Nine changes since 1.10.0, all fixes, tests or internal cleanup. No new features.
If you use the REST API, read this first
Responses now only return an entity's properties.
A client reading only documented fields is unaffected; a client reading the internals will need
updating.
Routes carried in owa_rest_params now resolve. The handler read the do
parameter first and returned early when it was absent, so the documented route
form — /api/<module>/<version>/<route>, which .htaccess rewrites to
owa_rest_params with no do of its own — answered 200 with an empty body.
Those URLs now work.
Fixes
- Applying schema updates no longer requires a signed-in admin. Gating it
made the documented tarball upgrade impossible to complete from a browser:
base.updatesrenders anonymously, so its Apply link carried a nonce minted
with no user, and that nonce could never verify once you signed in. The
request was turned away and correct credentials appeared to be rejected.
Reported in #979. - A stale form no longer asks you to log in again. A nonce that has expired,
or was minted under a different account, is now reported as such instead of
being answered with the login form. - An unrecognised report name is refused rather than dispatched.
GET base/v1/reports/{name}previously raised an uncaught error for any name
without a matching implementation. - Malformed REST requests are answered. A request naming no route returns
400through the standard response envelope instead of an empty200. - The JavaScript tracker delivers its first request via
sendBeaconwhere available,
and no longer records session state for a request that was never delivered.
Internal
- Actions resolve through the controller registry; all Base controllers are
registered, and an action name must be a bare identifier. - REST route registrations and the Domstream view moved to PSR-4.
- End-to-end coverage added for every registered REST route, and for the
post-login redirect and nonce-failure paths.