plone / plone/plone.restapi

`@querystring-search` does not handle Virtual Host Monster (VHM) mapped paths

Open
#2,023 1 comment 0 reactions 1 assignee View on GitHub

@erral is already working on this.

Since Jun 19, 2026.

01 type: bug
Dominant language
Python
Stars
109
Forks
107
Avg merge
2d 3h
Merged PRs (30d)
4

Description

The /@querystring-search endpoint fails to return results when queried with paths relative to a virtual host root. While the standard /@search endpoint correctly resolves virtual paths to physical catalog paths using the VirtualRootPhysicalPath request variable, /@querystring-search passes the criteria directly to the query builder without normalization.

This causes modern frontend components (like the new Svelte-based pat-filemanager) to show empty listings when navigating into subfolders in a production environment where VHM is active.

Steps to Reproduce
  1. Set up a Plone site behind a Virtual Host Monster (e.g., mapping http://plone.org/ to /Plone).
  2. Create a folder at /Plone/folder.
  3. Call /@querystring-search via the virtual URL http://plone.org/@querystring-search with the following JSON:
    {
      "query": [
        {
          "i": "path",
          "o": "plone.app.querystring.operation.string.path",
          "v": "/folder::1"
        }
      ]
    }
    
  4. Expected: The endpoint returns the children of /Plone/folder.
  5. Actual: The endpoint returns 0 results because it looks for a physical path /folder, which does not exist in the catalog.
Technical Details

The issue lies in plone.restapi.services.querystringsearch.get.QuerystringSearch. Unlike plone.restapi.search.handler.SearchHandler, it does not check for VirtualRootPhysicalPath in the request.
In SearchHandler._constrain_query_by_path, the following logic is applied:

vhm_physical_path = self.request.get("VirtualRootPhysicalPath")
if vhm_physical_path:
    # ... prepends vhm_physical_path to the query ...

The @querystring-search implementation should adopt similar logic to ensure consistency across search services.

Proposed Solution

Update QuerystringSearch.__call__ in src/plone/restapi/services/querystringsearch/get.py to:

  1. Detect VirtualRootPhysicalPath.
  2. Iterate through query criteria.
  3. For any path index, prepend the physical root to the value (handling both string and list formats).
  4. Preserve the ::depth suffix if present in the string value.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.