Skip to content

Conversation

@KevinDavilaDotCMS
Copy link
Contributor

@KevinDavilaDotCMS KevinDavilaDotCMS commented Jan 31, 2026

2026-02-02.12-20-37.mov

Changes Made

  • Replaced the placeholder message in the style editor palette with a new component.
  • Added HTML, SCSS, and TypeScript files for the new empty state component to enhance user experience when no styles are available.
  • Updated the language properties to include a message for the empty state.

This PR fixes: #34470

…palette

### Changes Made
- Replaced the placeholder message in the style editor palette with a new  component.
- Added HTML, SCSS, and TypeScript files for the new empty state component to enhance user experience when no styles are available.
- Updated the language properties to include a message for the empty state.

### Motivation
This update improves the user interface by providing a more informative and visually appealing empty state when no styles are present, guiding users on how to start styling their
### Changes Made
- Introduced a new empty state component for the style editor palette to enhance user experience when no styles are available.
- Added corresponding HTML, SCSS, and TypeScript files for the new component.
- Updated the component imports to ensure proper functionality.

### Motivation
This update provides a visually appealing and informative empty state, guiding users on how to start styling when no styles are present.
@semgrep-code-dotcms-test
Copy link

Semgrep found 1 ssc-4fd3a3fc-acff-4277-9d88-60469f5a4fa5 finding:

  • core-web/libs/portlets/edit-ema/portlet/src/lib/edit-ema-editor/components/dot-uve-palette/dot-uve-palette.component.ts

Risk: Affected versions of @angular/compiler and @angular/core are vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). Angular's template compiler fails to classify the href and xlink:href attributes on SVG <script> elements as Resource URL contexts. This allows an attacker to bind a malicious data: URI or external script via [attr.href] or [attr.xlink:href], resulting in arbitrary JavaScript execution (XSS) in the victim's browser.

Fix: Upgrade this library to at least version 20.3.16 at core/core-web/yarn.lock:512.

Reference(s): GHSA-jrmj-c5cx-3cw6, CVE-2026-22610

If this is a critical or high severity finding, please also link this issue in the #security channel in Slack.

### Changes Made
- Added a new effect to reset the active contentlet when the page is unlocked, preventing editing conflicts.
- Updated the component's TypeScript file to include logic for handling the active contentlet state based on the page's lock status.
- Enhanced unit tests to verify the new behavior of resetting the active contentlet under specified conditions.

### Motivation
This update improves the user experience by ensuring that when a page is unlocked, any active contentlet selection is cleared, reducing the risk of editing conflicts.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: No status

Development

Successfully merging this pull request may close these issues.

[TASK] Improve Empty state on style editor palette

3 participants