@recaptime-dev's working patches + fork for Phorge, a community fork of Phabricator. (Upstream dev and stable branches are at upstream/main and upstream/stable respectively.)
hq.recaptime.dev/wiki/Phorge
phorge
phabricator
Tighten up Phragment routes to prevent page crashes
Summary: Fixes T5418. These routes were a little more permissive than they should have been.
Test Plan: Hit those URLs without a path, got a 404 instead.
Reviewers: #blessed_reviewers, epriestley
Reviewed By: #blessed_reviewers, epriestley
Subscribers: epriestley, Korvin, hach-que
Maniphest Tasks: T5418
Differential Revision: https://secure.phabricator.com/D9635
+5
-5
+5
-5
src/applications/phragment/application/PhabricatorApplicationPhragment.php
+5
-5
src/applications/phragment/application/PhabricatorApplicationPhragment.php
···
36
36
'' => 'PhragmentBrowseController',
37
37
'browse/(?P<dblob>.*)' => 'PhragmentBrowseController',
38
38
'create/(?P<dblob>.*)' => 'PhragmentCreateController',
39
-
'update/(?P<dblob>.*)' => 'PhragmentUpdateController',
40
-
'policy/(?P<dblob>.*)' => 'PhragmentPolicyController',
41
-
'history/(?P<dblob>.*)' => 'PhragmentHistoryController',
42
-
'zip/(?P<dblob>.*)' => 'PhragmentZIPController',
43
-
'zip@(?P<snapshot>[^/]+)/(?P<dblob>.*)' => 'PhragmentZIPController',
39
+
'update/(?P<dblob>.+)' => 'PhragmentUpdateController',
40
+
'policy/(?P<dblob>.+)' => 'PhragmentPolicyController',
41
+
'history/(?P<dblob>.+)' => 'PhragmentHistoryController',
42
+
'zip/(?P<dblob>.+)' => 'PhragmentZIPController',
43
+
'zip@(?P<snapshot>[^/]+)/(?P<dblob>.+)' => 'PhragmentZIPController',
44
44
'version/(?P<id>[0-9]*)/' => 'PhragmentVersionController',
45
45
'patch/(?P<aid>[0-9x]*)/(?P<bid>[0-9]*)/' => 'PhragmentPatchController',
46
46
'revert/(?P<id>[0-9]*)/(?P<dblob>.*)' => 'PhragmentRevertController',