q2a / question2answer

Question2Answer is a free and open source platform for Q&A sites, running on PHP/MySQL.
http://www.question2answer.org/
GNU General Public License v3.0
1.63k stars 627 forks source link

Make sure there is an editor loaded when reading the content of a post #994

Closed pupi1985 closed 2 months ago

pupi1985 commented 4 months ago

It is possible to send a POST request setting any value to the editor field (e.g. a_editor, when submitting an answer).

If the editor is found, it works. If the whole field is removed, it works (by defaulting to the basic editor). If the field is set but the editor is not found, this throws a 500 error.

I think giving the client a basic editor when they attempt to fetch an invalid one seems like an acceptable solution. Catching the error specifically and giving the user the error string seems to be overcomplicated, considering the client is most likely deliberately modifying the HTTP request.