Problem/Motivation

When creating a custom path alias, users currently can set the alias to an internal path, eg. /modules/custom/my_custom_module/custom.js .

When a users visit a node with this path alias, instead of showing the actual node data it will try to access the file instead.

Steps to reproduce

1. Create a new topic
2. Set the path alias to /modules/custom/my_custom_module/custom.js
3. Make sure that the actual path exist and that the file is actually there.
4. Try to visit this URL
5. You should be prompted to download this file.

Proposed resolution

Add a custom validation function that disallow to set path alias that starts with a reserved Drupal path or a path that points to an actual file on the server itself.

Remaining tasks

User interface changes

API changes

Data model changes

Comments

nkoporec created an issue. See original summary.

nkoporec’s picture

Status: Active » Needs review
robertragas’s picture

Status: Needs review » Fixed

Landing in alpha10

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.