Problem/Motivation
When creating a custom path alias, users currently can set the alias to an internal path, eg. /modules/custom/my_custom_module/custom.js .
When a users visit a node with this path alias, instead of showing the actual node data it will try to access the file instead.
Steps to reproduce
1. Create a new topic
2. Set the path alias to /modules/custom/my_custom_module/custom.js
3. Make sure that the actual path exist and that the file is actually there.
4. Try to visit this URL
5. You should be prompted to download this file.
Proposed resolution
Add a custom validation function that disallow to set path alias that starts with a reserved Drupal path or a path that points to an actual file on the server itself.
Remaining tasks
User interface changes
API changes
Data model changes
Comments
Comment #2
nkoporecPR: https://github.com/goalgorilla/open_social/pull/4028
Comment #3
robertragas commentedLanding in alpha10