Remove unroutable mock redirect routes and dummy controller#17
Open
madsnorgaard wants to merge 1 commit into
Open
Remove unroutable mock redirect routes and dummy controller#17madsnorgaard wants to merge 1 commit into
madsnorgaard wants to merge 1 commit into
Conversation
commerce_payfast.routing.yml declared two routes whose path was the absolute external URL 'https://www.payfast.co.za/eng/process'. Drupal route paths must be site-relative, so these never registered and could never match a request - they were leftover scaffolding from Commerce's example off-site gateway. Their target, PayfastRedirectController, is self-described as 'a dummy controller for mocking an off-site gateway' and is referenced nowhere else. It issued TrustedRedirectResponse to unvalidated request parameters; unreachable in practice, but dead code worth removing rather than leaving as a latent open-redirect surface. The real ITN endpoint (commerce_payment_payfast.notify) is untouched, and the live redirect to Payfast is built by PaymentOffsiteForm, not these routes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Independent cleanup, separate from #12 and #16.
commerce_payfast.routing.ymldeclared two routes whosepathwas the absolute external URLhttps://www.payfast.co.za/eng/process. Drupal route paths must be site-relative, so these never registered and could never match a request - leftover scaffolding copied from Commerce's example off-site gateway.Their target,
PayfastRedirectController, is self-described as "a dummy controller for mocking an off-site gateway" and is referenced nowhere else. It issuedTrustedRedirectResponseto unvalidatedreturn/cancelrequest parameters - unreachable in practice, but dead code worth removing rather than leaving as a latent open-redirect surface.Untouched: the real ITN endpoint (
commerce_payment_payfast.notify) and the live redirect to PayFast, whichPaymentOffsiteFormbuilds directly.Removes 2 routes + 1 controller file; no runtime behaviour change.