apostrophe 4.14.1 → 4.14.2

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## UNRELEASED
+
+## 4.14.2 (2025-04-02)
+
+### Fixes
+
+* Hotfix: the `choices` query parameter of the REST API no longer results in a 500 error if an invalid filter name is part of the list. Such filters are now properly ignored in `choices`. This issue could also have resulted in invocation of query methods that are not builders, however since all such methods are read-only operations, no arguments could be passed and no information was returned, there are no security implications.
+
 ## 4.14.1 (2025-03-31)
 
 ### Fixes

package/modules/@apostrophecms/doc-type/index.js

@@ -2482,6 +2482,16 @@ module.exports = {
               // except this one (filtering by topic pares down the list of categories and
               // vice versa)
               const _query = baseQuery.clone();
+              // Make sure this is a legitimate builder before attempting to shut it off
+              if (!_.has(query.builders, filter)) {
+                continue;
+              }
+              // Make sure it would ever be accepted via a query parameter before attempting
+              // to shut it off
+              if (!query.builders[filter].launder) {
+                continue;
+              }
+              // Now shut it off
               _query[filter](null);
               choices[filter] = await _query.toChoices(filter, { counts: query.get('counts') });
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apostrophe",
-  "version": "4.14.1",
+  "version": "4.14.2",
   "description": "The Apostrophe Content Management System.",
   "main": "index.js",
   "scripts": {

package/test/pieces.js

@@ -1161,8 +1161,8 @@ describe('Pieces', function() {
     assert(response._products[0]._id === draftRelatedProductId);
   });
 
-  it('can GET results plus filter choices', async function() {
-    const response = await apos.http.get('/api/v1/product?choices=title,visibility,_articles,articles', {
+  it('can GET results plus filter choices and ignore bogus filter names in choices', async function() {
+    const response = await apos.http.get('/api/v1/product?choices=title,visibility,_articles,articles,bogus', {
       jar
     });
     assert(response);
@@ -1182,8 +1182,8 @@ describe('Pieces', function() {
     assert(response.choices.articles[0].value === 'first-article');
   });
 
-  it('can GET results plus filter counts', async function() {
-    const response = await apos.http.get('/api/v1/product?_edit=1&counts=title,visibility,_articles,articles', {
+  it('can GET results plus filter counts, ignoring bogus filter names', async function() {
+    const response = await apos.http.get('/api/v1/product?_edit=1&counts=title,visibility,_articles,articles,bogus', {
       jar
     });
     assert(response);