Uh oh!
There was an error while loading. Please reload this page.
perf: remove unneeded sort in getFolderContentsById - #60225
Merged
Conversation
Signed-off-by: Robin Appelman <robin@icewind.nl>
icewind1991force-pushed
the
remove-cache-order
branch
from
May 8, 2026 16:01
efc798d to
ba0718bCompareSigned-off-by: Robin Appelman <robin@icewind.nl>
icewind1991force-pushed
the
remove-cache-order
branch
from
May 12, 2026 17:30
ba0718b to
c91f8b0Compareicewind1991
marked this pull request as ready for review
May 13, 2026 14:30
icewind1991
requested review from
Altahrim, ArtificialOwl, CarlSchwan and leftybournes
and removed request for
a teamMay 13, 2026 14:30
icewind1991
commented
May 13, 2026
MemberAuthor
/backport to stable33 |
skjnldsv
approved these changes
May 13, 2026
Altahrim
approved these changes
May 13, 2026
Uh oh!
There was an error while loading. Please reload this page.
Merged
oleksandr-nc added a commit
to cloud-py-api/nc_py_api
that referenced
this pull request
May 16, 2026
Nextcloud server PR nextcloud/server#60225 dropped the implicit `ORDER BY name ASC` from `Cache::getFolderContentsById`, so the order of children inside a downloaded zip is now whatever the DB returns and varies by backend. On PostgreSQL this breaks test_download_as_zip / test_download_as_zip_async, which asserted on positional indices. Rebuild `_test_download_as_zip` around a `{filename: size}` dict and check membership + sizes instead of positions. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Tests** * Improved robustness of ZIP download tests to handle varying file ordering, ensuring reliable validation of downloaded archive contents. <!-- review_stack_entry_start --> [](https://app.coderabbit.ai/change-stack/cloud-py-api/nc_py_api/pull/429?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack) <!-- review_stack_entry_end --> <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Review <review@local>
](https://app.coderabbit.ai/change-stack/cloud-py-api/nc_py_api/pull/429?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack){kind=link}
Merged
icewind1991
commented
May 20, 2026
MemberAuthor
/backport to stable32 |
Merged
oleksandr-nc added a commit
to cloud-py-api/nc_py_api
that referenced
this pull request
Jun 2, 2026
## Summary Remediates **BadHost** ([CVE-2026-48710](GHSA-86qp-5c8j-p5mr)), a Host-header path-confusion vulnerability in **Starlette ≤ 1.0.0** that can bypass path-based authorization. The fix lives in **Starlette 1.0.1**. FastAPI does **not** cap Starlette (even latest `0.136.3` only requires `starlette>=0.46.0`), so bumping FastAPI alone does not guarantee a fixed Starlette, and an explicit floor is required. `nc_py_api` also imports `starlette` directly (`_session.py`, `ex_app/integration_fastapi.py`), so declaring it is correct regardless. ## Changes - **`pyproject.toml`** - add `starlette>=1.0.1` (the BadHost fix) - raise `fastapi>=0.133` (the first FastAPI release compatible with Starlette 1.0+) - **`CHANGELOG.md`**: `0.30.2` section: - `Security`: the BadHost pin - `Changed`: `download_directory_as_zip` archive entry order is no longer guaranteed (server-side, per nextcloud/server#60225) The version bump (`_version.py` to `0.30.2`) is intentionally **omitted** here; it lands in the `[publish]` commit on `main` after merge. ## Compatibility - Keeps Python `>=3.10` (FastAPI 0.133+ and Starlette 1.x both require `>=3.10`). - Verified: under these constraints pip upgrades the vulnerable Starlette from `1.0.0` to `1.2.1`; `import nc_py_api` succeeds.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
TODO
Checklist
3. to review, feature component)stable32)AI (if applicable)