Bug #4519
closed
Renaming host with / in name causes "No route matches" error
Added by Dominic Cleal over 10 years ago.
Updated over 6 years ago.
Description
1. Edit an existing host
2. Change name to "foo/bar" (or add a "/" inside the name)
3. Submit form
You receive the following error:
No route matches {:action=>"toggle_manage", :controller=>"hosts", :id=>"foo/bar.example.com"}
The save doesn't occur as the name is invalid (since #3697), but the form fails to re-render.
- Related to Bug #3697: Field Validations Should be more Comprehensive added
- Related to Bug #4456: CVE-2014-0089 - Stored Cross Site Scripting (XSS) on 500 error page added
This issue is marked as private, not because of a particular security angle, but because it's possible to include JavaScript in the host name, which thanks to #4456 gets rendered in the user's browser. Once #4456 is fixed, I'll make this issue public.
- Category changed from Security to Web Interface
- Private changed from Yes to No
- Related to Bug #9531: Removing host name from Host#edit throws routing error added
- Status changed from New to Ready For Testing
- Assignee set to Tomer Brisker
- Pull request https://github.com/theforeman/foreman/pull/4179 added
- Status changed from Ready For Testing to Closed
- % Done changed from 0 to 100
- Translation missing: en.field_release set to 210
- Target version set to 169
- Target version deleted (
169)
- Target version set to 1.11.0
Also available in: Atom
PDF