From 57533e64b346ce60b36c57ef5cdc6cc35c9b9b83 Mon Sep 17 00:00:00 2001
From: Steven Nguyen <1477010+stnguyen90@users.noreply.github.com>
Date: Wed, 20 Mar 2024 15:46:42 +0000
Subject: [PATCH 1/3] chore: remove dead code in error template

---
 app/views/general/error.phtml | 39 -----------------------------------
 1 file changed, 39 deletions(-)

diff --git a/app/views/general/error.phtml b/app/views/general/error.phtml
index 450dcf8973..6c75ee1e5f 100644
--- a/app/views/general/error.phtml
+++ b/app/views/general/error.phtml
@@ -111,45 +111,6 @@ $title = $this->getParam('title', '')
             </div>
         </article>
     </div>
-    <!--section>
-        <h1>Error <?php echo $this->print($code, self::FILTER_ESCAPE); ?></h1>
-
-        <p><?php echo $this->print($message, self::FILTER_ESCAPE); ?></p>
-
-        <small>Error ID: <?php echo $this->print($errorID, self::FILTER_ESCAPE); ?></small>
-
-        <?php if (!empty($projectURL)) : ?>
-            <hr />
-
-            <p><a href="<?php echo $this->print($projectURL, self::FILTER_ESCAPE); ?>" rel="noopener">Back to <?php echo $this->print($projectName, self::FILTER_ESCAPE); ?></a></p>
-        <?php endif; ?>
-
-        <?php if ($development) : ?>
-            <div>
-
-                <h2>Error Trace</h2>
-
-                <?php foreach ($trace as $log) : ?>
-                    <table>
-                        <?php foreach ($log as $key => $value) : ?>
-                            <tr>
-                                <td style="width: 120px"><?php echo $this->print($key, self::FILTER_ESCAPE); ?></td>
-                                <td>
-                                    <?php if (is_array($value)) : ?>
-                                        <?php echo $this->print(var_export($value, true), self::FILTER_ESCAPE); ?>
-                                    <?php else : ?>
-                                        <?php echo $this->print($value, self::FILTER_ESCAPE); ?>
-                                    <?php endif; ?>
-                                </td>
-                            </tr>
-
-                        <?php endforeach; ?>
-                    </table>
-                <?php endforeach; ?>
-            </div>
-        <?php endif; ?>
-
-    </section-->
     <script type="text/javascript">
         const app = (JSON.parse(localStorage.getItem('appwrite')) ?? {});
         const theme = app.theme ?? 'auto';

From 901a1b8b654832e9d48e1f8ee60797f7d35d9978 Mon Sep 17 00:00:00 2001
From: Steven Nguyen <1477010+stnguyen90@users.noreply.github.com>
Date: Wed, 20 Mar 2024 15:47:33 +0000
Subject: [PATCH 2/3] fix: remove escaping

It's done automatically when setting the params already.
---
 app/views/general/error.phtml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/app/views/general/error.phtml b/app/views/general/error.phtml
index 6c75ee1e5f..a3715e0156 100644
--- a/app/views/general/error.phtml
+++ b/app/views/general/error.phtml
@@ -59,7 +59,7 @@ $title = $this->getParam('title', '')
     <link rel="stylesheet" href="/fonts/main.css" />
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <meta http-equiv="content-security-policy" content="">
-    <title><?php echo $this->print($title, self::FILTER_ESCAPE); ?></title>
+    <title><?php echo $this->print($title); ?></title>
 
     <style>
         @media(min-width:768px) {
@@ -74,11 +74,11 @@ $title = $this->getParam('title', '')
     <div class="container u-margin-block-start-24">
         <article class="card u-padding-16">
             <div class="u-flex u-flex-vertical u-gap-16">
-                <h1 class="heading-level-4 u-trim-1">Error <?php echo $this->print($code, self::FILTER_ESCAPE); ?></h1>
-                <p class="text"><?php echo $this->print($message, self::FILTER_ESCAPE); ?></p>
+                <h1 class="heading-level-4 u-trim-1">Error <?php echo $this->print($code); ?></h1>
+                <p class="text"><?php echo $this->print($message); ?></p>
                 <div class="u-flex u-flex-vertical u-gap-8">
                     <p class="text">Type</p>
-                    <p><code class="inline-code"><?php echo $this->print($type, self::FILTER_ESCAPE); ?></code></p>
+                    <p><code class="inline-code"><?php echo $this->print($type); ?></code></p>
                 </div>
                 <?php if ($development) : ?>
                     <h2 class="heading-level-5 u-trim-1">Error Trace</h2>

From 7604d351385ccb18835a4ffcbbdbb6654b676783 Mon Sep 17 00:00:00 2001
From: Steven Nguyen <1477010+stnguyen90@users.noreply.github.com>
Date: Wed, 20 Mar 2024 15:49:05 +0000
Subject: [PATCH 3/3] fix(functions): fix permissions for function domains

Execution via domain should be blocked if permissions does not contain
any and permissions does not contain guests.
---
 app/controllers/general.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/controllers/general.php b/app/controllers/general.php
index 1602316dd4..c4d731fa89 100644
--- a/app/controllers/general.php
+++ b/app/controllers/general.php
@@ -156,7 +156,7 @@ function router(App $utopia, Database $dbForConsole, callable $getProjectDB, Swo
 
         $permissions = $function->getAttribute('execute');
 
-        if (!(\in_array('any', $permissions)) && (\in_array('guests', $permissions))) {
+        if (!(\in_array('any', $permissions)) && !(\in_array('guests', $permissions))) {
             throw new AppwriteException(AppwriteException::USER_UNAUTHORIZED, 'To execute function using domain, execute permissions must include "any" or "guests"');
         }