Repository navigation
fix(modules): read the module from the path id in startDownload and getDownloadStatus (#1250) - #1293
Merged
Conversation
…etDownloadStatus (#1250) REST v3 puts the module of /modules/{id}:getDownloadStatus and :startDownload in data['id'], but the processor read only data['uniqid'], so every v3 call failed with 422 "Undefined array key". Use uniqid when it is a non-empty string, otherwise the path id; non-string values become ''. Both actions still reject a bad id with 400 before touching the filesystem. Since #1161 GET bodies are ignored, so test_04 now sends the unsafe uniqid in the query; test_05 checks that the path id reaches the action.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
REST v3 passes the module of
/modules/{id}:getDownloadStatusand/modules/{id}:startDownloadindata['id'], butModulesManagementProcessorread onlydata['uniqid']. Every v3 call therefore failed with 422Undefined array key "uniqid", not just the test. The processor now usesuniqidwhen it is a non-empty string and the pathidotherwise; a non-string value (uniqid[]=x) is ignored instead of causing a TypeError. Both actions still reject an invalid id with 400 before any filesystem access.Since #1161 the API ignores GET bodies, so the old test vector (unsafe uniqid in a GET JSON body) cannot reach PHP anymore.
test_04now sends the unsafe uniqid in the query string, and the newtest_05checks that the path id reaches the action.Closes #1250
Verification
tests/api/test_39_modules.pyagainst the localmikopbx-php83container:test_05fails with 422Undefined array key "uniqid"(no body) and 422 TypeError (uniqid[]);Code review: no findings.