
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@fonixtree/magic-box
Advanced tools
MagicBox(魔方) 是装修工具的名称,也是核心组件的名称。
yarn add @whalecloud/magic-box
Designer & Previewer 是两个巨型 React 组件,所有功能都封装在组件内部,所有必备的参数和定制都通过 props 传递进来。
设计器整体采用行列布局,也就是 Row( MRow 类) 和 Column( MCol 类) 模型,此设计参考了 Bootstrap 的栅格布局模型。
MRow 表示一行,MCol 表示一列,MRow 中只能放置 MCol。虽然组件没有约束一行中最多放多少列,但是建议参考 Bootstrap 的思路,最多放 12 列。
MCol 内部可以放真正的业务组件,也可以继续放置 MRow,可以形成无限嵌套。
Designer 和 Renderer 都基于数据驱动模式工作,整体是一份巨大的 JSON 数据。
数据中只记录组件类型和数据,不记录组件具体的展示逻辑,UI 展示逻辑由不同类型的 Render 具体负责,在对页面布局要求不高的场景下,PC、手机端、Pad 可以共用一份数据。
数据格式示例:
{
index: 0,
id: 'df019a54-e3fb-40f8-b916-d2cde8325475',
pid: -1,
childNodes: [
{
type: 'MRow',
id: '9c40cfe6-c6ff-418f-8ae6-5e1818189172',
title: 'MRow',
pid: 'df019a54-e3fb-40f8-b916-d2cde8325475',
index: 0,
childNodes: [
{
type: 'MCol',
id: '9d027c88-ad6d-43c3-850e-ab8bae6b8ab4',
title: 'MCol',
pid: '9c40cfe6-c6ff-418f-8ae6-5e1818189172',
index: 0,
childNodes: [
{
type: 'GalaryTemplate4',
id: '80c970f7-5f30-4f72-b6a9-455399ac2aea',
title: '4 Images',
pid: '9d027c88-ad6d-43c3-850e-ab8bae6b8ab4',
index: 0,
},
],
},
],
}
...
document updating...
核心组件只有2个:
id,
pid,
index,
nodeData,
children,
onHover,
onDrop,
componentMap,
acceptTypes = ['MagicBox', 'MRow'], //盒子内部可以接受的类型只有 MagicBox 和 MRow,MagicBox 默认可以接受自己,形成无限嵌套。
isValidDest = false,
canDrag = true,
isLeaf = false,
isSelected = false,
innerDirection = 'vertical',
FAQs
MagicBox
We found that @fonixtree/magic-box demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.