Cannot view or delete groups with a slash in their name using provisioning API
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 8.8k
- Forks
- 2.1k
- Avg merge
- 20h 7m
- Merged PRs (30d)
- 41
Description
You can create groups with all sorts of names in the webUI or with the provisioning API like:
curl http://admin:admin@localhost:8080/ocs/v2.php/cloud/groups -X POST -d "groupid=q?mark"
curl http://admin:admin@localhost:8080/ocs/v2.php/cloud/groups -X POST -d "groupid=a%sign"
curl http://admin:admin@localhost:8080/ocs/v2.php/cloud/groups -X POST -d "groupid=a/slash"
and other special characters.
You can list all groups fine with:
curl http://admin:admin@localhost:8080/ocs/v2.php/cloud/groups
And view individual groups with:
curl http://admin:admin@localhost:8080/ocs/v2.php/cloud/groups/a%sign
and to get a "?" through, you have to put the escaped value "%3F"
curl http://admin:admin@localhost:8080/ocs/v2.php/cloud/groups/q%3Fmark
You can delete such groups with:
curl http://admin:admin@localhost:8080/ocs/v2.php/cloud/groups/a%sign -X DELETE
curl http://admin:admin@localhost:8080/ocs/v2.php/cloud/groups/q%3Fmark -X DELETE
The problem comes if you try with groups that have a / in their name. A literal slash is never going to work:
curl http://admin:admin@localhost:8080/ocs/v2.php/cloud/groups/a/slash
And an escaped slash, like this, is rejected by the server (Apache or PHP dev server):
curl http://admin:admin@localhost:8080/ocs/v2.php/cloud/groups/a%2Fslash
So you cannot manage a group like a/slash via the provisioning API. But you can manage it through webUI.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the provisioning API requests in the issue for groups named a/slash, including literal and escaped slashes. Trace how the API and server handle the group name in view and DELETE requests; done means both operations work for slash-containing groups without regressing the existing special-character cases.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100