yv01p/Umbraco-CMS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add check to ensure that RenderControllers and SurfaceControllers are always routed through the UmbracoRouteValueTransforms (#16540)

Browse Source
This commit is contained in:
Mole
2024-06-03 12:03:40 +02:00
committed by GitHub
parent 0aaac78cfa
commit 100f2c3bcd
1 changed files with 15 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
src/Umbraco.Web.Website/Routing/EagerMatcherPolicy.cs
View File

@@ -1,4 +1,5 @@
using Microsoft.AspNetCore.Http;
using System.Reflection;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Mvc.Controllers;
using Microsoft.AspNetCore.Routing;
using Microsoft.AspNetCore.Routing.Matching;
@@ -8,8 +9,8 @@ using Umbraco.Cms.Core.Configuration.Models;
using Umbraco.Cms.Core.Routing;
using Umbraco.Cms.Core.Services;
using Umbraco.Cms.Web.Common.Controllers;
using Umbraco.Cms.Web.Website.Controllers;
using Umbraco.Extensions;
using HttpRequestExtensions = Umbraco.Extensions.HttpRequestExtensions;
namespace Umbraco.Cms.Web.Website.Routing;
@@ -104,6 +105,18 @@ internal class EagerMatcherPolicy : MatcherPolicy, IEndpointSelectorPolicy
continue;
}
// We have to ensure that none of the candidates is a render controller or surface controller
// Normally these shouldn't be statically routed, however some people do it.
// So we should probably be friendly and check for it.
// Do not add this to V14.
ControllerActionDescriptor? controllerDescriptor = routeEndpoint.Metadata.GetMetadata<ControllerActionDescriptor>();
TypeInfo? controllerTypeInfo = controllerDescriptor?.ControllerTypeInfo;
if (controllerTypeInfo is not null &&
(controllerTypeInfo.IsType<RenderController>() || controllerTypeInfo.IsType<SurfaceController>()))
{
return;
}
if (routeEndpoint.Order < lowestOrder)
{
// We have to ensure that the route is valid for the current request method.