Problem/Motivation
The Calendar module appears to allow unbounded week-based URLs such as /calendar/week/251010, /251011, and so on. These requests can continue indefinitely, and the module may keep rendering valid-looking pages with a forward pager link.
This creates a crawl trap where bots can discover and follow an endless sequence of week URLs. The fix should be made in the Calendar module itself by validating incoming week values, returning 404 for malformed or unreasonable requests, and preventing pager links from extending beyond supported bounds.
Proposed resolution
Investigate how the week route argument is parsed, validated, and used to build previous/next pager links. Add a validation path for week values so malformed, impossible, or unreasonable far-future requests return 404 instead of rendering normal calendar output. Update pager generation so it does not emit an endless forward navigation path beyond the allowed range, while preserving normal navigation for valid week URLs.
Remaining tasks
- Identify where the week route parameter is parsed and normalized.
- Confirm the expected week format and current validation behaviour.
- Update pager generation to respect the same supported bounds.
- Add test coverage for valid input, malformed input, far-future input, and pager limits.
AI-Generated: Yes (AI was used to assist with drafting of the issue summary from a report in our logs and some implementation work. All changes were reviewed and steered by me.)
Issue fork calendar-3586572
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
Comments
Comment #3
joelpittetComment #4
joelpittetI am happy with this, it's BC friendly but allows you to config some limits.
Comment #7
franceslui commentedI updated the issue title from:
“Validate week route values and stop endless forward calendar paging”
to:
“Validate calendar route values and stop unbounded calendar paging”
The updated title better reflects the final scope of the merged patch, which applies date bounds to day, week, month, and year calendar displays, and also prevents pager links from going beyond the configured date limits.