Extra slash in url bypasses rights list about pico-users HOT 3 CLOSED

I've updated hasRight locally to tidy up URLs before checking them. It enforces singular slashes and no leading slashes. Seems to fix the problem for me with no side effects yet.

    public function hasRight($rule, $default = false)
    {
        $rule = ltrim($rule, '/');
        $rule = preg_replace('(\/{2,})', '/', $rule);
        ...

I did see the other plugin, but opted for this as the other is a bit much for what I need

from pico-users.

Hi, thanks for the report.

It depends on how double slashes should be considered by Pico. It probably should be defined either as a different page (// being a subdirectory without name), or dropped and redirected, but not dismissed as it seems to be now.

Anyway I'm not sure about the relevance of this plugin since a larger one have been made : https://github.com/picoauth/picoauth.

from pico-users.

Great, do not hesitate to make a PR.

from pico-users.