
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
react-cms-firestore
Advanced tools
Dependency-inject CMS data into any react component from the Firestore
Wrap your component in withCms to have props.cms injected into your components.
CMS data is downloaded from the Firestore.
the second argument to withCms defines the CMS entries injected into the component.
Import looks like:
import {withCms} from "react-cms-firestore";
Usage often looks like this:
export default withCms(MyScreen, 'MyScreenData');
or
export default withCms(MyComponent, ['entry1', 'entry2']);
Then the data can be accessed like:
const {cms} = props;
const {footerCms, headerCms} = cms;
const {footerTitle} = footerCms;
const {headerLogoUrl} = headerCms;
...
There is a optional third parameter which styles a default placeholder while the data is loading. It may look like this:
export default withCms(MyComponent, 'myCmsData', {width: 200, height:100});
The possible style values are:
width, height,
padding, paddingTop, paddingRight, paddingBottom, paddingLeft,
radius,
and test.
test forces the placeholder state for easy testing.
Add a collection called cms to your Firestore.
Add a collection called cms-editor to your Firestore.
####Security Rules Users with the role of admin or cmsEditor can update cms. Everyone can read cms.
Use firebase-roles package to set up initial roles.
function isCmsEditor() {
return request.auth != null
&& request.auth.token != null
&& (
request.auth.token.admin == true ||
request.auth.token.cmsEditor == true
);
}
match /cms/{id} {
allow read: if true;
allow write: if isCmsEditor();
}
match /cms-editor/{id} {
allow read: if isCmsEditor();
allow write: if isCmsEditor();
}
The Firestore needs to be initialized in the code before withCms is used.
Remember to npm run build before deploying.
FAQs
Dependency-inject CMS data into any react component from the Firestore
We found that react-cms-firestore demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.