{"record":{"id":"2d14e6adf1db33a9","repo":"flarum/framework","slug":"invalid-sort-fields-comma-separated-invalid-fields","errorCode":null,"errorMessage":"Invalid sort fields [<comma-separated invalid fields>]","messagePattern":"Invalid sort fields \\[<comma-separated invalid fields>\\]","errorType":"http","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"framework/core/src/Http/RequestUtil.php","lineNumber":142,"sourceCode":"        }\n\n        $sort = [];\n\n        foreach (explode(',', $input) as $field) {\n            if (str_starts_with($field, '-')) {\n                $field = substr($field, 1);\n                $order = 'desc';\n            } else {\n                $order = 'asc';\n            }\n\n            $sort[$field] = $order;\n        }\n\n        $invalid = array_diff(array_keys($sort), $available);\n\n        if (count($invalid)) {\n            throw new BadRequestException(\n                'Invalid sort fields ['.implode(',', $invalid).']',\n            );\n        }\n\n        return $sort;\n    }\n\n    public static function extractLimit(Request $request, ?int $defaultLimit = null, ?int $max = null): ?int\n    {\n        $limit = $request->getQueryParams()['page']['limit'] ?? '';\n\n        if (! filled($limit)) {\n            $limit = $defaultLimit;\n        }\n\n        // Only short-circuit when there is genuinely no limit (no page[limit] and no\n        // default). A loose `! $limit` check here also caught the string \"0\", returning\n        // null which then broke OffsetPagination's non-nullable int $limit. An explicit","sourceCodeStart":124,"sourceCodeEnd":160,"githubUrl":"https://github.com/flarum/framework/blob/4b939f685389bfe8a380e9e28ddf305a1c66950c/framework/core/src/Http/RequestUtil.php#L124-L160","documentation":"Thrown in RequestUtil::extractSort after parsing the sort string into field=>direction pairs: any requested field not present in the endpoint's $available allow-list is rejected. This prevents arbitrary sort columns (which would leak schema details or break queries); the message lists the offending comma-separated field names and the API returns 400.","triggerScenarios":"Thrown at framework/core/src/Http/RequestUtil.php:142 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Only request sort fields the endpoint documents as sortable","Remove unsupported fields from the sort parameter","If you need another sortable column, register a Sort for that endpoint server-side"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"4b939f685389bfe8a380e9e28ddf305a1c66950c","analyzedAt":"2026-09-15T18:09:20.879Z","contentChangedAt":"2026-09-15T18:09:20.879Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}