From cd2fcfebabbd0b8fc6d912cb8b257fd8bd0bc5b2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20P=C3=A9ters?= <fpeters@entrouvert.com>
Date: Sat, 21 Mar 2020 10:20:20 +0100
Subject: [PATCH] misc: restrict ajax cell url regex (#40875)

---
 combo/public/urls.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/combo/public/urls.py b/combo/public/urls.py
index 933d72c5..acafede1 100644
--- a/combo/public/urls.py
+++ b/combo/public/urls.py
@@ -21,7 +21,7 @@ from . import views
 
 urlpatterns = [
     url(r'^api/menu-badges/$', views.menu_badges),
-    url(r'^ajax/cell/(?P<page_pk>\w+)/(?P<cell_reference>[\w_-]+)/$',
+    url(r'^ajax/cell/(?P<page_pk>\d+)/(?P<cell_reference>[\w_]+-\d+)/$',
         views.ajax_page_cell, name='combo-public-ajax-page-cell'),
     url(r'^snapshot/(?P<pk>\w+)/$', manager_required(views.snapshot), name='combo-snapshot-view'),
     url(r'__style__/$', views.style),