opensource/coder
3
0
Fork 0
mirror of https://github.com/coder/coder.git synced 2026-09-24 15:04:27 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: don't allow "new" or "create" as url-friendly names (#13596)

Browse Source
This commit is contained in:
Kayla Washburn-Love
2024-06-18 15:36:13 -06:00
committed by GitHub
parent 3a1fa04590
commit e987ad1d89
12 changed files with 117 additions and 108 deletions
Download Patch File Download Diff File Expand all files Collapse all files
coderd/httpapi/httpapi.go
+2 -2
View File
@@ -46,7 +46,7 @@ func init() {
valid := NameValid(str)
return valid == nil
}
for _, tag := range []string{"username", "organization_name", "template_name", "workspace_name", "oauth2_app_name"} {
for _, tag := range []string{"username", "organization_name", "template_name", "group_name", "workspace_name", "oauth2_app_name"} {
err := Validate.RegisterValidation(tag, nameValidator)
if err != nil {
panic(err)
@@ -62,7 +62,7 @@ func init() {
valid := DisplayNameValid(str)
return valid == nil
}
for _, displayNameTag := range []string{"organization_display_name", "template_display_name"} {
for _, displayNameTag := range []string{"organization_display_name", "template_display_name", "group_display_name"} {
err := Validate.RegisterValidation(displayNameTag, displayNameValidator)
if err != nil {
panic(err)
coderd/httpapi/name.go
+4
View File
@@ -46,6 +46,10 @@ func NameValid(str string) error {
if len(str) < 1 {
return xerrors.New("must be >= 1 character")
}
// Avoid conflicts with routes like /templates/new and /groups/create.
if str == "new" || str == "create" {
return xerrors.Errorf("cannot use %q as a name", str)
}
matched := UsernameValidRegex.MatchString(str)
if !matched {
return xerrors.New("must be alphanumeric with hyphens")