When normalizing the rest request don't assume that the additional arguments are acutall a path. Leave it up to the handler to determine.

4 files changed, 22 insertions, 20 deletions

diff --git a/modules/gallery/helpers/gallery_rest.php b/modules/gallery/helpers/gallery_rest.php
index a052ae64..227a6f02 100644
--- a/modules/gallery/helpers/gallery_rest.php
+++ b/modules/gallery/helpers/gallery_rest.php
@@ -19,17 +19,15 @@
  */
 class gallery_rest_Core {
   static function get($request) {
-    if (empty($request->path)) {
-      $request->path = "";
-    }
+    $path = implode("/", $request->arguments);
 
     $item = ORM::factory("item")
-      ->where("relative_url_cache", $request->path)
+      ->where("relative_url_cache", $path)
       ->viewable()
       ->find();
 
     if (!$item->loaded) {
-      return rest::not_found("Resource: {$request->path} missing.");
+      return rest::not_found("Resource: {$path} missing.");
     }
 
     $parent = $item->parent();
@@ -58,21 +56,22 @@ class gallery_rest_Core {
   }
 
   static function put($request) {
-    if (empty($request->path)) {
+    if (empty($request->arguments)) {
       return rest::invalid_request();
     }
+    $path = implode("/", $request->arguments);
 
     $item = ORM::factory("item")
-      ->where("relative_url_cache", $request->path)
+      ->where("relative_url_cache", $path)
       ->viewable()
       ->find();
 
     if (!$item->loaded) {
-      return rest::not_found("Resource: {$request->path} missing.");
+      return rest::not_found("Resource: {$path} missing.");
     }
 
     if (!access::can("edit", $item)) {
-      return rest::not_found("Resource: {$request->path} permission denied.");
+      return rest::not_found("Resource: {$path} permission denied.");
     }
 
     // Validate the request data
@@ -90,11 +89,12 @@ class gallery_rest_Core {
   }
 
   static function post($request) {
-    if (empty($request->path)) {
+    if (empty($request->arguments)) {
       return rest::invalid_request();
     }
+    $path = implode("/", $request->arguments);
 
-    $components = explode("/", $request->path);
+    $components = explode("/", $path);
     $name = urldecode(array_pop($components));
 
     $parent = ORM::factory("item")
@@ -103,11 +103,11 @@ class gallery_rest_Core {
       ->find();
 
     if (!$parent->loaded) {
-      return rest::not_found("Resource: {$request->path} missing.");
+      return rest::not_found("Resource: {$path} missing.");
     }
 
     if (!access::can("edit", $parent)) {
-      return rest::not_found("Resource: {$request->path} permission denied.");
+      return rest::not_found("Resource: {$path} permission denied.");
     }
 
     // Validate the request data
@@ -147,12 +147,13 @@ class gallery_rest_Core {
   }
 
   static function delete($request) {
-    if (empty($request->path)) {
+    if (empty($request->arguments)) {
       return rest::invalid_request();
     }
+    $path = implode("/", $request->arguments);
 
     $item = ORM::factory("item")
-      ->where("relative_url_cache", $request->path)
+      ->where("relative_url_cache", $path)
       ->viewable()
       ->find();
 
@@ -161,7 +162,7 @@ class gallery_rest_Core {
     }
 
     if (!access::can("edit", $item)) {
-      return rest::not_found("Resource: {$request->path} permission denied.");
+      return rest::not_found("Resource: {$path} permission denied.");
     }
 
     if ($item->id == 1) {
diff --git a/modules/image_block/helpers/image_block_rest.php b/modules/image_block/helpers/image_block_rest.php
index eca74941..363eabee 100644
--- a/modules/image_block/helpers/image_block_rest.php
+++ b/modules/image_block/helpers/image_block_rest.php
@@ -19,7 +19,8 @@
  */
 class image_block_rest_Core {
   static function get($request) {
-    switch ($request->path) {
+    $path = implode("/", $request->arguments);
+    switch ($path) {
     case "random":
       $random = ((float)mt_rand()) / (float)mt_getrandmax();
 
@@ -41,7 +42,7 @@ class image_block_rest_Core {
       }
       break;
     default:
-      return rest::fail("Unsupported block type: '{$request->path}'");
+      return rest::fail("Unsupported block type: '{$path}'");
     }
 
     if ($items->count() > 0) {
diff --git a/modules/rest/controllers/rest.php b/modules/rest/controllers/rest.php
index 4d476a0d..1289d62b 100644
--- a/modules/rest/controllers/rest.php
+++ b/modules/rest/controllers/rest.php
@@ -83,7 +83,7 @@ class Rest_Controller extends Controller {
 
     $request->method = strtolower($this->input->server("HTTP_X_GALLERY_REQUEST_METHOD", $method));
     $request->access_token = $this->input->server("HTTP_X_GALLERY_REQUEST_KEY");
-    $request->path = implode("/", $args);
+    $request->arguments = $args;  // Let the rest handler figure out what the arguments mean
 
     return $request;
   }
diff --git a/modules/rest/tests/Rest_Controller_Test.php b/modules/rest/tests/Rest_Controller_Test.php
index 39e79a81..b7fbd5a3 100644
--- a/modules/rest/tests/Rest_Controller_Test.php
+++ b/modules/rest/tests/Rest_Controller_Test.php
@@ -173,7 +173,7 @@ class rest_rest {
   static function get($request) {
     self::$request = $request;
     $item = ORM::factory("item")
-      ->where("relative_url_cache", $request->path)
+      ->where("relative_url_cache", implode("/", $request->arguments))
       ->find();
     $response["path"] = $item->relative_url();
     $response["title"] = $item->title;