fix: update default frontend hardcoded route links - #5016
Merged
seefs001 merged 1 commit intoMay 22, 2026
Conversation
Contributor
WalkthroughThis PR updates three UI component files to redirect navigation links away from legacy console routes to new system-settings and models deployment destinations. Channel test dialogs, message error handlers, and deployment columns now point to consolidated billing and deployment pages. ChangesNavigation route consolidation
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~3 minutes Possibly related PRs
Suggested reviewers
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@web/default/src/features/channels/components/dialogs/channel-test-dialog.tsx`:
- Around line 762-764: Multiple call sites open external pages with
window.open(..., '_blank') (e.g., the window.open in channel-test-dialog.tsx) or
anchor elements without rel protection; update each to prevent
tabnabbing/referrer leakage by adding the third window.open argument
"noopener,noreferrer" (e.g., window.open(url, '_blank', 'noopener,noreferrer'))
and, where an <a> element is used (e.g., in ChatPresetsItem, ChannelsColumns,
ViewDetailsDialog, MessageError, SubscriptionPurchaseDialog,
IonetDeploymentSettingsSection, AudioPreviewDialog and similar), add
rel="noopener noreferrer" alongside target="_blank"; also update the hook files
(use-creem-payment, use-payment, use-waffo-payment) and oauth.ts to use the same
window.open signature so all listed symbols are hardened.
In `@web/default/src/features/playground/components/message-error.tsx`:
- Around line 59-61: The onClick handler that opens
'/system-settings/billing/model-pricing' in a new tab should pass secure
window.open features to prevent opener/referrer leakage; update the onClick in
the MessageError component (the onClick that calls
window.open('/system-settings/billing/model-pricing', '_blank')) to include the
third argument "noopener,noreferrer" (or convert to an anchor element with
target="_blank" and rel="noopener noreferrer") so the new-tab navigation uses
noopener and noreferrer.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: ac8a6425-2bac-411b-8a02-34af88a13d4e
📒 Files selected for processing (3)
web/default/src/features/channels/components/channels-columns.tsxweb/default/src/features/channels/components/dialogs/channel-test-dialog.tsxweb/default/src/features/playground/components/message-error.tsx
Comment on lines
+762
to
+764
| onClick={() => | ||
| window.open('/system-settings/billing/model-pricing', '_blank') | ||
| } |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE="web/default/src/features/channels/components/dialogs/channel-test-dialog.tsx"
# Show the exact snippet + a little context around the referenced lines
sed -n '740,790p' "$FILE" | nl -ba | sed -n '1,120p'
# Search for other window.open usages in the frontend and summarize patterns
rg -n "window\.open\(" web/default/src --glob='*.ts*' || true
# Specifically find calls that open _blank without noopener/noreferrer (3-arg form or missing third arg)
rg -n --glob='*.ts*' "window\.open\([^)]*['_\"]_blank['\"][^,)]*(?:\)[;}]|\n)" web/default/src || trueRepository: QuantumNous/new-api
Length of output: 106
🏁 Script executed:
#!/bin/bash
set -euo pipefail
FILE="web/default/src/features/channels/components/dialogs/channel-test-dialog.tsx"
echo "== Snippet with line numbers =="
awk 'NR>=740 && NR<=785 {printf "%d\t%s\n", NR, $0}' "$FILE"
echo
echo "== All window.open occurrences (ts/tsx) =="
rg -n "window\.open\(" web/default/src --glob='*.ts*' | head -n 200 || true
echo
echo "== window.open(_blank) missing noopener/noreferrer (best-effort scan) =="
python3 - <<'PY'
import os, re
root = "web/default/src"
target_ext = (".ts", ".tsx")
files=[]
for dirpath, _, filenames in os.walk(root):
for fn in filenames:
if fn.endswith(target_ext):
files.append(os.path.join(dirpath, fn))
# Find window.open occurrences and inspect nearby text for _blank and noopener/noreferrer.
# Best-effort: examines up to N chars after the call site.
N=600
occ_re = re.compile(r'window\s*\.?\s*open\s*\(')
def linecol(text, idx):
# compute 1-based line and column
line = text.count('\n', 0, idx) + 1
last_nl = text.rfind('\n', 0, idx)
col = idx - last_nl if last_nl != -1 else idx + 1
return line, col
bad=[]
for path in files:
try:
with open(path, "r", encoding="utf-8") as f:
s=f.read()
except Exception:
continue
for m in occ_re.finditer(s):
i=m.start()
chunk = s[i:i+N]
if ("'_blank'" in chunk) or ('"_blank"' in chunk) or ("_blank" in chunk):
# consider it "has protections" if both substrings appear somewhere nearby
# (covers typical "'noopener,noreferrer'" or separate 'noopener'/'noreferrer')
has_noop = "noopener" in chunk
has_noref = "noreferrer" in chunk
if not (has_noop and has_noref):
# find line number
line, col = linecol(s, i)
snippet = chunk.splitlines()[0][:180]
bad.append((path, line, col, snippet))
break # report at most once per file to keep output bounded
print("Matches:")
if not bad:
print("None found (best-effort).")
