-
-
Notifications
You must be signed in to change notification settings - Fork 4.7k
Match slashes in ../{id} resource routes #4138
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
|
@rullzer, thanks for your PR! By analyzing the history of the files in this pull request, we identified @BernhardPosselt, @Xenopathic and @icewind1991 to be potential reviewers. |
nickvergessen
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think we should specify that on the routes which are affected:
https://github.com/nextcloud/notifications/blob/master/appinfo/routes.php#L24
Not in general. And with your current approach I think you even kill existing restrictions?
|
This will also cause problems with: |
|
we don't do it in general. Only for resources like https://github.com/nextcloud/server/blob/master/settings/routes.php#L40 I see no use case where you'd generate a resource url like |
|
@nickvergessen so this way now or are you going to rewrite it to use the provisioning api? |
nickvergessen
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
yeah let's try it
Fixes #2954 Before we could match on <prefix>/{id} however if the id contains a / this would not match properly. But since we define the resource routes internally we now make sure that we match all chars (up until the ?). Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
44ed097 to
31f9be7
Compare
MorrisJobke
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Tested and works 👍
|
Reverted in #4381 |
Fixes #2954
Before we could match on /{id} however if the id contains a /
this would not match properly. But since we define the resource routes
internally we now make sure that we match all chars (up until the ?).
to test:
foo/barBefore: nope
Now: yes, master
CC: @hirschrobert