Index.php:36-50
$queryParams = $request->getQueryParams();
$sort = Arr::pull($queryParams, 'sort');
$q = Arr::pull($queryParams, 'q');
$page = max(1, intval(Arr::pull($queryParams, 'page')));
$sortMap = $this->resource->sortMap();
$params = [
...$queryParams,
'sort' => $sort && isset($sortMap[$sort]) ? $sortMap[$sort] : null,
'page' => [
'number' => $page
],
];
The homepage captures the URL query string and forwards all unknown parameters to the internal /discussions API endpoint. Then, in the JsonApi.
The rule that triggers it:
JsonApi.php:176-188:
public function validateQueryParameters(Request $request): void {
foreach ($request->getQueryParams() as $key => $value) {
if (
! preg_match('/[^a-z]/', $key) && // chave SÓ tem letras minúsculas a-z
! in_array($key, ['include','fields','filter','page','sort'])
) {
throw (new BadRequestException("Invalid query parameter: $key"))...
}
}
}
This rule is part of the JSON:API spec implementation, which reserves lowercase-only keys for spec extensions. Any key not on the whitelist results in a 400 error.
Solution
Add block to nginx:
if ($args ~* "^(fbclid|gclid|msclkid|igshid|ttclid|yclid|dclid|wickedid)=[^&]*$") {
rewrite ^ $uri? permanent;
}
if ($args ~* "^(fbclid|gclid|msclkid|igshid|ttclid|yclid|dclid|wickedid)=[^&]*&(.+)$") {
set $clean_args $2;
rewrite ^ $uri?$clean_args? permanent;
}
if ($args ~* "^(.+)&(fbclid|gclid|msclkid|igshid|ttclid|yclid|dclid|wickedid)=[^&]*&(.+)$") {
set $clean_args $1&$3;
rewrite ^ $uri?$clean_args? permanent;
}
if ($args ~* "^(.+)&(fbclid|gclid|msclkid|igshid|ttclid|yclid|dclid|wickedid)=[^&]*$") {
set $clean_args $1;
rewrite ^ $uri?$clean_args? permanent;
}
Sure, until the Flarum team implements it into the core.
