decode HTML entities in REST/JSON service

[JoshMcCullough]

Description

I worked on this for many hours, trying to figure out why my API calls were never working. After digging through and adding logging, I found that the rest_data parameter was not being properly HTML-entity-decoded.

Motivation and Context

8.7.0 REST API simply does not work. See this thread on the forum: https://community.suitecrm.com/t/v4-1-api-call-not-working-params-not-received/97318

How To Test This

This will fail using the current 8.7.0 API:

curl -X POST http://localhost:3001/service/v4_1/rest.php -H 'Content-Type: application/x-www-form-urlencoded' -d 'input_type=JSON' -d 'response_type=JSON' -d 'method=login' -d 'rest_data={"user_auth":{"user_name":"admin","password":"dd995564b1fa70241364c5926aa27997"},"application":"test"}'

Types of changes

• [ x ] Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• [ * ] Breaking change (fix or feature that would cause existing functionality to change)

• I don't think this is a breaking change. As far as I can tell, there is no way to use the API as-is. But I ... must be wrong, right?

Final checklist

• [ x ] My code follows the code style of this project found here.
• My change requires a change to the documentation.
• [ x ] I have read the How to Contribute guidelines.

[shubham-pawar]

What about the below code?

$json_data = !empty($_REQUEST['rest_data']) ? html_entity_decode($GLOBALS['RAW_REQUEST']['rest_data']) : '';

[JoshMcCullough]

What about the below code?

That would make sense, but it was unclear to me why $_REQUEST['rest_data'] is used on the left and $GLOBALS['RAW_REQUEST']['rest_data'] is used on the right. So I wrapped the whole line. I suspect this is also a bug, and the solution is actually:

$json_data = !empty($_REQUEST['rest_data']) ? html_entity_decode($_REQUEST['rest_data']) : ''; 

[JoshMcCullough]

I don't "do" PHP, so this is a bit lost on me, but apparently:

# $GLOBALS['RAW_REQUEST']['rest_data']
{"user_auth":{"user_name":"admin","password":"dd995564b1fa70241364c5926aa27997"},"application":"test"}

# $_REQUEST['rest_data']
{&user_auth&:&user_name&:&admin&,&password&:&dd995564b1fa70241364c5926aa27997&},&application&:&test&}

Why would the quotes in $_REQUEST['rest_data'] be replaced with & in the incoming request body?

---

So the solution, then, seems to be:

$raw_json_data = $GLOBALS['RAW_REQUEST']['rest_data'];
$json_data = !empty($raw_json_data)? html_entity_decode($raw_json_data): '';

[pgorod]

Isn't the solution to fix the place where the data is being broken, instead of un-breaking it later?