regression: allow specific routes to receive query attr (#33691)

RocketChat · Oct 22, 2024 · a46dbfd · a46dbfd
1 parent ce283bf
commit a46dbfd
Showing 1 changed file with 9 additions and 1 deletion.
diff --git a/apps/meteor/app/api/server/helpers/parseJsonQuery.ts b/apps/meteor/app/api/server/helpers/parseJsonQuery.ts
@@ -107,8 +107,16 @@ export async function parseJsonQuery(api: PartialThis): Promise<{
 		}
 	}
 
+	const allowedRoutes = [
+		'/api/v1/settings.public',
+		'/api/v1/directory',
+		'/api/v1/channels.messages',
+		'/api/v1/groups.messages',
+		'/api/v1/dm.messages',
+		'/api/v1/im.messages',
+	];
 	let query: Record<string, any> = {};
-	if (params.query && isUnsafeQueryParamsAllowed) {
+	if (params.query && (isUnsafeQueryParamsAllowed || allowedRoutes.includes(route))) {
 		apiDeprecationLogger.parameter(route, 'query', '8.0.0', response, messageGenerator);
 		try {
 			query = ejson.parse(params.query);