While browsing the database logs of a website I maintain, running drupal-10.0.2 and dblog_ban-2.0.1, I tried banning some IPv6 addresses, but the ban link didn't change to an unban link. Refreshing the database log showed "access denied" entries, with the following message:
Path: /dblog_ban/ajax/ban/AN_IPV6_ADDRESS_HERE?destination=/admin/reports/dblog%3Fpage%3D2&token=A_TOKEN_HERE&_wrapper_format=drupal_ajax. Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException: 'dblog_ban_csrf_ajax_token' URL query argument is invalid. in Drupal\Core\Routing\AccessAwareRouter->checkAccess() (line 115 of /code/web/core/lib/Drupal/Core/Routing/AccessAwareRouter.php).
... so it seems like a regular token got added to the URL; but the dblog_ban_csrf_ajax_token token was not added?
(to be done)
(to be determined)
(to be determined)
(to be determined)
(to be determined)
(to be determined)
Needs review
2.0
Code
Revert "Double-escaping IP addresses causes IPv6 AJAX links to break."...