Skip to content

fix(ContactsStore): Sanitize user ID given to guest avatar route - #43317

Merged
skjnldsv merged 1 commit into
masterfrom
fix/contacts-name
Feb 7, 2024
Merged

fix(ContactsStore): Sanitize user ID given to guest avatar route#43317
skjnldsv merged 1 commit into
masterfrom
fix/contacts-name

Conversation

@susnux

@susnuxsusnux commented Feb 3, 2024

Copy link
Copy Markdown
Contributor

It is not allowed to use slashes within path parameters, so they would need to be encoded. But URL encoded slashes are not supported by Apache, so instead replace slash with space.

Checklist

It is not allowed to use slashes within path parameters, so they would need to be encoded.
But URL encoded slashes are not suported by Apache, so instead replace slash with space.
Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
@susnuxsusnux added bug 3. to review Waiting for reviews php Pull requests that update Php code labels Feb 3, 2024
@susnuxsusnux added this to the Nextcloud 29 milestone Feb 3, 2024
@susnux
susnux requested review from a team, Altahrim, ArtificialOwl, icewind1991 and szaimen and removed request for a teamFebruary 3, 2024 10:36
@susnux

Copy link
Copy Markdown
ContributorAuthor

/backport to stable28

@szaimenszaimen left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I guess makes sense but did not test

@skjnldsv
skjnldsv merged commit bea8bf9 into masterFeb 7, 2024
@skjnldsv
skjnldsv deleted the fix/contacts-name branch February 7, 2024 09:23
@blizzzblizzz mentioned this pull request Mar 5, 2024
@D3nnis3n

D3nnis3n commented Mar 5, 2024

Copy link
Copy Markdown

Sorry if I'm not supposed to write here and I have absolutely no idea if this is already released in 28.0.3, but if that is the case, it didn't work. I'm still getting the exception in the log for contacts#3800 / nextcloud/contacts#3479.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

3. to reviewWaiting for reviewsbugphpPull requests that update Php code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Exception in "core.GuestAvatar.getAvatar" Contacts Search Widget Malfunction?

5 participants

@susnux@D3nnis3n@icewind1991@szaimen@skjnldsv