: Add a cleanup function to remove the `reply:help` listener in `useEffect` to avoid accumulating duplicate socket handlers.</violation>
</file>

<file name="README.md">

<violation number="1" location="README.md:103">
P2: The README now omits the minimum supported Node.js version, making the install requirement inaccurate. This can lead users to install unsupported Node versions and hit avoidable setup/runtime failures.</violation>
</file>

<file name="AGENTS.MD">

<violation number="1" location="AGENTS.MD:54">
P2: The contributor workflow should not require a specific maintainer’s fork; this should point contributors to their own fork.</violation>
</file>

<file name="best_practices.md">

<violation number="1" location="best_practices.md:1">
P2: This new file substantially duplicates `CONTRIBUTING.md`, creating a second source of truth for contributor policies. Consolidate into one canonical doc (or make this file a short pointer) to avoid future drift.</violation>
</file>

<file name="src/locales/ga.json">

<violation number="1" location="src/locales/ga.json:92">
P2: Missing translation key `pad.settings.fontType.normal` in the new `ga` locale file.</violation>
</file>

<file name="src/templates/javascript.html">

<violation number="1" location="src/templates/javascript.html:13">
P3: The displayed jQuery filename does not match the linked file path (`3.0.1` text vs `3.0.0` href), which makes the license listing inaccurate.</violation>
</file>

<file name="src/locales/nb.json">

<violation number="1" location="src/locales/nb.json:65">
P3: `$1` is not a supported interpolation format here, so the Norwegian label will render as literal text (`Drevet av $1`). Use plain text (or `{{...}}` with args) instead.</violation>
</file>

<file name="admin/package.json">

<violation number="1" location="admin/package.json:23">
P1: Upgrading `@vitejs/plugin-react` to v6 is incompatible with the current Vite 7 setup and existing inline `babel` plugin config, which can break install/build.</violation>
</file>

_{Note: This PR contains a large number of files. cubic only reviews up to 75 files per PR, so some files may not have been reviewed. cubic prioritizes the most important files to review.
On a pro plan you can use ultrareview for larger PRs.}

[cubic-dev-ai]

P1: Avoid writing untrusted plugin names/keys into a normal object literal; this allows prototype-pollution keys (for example __proto__) to be assigned.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/static/js/pluginfw/installer.ts, line 183:

<comment>Avoid writing untrusted plugin names/keys into a normal object literal; this allows prototype-pollution keys (for example `__proto__`) to be assigned.</comment>

<file context>
@@ -174,7 +178,18 @@ export const getAvailablePlugins = async (maxCacheAge: number | false) => {
-  availablePlugins = pluginsLoaded.data;
+  const data = pluginsLoaded.data;
+  // Normalize: the registry may use numeric keys instead of plugin names
+  const normalized: MapArrayType<PackageInfo> = {};
+  for (const key in data) {
+    const entry = data[key];
</file context>

Suggested change

	const normalized: MapArrayType<PackageInfo> = {};
	const normalized: MapArrayType<PackageInfo> = Object.create(null);

[cubic-dev-ai]

P1: Upgrading @vitejs/plugin-react to v6 is incompatible with the current Vite 7 setup and existing inline babel plugin config, which can break install/build.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At admin/package.json, line 23:

<comment>Upgrading `@vitejs/plugin-react` to v6 is incompatible with the current Vite 7 setup and existing inline `babel` plugin config, which can break install/build.</comment>

<file context>
@@ -18,27 +18,27 @@
-    "@vitejs/plugin-react": "^5.1.4",
+    "@typescript-eslint/eslint-plugin": "^8.58.0",
+    "@typescript-eslint/parser": "^8.58.0",
+    "@vitejs/plugin-react": "^6.0.1",
     "babel-plugin-react-compiler": "19.1.0-rc.3",
-    "eslint": "^10.0.0",
</file context>

[cubic-dev-ai]

P2: Return immediately after the error callback to avoid invoking the backend callback twice when parsing fails.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At admin/src/localization/i18n.ts, line 31:

<comment>Return immediately after the error callback to avoid invoking the backend callback twice when parsing fails.</comment>

<file context>
@@ -6,52 +6,52 @@ import LanguageDetector from 'i18next-browser-languagedetector'
+    try {
+      json = JSON.parse(await localeJSON.text())
+    } catch(e) {
+      callback(new Error("Error loading"), null);
+    }
+
</file context>

Suggested change

	callback(new Error("Error loading"), null);
	return callback(new Error("Error loading"), null);

[cubic-dev-ai]

P2: compilerOptions.types is declared twice; the later entry overrides the earlier one, leaving the first added config ineffective.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/tsconfig.json, line 6:

<comment>`compilerOptions.types` is declared twice; the later entry overrides the earlier one, leaving the first added config ineffective.</comment>

<file context>
@@ -2,7 +2,8 @@
     "moduleDetection": "force",
-    "lib": ["ES2023"],
+    "lib": ["ES2023", "DOM"],
+    "types": ["node", "jquery"],
     /* Language and Environment */
     "target": "es6",                                  /* Set the JavaScript language version for emitted JavaScript and include compatible library declarations. */
</file context>

