LanguageNegotiationUrl unnecessarily adds domain to outbound URL's

Created on 29 February 2024, about 1 year ago

Problem/Motivation

Core does not always check if external URL's are local (using UrlHelper::externalIsLocal) which has varied consequences. We can avoid adding the base_path to outbound URL's by checking if the language negotiation path is the same as the current path and avoid some problems.

See 🐛 Cannot delete file when using language negotiation domains Active for full context.

Steps to reproduce

  1. Setup two domains (.ddev/config.yaml additional_hostnames, I used "local" and "es.local").
  2. Install Drupal, enable media and language modules.
  3. Add a language for the second domain on admin/config/regional/language (I used Spanish). Configure detection on admin/config/regional/language/detection, edit "URL", select "Domain", and set the two domain URL's (I used local.ddev.site and es.local.ddev.site)
  4. Add a media document from admin/content/media
  5. Visit admin/content/files and hover over the "Delete" link. Notice that it uses the full URL.

Proposed resolution

Add an additional check in LanguageNegotiationUrl::processOutbound() that returns early if the base_url's match.

🐛 Bug report
Status

Active

Version

10.2

Component
Language system 

Last updated 6 days ago

  • Maintained by
  • 🇩🇪Germany @sun
Created by

🇺🇸United States douggreen Winchester, VA

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Merge Requests

Comments & Activities

  • Issue created by @douggreen
  • 🇺🇸United States douggreen Winchester, VA
  • Pipeline finished with Failed
    about 1 year ago
    Total: 541s
    #107280
  • 🇺🇸United States xjm

    Thanks for reporting this!

    The merge request needs to be created against 11.x (our main development branch); it will be backported to supported versions once committed to 11.x. In some cases the easiest thing to do is close the previous merge request and create a new one against 11.x. Thanks!

  • First commit to issue fork.
  • Merge request !8326Update file LanguageNegotiationUrl.php → (Open) created by immaculatexavier
  • Pipeline finished with Failed
    11 months ago
    Total: 890s
    #193432
  • Status changed to Needs review 11 months ago
  • Status changed to Needs work 11 months ago
  • First commit to issue fork.
  • Pipeline finished with Failed
    3 months ago
    Total: 537s
    #416037
  • Pipeline finished with Failed
    3 months ago
    Total: 914s
    #416056
  • Pipeline finished with Success
    3 months ago
    Total: 6340s
    #416071
  • 🇪🇸Spain vidorado Logroño (La Rioja)

    I've added test coverage.

    As a bonus, it turns out that we've fixed, at least partially, a bug stated in 🐛 Domain-based language negotiation strips "destination" URL query argument, causing BigPipe error Closed: duplicate , so I have had to change a line in BlockUiTest too.

  • 🇺🇸United States smustgrave

    Left 1 small comment on MR

    If you are another contributor eager to jump in, please allow the previous poster at least 48 hours to respond to feedback first, so they have the opportunity to finish what they started!

  • 🇪🇸Spain vidorado Logroño (La Rioja)

    Thanks! I've replied to your comment in the MR.

  • 🇺🇸United States smustgrave

    Been about a month without additional review. Will RTBC but leaving the one thread open.

  • Status changed to RTBC 14 days ago
  • First commit to issue fork.
  • Pipeline finished with Failed
    14 days ago
    Total: 821s
    #470471
  • 🇺🇸United States uri_frazier Portland, Oregon

    I'm not sure if this belongs here, or if there needs to be a it's own (new) issue:
    I think this fix should apply to the actual domain as well, and not just the destination URL/domain.

    Context:
    I have a multilingual site that uses sub-domains (and domain-based language negotiation). I want admin users to be able to delete files
    The "delete" link that is generated uses the English domain (e.g. website.com/file/123/delete) instead of the sub-domain (e.g. japan.website.com/file/123/delete) the user is currently logged into and clicked the original "delete" link from. So when clicking "delete", it tries to take users cross-domain to complete the process, but stops them with an "access denied" screen since they are not logged in under the English (default) domain.

    This is also the same behavior/problem that occurs when trying to use the file_replace module and it's "replace" link.

Production build 0.71.5 2024