Actions
Issue #5330
closedHardcoded URL patterns needs proper check
Start date:
Due date:
Estimated time:
Severity:
2. Medium
Version:
Platform Release:
OS:
Triaged:
Yes
Groomed:
No
Sprint Candidate:
No
Tags:
Sprint:
Sprint 59
Quarter:
Description
As now used urlpatterns check only ending of url :
urlpatterns = [
url(r'rpm/upload/$', OneShotUploadViewSet.as_view({'post': 'create'})),
url(r'rpm/copy/$', CopyViewSet.as_view({'post': 'create'})),
url(r'modulemd/upload/$', ModuleOneShotUpload.as_view({'post': 'create'}))
]
it is possible to use them in strange ways :
http --form POST :24817/pulp/api/v3/sdfghjkl/modulemd/upload/ file@./fedora.yaml.gz
works same as
http --form POST :24817/pulp/api/v3/modulemd/upload/ file@./fedora.yaml.gz
We should allow users to use only one way as other api calls starts with "/pulp/api/v3/..."
Related issues
Actions
Add url prefix to plugin custom urls.
closes #5330 https://pulp.plan.io/issues/5330