[cubic-dev-ai]

P2: Add a cleanup function to remove the reply:help listener in useEffect to avoid accumulating duplicate socket handlers.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At admin/src/pages/HelpPage.tsx, line 12:

<comment>Add a cleanup function to remove the `reply:help` listener in `useEffect` to avoid accumulating duplicate socket handlers.</comment>

<file context>
@@ -4,67 +4,67 @@ import {useEffect, useState} from "react";
-        });
+  useEffect(() => {
+    if(!settingsSocket) return;
+    settingsSocket?.on('reply:help', (data) => {
+      setHelpData(data)
+    });
</file context>

Suggested change

	settingsSocket?.on('reply:help', (data) => {
	setHelpData(data)
	});
	settingsSocket?.emit('help');
	}, [settingsSocket]);
	settingsSocket?.emit('help');
	const handleHelpReply = (data: HelpObj) => {
	setHelpData(data)
	};
	settingsSocket.on('reply:help', handleHelpReply);
	settingsSocket.emit('help');
	return () => {
	settingsSocket.off('reply:help', handleHelpReply);
	};

[cubic-dev-ai]

P2: This new file substantially duplicates CONTRIBUTING.md, creating a second source of truth for contributor policies. Consolidate into one canonical doc (or make this file a short pointer) to avoid future drift.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At best_practices.md, line 1:

<comment>This new file substantially duplicates `CONTRIBUTING.md`, creating a second source of truth for contributor policies. Consolidate into one canonical doc (or make this file a short pointer) to avoid future drift.</comment>

<file context>
@@ -0,0 +1,132 @@
+# Contributor Guidelines
+(Please talk to people on the mailing list before you change this page, see our section on [how to get in touch](https://github.com/ether/etherpad-lite#get-in-touch))
+
</file context>

[cubic-dev-ai]

P2: Missing translation key pad.settings.fontType.normal in the new ga locale file.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/locales/ga.json, line 92:

<comment>Missing translation key `pad.settings.fontType.normal` in the new `ga` locale file.</comment>

<file context>
@@ -0,0 +1,189 @@
+	"pad.settings.colorcheck": "Dathanna údair",
+	"pad.settings.linenocheck": "Uimhreacha líne",
+	"pad.settings.rtlcheck": "Léigh ábhar ó dheis go clé?",
+	"pad.settings.fontType": "Cineál cló:",
+	"pad.settings.language": "Teanga:",
+	"pad.settings.deletePad": "Scrios Pad",
</file context>

[cubic-dev-ai]

P3: Remove the debug console.log() from the component render path.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At admin/src/utils/Toast.tsx, line 11:

<comment>Remove the debug `console.log()` from the component render path.</comment>

<file context>
@@ -3,24 +3,24 @@ import {useStore} from "../store/store.ts";
-    </Toast.Root>
-        <Toast.Viewport className="ToastViewport"/>
-    </>
+  console.log()
+  return <>
+    <Toast.Root className={"ToastRoot "+resultingClass} open={toastState && toastState.open} onOpenChange={()=>{
</file context>

[cubic-dev-ai]

P3: The displayed jQuery filename does not match the linked file path (3.0.1 text vs 3.0.0 href), which makes the license listing inaccurate.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/templates/javascript.html, line 13:

<comment>The displayed jQuery filename does not match the linked file path (`3.0.1` text vs `3.0.0` href), which makes the license listing inaccurate.</comment>

<file context>
@@ -1,51 +1,51 @@
+  <body>
+    <table id="jslicense-labels1">
+      <tr>
+        <td><a href="/static/js/vendors/jquery-3.0.0.min.js">jquery-3.0.1.min.js</a></td>
+        <td><a href="http://www.jclark.com/xml/copying.txt">Expat</a></td>
+        <td><a href="/static/js/vendors/jquery.js">jquery.js</a></td>
</file context>

Suggested change

	<td><a href="/static/js/vendors/jquery-3.0.0.min.js">jquery-3.0.1.min.js</a></td>
	<td><a href="/static/js/vendors/jquery-3.0.0.min.js">jquery-3.0.0.min.js</a></td>

[cubic-dev-ai]

P3: $1 is not a supported interpolation format here, so the Norwegian label will render as literal text (Drevet av $1). Use plain text (or {{...}} with args) instead.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/locales/nb.json, line 65:

<comment>`$1` is not a supported interpolation format here, so the Norwegian label will render as literal text (`Drevet av $1`). Use plain text (or `{{...}}` with args) instead.</comment>

<file context>
@@ -49,8 +59,10 @@
+	"pad.delete.confirm": "Vil du virkelig slette denne paden?",
 	"pad.settings.about": "Om",
-	"pad.settings.poweredBy": "Drives av",
+	"pad.settings.poweredBy": "Drevet av $1",
 	"pad.importExport.import_export": "Importer/eksporter",
 	"pad.importExport.import": "Last opp tekstfil eller dokument",
</file context>