[#34261] - [4.0] - Web service PATCH requests not validatated properly
- Closed
- 29 May 2021
- Medium
- Build: staging
- # 34261
Steps to reproduce the issue
Create an article or obtain the id of an existing article.
Obtain an active Joomla Api Token.
Run the following cURL command after replacing [your J4 website] with the name of your website, [your article id] with the above mentioned article id and [your user token] with the above mentioned Joomla Api Token.
curl --location --request PATCH 'https://[your J4 website]/api/index.php/v1/content/articles/[your article id]' \
--header 'Content-Type: application/json' \
--header 'X-Joomla-Token: [your user token]' \
--data-raw '{
"state": 1
}'
Expected result
'[]'
Actual result
{
"errors": [
{
"title": "Field required: Title\nField required: Category"
}
]
}
Additional comments
For a large part, web services use existing, non web service specific logic. In this particular case, the Joomla\CMS\MVC\Controller\ApiController::save() method obtains a Joomla\CMS\Form\Form object from the administrator ArticleModel and calls that model's validate method. Unfortunately that method seems to expect a valid article and not a just one or more fields to update (PATCH) an existing article with.
joomla-cms-bot
- | Labels |
Added:
?
|
||
@alikon I'm not sure I grasp your intention. Do you propose to add specific forms with the sole purpose of validating web service request data? To be honest, I am not a huge fan of using form definitions in the context of web services. @joomdonation suggested something similar in #34101. But maybe you two are right and I am totally wrong.
Anyhow, even if we use forms for this purpose, how do you distinguish different requests (POST, PATCH) in order to do the appropriate validations?
Adding a new form does not help, I think. I think an acceptable solution would be pre-load $data array with the data which we are having in the database for the record at the moment. So adding these lines of code below after this line https://github.com/joomla/joomla-cms/blob/4.0-dev/libraries/src/MVC/Controller/ApiController.php#L432 might help
if ($recordKey && $table->load($recordKey))
{
$fields = $table->getFields();
foreach ($fields as $field)
{
if (array_key_exists($field, $data))
{
continue;
}
$fieldValue = $table->{$field};
if (is_string($fieldValue) && is_array(json_decode($fieldValue)))
{
$fieldValue = json_decode($fieldValue);
}
$data[$field] = $fieldValue;
}
}| Labels |
Added:
?
|
||
@joomdonation It feels just only a little less hacky than @alikon's suggestion :D But I can see it work. I do propose to incorporate this logic in the edit() as opposed to the save() method though. After all, we only need it for PATCH requests. A dedicated method that adds 'missing' item attributes to the request's data object could do the trick, called just before line https://github.com/joomla/joomla-cms/blob/4.0-dev/libraries/src/MVC/Controller/ApiController.php#L396.
What do you think @alikon? And who is going to do the PR?
| Status | New | ⇒ | Closed |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2021-05-29 09:52:26 |
| Closed_By | ⇒ | alikon | |
| Labels |
Added:
?
Removed: ? |
||
The same error:"{"errors":[{"title":"Field required: Title\nField required: Category"}]}"
when i send curl forn new rticle:
curl -X POST [myhttspsite]/joomla/api/index.php/v1/content/articles
-H "Content-Type: application/json"
-H "X-Joomla-Token: mytoken"
-d "{'alias': 'my-article','articletext': 'My text','catid':'2,'language': '*','metadesc': '','metakey': '','title': 'Here's an article'}"
This comment was created with the J!Tracker Application at issues.joomla.org/tracker/joomla-cms/34261.
joomla-cms/libraries/src/MVC/Controller/ApiController.php
Lines 436 to 437 in f61b9ae
a quick & dirty hack could be to have a specific form for the api
Form::addFormPath(JPATH_COMPONENT_ADMINISTRATOR . '/forms/api');