Problem/Motivation

The Calendar module appears to allow unbounded week-based URLs such as /calendar/week/251010, /251011, and so on. These requests can continue indefinitely, and the module may keep rendering valid-looking pages with a forward pager link.

This creates a crawl trap where bots can discover and follow an endless sequence of week URLs. The fix should be made in the Calendar module itself by validating incoming week values, returning 404 for malformed or unreasonable requests, and preventing pager links from extending beyond supported bounds.

Proposed resolution

Investigate how the week route argument is parsed, validated, and used to build previous/next pager links. Add a validation path for week values so malformed, impossible, or unreasonable far-future requests return 404 instead of rendering normal calendar output. Update pager generation so it does not emit an endless forward navigation path beyond the allowed range, while preserving normal navigation for valid week URLs.

Remaining tasks

  • Identify where the week route parameter is parsed and normalized.
  • Confirm the expected week format and current validation behaviour.
  • Update pager generation to respect the same supported bounds.
  • Add test coverage for valid input, malformed input, far-future input, and pager limits.

AI-Generated: Yes (AI was used to assist with drafting of the issue summary from a report in our logs and some implementation work. All changes were reviewed and steered by me.)

Issue fork calendar-3586572

Command icon Show commands

Start within a Git clone of the project using the version control instructions.

Or, if you do not have SSH keys set up on git.drupalcode.org:

Comments

joelpittet created an issue. See original summary.

joelpittet’s picture

Issue summary: View changes
joelpittet’s picture

Status: Active » Fixed

I am happy with this, it's BC friendly but allows you to config some limits.

Now that this issue is closed, review the contribution record.

As a contributor, attribute any organization that helped you, or if you volunteered your own time.

Maintainers, credit people who helped resolve this issue.

  • joelpittet committed 7f7931d1 on 8.x-1.x
    feat: #3586572 Configurable validation of date args and stop endless...
franceslui’s picture

Title: Validate week route values and stop endless forward calendar paging » Validate calendar route values and stop unbounded calendar paging

I updated the issue title from:

“Validate week route values and stop endless forward calendar paging”

to:

“Validate calendar route values and stop unbounded calendar paging”

The updated title better reflects the final scope of the merged patch, which applies date bounds to day, week, month, and year calendar displays, and also prevents pager links from going beyond the configured date limits.