Skip to content

Latest commit

 

History

History
1 lines (1 loc) · 1.1 KB

File metadata and controls

1 lines (1 loc) · 1.1 KB
  • Pagination handles are now stored under request.wheels.$pagination[handle] instead of directly in request.wheels[handle]. Handles are caller-supplied names, so the flat layout put arbitrary user input in the same case-insensitive keyspace as framework-owned request state, and the collision ran both ways. Writing: setPagination(handle="tenant") replaced the resolved tenant context with a pagination struct, and handle="$queryCache" did the same to the per-request finder cache — silently, since neither is validated. Reading: pagination() only checks that a handle exists when showErrorInformation is on, so in production an unknown handle that happened to name a framework key returned that key's struct as though it were pagination data. request.wheels currently holds around thirty-five framework-owned keys — including params, execution, currentRoute, transactions, flashKeep and exception — every one of which was reachable this way. Handles now resolve only inside their own sub-struct, so neither direction can cross over. Wheels.QueryHandleNotFound behaviour is unchanged (#3339)