From e3041700cf66a133e287d6ddf33c4490b9e9afe9 Mon Sep 17 00:00:00 2001
From: El RIDO <elrido@gmx.net>
Date: Mon, 15 Jun 2026 23:05:27 +0200
Subject: [PATCH 1/2] add test to catch URL path extraction not removing query

---
 tst/RequestTest.php | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tst/RequestTest.php b/tst/RequestTest.php
index 41794d5c..d7e4d9ac 100644
--- a/tst/RequestTest.php
+++ b/tst/RequestTest.php
@@ -218,6 +218,7 @@ class RequestTest extends TestCase
     {
         $this->reset();
         $id              = Helper::getRandomId();
+        $path            = '/' . $this->getRandomQueryChars() . '/';
         $queryParams     = array($id);
         $queryParamCount = random_int(1, 5);
         for ($i = 0; $i < $queryParamCount; ++$i) {
@@ -226,8 +227,10 @@ class RequestTest extends TestCase
         shuffle($queryParams);
         $_SERVER['REQUEST_METHOD'] = 'GET';
         $_SERVER['QUERY_STRING']   = implode('&', $queryParams);
+        $_SERVER['REQUEST_URI']    = $path . '?' . $_SERVER['QUERY_STRING'];
         $_GET[$id]                 = '';
         $request                   = new Request;
         $this->assertEquals($id, $request->getParam('pasteid'));
+        $this->assertEquals($path, $request->getRequestUri());
     }
 }

From 164c839c39688533ef0086575878e8392cd21249 Mon Sep 17 00:00:00 2001
From: El RIDO <elrido@gmx.net>
Date: Mon, 15 Jun 2026 23:12:52 +0200
Subject: [PATCH 2/2] insert only base path in JSON API responses, without GET
 parameters

---
 CHANGELOG.md    | 1 +
 lib/Request.php | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a414be86..9a6d157e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,7 @@
 * FIXED: State corruption after "Remove attachment" (#1824)
 * FIXED: Copy button is hidden if the document is made as markdown (#1703)
 * FIXED: Shortened URLs from YOURLS received but failed to parse (#1844)
+* FIXED: Insert only base path in JSON API responses, without GET parameters
 
 ## 2.0.4 (2026-05-03)
 * ADDED: Translations for Swedish & Persian
diff --git a/lib/Request.php b/lib/Request.php
index 2e386e6f..31233472 100644
--- a/lib/Request.php
+++ b/lib/Request.php
@@ -220,7 +220,7 @@ class Request
     }
 
     /**
-     * Get request URI
+     * Get request URI path without GET parameters
      *
      * @access public
      * @return string
@@ -228,7 +228,7 @@ class Request
     public function getRequestUri()
     {
         $uri = array_key_exists('REQUEST_URI', $_SERVER) ? filter_var($_SERVER['REQUEST_URI'], FILTER_SANITIZE_URL) : '';
-        return empty($uri) ? '/' : $uri;
+        return empty($uri) ? '/' : parse_url($uri, PHP_URL_PATH);
     }
 
     /**