Yioop URL Paths and Their Arguments

This page lists each url path Yioop answers, the request fields each activity reads, who may call it, and the checks made on the way. It was written for the version 10 security audit. The fields listed for an activity are the ones its own code reads from the request; a component may read more through the controller it belongs to.

How a request finds its controller

A url of the form ?c=controller&a=activity names the controller and the activity directly. With redirects on, src/index.php turns the first part of a path into these fields before any controller runs:

• /wd/...: resource controller, get. /wd/css, /wd/scripts and /wd/locale name a folder and file; /wd/resources/NAME, /wd/resources/FOLDER/NAME; /wd/resources, /wd/thumbs and /wd/athumbs/TOKEN/GROUP/PAGE/[SUBFOLDER/]NAME read a wiki page's resources; TOKEN is YIOOP_TOKEN=value, a bare token, or feed, and nothing else is accepted; /wd/users/ID is a user's icon; /wd/suggest/LOCALE is the suggest trie.
• /favicon.ico, /robots.txt, /humans.txt, /yioopbar.xml: resource controller, get, from the site folder or the source folder.
• /css, /scripts, /resources, /locale: resource controller, get, a file from the source folder; /locale never sends a .php file.
• /.well-known/acme-challenge/TOKEN: the certificate challenge answer; a token that is not base64url gets 404.
• /blog: group controller, groupFeeds of the public group.
• /admin, /register, /tests: that controller; /tests only when DEBUG_LEVEL has TEST_INFO; /admin/GROUP and /admin/GROUP/PAGE read a group's feed or wiki.
• /advertise, /bot, /privacy, /terms: static controller, that page of the public group.
• /group/ID, /thread/ID, /user/ID: group controller, groupFeeds with just_group_id, just_thread or just_user_id; /group/ID/PAGE and further parts read a wiki page.
• /group/ID/PAGE.git/... and /ID/PAGE.git/...: group controller, gitService for a git repository page.
• /user_messages[/CONTACT]: group controller, userMessages; CONTACT must be a whole number.
• /user_mail: admin controller, userMail.
• /s/NAME: search controller with s, a subsearch.
• /serp_icon/TIME/CODE: search controller, cache with field=favicon, a site icon from the index.
• /suggest: register controller, suggestUrl.
• /p/PAGE[/SUBFOLDER...] and /p/pages[/CATEGORY]: static controller showPage, or the group controller's list of pages for a routed domain's group.
• /ws-messages: the message websocket under Yioop's own server; the user comes from the session cookie and contact_id must be a whole number.

Public controllers

search

Who may call: anyone; an activity not in the list falls back to query. Fields SearchController reads for every activity: YIOOP_TOKEN, a, arg, callback, category, f, field, from_cache, guess, hist_open, imagecolor, imagelayout, imagesize, its, lang, limit, machine, maxvideoduration, minvideoduration, mirror, network, no_query, num, open_in_tabs, order, period, perpage, q, raw, repository, s, safe_search, save_timestamp, term, timeperiod, videoresolution.

• query (SearchController): none read directly
• cache (SearchController): none read directly
• chart (SearchController): none read directly
• related (SearchController): none read directly
• signout (SearchController): none read directly
• recordClick (SearchController): none read directly
• trending (SearchController): none read directly
• synthetic (SearchController): none read directly

static

Who may call: anyone; reads pages of the public group or of the group a domain is routed to. Fields StaticController reads for every activity: CSVFORM, a.

• showPage (StaticController): arg, n, p, page_locale, resource_filter, sf
• signout (StaticController): none read directly

resource

Who may call: get and suggest for anyone; a private group's resources are checked in checkAndLogViewGetBaseFolder; syncList and syncNotify need the machine check below. Fields ResourceController reads for every activity: a.

• get (ResourceController): b, download, f, feed, g, l, n, o, p, s, sf, t
• suggest (ResourceController): locale
• syncList (ResourceController): last_sync, machine_uri, robot_instance
• syncNotify (ResourceController): last_sync, machine_uri, robot_instance

register

Who may call: anyone; sign-up, recovery and url suggestion pages ask a hash captcha; recovery and email links carry hashes compared with hash_equals. Fields RegisterController reads for every activity: YIOOP_TOKEN, a, arg, email, password, repassword.

