nandi/gleanpublic Fork 0
368dd5f
Commits
Clone
git clone https://git.rickub.com/nandi/glean.git
git clone ssh://git@rickub.com/nandi/glean.git

Host key fingerprint (ed25519): SHA256:iycHnxEyq0Q7uyVpB7JlznP0G7JrTPXLYRcAU5CSLhc — verify it before your first connect.

fix(server): parse form body for DELETE requestsUnverified

Julien Robert committed 2026-07-15T11:39:16+02:00 Browse files
368dd5f parent: ee14213
modified internal/server/feeds_handler.go +13 -1
@@ -4,6 +4,7 @@ import (
44 "context"
55 "errors"
66 "fmt"
7+ "io"
78 "net/http"
89 "net/url"
910 "time"
@@ -281,7 +282,18 @@ func (s *Server) handleEditFeed(w http.ResponseWriter, r *http.Request) {
281282
282283 func (s *Server) handleRemoveFeed(w http.ResponseWriter, r *http.Request) {
283284 user := currentUser(r)
284- feedURL := r.FormValue("url")
285+
286+ // FormValue only parses the body for POST/PUT/PATCH; for DELETE we read it manually.
287+ feedURL := r.URL.Query().Get("url")
288+ if feedURL == "" {
289+ body, err := io.ReadAll(http.MaxBytesReader(w, r.Body, 1<<20))
290+ if err == nil {
291+ vals, parseErr := url.ParseQuery(string(body))
292+ if parseErr == nil {
293+ feedURL = vals.Get("url")
294+ }
295+ }
296+ }
285297
286298 if feedURL == "" {
287299 writeAPIError(w, http.StatusBadRequest, "url required")
@@ -4,6 +4,7 @@ import (
4 "context"4 "context"
5 "errors"5 "errors"
6 "fmt"6 "fmt"
7+ "io"
7 "net/http"8 "net/http"
8 "net/url"9 "net/url"
9 "time"10 "time"
@@ -281,7 +282,18 @@ func (s *Server) handleEditFeed(w http.ResponseWriter, r *http.Request) {
281 282
282 func (s *Server) handleRemoveFeed(w http.ResponseWriter, r *http.Request) {283 func (s *Server) handleRemoveFeed(w http.ResponseWriter, r *http.Request) {
283 user := currentUser(r)284 user := currentUser(r)
284- feedURL := r.FormValue("url")285+
286+ // FormValue only parses the body for POST/PUT/PATCH; for DELETE we read it manually.
287+ feedURL := r.URL.Query().Get("url")
288+ if feedURL == "" {
289+ body, err := io.ReadAll(http.MaxBytesReader(w, r.Body, 1<<20))
290+ if err == nil {
291+ vals, parseErr := url.ParseQuery(string(body))
292+ if parseErr == nil {
293+ feedURL = vals.Get("url")
294+ }
295+ }
296+ }
285 297
286 if feedURL == "" {298 if feedURL == "" {
287 writeAPIError(w, http.StatusBadRequest, "url required")299 writeAPIError(w, http.StatusBadRequest, "url required")