exchange

commit 6cd6d9b77ef33f86627f5cb1251ce320e9346f35
parent 69e4218beaef5b7ea8bbcef8742e95333e1a21f8
Author: Christian Grothoff <grothoff@gnunet.org>
Date:   Sat, 15 Aug 2026 21:27:56 +0200

scan corrrect path segement in auditor REST API

Diffstat:
M
src/auditor/taler-auditor-httpd.c
 | 
3
++-
M
src/auditor/taler-auditor-httpd.h
 | 
2
++
M
src/auditor/taler-auditor-httpd_delete-generic.c
 | 
5
+++--
M
src/auditor/taler-auditor-httpd_patch-generic-suppressed.c
 | 
5
+++--

4 files changed, 10 insertions(+), 5 deletions(-)
diff --git a/src/auditor/taler-auditor-httpd.c b/src/auditor/taler-auditor-httpd.c
@@ -1074,8 +1074,9 @@ handle_mhd_request (void *cls,
                            "/"))
     {
       i++;
-      if (i >= args_max)
+      if (i > args_max)
       {
+        /* more than @e args_max segments in the URL */
         GNUNET_break_op (0);
         goto not_found;
       }
diff --git a/src/auditor/taler-auditor-httpd.h b/src/auditor/taler-auditor-httpd.h
@@ -95,6 +95,8 @@ struct TAH_RequestHandler
    * @param[in,out] connection_cls the connection's closure (can be updated)
    * @param upload_data upload data
    * @param[in,out] upload_data_size number of bytes (left) in @a upload_data
+   * @param args NULL-terminated array with the '/'-separated segments of the
+   *        requested URL, including those that are part of @e url
    * @return MHD result code
    */
   enum MHD_Result (*handler)(
diff --git a/src/auditor/taler-auditor-httpd_delete-generic.c b/src/auditor/taler-auditor-httpd_delete-generic.c
@@ -50,8 +50,9 @@ TAH_delete_generic (
                                        NULL);
   }
 
-  if ((NULL == args[1]) ||
-      (1 != sscanf (args[1],
+  /* The URL is "/monitoring/$TABLE/$ROW_ID", so the row ID is args[2]. */
+  if ((NULL == args[2]) ||
+      (1 != sscanf (args[2],
                     "%llu%c",
                     &row_id,
                     &dummy)))
diff --git a/src/auditor/taler-auditor-httpd_patch-generic-suppressed.c b/src/auditor/taler-auditor-httpd_patch-generic-suppressed.c
@@ -51,8 +51,9 @@ TAH_patch_generic_suppressed (
                                        NULL);
   }
 
-  if ( (NULL == args[1]) ||
-       (1 != sscanf (args[1],
+  /* The URL is "/monitoring/$TABLE/$ROW_ID", so the row ID is args[2]. */
+  if ( (NULL == args[2]) ||
+       (1 != sscanf (args[2],
                      "%llu%c",
                      &row_id,
                      &dummy)) )