GHSA-9jr9-8ff3-m894 consistency w/ responses in node

btopro · btopro · commit 24d30222481a · 2025-07-23T16:25:58.000-04:00
diff --git a/system/backend/php/lib/HAXCMS.php b/system/backend/php/lib/HAXCMS.php
@@ -852,7 +852,7 @@ public function pageBreakParser($body = '<page-break></page-break>') {
     /**
      * Generate a valid HAX App store specification schema for connecting to this site via JSON.
      */
-    public function siteConnectionJSON($siteToken = '', $siteName = '')
+    public function siteConnectionJSON($siteToken = '')
     {
         return '{
       "details": {
@@ -869,7 +869,7 @@ public function siteConnectionJSON($siteToken = '', $siteName = '')
         "operations": {
           "browse": {
             "method": "GET",
-            "endPoint": "system/api/listFiles?site_token=' . $siteToken . '&siteName=' . $siteName . '",
+            "endPoint": "system/api/listFiles?site_token=' . $siteToken . '",
             "pagination": {
               "style": "link",
               "props": {
diff --git a/system/backend/php/lib/Operations.php b/system/backend/php/lib/Operations.php
@@ -256,9 +256,8 @@ public function rebuildManagedFiles() {
    * )
    */
   public function saveManifest() {
-    // load the site from name
     if (isset($this->params['site_token']) && $GLOBALS['HAXCMS']->validateRequestToken($this->params['site_token'], $GLOBALS['HAXCMS']->getActiveUserName() . ':' . $this->params['site']['name'])) {
-
+      // load the site from name
       $site = $GLOBALS['HAXCMS']->loadSite($this->params['site']['name']);
       // standard form submit
       // @todo 
@@ -487,7 +486,7 @@ public function saveManifest() {
     else {
       return array(
         '__failed' => array(
-          'status' => 500,
+          'status' => 403,
           'message' => 'invalid site token',
         )
       );
@@ -709,7 +708,7 @@ public function saveOutline() {
     } else {
       return array(
         '__failed' => array(
-          'status' => 500,
+          'status' => 403,
           'message' => 'invalid site token',
         )
       );
@@ -884,8 +883,8 @@ public function createNode() {
     else {
       return array(
         '__failed' => array(
-          'status' => 500,
-          'message' => 'failed to create node',
+          'status' => 403,
+          'message' => 'invalid site token',
         )
       );
     }
@@ -1278,8 +1277,8 @@ public function deleteNode() {
     else {
       return array(
         '__failed' => array(
-          'status' => 500,
-          'message' => 'failed to delete',
+          'status' => 403,
+          'message' => 'invalid site token',
         )
       );
     }
@@ -1372,7 +1371,7 @@ public function generateAppStore() {
       }
       $appStore = $haxService->loadBaseAppStore($apikeys);
       // pull in the core one we supply, though only upload works currently
-      $tmp = json_decode($GLOBALS['HAXCMS']->siteConnectionJSON($this->params['site_token'], $this->params['site']['name']));
+      $tmp = json_decode($GLOBALS['HAXCMS']->siteConnectionJSON($this->params['site_token']));
       array_push($appStore, $tmp);
       if (isset($GLOBALS['HAXCMS']->config->appStore->stax)) {
           $staxList = $GLOBALS['HAXCMS']->config->appStore->stax;
@@ -1452,6 +1451,14 @@ public function getUserData() {
         'data' => $GLOBALS['HAXCMS']->userData
       );
     }
+    else {
+      return array(
+        '__failed' => array(
+          'status' => 403,
+          'message' => 'invalid request token',
+        )
+      );
+    }
   }
   /**
    * @OA\Post(
@@ -1904,6 +1911,14 @@ public function listSites() {
         "data" => $return
       );
     }
+    else {
+      return array(
+        '__failed' => array(
+          'status' => 403,
+          'message' => 'invalid request token',
+        )
+      );
+    }
   }
   /**
    * @OA\Post(
@@ -2240,6 +2255,14 @@ public function cloneSite() {
         ),
       );
     }
+    else {
+      return array(
+        '__failed' => array(
+          'status' => 403,
+          'message' => 'invalid request token',
+        )
+      );
+    }
   }
   /**
    * @OA\Post(
@@ -2324,6 +2347,14 @@ public function downloadSite() {
         )
       );
     }
+    else {
+      return array(
+        '__failed' => array(
+          'status' => 403,
+          'message' => 'invalid request token',
+        )
+      );
+    }
   }
   /**
    * @OA\Post(
@@ -2383,5 +2414,13 @@ public function archiveSite() {
         );
       }
     }
+    else {
+      return array(
+        '__failed' => array(
+          'status' => 403,
+          'message' => 'invalid request token',
+        )
+      );
+    }
   }
 }
