Remove _path from query parameters when fragment is a subrequest and request attributes are already set

Craig Menning · Craig Menning · commit 545c822081e6 · 2016-03-02T08:55:04.000-06:00
Added tests for _path removal in FragmentListener
diff --git a/src/Symfony/Component/HttpKernel/EventListener/FragmentListener.php b/src/Symfony/Component/HttpKernel/EventListener/FragmentListener.php
@@ -58,7 +58,14 @@ public function onKernelRequest(GetResponseEvent $event)
     {
         $request = $event->getRequest();
 
-        if ($request->attributes->has('_controller') || $this->fragmentPath !== rawurldecode($request->getPathInfo())) {
+        if ($this->fragmentPath !== rawurldecode($request->getPathInfo())) {
+            return;
+        }
+
+        if ($request->attributes->has('_controller')) {
+            // Is a sub-request: no need to parse _path but it should still be removed from query parameters as below.
+            $request->query->remove('_path');
+
             return;
         }
 
diff --git a/src/Symfony/Component/HttpKernel/Tests/EventListener/FragmentListenerTest.php b/src/Symfony/Component/HttpKernel/Tests/EventListener/FragmentListenerTest.php
@@ -89,6 +89,31 @@ public function testWithSignature()
         $this->assertFalse($request->query->has('_path'));
     }
 
+    public function testRemovesPathWithControllerDefined()
+    {
+        $request = Request::create('http://example.com/_fragment?_path=foo%3Dbar%26_controller%3Dfoo');
+
+        $listener = new FragmentListener(new UriSigner('foo'));
+        $event = $this->createGetResponseEvent($request, HttpKernelInterface::SUB_REQUEST);
+
+        $listener->onKernelRequest($event);
+
+        $this->assertFalse($request->attributes->has('_path'));
+    }
+
+    public function testRemovesPathWithControllerNotDefined()
+    {
+        $signer = new UriSigner('foo');
+        $request = Request::create($signer->sign('http://example.com/_fragment?_path=foo%3Dbar'), 'GET', array(), array(), array(), array('REMOTE_ADDR' => '10.0.0.1'));
+
+        $listener = new FragmentListener($signer);
+        $event = $this->createGetResponseEvent($request);
+
+        $listener->onKernelRequest($event);
+
+        $this->assertFalse($request->attributes->has('_path'));
+    }
+
     private function createGetResponseEvent(Request $request, $requestType = HttpKernelInterface::MASTER_REQUEST)
     {
         return new GetResponseEvent($this->getMock('Symfony\Component\HttpKernel\HttpKernelInterface'), $request, $requestType);

Original file line number	Diff line number	Diff line change
`@@ -58,7 +58,14 @@ public function onKernelRequest(GetResponseEvent $event)`
`58`	`58`	`{`
`59`	`59`	`$request = $event->getRequest();`
`60`	`60`
`61`		`- if ($request->attributes->has('_controller') \|\| $this->fragmentPath !== rawurldecode($request->getPathInfo())) {`
	`61`	`+ if ($this->fragmentPath !== rawurldecode($request->getPathInfo())) {`
	`62`	`+ return;`
	`63`	`+ }`
	`64`	`+`
	`65`	`+ if ($request->attributes->has('_controller')) {`
	`66`	`+ // Is a sub-request: no need to parse _path but it should still be removed from query parameters as below.`
	`67`	`+ $request->query->remove('_path');`
	`68`	`+`
`62`	`69`	`return;`
`63`	`70`	`}`
`64`	`71`