Add route constraint to only allow numeric ids (#39523)

2026-06-23 11:17:54 +02:00
parent 58cf7cfd75
commit 7608436b64
3 changed files with 24 additions and 7 deletions
@@ -124,7 +124,7 @@ Rails.application.routes.draw do
  end

  scope path: 'ap', as: 'ap' do
-    resources :accounts, path: 'users', only: [:show], param: :id, concerns: :account_resources do
+    resources :accounts, path: 'users', only: [:show], param: :id, concerns: :account_resources, constraints: { id: /-?\d+/ } do
      resources :collections, only: [:show], constraints: { id: /\d+/ }
      resources :collection_items, only: [:show]
      resources :feature_authorizations, only: [:show], module: :activitypub