• createAccount (RegisterController): none read directly
• emailVerification (RegisterController): hash, token
• processAccountData (RegisterController): a, email, password, recovery_answer, recovery_question, repassword
• processRecoverData (RegisterController): a, email, password, repassword
• recoverPassword (RegisterController): none read directly
• recoverComplete (RegisterController): answer, finish_hash
• resendComplete (RegisterController): user
• resendRegistration (RegisterController): none read directly
• signinCode (RegisterController): none read directly
• processSigninData (RegisterController): a, email, password, repassword
• signinCodeComplete (RegisterController): code, token
• suggestUrl (RegisterController): arg, build_time, url

api

Who may call: anyone may reach it; for a signed-in user the YIOOP_TOKEN form token is checked as in the admin controller. Fields ApiController reads for every activity: YIOOP_TOKEN, a, page_name.

• summarize (ApiController): thread_id
• suggest (ApiController): filter, kind
• unsubscribe (ApiController): token

Signed-in controllers

admin

Who may call: a signed-in user whose roles allow the activity, with a valid YIOOP_TOKEN form token; the arguments the role allows are handed to the activity; a suspended or inactive user is allowed no activity, and a request without a token is sent to sign in. Fields AdminController reads for every activity: YIOOP_TOKEN, a, arg, c, domain_handoff, p, page_id, page_name, preserve, u.

• crawlStatus (AdminController): crawl_toggle
• machineStatus (AdminController): toggle
• signout (AdminController): none read directly
• userMessages (MessageComponent): answer_call, arg, contact_id, contact_name, decline_call, limit, num
• userMail (MailComponent): a, account_id, arg, c, deselect, filter, flagged_only, folder, index, job_id, scheduled_id, sort_key, sort_reverse, uid, unread_only
• manageAccount (AccountaccessComponent): BOT_CALLBACK_URL, BOT_TOKEN, IS_BOT_USER, YIOOP_TOKEN, a, arg, c, edit, edit_pass, edit_purchase, edit_recovery, impersonator_password, lang, new_password, password, purchase_role_id, recovery_answer, recovery_question, retype_password, unsubscribe_role_id
• manageUsers (AccountaccessComponent): YIOOP_TOKEN, a, arg, c, change_filter, context, email, first_name, group_filter, group_ids, group_limit, group_sorts, last_name, new_password, password, retypepassword, role_filter, role_ids, role_limit, role_sorts, selectgroup, selectrole, status, user_name, userstatus, visible_groups, visible_roles
• manageRoles (AccountaccessComponent): activities, arg, context, modifier, name, selectactivity, selectmodifier
• manageCrawls (CrawlComponent): arg, asleep_duration, asleep_start, channel, context, crawl_indexes, crawl_order, crawl_type, description, filter, inject_sites, its, load_option, max_depth, posted, recompute, repeat_type, restrict_sites_by_url, robots_txt, server_channel, sleep_duration, sleep_start, suggest, timestamp, ts, use_suggest
• manageClassifiers (CrawlComponent): arg, class_label, context, name, rename_label, update
• mixCrawls (CrawlComponent): NAME, a, arg, context, mix, name, timestamp, update
• pageOptions (CrawlComponent): INDEXING_PLUGINS, TESTPAGE, cache_pages, classifier, filetype, load_option, max_description_len, max_links_to_extract, option_type, page_range_request, page_recrawl_frequency, page_rules, page_type, posted, ranker, summarizer_option, test_method, test_uri
• resultsEditor (CrawlComponent): DESCRIPTION, FIRST, ID, KWIKI_PAGE, MAP_QUERY, MAP_URLS, MODE, QUERY, SEARCH, TITLE, URL, URL_ACTION, arg
• scrapers (CrawlComponent): arg, context, id, name, per_page, signature
• searchSources (CrawlComponent): arg, category, context, expires, fn, landing_highlight, language, modify_add, name, path_regex, per_page, trend_category, trend_sort, trending_stop_regex, ts, type
• manageGroups (SocialComponent): arg, browse, c, context, default_page_type, encryption, filter, group_filter, group_id, group_limit, group_sort, group_theme, impression, item, limit, mail_pref_shown, member_access, name, owner, page_categories, page_footer, page_header, post_lifetime, receive_group_mail, register, render_engine, return, start_row, time, user_filter, user_id, user_ids, user_limit, user_sorts, users_names, visible_users, vote_access
• botStory (ChatbotComponent): arg, form_type, pattern_id
• manageCredits (StoreComponent): CARD_TOKEN, NUM_CREDITS, NUM_DOLLARS, YIOOP_TOKEN, arg, context, type
• manageAdvertisements (StoreComponent): CALCULATE, DESCRIPTION, DESTINATION, DURATION, EDIT_AD, END_DATE, KEYWORDS, NAME, PURCHASE, START_DATE, arg, context, id, name, save
• manageMachines (SystemComponent): NO_REFRESH, action, arg, channel, id, job_name, num_fetchers, parent, time, type
• manageLocales (SystemComponent): STRINGS, arg, context, filter, limit, name, previous_activity, show, update
• servers (SystemComponent): DBMS, additional, arg, cancel, crawl_delay, disallow_all, domain, feeds, humans, page_feed, page_list, page_source, preview, route_domain, route_group, save, search, wiki
• userRolesGroups (SystemComponent): arg, selected_role
• security (SystemComponent): LDAP_ROOT_NAME, LDAP_ROOT_PASSWORD, PASSWORD_MIN_LEN, arg
• appearance (SystemComponent): APPEARANCE_DOMAIN, APPEARANCE_TARGET, AUXILIARY_CSS, AUXILIARY_CSS_NAME, SITE_MOTTO, SITE_NAME, add_theme, advanced, arg, caret, edit_theme, scroll_top
• configure (SystemComponent): ERROR_INFO, QUERY_INFO, ROBOT_DESCRIPTION, TEST_INFO, WORK_DIRECTORY, arg, lang

