Fix site scoped contextinfo#9454
Open
jorisvanduyse wants to merge 2 commits into
Open
Conversation
…soft#8932) Adds coverage for CreateFolder, CreateList, and CreateListItem to assert that the request digest (_api/contextinfo) is requested from the site-scoped URL rather than the tenant root, so the fix keeps working under Sites.Selected permissions.
github-actions
Bot
added
AL: System Application
From Fork
Author
|
@microsoft-github-policy-service agree |
github-actions
Bot
added
the
needs-approval
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
This fixes SharePoint request-digest acquisition for site-scoped SharePoint URLs.
SharePoint Uri Builder.GetHost() intentionally returns only the hostname, but request-digest calls used it for/_api/contextinfo. For URLs such ashttps://tenant.sharepoint.com/sites/site, this caused the request to target the tenant root instead of the configured site.The change adds a site-base URL accessor and uses it for request-digest acquisition in CreateList, both CreateListItem overloads, CreateFolder, and UpdateListItemMetaDataField.
GetHost()remains unchanged for callers that require hostname-only behavior.Regression tests verify that contextinfo requests retain the configured
/sites/<site>path.Linked work
Fixes #8932
How I validated this
What I tested and the outcome
.../sites/<site>/_api/contextinfo/.../_api/contextinfo/TestCreateFolder,TestCreateListRequestDigestUsesSiteScopedUrl, andTestCreateListItemRequestDigestUsesSiteScopedUrlpass with the fix applied.Risk & compatibility
This is an internal URI-construction change with no schema, data-upgrade, permission, or public API contract changes.
GetHost()is unchanged. The new site-base URL accessor is used only for request-digest acquisition, ensuring existing hostname-only consumers retain their behavior.Fixes #8932 is the GitHub issue link. GitHub will automatically link it, and close the issue when the PR is merged.