else:
for path,line,col,snippet in bad[:200]:
print(f"- {path}:{line}:{col} :: {snippet}")
PYRepository: QuantumNous/new-api
Length of output: 6792
Harden window.open(..., '_blank') against tabnabbing/referrer leakage
web/default/src/features/channels/components/dialogs/channel-test-dialog.tsxuseswindow.open(..., '_blank')withoutnoopener,noreferrer(lines 762-764); add the third argument to prevent opener/referrer leakage.- Other
_blankcallsites also lack full protection and should be updated similarly:
web/default/src/components/layout/components/chat-presets-item.tsx,web/default/src/features/channels/components/channels-columns.tsx,web/default/src/features/keys/components/dialogs/cc-switch-dialog.tsx,web/default/src/features/keys/components/data-table-row-actions.tsx,web/default/src/features/models/components/dialogs/view-details-dialog.tsx,web/default/src/features/playground/components/message-error.tsx,web/default/src/features/subscriptions/components/dialogs/subscription-purchase-dialog.tsx,web/default/src/features/system-settings/integrations/ionet-deployment-settings-section.tsx,web/default/src/features/usage-logs/components/dialogs/audio-preview-dialog.tsx,web/default/src/features/wallet/hooks/use-creem-payment.ts,web/default/src/features/wallet/hooks/use-payment.ts,web/default/src/features/wallet/hooks/use-waffo-payment.ts,web/default/src/lib/oauth.ts.
Suggested fix
- onClick={() =>
- window.open('/system-settings/billing/model-pricing', '_blank')
- }
+ onClick={() =>
+ window.open(
+ '/system-settings/billing/model-pricing',
+ '_blank',
+ 'noopener,noreferrer'
+ )
+ }📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| onClick={() => | |
| window.open('/system-settings/billing/model-pricing', '_blank') | |
| } | |
| onClick={() => | |
| window.open( | |
| '/system-settings/billing/model-pricing', | |
| '_blank', | |
| 'noopener,noreferrer' | |
| ) | |
| } |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@web/default/src/features/channels/components/dialogs/channel-test-dialog.tsx`
around lines 762 - 764, Multiple call sites open external pages with
window.open(..., '_blank') (e.g., the window.open in channel-test-dialog.tsx) or
anchor elements without rel protection; update each to prevent
tabnabbing/referrer leakage by adding the third window.open argument
"noopener,noreferrer" (e.g., window.open(url, '_blank', 'noopener,noreferrer'))
and, where an <a> element is used (e.g., in ChatPresetsItem, ChannelsColumns,
ViewDetailsDialog, MessageError, SubscriptionPurchaseDialog,
IonetDeploymentSettingsSection, AudioPreviewDialog and similar), add
rel="noopener noreferrer" alongside target="_blank"; also update the hook files
(use-creem-payment, use-payment, use-waffo-payment) and oauth.ts to use the same
window.open signature so all listed symbols are hardened.
Comment on lines
59
to
61
| onClick={() => | ||
| window.open('/console/setting?tab=ratio', '_blank') | ||
| window.open('/system-settings/billing/model-pricing', '_blank') | ||
| } |
Contributor
There was a problem hiding this comment.
Use secure window.open features for the new-tab link.
Please include noopener,noreferrer for this _blank navigation to avoid opener/referrer exposure.
Suggested fix
- onClick={() =>
- window.open('/system-settings/billing/model-pricing', '_blank')
- }
+ onClick={() =>
+ window.open(
+ '/system-settings/billing/model-pricing',
+ '_blank',
+ 'noopener,noreferrer'
+ )
+ }📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| onClick={() => | |
| window.open('/console/setting?tab=ratio', '_blank') | |
| window.open('/system-settings/billing/model-pricing', '_blank') | |
| } | |
| onClick={() => | |
| window.open( | |
| '/system-settings/billing/model-pricing', | |
| '_blank', | |
| 'noopener,noreferrer' | |
| ) | |
| } |
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@web/default/src/features/playground/components/message-error.tsx` around
lines 59 - 61, The onClick handler that opens
'/system-settings/billing/model-pricing' in a new tab should pass secure
window.open features to prevent opener/referrer leakage; update the onClick in
the MessageError component (the onClick that calls
window.open('/system-settings/billing/model-pricing', '_blank')) to include the
third argument "noopener,noreferrer" (or convert to an anchor element with
target="_blank" and rel="noopener noreferrer") so the new-tab navigation uses
noopener and noreferrer.
seefs001
approved these changes
May 22, 2026
xyfacai
pushed a commit
to xyfacai/new-api
that referenced
this pull request
May 30, 2026
SamuelSxy
pushed a commit
to SamuelSxy/new-api-rh
that referenced
this pull request
Jun 7, 2026
fx247562340
pushed a commit
to fx247562340/vancine-platform
that referenced
this pull request
Jun 11, 2026
330079598
pushed a commit
to 330079598/new-api
that referenced
this pull request
Aug 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Important
📝 变更描述 / Description
(简述：做了什么？为什么这样改能生效？请基于你对代码逻辑的理解来写，避免粘贴未经整理的内容)
修复 default 前端中残留的 classic 硬编码路由。
🚀 变更类型 / Type of change
🔗 关联任务 / Related Issue
✅ 提交前检查项 / Checklist
Bug fix，我已提交或关联对应 Issue，且不会将设计取舍、预期不一致或理解偏差直接归类为 bug。📸 运行证明 / Proof of Work
(请在此粘贴截图、关键日志或测试报告，以证明变更生效)
Summary by CodeRabbit
Release Notes