mirror of
https://github.com/discourse/discourse.git
synced 2025-02-25 18:55:32 -06:00
FIX: Drop internal URL validation for paths in sidebar (#20891)
`Rails.application.routes.recognize_path(value)` was not working for /admin paths because StaffConstraint.new requires user to check permission. This validation is not bringing much value, and the easiest way is to drop it. In the worse case scenario, a user will have an incorrect link in their sidebar. Bug reported: https://meta.discourse.org/t/custom-sidebar-sections-being-tested-on-meta/255303/66
This commit is contained in:
committed by
GitHub
parent
ef1b781ced
commit
c86d772277
@@ -15,11 +15,8 @@ class SidebarUrl < ActiveRecord::Base
|
|||||||
before_validation :remove_internal_hostname, :set_external
|
before_validation :remove_internal_hostname, :set_external
|
||||||
|
|
||||||
def path_validator
|
def path_validator
|
||||||
if external?
|
return true if !external?
|
||||||
raise ActionController::RoutingError.new("Not Found") if value !~ Discourse::Utils::URI_REGEXP
|
raise ActionController::RoutingError.new("Not Found") if value !~ Discourse::Utils::URI_REGEXP
|
||||||
else
|
|
||||||
Rails.application.routes.recognize_path(value)
|
|
||||||
end
|
|
||||||
rescue ActionController::RoutingError
|
rescue ActionController::RoutingError
|
||||||
errors.add(
|
errors.add(
|
||||||
:value,
|
:value,
|
||||||
|
|||||||
@@ -1,13 +1,7 @@
|
|||||||
# frozen_string_literal: true
|
# frozen_string_literal: true
|
||||||
|
|
||||||
RSpec.describe SidebarUrl do
|
RSpec.describe SidebarUrl do
|
||||||
it "validates path" do
|
it "validates external URLs" do
|
||||||
expect(SidebarUrl.new(icon: "link", name: "categories", value: "/categories").valid?).to eq(
|
|
||||||
true,
|
|
||||||
)
|
|
||||||
expect(SidebarUrl.new(icon: "link", name: "categories", value: "/invalid_path").valid?).to eq(
|
|
||||||
false,
|
|
||||||
)
|
|
||||||
expect(
|
expect(
|
||||||
SidebarUrl.new(
|
SidebarUrl.new(
|
||||||
icon: "link",
|
icon: "link",
|
||||||
|
|||||||
Reference in New Issue
Block a user