From 950497311c4c88ca4bd472fe8ccf0629a2374587 Mon Sep 17 00:00:00 2001 From: Daniel S Date: Sun, 9 Aug 2026 23:55:16 +0200 Subject: [PATCH] fix: enforce strict draft vs publish isolation on all editor API endpoints --- src/pages/api/editor/add-section.ts | 1 - src/pages/api/editor/delete-section.ts | 1 - src/pages/api/editor/save-draft.ts | 1 - src/pages/api/editor/update-section-settings.ts | 1 - src/pages/api/editor/update-section.ts | 1 - 5 files changed, 5 deletions(-) diff --git a/src/pages/api/editor/add-section.ts b/src/pages/api/editor/add-section.ts index b7ee6f4..810b1fd 100644 --- a/src/pages/api/editor/add-section.ts +++ b/src/pages/api/editor/add-section.ts @@ -73,7 +73,6 @@ export const POST: APIRoute = async ({ request }) => { targetPage.sections.push(newSection); await fs.mkdir(DATA_DIR, { recursive: true }); - await fs.writeFile(livePath, JSON.stringify(config, null, 2), 'utf-8'); await fs.writeFile(draftPath, JSON.stringify(config, null, 2), 'utf-8'); return new Response(JSON.stringify({ success: true, section: newSection }), { status: 201 }); diff --git a/src/pages/api/editor/delete-section.ts b/src/pages/api/editor/delete-section.ts index 518723f..55cdb37 100644 --- a/src/pages/api/editor/delete-section.ts +++ b/src/pages/api/editor/delete-section.ts @@ -35,7 +35,6 @@ export const POST: APIRoute = async ({ request }) => { targetPage.sections = targetPage.sections.filter((sec: any) => sec.id !== section_id); await fs.mkdir(DATA_DIR, { recursive: true }); - await fs.writeFile(livePath, JSON.stringify(config, null, 2), 'utf-8'); await fs.writeFile(draftPath, JSON.stringify(config, null, 2), 'utf-8'); return new Response(JSON.stringify({ success: true, message: 'Sektion gelöscht' }), { status: 200 }); diff --git a/src/pages/api/editor/save-draft.ts b/src/pages/api/editor/save-draft.ts index 4dc16ee..a1d3097 100644 --- a/src/pages/api/editor/save-draft.ts +++ b/src/pages/api/editor/save-draft.ts @@ -26,7 +26,6 @@ export const POST: APIRoute = async ({ request }) => { const updatedConfig = { ...baseConfig, ...draftBody, updated_at: new Date().toISOString() }; await fs.mkdir(DATA_DIR, { recursive: true }); - await fs.writeFile(livePath, JSON.stringify(updatedConfig, null, 2), 'utf-8'); await fs.writeFile(draftPath, JSON.stringify(updatedConfig, null, 2), 'utf-8'); return new Response(JSON.stringify({ success: true, message: 'Entwurf erfolgreich gespeichert' }), { status: 200 }); diff --git a/src/pages/api/editor/update-section-settings.ts b/src/pages/api/editor/update-section-settings.ts index 8fbc091..eb1ff4e 100644 --- a/src/pages/api/editor/update-section-settings.ts +++ b/src/pages/api/editor/update-section-settings.ts @@ -40,7 +40,6 @@ export const POST: APIRoute = async ({ request }) => { targetSection.settings = { ...targetSection.settings, ...settings }; await fs.mkdir(DATA_DIR, { recursive: true }); - await fs.writeFile(livePath, JSON.stringify(config, null, 2), 'utf-8'); await fs.writeFile(draftPath, JSON.stringify(config, null, 2), 'utf-8'); return new Response(JSON.stringify({ success: true, settings: targetSection.settings }), { status: 200 }); diff --git a/src/pages/api/editor/update-section.ts b/src/pages/api/editor/update-section.ts index 3624276..d3e3008 100644 --- a/src/pages/api/editor/update-section.ts +++ b/src/pages/api/editor/update-section.ts @@ -37,7 +37,6 @@ export const POST: APIRoute = async ({ request }) => { // 3. Speichere ausschließlich in site.config.draft.json await fs.mkdir(DATA_DIR, { recursive: true }); - await fs.writeFile(livePath, JSON.stringify(config, null, 2), 'utf-8'); await fs.writeFile(draftPath, JSON.stringify(config, null, 2), 'utf-8'); return new Response(