From 2e0d92d8f5d189d466f05135a7f65da0563e8b0e Mon Sep 17 00:00:00 2001 From: shamoon <4887959+shamoon@users.noreply.github.com> Date: Sat, 7 Nov 2026 12:20:31 -0800 Subject: [PATCH 1/3] Fix: two dropdown-related UI fixes (#14717) --- .../input/document-link/document-link.component.html | 2 +- .../common/input/select/select.component.spec.ts | 3 +++ .../components/common/input/select/select.component.ts | 8 +++++++- 3 files changed, 11 insertions(+), 2 deletions(-) diff --git a/src-ui/src/app/components/common/input/document-link/document-link.component.html b/src-ui/src/app/components/common/input/document-link/document-link.component.html index 39a84ac5c3..2b5e3be90e 100644 --- a/src-ui/src/app/components/common/input/document-link/document-link.component.html +++ b/src-ui/src/app/components/common/input/document-link/document-link.component.html @@ -36,7 +36,7 @@ [appendTo]="appendTo" [loading]="loading()" [typeahead]="documentsInput$" - (mousedown)="$event.stopImmediatePropagation()" + (mousedown)="appendTo && $event.stopImmediatePropagation()" (change)="onChange(selectedDocumentIDs)">
diff --git a/src-ui/src/app/components/common/input/select/select.component.spec.ts b/src-ui/src/app/components/common/input/select/select.component.spec.ts index a71f37afb7..23a32f85f8 100644 --- a/src-ui/src/app/components/common/input/select/select.component.spec.ts +++ b/src-ui/src/app/components/common/input/select/select.component.spec.ts @@ -97,6 +97,7 @@ describe('SelectComponent', () => { let createNewVal component.createNew.subscribe((v) => (createNewVal = v)) expect(component.allowCreateNew).toBeTruthy() + const closeSpy = jest.spyOn(component.ngSelectComponent, 'close') component.onSearch({ term: 'foo' }) component.addItem(undefined) expect(createNewVal).toEqual('foo') @@ -105,6 +106,8 @@ describe('SelectComponent', () => { component.onSearch({ term: 'baz' }) component.clickNew() expect(createNewVal).toEqual('baz') + // dropdown should close when creating a new item so it isn't left open behind the modal + expect(closeSpy).toHaveBeenCalled() }) it('should search items by independent normalized terms', () => { diff --git a/src-ui/src/app/components/common/input/select/select.component.ts b/src-ui/src/app/components/common/input/select/select.component.ts index 1fd2db3b7b..f3d8b39fdd 100644 --- a/src-ui/src/app/components/common/input/select/select.component.ts +++ b/src-ui/src/app/components/common/input/select/select.component.ts @@ -4,6 +4,7 @@ import { forwardRef, Input, Output, + ViewChild, } from '@angular/core' import { FormsModule, @@ -11,7 +12,7 @@ import { ReactiveFormsModule, } from '@angular/forms' import { RouterModule } from '@angular/router' -import { NgSelectModule } from '@ng-select/ng-select' +import { NgSelectComponent, NgSelectModule } from '@ng-select/ng-select' import { BootstrapIconComponent } from 'src/app/components/common/bootstrap-icon/bootstrap-icon.component' import { matchesSearchText } from 'src/app/utils/text-search' import { AbstractInputComponent } from '../abstract-input' @@ -124,6 +125,9 @@ export class SelectComponent extends AbstractInputComponent { @Output() filterDocuments = new EventEmitter() + @ViewChild(NgSelectComponent) + ngSelectComponent: NgSelectComponent + public addItemRef: (name) => void private _lastSearchTerm: string @@ -150,11 +154,13 @@ export class SelectComponent extends AbstractInputComponent { if (name) this.createNew.next(name) else this.createNew.next(this._lastSearchTerm) this.clearLastSearchTerm() + this.ngSelectComponent?.close() } clickNew() { this.createNew.next(this._lastSearchTerm) this.clearLastSearchTerm() + this.ngSelectComponent?.close() } clearLastSearchTerm() { From d5698329f5e0845969c0af6ad9312f1d18a5db5a Mon Sep 17 00:00:00 2001 From: GitHub Actions <41898282+github-actions[bot]@users.noreply.github.com> Date: Sat, 7 Nov 2026 20:22:08 +0000 Subject: [PATCH 2/3] Auto translate strings --- src-ui/messages.xlf | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src-ui/messages.xlf b/src-ui/messages.xlf index bc7c63a91e..e7717e96ed 100644 --- a/src-ui/messages.xlf +++ b/src-ui/messages.xlf @@ -6984,7 +6984,7 @@ src/app/components/common/input/select/select.component.ts - 179 + 185 @@ -7091,7 +7091,7 @@ Private src/app/components/common/input/select/select.component.ts - 72 + 73 src/app/components/common/tag/tag.component.html @@ -7114,7 +7114,7 @@ No items found src/app/components/common/input/select/select.component.ts - 113 + 114 From 32bc5522e914f1e5f3a36eb60de6988611ca310f Mon Sep 17 00:00:00 2001 From: shamoon <4887959+shamoon@users.noreply.github.com> Date: Sat, 7 Nov 2026 12:24:29 -0800 Subject: [PATCH 3/3] Update SECURITY.md --- SECURITY.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/SECURITY.md b/SECURITY.md index b08aaabae2..3f07f82d3c 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -56,6 +56,9 @@ We may close reports that are: The following are not generally considered vulnerabilities unless accompanied by a concrete, reproducible impact in Paperless-ngx: +- password length inferred from masked mail-account passwords by users who already have permission to view the account, without disclosure of the password or token itself +- disclosure limited to document IDs, existence, page counts, checksums, or modification/deletion timestamps, without access to document contents or an unintended privileged action +- authenticated access to non-secret application settings, such as service endpoint URLs, model names, or configured environment variable names, without disclosure of credentials or secret values - large uploads or resource usage that do not bypass documented limits or privileges - IDOR / access control claims regarding the ability to attach an un-viewable object to a document. This is expected behavior. - claims based solely on the presence of a library, framework feature or code pattern without a working exploit