Skip to content

BUGFIX: sanitize current page input#52

Merged
dlubitz merged 1 commit intoFlowpack:3.6from
Pingu501:ah/bugfix/sanitize-current-page
Aug 18, 2025
Merged

BUGFIX: sanitize current page input#52
dlubitz merged 1 commit intoFlowpack:3.6from
Pingu501:ah/bugfix/sanitize-current-page

Conversation

@Pingu501
Copy link
Contributor

On paginated sites the currentPage is not sanitized result in thrown errors: Unsupported operand types: string * int.

You can see this in the wild as soon as paginated page urls get manipulated. Samples:

We see these errors frequently in logs and exceptions from bots trying to exploit this.

Copy link
Member

@markusguenther markusguenther left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the fix ❤️

Copy link
Contributor

@dlubitz dlubitz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for taking care. I left a question, as I couldn't test it myself atm.

Copy link
Contributor

@dlubitz dlubitz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, I tested it quickly and it works as expected.

# this is also 1
currentPage = ${0 || 1}

@dlubitz dlubitz merged commit a8d4890 into Flowpack:3.6 Aug 18, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants