search

getkirby / kirby

Kirby's core application folder
https://getkirby.com
Other
1.27k stars 167 forks source link

Wrong field names like `delete` can result in content loss when using it in query syntax #3930

Closed texnixe closed 2 years ago

texnixe commented 2 years ago

Describe the bug
If you are really unlucky and happen to call a field deleteand then use this field name in your query syntax, this can result in all your content being lost.

Example:

 sections:
      drafts:
        extends: sections/notes
        headline: Drafts
        status: draft
        info: "{{page.delete}}"

When you open this section in the Panel, the pages in the section are deleted.

Expected behavior
While field names shouldn't use native methods, it can happen. Maybe it would make sense to disable such destructive methods in query syntax or only allow GET requests.

Screenshots

Kirby Version
Tested with 3.5.7.1 and Kirby 3.6

Additional context

lukasbestle commented 2 years ago

We discussed this a while back, can't find it anymore. :(

Basically we could create a blocklist of methods of each class that cannot be called from the query language. Would be a bit hard to maintain though.

bastianallgeier commented 2 years ago

I think we need to bring KQL into the core sooner or later. It solves all of that already. It would also allow to use queries in client side panel code which would be super powerful

distantnative commented 2 years ago

I would suggest to close this for now as we cannot solve it until e.g. adding KQL to the core.