Conversation
kesselb
added
2. developing
kesselb
force-pushed
the
bug-59229
branch
3 times, most recently
from
August 4, 2026 13:49
436584a to
7c960b3
Compare
kesselb
added
3. to review
Contributor
There was a problem hiding this comment.
Pull request overview
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Updates public preview input handling to return a 400 Bad Request for invalid folder-share file query values (e.g., empty or pointing to a folder), avoiding an internal server error and clarifying API behavior.
Changes:
- Validate
filefor folder shares (reject empty values and folder targets) and add Forbidden handling for permission failures. - Add/extend unit tests covering invalid folder-share
fileinputs and MIME-icon fallback redirect behavior. - Update OpenAPI summaries/descriptions for the public preview endpoint to reflect folder vs single-file share behavior.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| openapi.json | Clarifies endpoint summary/description and file query parameter semantics. |
| apps/files_sharing/openapi.json | Mirrors OpenAPI clarification within the app spec. |
| apps/files_sharing/lib/Controller/PublicPreviewController.php | Adds input validation for folder shares and refines exception handling + MIME fallback gating. |
| apps/files_sharing/tests/Controller/PublicPreviewControllerTest.php | Updates calls for new signature and adds tests for bad-request cases + MIME fallback redirect. |
Suppressed comments (2)
openapi.json:1
- The OpenAPI schema still sets
"default": ""forfile, but the controller now returns 400 for folder shares whenfileis empty. This default is misleading for API consumers and tooling that auto-populates query params. Consider removing the default entirely and/or adding an"example"like"path/to/file.jpg"to reflect valid usage.
apps/files_sharing/openapi.json:1508 - Same issue as the root OpenAPI spec:
"default": ""conflicts with the new behavior (400 on emptyfilefor folder shares). Remove the default and/or provide an example to prevent clients from sending invalid requests by default.
{
"name": "file",
"in": "query",
"description": "Relative path to a file inside a shared folder; ignored for single-file shares",
"schema": {
"type": "string",
"default": ""
}
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+129
to
+133
| $previewFile = null; | ||
|
|
||
| try { | ||
| $node = $share->getNode(); | ||
| if ($node instanceof Folder) { | ||
| $file = $node->get($file); | ||
| $shareNode = $share->getNode(); | ||
| if ($shareNode instanceof Folder) { |
| return new DataResponse([], Http::STATUS_BAD_REQUEST); | ||
| } | ||
|
|
||
| $previewFile = $shareNode->get($file); |
Comment on lines
+143
to
+146
| $previewFile = $shareNode; | ||
| } | ||
|
|
||
| $f = $this->previewManager->getPreview($file, $x, $y, !$a); | ||
| $response = new FileDisplayResponse($f, Http::STATUS_OK, ['Content-Type' => $f->getMimeType()]); | ||
| $preview = $this->previewManager->getPreview($previewFile, $x, $y, !$a); |
Comment on lines
+155
to
161
| } catch (NotFoundException) { | ||
| // If a preview could not be generated for a resolved file, we can redirect to the mime icon if any | ||
| if ($mimeFallback && $previewFile instanceof File) { | ||
| if ($url = $this->mimeIconProvider->getMimeIconUrl($previewFile->getMimeType())) { | ||
| return new RedirectResponse($url); | ||
| } | ||
| } |
Return 400 Bad Request when the file parameter is empty and the shared node is a folder, instead of passing the folder itself to getPreview which triggers an internal server error. Also rename the local variable to $fileNode to prevent the catch block from calling getMimeType() on the original string parameter when get() throws NotFoundException. Fixes #59229 Assisted-by: ClaudeCode:claude-opus-4-6 Assisted-by: ClaudeCode:claude-opus-5 Signed-off-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Signed-off-by: Josh <josh.t.richards@gmail.com> Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de> # Conflicts: # apps/files_sharing/lib/Controller/PublicPreviewController.php
Contributor
Author
|
Rebased after #56196. |
Contributor
Author
|
/backport to stable34 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #59229
Summary
Local version of #59253
Return 400 Bad Request when the file parameter is empty and the shared node is a folder, instead of passing the folder itself to getPreview which triggers an internal server error.
Checklist
3. to review, feature component)stable32)AI (if applicable)