mirror of
https://github.com/ether/etherpad-lite.git
synced 2026-07-19 01:24:19 +00:00
af03259555
* fix: POST API requests with JSON body no longer time out When express.json() middleware parses the request body before the OpenAPI handler runs, formidable's IncomingForm hangs forever waiting for stream data that was already consumed. Now checks req.body first and only falls back to formidable for multipart/form-data requests. Also fixed case-insensitive method check (c.request.method may be uppercase depending on openapi-backend version). Fixes #7127 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: handle empty JSON body and missing method safely - Remove Object.keys().length > 0 check on req.body so empty JSON objects ({}) don't fall through to formidable (which would hang) - Guard c.request.method with fallback to empty string to prevent TypeError if method is undefined Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * security: prevent parameter pollution by excluding headers from field merge Previously Object.assign merged headers, params, query, and formData into a single fields object. This allowed POST body parameters to override security-sensitive headers like Authorization, or headers to pollute API parameter values. Now only merges params, query, and formData. The Authorization header is passed explicitly as a fallback for legacy API key authentication, but cannot be overridden by body/query parameters. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| admin.ts | ||
| adminplugins.ts | ||
| adminsettings.ts | ||
| apicalls.ts | ||
| errorhandling.ts | ||
| importexport.ts | ||
| openapi.ts | ||
| padurlsanitize.ts | ||
| pwa.ts | ||
| socketio.ts | ||
| specialpages.ts | ||
| static.ts | ||
| tokenTransfer.ts | ||
| webaccess.ts | ||