IBX-7044: Added dynamic route to settings submit form

[Gengar-i]

Question	Answer
Tickets	IBX-7044
Bug fix?	yes
New feature?	no
BC breaks?	no
Tests pass?	yes
Doc needed?	no
License	GPL-2.0

Suggestion of solution.
Added dynamic route to settings submit form
I know passing url breaks security and it suppose to be done differently.

Checklist:

• Implement tests
• Coding standards ($ composer fix-cs)

[ViniTou]

Where this route param is populated?

Also, I guess return url being part of form make more sense.

[Gengar-i]

https://github.com/ibexa/page-builder/pull/339/files#diff-8781e1f4fb2943dbbdf833e8a9e268ef9032bc749ad3bc25609bed0816b3e4cdR1379

[ViniTou]

I would suggest, at least, to change route name parameter as it really confusing. How abour return_route_name?
Not sure about it, but what about generating that whole URL in js, and just pass it here instead of route with params?
@dew326

[dew326]

I think both solutions are valid. If you think it will be cleaner that way I'm ok with that change.

[Gengar-i]

@alongosz Pointed possible danger while sending whole url to backend. So I stay with solution while passing route with parameters, which is safer solution.

[alongosz]

@alongosz Pointed possible danger while sending whole url to backend. So I stay with solution while passing route with parameters, which is safer solution.

The point there was rather to sanitize input and/or attach path & query part to the current request. Now we might have different bug. What would happen if you pass existing route name different than expected, which has different parameters?

[Steveb-p]

@alongosz Pointed possible danger while sending whole url to backend. So I stay with solution while passing route with parameters, which is safer solution.

The point there was rather to sanitize input and/or attach path & query part to the current request. Now we might have different bug. What would happen if you pass existing route name different than expected, which has different parameters?

I agree with Alongosz here, @Gengar-i. Route has to be checked before redirection - that it exists and can be created with those route parameters. You could fall back to a default redirect if they do not.

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud

[micszo]

@webhdx @dew326 do we consider review here sufficient? first PR (aui) was already sent to the next stage