Problem/Motivation

PageGeneralForm::validatePath() doesn't correctly validate paths, leading external URLs - i.e. http://example.com/my-page - to be accepted during the Wizard or Edit phases.
User is unaware of the error until visiting the Structure > Pages admin page (admin/structure/page_manager) where the following uncatched exception reports:

InvalidArgumentException: The internal path component 'http://example.com/my-page' is external. You are not allowed to specify an external URL together with internal:/. in Drupal\Core\Url::fromInternalUri() (line 409 of core/lib/Drupal/Core/Url.php).

When - I presume - the site is trying to render to URL the page URI using Drupal\Core\Url::fromUri.

The whole section is then inaccessible and user is not able to fix the mistake from the Page Manager UI.
The only solution is to manually update the configuration and refresh the cache.

Proposed resolution

Update PageGeneralForm::validatePath() to exclude external URL and alert the user.

CommentFileSizeAuthor
#5 2835742-0--1.patch1001 bytesgambry

Comments

gambry created an issue. See original summary.

gambry’s picture

gambry
Primary language Italian
Location Milan
commented

I can see some validation progress has been made on #2659948: Remove support for paths with %, provide validation and description for path, however validating external paths doesn't seem to be listed as requirements on that issue.

Happy to propose a patch as soon as the problem is confirmed and progress can be made on this issue.

gambry’s picture

gambry
Primary language Italian
Location Milan
commented
Priority: Critical » Major
gambry’s picture

gambry
Primary language Italian
Location Milan
commented
Issue summary: View changes
gambry’s picture

gambry
Primary language Italian
Location Milan
commented
Status: Active » Needs review
StatusFileSize
new 2835742-0--1.patch1001 bytes

Let's make some progress.

NormySan’s picture

NormySan commented

Tested the patch, validation looks like it's working fine now.

Did notice that the same issue is also on the 4.x branch, the same patch does apply without problem to both the 1.x and 4.x branches.

maaty388’s picture

maaty388 commented
Status: Needs review » Reviewed & tested by the community

This is working great thank you for patch #5.
@NormySan you forgot to change status I think

manuel.adan’s picture

manuel.adan
Location 🌌
commented
Status: Reviewed & tested by the community » Needs review
Issue tags: +Needs tests 
+++ b/page_manager_ui/src/Form/PageGeneralForm.php
@@ -170,6 +171,11 @@ public function validatePath(&$element, FormStateInterface $form_state) {
+    // Ensure the path is not external.
+    if (UrlHelper::isExternal(trim($element['#value'], '/'))) {
+      $form_state->setErrorByName('path', $this->t('The page path must be internal.'));
+    }
+
     // Ensure the path has a leading slash.
     $value = '/' . trim($element['#value'], '/');

trim() called twice, may be better assign the trimmed URL to a variable and work with it in advance.

We need some tests here. I added test for the general page form in another issue #3025397-8: PageGeneralForm::submitForm() should not use \Drupal to instantiate storage that can be ported or wait to be committed and add one more for this new validation.

manuel.adan’s picture

manuel.adan
Location 🌌
commented
Priority: Major » Normal
Status: Needs review » Needs work
shakilahmad’s picture

shakilahmad
Shakil
Primary language Urdu
Location Peshawar
commented

I am getting this error.

InvalidArgumentException: The internal path component 'https://maxclutch.com/hosting' is external. You are not allowed to specify an external URL together with internal:/. in Drupal\Core\Url::fromInternalUri() (line 419 of core\lib\Drupal\Core\Url.php).

I tried the patch but it did not work for me. Can anyone help me? to get rid of this error. I am not able to access the whole page manger.
I am using drupal 8.9.3

japerry’s picture

japerry
Location KOMK
commented
Status: Needs work » Closed (outdated)

Page Manager 8.x-1.x is no longer supported, closing.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.