From 188f357b3c97e77462f64aaafe5b04a1f428b2d1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20M=C3=BCller?=
 <1005065+DeepDiver1975@users.noreply.github.com>
Date: Mon, 27 Jul 2026 23:33:04 +0200
Subject: [PATCH] refactor(routing): rewire the setsites ajax route to an
 extension-free url
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The route url 'ajax/setsites.php' is prefixed to /apps/external/ajax/setsites.php
by the router, which *is* a real file on disk, and the front controller rewrite
skips those paths:

    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule . index.php [PT,E=PATH_INFO:$1]

The web server therefore executes the script directly, without the bootstrap
index.php would have performed, and such a request dies with `Class "OC" not
found` (HTTP 500). The route was unreachable at its own declared url.

This is hardening, not a user-visible bug fix. OC.filePath() unconditionally
injects /index.php/ for non-core app .php files, so the admin panel always
requested the routed /index.php/apps/external/ajax/setsites.php form, which
works. Verified against a pristine owncloud/server:11.0.0-rc2.

The url loses its .php suffix so that it no longer resolves to a file on disk.
The actionInclude() target and the route name are unchanged, so linkToRoute()
callers keep working. The js caller moves from OC.filePath() to
OC.generateUrl(): with a non-.php file name OC.filePath() falls through to the
OC.appswebroots[app] branch and would yield a static url instead of a routed one.

No backwards-compatible .php alias is added - an alias would re-introduce
exactly the shadowed url this change removes.

See https://github.com/owncloud/core/issues/41740 and
https://github.com/owncloud/core/pull/41742 for the same change in core.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com>
---
 CHANGELOG.md       | 3 +++
 appinfo/routes.php | 2 +-
 js/admin.js        | 2 +-
 3 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 852bb5256a..73d0abb529 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,9 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/).
 
 ## [Unreleased]
 
+### Changed
+
+- Rewire the setsites ajax route to an extension-free url so it is reachable at its own declared url - [#32](https://github.com/owncloud/external/pull/32)
 
 ## [1.5.1] - 2026-07-22
 
diff --git a/appinfo/routes.php b/appinfo/routes.php
index d6cf34df5b..d8774cc35b 100644
--- a/appinfo/routes.php
+++ b/appinfo/routes.php
@@ -8,5 +8,5 @@
 /** @var $this \OCP\Route\IRouter */
 $this->create('external_index', '/{id}')
 	->actionInclude('external/index.php');
-$this->create('external_ajax_setsites', 'ajax/setsites.php')
+$this->create('external_ajax_setsites', 'ajax/setsites')
 	->actionInclude('external/ajax/setsites.php');
diff --git a/js/admin.js b/js/admin.js
index 4142b4480e..d47d92383a 100644
--- a/js/admin.js
+++ b/js/admin.js
@@ -24,7 +24,7 @@ $(document).ready(function(){
 	function saveSites() {
 		var post = $('#external').serialize();
 		OC.msg.startSaving('#external .msg');
-		$.post( OC.filePath('external','ajax','setsites.php') , post, function(data) {
+		$.post( OC.generateUrl('/apps/external/ajax/setsites') , post, function(data) {
 			OC.msg.finishedSaving('#external .msg', data);
 		});
 	}