scary PATCH injection - Githubissues

agco / harvesterjs

Create JSONAPI-compliant APIs over a Node.js + MongoDB stack in an easy, boilerplate-free manner

http://agco.github.io/harvesterjs/

MIT License

68 stars 13 forks source link

Closed superpeixeboi closed 7 years ago

superpeixeboi commented 7 years ago

PATCH http://app.com/model/:id [ { "path": "///$unset", "value": { "fieldName": "" }, "op": "replace" } ]

This is actually allowed... I believe this was not supposed to be used this way.

waldemarnt commented 7 years ago

Thank you for the point. We decided to remove PATCH on https://github.com/agco/harvesterjs/pull/206 while we design its functionality to add again.

To ensure that old client will not break we generated a new Major tag https://github.com/agco/harvesterjs/tree/3.0.0

Cheers