Uploaded image for project: 'eZ Publish / Platform'
  1. eZ Publish / Platform
  2. EZP-29933

Admin UI REST API listener considers 3rd party routes as REST routes

    XMLWordPrintable

Details

    Description

      https://github.com/ezsystems/ezplatform-admin-ui/pull/691 added a request listener that matches on request path info and evaluates if the request is an eZ Platform REST API request.

      The regex used is too broad and takes into account routes that have nothing to do with eZ Platform REST API, for example:

      https://example.com/netgen/api/some/path
      https://example.com/admin/netgen/api/some/path
      https://example.com/cro/netgen/api/some/path

      Two issues exist with the pattern:

      1) It doesn't start with a slash, matching any part of the path info
      2) It doesn't validate that the part before `/api/` is a valid siteaccess

      Attachments

        Activity

          People

            Unassigned Unassigned
            f8f4635f-c125-4f25-94af-5c94e74ef8c1@accounts.ibexa.co Edi Modrić
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: