Contacts|Contactgroups endpoints: Only allow filter on GET method

Icinga · Jul 3, 2024 · 8453e00 · 8453e00
1 parent 898009b
commit 8453e00
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 6 deletions.
diff --git a/application/controllers/ApiV1ContactgroupsController.php b/application/controllers/ApiV1ContactgroupsController.php
@@ -60,8 +60,13 @@ public function indexAction(): void
             $this->httpBadRequest('The given identifier is not a valid UUID');
         }
 
+        $filterStr = rawurldecode(Url::fromRequest()->getQueryString());
+        if ($method !== 'GET' && $filterStr) {
+            $this->httpBadRequest('Filter is only allowed for GET requests');
+        }
+
         $filter = FilterProcessor::assembleFilter(
-            QueryString::fromString(rawurldecode(Url::fromRequest()->getQueryString()))
+            QueryString::fromString($filterStr)
                 ->on(
                     QueryString::ON_CONDITION,
                     function (Filter\Condition $condition) {

diff --git a/application/controllers/ApiV1ContactsController.php b/application/controllers/ApiV1ContactsController.php
@@ -65,8 +65,13 @@ public function indexAction(): void
             $this->httpBadRequest('The given identifier is not a valid UUID');
         }
 
+        $filterStr = rawurldecode(Url::fromRequest()->getQueryString());
+        if ($method !== 'GET' && $filterStr) {
+            $this->httpBadRequest('Filter is only allowed for GET requests');
+        }
+
         $filter = FilterProcessor::assembleFilter(
-            QueryString::fromString(rawurldecode(Url::fromRequest()->getQueryString()))
+            QueryString::fromString($filterStr)
                 ->on(
                     QueryString::ON_CONDITION,
                     function (Filter\Condition $condition) {
@@ -164,10 +169,6 @@ function (Filter\Condition $condition) {
 
                 exit;
             case 'POST':
-                if ($filter !== null) {
-                    $this->httpBadRequest('Cannot filter on POST');
-                }
-
                 $data = $this->getValidatedData();
 
                 $db->beginTransaction();