search

Locastic / ApiPlatformTranslationBundle

Translation bundle for ApiPlatform based on Sylius translation
MIT License
85 stars 28 forks source link

Declare group filter whitelist to prevent exposure of prohibited properties #48

Closed pascal-zarrad closed 2 years ago

pascal-zarrad commented 2 years ago

Description

If translation.groups is defined as filter without a defined whitelist, it will allow to provide just any serialization group for the ?groups[]= parameter. This might expose properties with serialization groups that are not defined in the normalizationContext of an API resource and shouldn't be exposed.

By configuring locastic_api_platform_translation.filter.translation_groups arguments with 'translations' defined in the $whitelist parameter, only the translations serialization group is allowed for the filter defined by this bundle.

paullla commented 2 years ago

Hi @pascal-zarrad thank you for the PR. Can you please rebase to the master? It will fix the CI problem.

pascal-zarrad commented 2 years ago

Hi @paullla, rebase is done.