Cockpit-HQ / Cockpit

Cockpit Core - Content Platform
https://getcockpit.com
Other
388 stars 47 forks source link

500 Internal Server Error due to invalid API payload #229

Closed Pa55er6y closed 3 weeks ago

Pa55er6y commented 3 weeks ago

Sorry for spamming.

With an authenticated user, sending a JSON payload with an invalid _id to the endpoint POST /content/models/saveItem/{content_type} would lead to 500 internal server error instead of 400 bad request.

To reproduce, (with a login-ed user) create a content type (singleton or collection), containing arbitrary fields. Send the payload {"item": {"_id": [1]}} to the endpoint POST /content/models/saveItem/{content_type}. It would trigger a HTTP 500 error.

Version: 2.9.4 OS: Ubuntu 24.04 Setup: PHP 8.3.6 + SQLite