Update Composer packages

kirby/src/Panel/Document.php

@@ -69,10 +69,15 @@ class Document
 				'custom'  => static::customAsset('panel.css'),
 			],
 			'icons' => static::favicon($url),
-			// loader for plugins' index.dev.mjs files – inlined, so we provide the code instead of the asset URL
+			// loader for plugins' index.dev.mjs files –
+			// inlined, so we provide the code instead of the asset URL
 			'plugin-imports' => $plugins->read('mjs'),
 			'js' => [
-				'vendor'       => [
+				'vue' => [
+					'nonce' => $nonce,
+					'src'   => $url . '/js/vue.js'
+				],
+				'vendor' => [
 					'nonce' => $nonce,
 					'src'   => $url . '/js/vendor.js',
 					'type'  => 'module'
@@ -82,17 +87,17 @@ class Document
 					'src'   => $url . '/js/plugins.js',
 					'type'  => 'module'
 				],
-				'plugins'      => [
+				'plugins' => [
 					'nonce' => $nonce,
 					'src'   => $plugins->url('js'),
 					'defer' => true
 				],
-				'custom'       => [
+				'custom' => [
 					'nonce' => $nonce,
 					'src'   => static::customAsset('panel.js'),
 					'type'  => 'module'
 				],
-				'index'        => [
+				'index' => [
 					'nonce' => $nonce,
 					'src'   => $url . '/js/index.js',
 					'type'  => 'module'
@@ -115,6 +120,9 @@ class Document
 				'type'  => 'module'
 			];
 
+			// load the development version of Vue
+			$assets['js']['vue']['src'] = $url . '/node_modules/vue/dist/vue.js';
+
 			unset($assets['css']['index'], $assets['js']['vendor']);
 		}
 
@@ -270,6 +278,16 @@ class Document
 			'panelUrl' => $uri->path()->toString(true) . '/',
 		]);
 
-		return new Response($body, 'text/html', $code);
+		$frameAncestors = $kirby->option('panel.frameAncestors');
+		$frameAncestors = match (true) {
+			$frameAncestors === true   => "'self'",
+			is_array($frameAncestors)  => "'self' " . implode(' ', $frameAncestors),
+			is_string($frameAncestors) => $frameAncestors,
+			default                    => "'none'"
+		};
+
+		return new Response($body, 'text/html', $code, [
+			'Content-Security-Policy' => 'frame-ancestors ' . $frameAncestors
+		]);
 	}
 }

kirby/src/Panel/Panel.php

@@ -11,6 +11,7 @@ use Kirby\Exception\NotFoundException;
 use Kirby\Exception\PermissionException;
 use Kirby\Http\Response;
 use Kirby\Http\Router;
+use Kirby\Http\Uri;
 use Kirby\Http\Url;
 use Kirby\Toolkit\Str;
 use Kirby\Toolkit\Tpl;
@@ -538,15 +539,22 @@ class Panel
 	 */
 	public static function url(string|null $url = null): string
 	{
-		$slug = App::instance()->option('panel.slug', 'panel');
-
 		// only touch relative paths
 		if (Url::isAbsolute($url) === false) {
-			$path = trim($url, '/');
+			$kirby = App::instance();
+			$slug  = $kirby->option('panel.slug', 'panel');
+			$path  = trim($url, '/');
 
+			$baseUri  = new Uri($kirby->url());
+			$basePath = trim($baseUri->path()->toString(), '/');
+
+			// removes base path if relative path contains it
+			if (empty($basePath) === false && Str::startsWith($path, $basePath) === true) {
+				$path = Str::after($path, $basePath);
+			}
 			// add the panel slug prefix if it it's not
 			// included in the path yet
-			if (Str::startsWith($path, $slug . '/') === false) {
+			elseif (Str::startsWith($path, $slug . '/') === false) {
 				$path = $slug . '/' . $path;
 			}
 

kirby/src/Panel/View.php

@@ -137,7 +137,7 @@ class View
 		$user = $kirby->user();
 
 		// user permissions
-		$permissions = $user ? $user->role()->permissions()->toArray() : [];
+		$permissions = $user?->role()->permissions()->toArray() ?? [];
 
 		// current content language
 		$language = $kirby->language();