Skip to content

Updated BookController:store method to sanitize input#614

Closed
ptcrash wants to merge 1 commit intoBookStackApp:masterfrom
ptcrash:LookLittleJohn-patch-1
Closed

Updated BookController:store method to sanitize input#614
ptcrash wants to merge 1 commit intoBookStackApp:masterfrom
ptcrash:LookLittleJohn-patch-1

Conversation

@ptcrash
Copy link

@ptcrash ptcrash commented Dec 11, 2017

Fixed a bug where a person could mess up the router by having books with slashes in the name as well as create books with the name of the create, which makes a book that is totally accessible since the route /books/create is already used for the book creation view.

Fixed a bug where a person could mess up the router by having books with slashes in the name as well as create books with the name of reserved words.
@ssddanbrown
Copy link
Member

Thank you for your pull request.

In regards to slashes in the names, These should be stripped when URL slugs are generated.

This pull request would prevent spaces or underscores from being able to be used within Book names which I'd prefer to allow.

The usage of keywords is a good point. I do think we should add something to prevent clashes but I don't think it should be part of the name validation logic but instead part of the slug generation. Keywords should still be able to be used for book/page/chapter names if specified, We would just generate non-conflicting slugs.

@ptcrash
Copy link
Author

ptcrash commented Dec 13, 2017

Sounds good! I've got some spare time this weekend - I'll propose an update for y'all then 😄
I'll just use this PR and ping you when there's something worth looking at, if that works for you.

@ssddanbrown
Copy link
Member

Now closing this as the core issues has been mitigated through a different solution within 1a9f676

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants