FIX: Drop internal URL validation for paths in sidebar (#20891)
`Rails.application.routes.recognize_path(value)` was not working for /admin paths because StaffConstraint.new requires user to check permission. This validation is not bringing much value, and the easiest way is to drop it. In the worse case scenario, a user will have an incorrect link in their sidebar. Bug reported: https://meta.discourse.org/t/custom-sidebar-sections-being-tested-on-meta/255303/66
This commit is contained in:
parent
ef1b781ced
commit
c86d772277
|
@ -15,11 +15,8 @@ class SidebarUrl < ActiveRecord::Base
|
||||||
before_validation :remove_internal_hostname, :set_external
|
before_validation :remove_internal_hostname, :set_external
|
||||||
|
|
||||||
def path_validator
|
def path_validator
|
||||||
if external?
|
return true if !external?
|
||||||
raise ActionController::RoutingError.new("Not Found") if value !~ Discourse::Utils::URI_REGEXP
|
raise ActionController::RoutingError.new("Not Found") if value !~ Discourse::Utils::URI_REGEXP
|
||||||
else
|
|
||||||
Rails.application.routes.recognize_path(value)
|
|
||||||
end
|
|
||||||
rescue ActionController::RoutingError
|
rescue ActionController::RoutingError
|
||||||
errors.add(
|
errors.add(
|
||||||
:value,
|
:value,
|
||||||
|
|
|
@ -1,13 +1,7 @@
|
||||||
# frozen_string_literal: true
|
# frozen_string_literal: true
|
||||||
|
|
||||||
RSpec.describe SidebarUrl do
|
RSpec.describe SidebarUrl do
|
||||||
it "validates path" do
|
it "validates external URLs" do
|
||||||
expect(SidebarUrl.new(icon: "link", name: "categories", value: "/categories").valid?).to eq(
|
|
||||||
true,
|
|
||||||
)
|
|
||||||
expect(SidebarUrl.new(icon: "link", name: "categories", value: "/invalid_path").valid?).to eq(
|
|
||||||
false,
|
|
||||||
)
|
|
||||||
expect(
|
expect(
|
||||||
SidebarUrl.new(
|
SidebarUrl.new(
|
||||||
icon: "link",
|
icon: "link",
|
||||||
|
|
Loading…
Reference in New Issue