group

Who may call: groupFeeds is open to anyone; wiki, userMessages and gitService need the reader's roles to allow them, a signed-out reader being the public user; the feed, wiki, message and git components then check the reader's access to the group, page, thread or conversation they read.

• groupFeeds (FeedComponent): a, arg, f, group_filter, group_id, group_sort, just_group_id, just_thread, limit, num, page_type, post_id, thread_filter, thread_order, thread_search, v
• wiki (WikiComponent): CSVFORM, CSV_FORM_HASH, SUBMIT_SUCCESSFUL, VOTE_RECEIPT, a, arg, article_categories, back_params, c, caret, default_sort, f, front_page_layout, front_page_slot, group_id, n, nonce_for_string, noredirect, page_id, page_locale, page_name, page_type, preview_mark, reltype, reset_detail, resource_description, resources, scroll_top, settings, sf, sort, user_captcha_text
• userMessages (MessageComponent): answer_call, arg, contact_id, contact_name, decline_call, limit, num
• gitService (GitComponent): group_id, page_name, service, sf

Checks inside admin and group activities

The controller lets a request reach an activity only when one of the reader's roles allows it. A new site gives its roles these activities:

• User, the role of every new account: manageAccount, manageGroups, groupFeeds (without git repositories), userMessages and userMail; manageCredits and manageAdvertisements as well when the site's monetization setting uses them.
• Developer: groupFeeds with git repositories.
• Admin: every activity but botStory, which the Bot role has, and manageCredits and manageAdvertisements only when the monetization setting uses them. Once reached, an activity open to the User role checks what the reader may touch:
• manageGroups: a group_id is loaded for the reader, and its settings, members and statistics are offered only to the group's owner (root may also read statistics and settings). infogroup shows a group the reader is not in, unless it is invite only. changemailpref checks that the reader is a member. deletegroup needs the owner or root. joingroup and unsubscribe act only on the signed-in reader: their links carry user_id, and a user_id naming anyone else is refused.
• userMessages: reads only conversations between the reader and contact_id, a whole number. A contact may not be the public user or the reader, and must be an active user.
• groupFeeds and wiki: the reader's roles in the group are checked, as read in this audit's second round. The other activities are reached only through the Admin role or a role a site's admin makes. Each one's own method was searched for its checks; the methods it calls were not:
• root only parts: resultsEditor, manageCredits, servers and configure each compare the reader with root for some of their arguments.
• form token checked in the method itself: manageAccount, wiki, groupFeeds, userMessages, userMail, security and appearance. AdminController also checks the token in processRequest (line 227); which requests that check covers is not yet followed. Fields a component reads through its controller:
• redirectWithMessage (every component): a, browse, c, context and route, and the fields the caller names in copy_fields, which the redirect carries over.
• pagingLogic (every paged table): num_show, start_row and end_row, with any prefix the table uses. num_show must be one of the sizes the paging table offers, and start_row is a whole number of at least 0.
• displayView (feed, social, wiki): c, to pick the view.
• recordViewSession (social): t.
• validatePostedHashCode (social): nonce_for_string, random_string and time, the hash code fields a form carries. Checks in the methods an activity calls, for the money and membership paths:
• manageCredits, redeemCredits: NUM_CREDITS must be a whole number the form offered, and the form offers only amounts the reader's balance covers; the reader needs a payment account that can take transfers.
• manageCredits, purchaseCredits: NUM_DOLLARS must be one of the amounts offered; the card is charged before credits are added.
• manageGroups, unsubscribe: the owner of a group cannot leave it.

