Comments (5)
OnGitHubSchatz
commented on July 17, 2024
Here is the relevant fix for Services module's 7.x-3.x branch: https://cgit.drupalcode.org/services/commit/?h=7.x-3.x&id=002f8c87fb40df714681345a4c5589ec0777b11f released today.
I'm looking for similar in Restful code now.
from restful.
OnGitHubSchatz
commented on July 17, 2024
Update given the Services patch: Restful 7.x-2.x already implements an operator allow-list in the DataProvider and DataProviderEntity classes in addition to controlling conjunctions in isValidConjunctionForFilter method.
From this I would say it is clear of specific vector for SA-CONTRIB-2019-026
from restful.
e0ipso
commented on July 17, 2024
We are looking good on this regard. As @gitschatz is pointing out, we already had that protection a while ago.
from restful.
krisahil
commented on July 17, 2024
Great. Thank you for looking into this!
I'll now close this thread.
from restful.
OnGitHubSchatz
commented on July 17, 2024
Heads up @krisahil:
Module was cleared for SA-CONTRIB-2019-026 but was just patched for SA-CORE-2019-003 (entity field validation) in this commit https://cgit.drupalcode.org/restful/commit/?id=5633f598a05fab6bb74c805b20ea828a1a9ced80 tagged with 7.x-2.17.
There is a corresponding release for Restful 1.x branch. Many thanks to @ordavidil 👏
from restful.
Related Issues (20)
- Handling child entity references in the parent
- Adding custom info to the discovery resource
- Duplicate 401 unauthorised error on incorrect access token
- Language and Cache
- Cannot filter != or NOT IN HOT 1
- Item Url gives 404
- Return fields not found in node (but are)
- defaultSortInfo() has no effect HOT 3
- 1.x "queryForListFilter()" does not support "NOT IN" operator HOT 1
- not able to POST comment on node
- token authentication entity query failure HOT 1
- Support Request: Custom Access HOT 3
- Pull security changes from drupal.org HOT 3
- Post new entry in Entity List with Node Reference to other Node HOT 2
- localhost/api/articles 404
- Taxonomy Term in Restful module
- Plugin ID 'json_api' was not found. HOT 1
- Question, authentication for asynchronous requests.
- Not able to update files in API catalog module
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from restful.