Feeling Lucky
PR-5.0-dev
[#40998] - Remove query parameters from API route variables
- Fixed in Code Base
- 26 Jun 2023
- Medium
- Build: 5.0-dev
- # 40998
- Diff
- SniperSister:5.0-remove-deprecated-query-merge
User tests: Successful: Unsuccessful:
Summary of Changes
The security issue fixed with 4.2.8 (https://developer.joomla.org/security-centre/894-20230201-core-improper-access-check-in-webservice-endpoints.html) was caused by the fact that query parameters have been merged into API route variables. That behavior is neither smart nor necessary and therefore a deprecation notice has been added. This PR removes the merge code.
Testing Instructions
Code Review
joomla-cms-bot
- | Category | ⇒ | Libraries |
| Status | New | ⇒ | Pending |
| Labels |
Added:
PR-5.0-dev
|
||
HLeithner
- comment
- 26 Jun 2023
@SniperSister did you tested what george said about pagination?
I'm merging this for now in alpha2 to get earlier feedback but we need documentation in manual.joomla.org please
| Status | Pending | ⇒ | Fixed in Code Base |
| Closed_Date | 0000-00-00 00:00:00 | ⇒ | 2023-06-26 07:53:51 |
| Closed_By | ⇒ | HLeithner |
We need to test the API Pagination still works. As that's the commit associated with this code being introduced. Obviously I support this removal - but point being we might need to make changes in the api controller to facilitate