Fix request parameter rewriting in rails 7.1.x

[Nick Budak]

It seems that in rails 7.1 our HTTP request parameters are being rewritten during the delegation process, where e.g.:

https://requests.stanford.edu/requests/new?a=b&c=d

should become

https://requests.stanford.edu/hold_recalls/new?a=b&c=d

but instead becomes (note ampersand)

https://requests.stanford.edu/hold_recalls/new?a=b&c=d

this causes the parameters to be parsed incorrectly by the receiving controller:

Started GET “/hold_recalls/create?request[barcodes][36105231817524]=1&request[destination]=GREEN-LOAN&request[item_id]=in00000001563&request[needed_date]=2024-10-23&request[origin]=SAL3&request[origin_location]=STACKS”
Parameters: {“request”=>{“barcodes”=>{“36105231817524”=>“1"}}, “amp;request”=>{“destination”=>“GREEN-LOAN”, “item_id”=>“in00000001563”, “needed_date”=>“2024-10-23”, “origin”=>“SAL3”, “origin_location”=>“STACKS”}}

this behavior originates here:

sul-requests/app/controllers/requests_controller.rb

Lines 148 to 153 in e1276a5

 def delegated_new_request_path(request, url_params = nil) 
   url_params ||= params.except(:controller, :action).to_unsafe_h 
   request.delegate_request! 
   new_polymorphic_path(request.type.underscore, url_params) 
 end 
 helper_method :delegated_new_request_path 

[Nick Budak]

we can't replicate this problem locally, so it may interact with some configuration on our servers (Apache?)

[Chris Beer]

Were you able to reproduce this on requests-dev? I deployed #1950 there and can't reproduce. Do you have example requests that this happened on?

[Nick Budak]

My memory is that we replicated and fixed this on stage; I don't think we did anything with dev. When I was testing, I did so with https://searchworks.stanford.edu/view/in00000001563. That resulted in https://app.honeybadger.io/projects/49963/faults/101591418/01HDEW0GXPZ486GB2K9862T6WT.

[Chris Beer]

I see; it's not the redirect from requests/new to hold_recalls/new, but actually submitting the form?

https://github.com/sul-dlss/sul-requests/blob/main/app/controllers/requests_controller.rb#L105-L113

[Nick Budak]

That would make sense! I just saw that the params from SW were coming in correctly but getting messed up somewhere inside requests, and assumed it was during request type delegation.

[hudajkhan]

Note: Chris may have a PR already for this which requires review/rebasing.

[Michael J. Giarlo]

@hudajkhan @cbeer Can y'all confirm whether there is a PR for this already?

[Justin Coyne]

The PR was #1950 AFACT