From 3b0005a0187fedc682e8454d4caff545d111153d Mon Sep 17 00:00:00 2001 From: sunguangning Date: Fri, 15 May 2026 06:14:01 +0800 Subject: [PATCH] fix: CardApiController reorder() reads target stackId from request body The Deck API reorder endpoint was ignoring the stackId in the request body because Nextcloud's ApiController maps route parameters to method parameters with matching names. Since the URL contains {stackId} as a route parameter (the source stack), that value was taking precedence over any stackId in the request body. Now we read stackId from the raw request body (php://input), allowing cards to be moved between stacks via the REST API. Fixes: #7933 --- lib/Controller/CardApiController.php | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/lib/Controller/CardApiController.php b/lib/Controller/CardApiController.php index 4bd3fdd2c..8e98c78b1 100644 --- a/lib/Controller/CardApiController.php +++ b/lib/Controller/CardApiController.php @@ -200,7 +200,13 @@ public function unarchive(int $cardId): DataResponse { #[CORS] #[NoCSRFRequired] public function reorder(int $stackId, int $order): DataResponse { - $card = $this->cardService->reorder((int)$this->request->getParam('cardId'), $stackId, $order); + // Read target stackId from request body to allow moving cards between stacks. + // The URL's {stackId} is the source stack (used in the route), but the request + // body can specify a different target stack for the move operation. + $input = json_decode(file_get_contents('php://input'), true); + $targetStackId = isset($input['stackId']) ? (int)$input['stackId'] : $stackId; + + $card = $this->cardService->reorder((int)$this->request->getParam('cardId'), $targetStackId, $order); return new DataResponse($card, HTTP::STATUS_OK); } }