Machine-to-machine controllers

archive, classifier, crawl, fetch, jobs, machine

Who may call: only another Yioop machine of the same site: the request's time must be within AUTOLOGOUT of this machine's clock and its session must be md5 of that time and AUTH_KEY, compared with hash_equals; the activity must be in the controller's list. Fields ArchiveController reads for every activity: a. Fields ClassifierController reads for every activity: a. Fields CrawlController reads for every activity: a. Fields FetchController reads for every activity: a, c, downloads_per_hour, machine_uri, p, robot_instance. Fields JobsController reads for every activity: a, args, job, machine_id. Fields MachineController reads for every activity: a.

• cache (ArchiveController): crawl_time, instance_num, offset, partition
• classify (ClassifierController): arg, doc_to_label, index, keywords, label, type
• clearFeedData (CrawlController): none read directly
• clearQuerySavePoint (CrawlController): arg
• crawlStalled (CrawlController): none read directly
• crawlStatus (CrawlController): none read directly
• deleteCrawl (CrawlController): arg
• injectUrlsCurrentCrawl (CrawlController): arg, i, num
• combinedCrawlInfo (CrawlController): none read directly
• getInfoTimestamp (CrawlController): arg
• getCrawlItems (CrawlController): arg, i, num
• getCrawlList (CrawlController): arg
• getCrawlSeedInfo (CrawlController): arg
• sendStartCrawlMessage (CrawlController): arg, fqs_ratio, i, num
• sendStopCrawlMessage (CrawlController): arg
• setCrawlSeedInfo (CrawlController): arg
• schedule (FetchController): crawl_time
• archiveSchedule (FetchController): crawl_time, robot_instance
• update (FetchController): arc_type, byte_counts, crawl_time, crawl_type, current_part, diff_origin, fetcher_peak_memory, hash_data, hash_part, num_parts, part, robot_instance, sequence_number
• crawlTime (FetchController): crawl_time, robot_instance, web_bot_auth
• getUpdateProperties (JobsController): none read directly
• statuses (MachineController): arg
• update (MachineController): action, channel, id, parent, type
• log (MachineController): channel, f, id, type

Checks made on every request

• File names are cleaned with the file_name rule, which turns ../ and /.. into a dash; subfolders lose any ..; the locale subfolder loses every dot.
• Form changes need the YIOOP_TOKEN form token, checked with hash_equals in checkCSRFToken.
• Passwords are checked with crawlCrypt and hash_equals; a repeated password must match exactly, compared with === since 1 November 2026.
• Git clone codes and email verification hashes are compared with hash_equals.
• Machine requests are checked by Controller::checkRequest as described above.

Fixed in the version 10 audit

• A /wd/resources path could set any request field with name=value in its token part, such as c=search; only the token is accepted now.
• /locale sent the PHP source of a locale's files; it sends no .php file now.
• Machine requests compared the session hash with !=, which takes two 0e-and-digits hashes as equal; hash_equals now.
• Password repeat checks and the recovery link hash used == and !=, which take 1e3 and 1000 as equal; === and hash_equals now.
• redeemCredits turned any NUM_CREDITS the request named into a transfer, whatever the reader's balance, and took the credits off, leaving the balance below zero; only an amount the form offered, within the balance, is taken now.
• A group's owner could leave the group, leaving it with an owner who is not a member; the owner is refused now.
• createdb meant to give the User role manageCredits and manageAdvertisements when the monetization setting uses them, but its check read the name of the last default activity, configure, so the role never got them; it now gets them.
• manageGroups' joingroup and unsubscribe acted on whichever user_id the request named, so any signed-in user could take another user out of a group, or accept another user's invitation; they now act only on the signed-in reader.
• manageGroups took infogroup and changemailpref for a group id that names no group as if the group were found, and read its name from nothing; the group must now exist.
• The suggest locale check, entity protection in utf8SafeSaveHtml and a GroupWikiTool pattern used the range A-z, which also takes [ \ ] ^ _ and the backquote; A-Z now.