passbolt/passbolt_api · error · CakeException

" " is not a valid order.

Error message

"{0}" is not a valid order.

What it means

validateOrders checks each entry of the 'order' query-string parameter against the component's order grammar via isOrder(). It throws when an entry is not a syntactically valid order expression (field name optionally followed by ASC or DESC). This prevents arbitrary strings from being injected into ORM order clauses.

Solutions

1. Use the format '<field_name> ASC' or '<field_name> DESC' (or just '<field_name>').
2. Only use ASC or DESC as the direction keyword.
3. Check the controller's allowed order list and use one of its field names.
4. Remove any extra whitespace, commas, or multiple directions from the order value.

Example fix

// before
GET /users?order[]=full_name ASCENDING
// after
GET /users?order[]=full_name DESC

const ORDER_RE = /^[a-z_]+( (ASC|DESC))?$/i;
if (!ORDER_RE.test(orderValue)) {
  throw new Error(`Invalid order expression: ${orderValue}`);
}

When it happens

Trigger: GET requests with order values like ?order[]=foo-bar-baz, ?order[]=name ASCENDING, or containing characters outside the allowed pattern (field plus optional ' ASC'/' DESC').

Common situations: Clients inventing sort keywords ('ASCENDING', 'ascending') instead of the supported ASC/DESC; passing multiple space-separated directions; copying field paths with dots or slashes not supported by the grammar.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• Invalid order.
• " " is not a valid contain value.
• " " is not a valid datetime for filter .
• " " is not a valid group filter.
• " " is not a valid group id for filter .

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/4b58606414c78744. Report an issue: GitHub.

Appendix: source

Thrown at src/Controller/Component/QueryStringComponent.php:676

        return true;
    }

    /**
     * Validate order
     *
     * @param array|null $orders a list of order to validate like ['Groups.name ASC', 'Users.created']
     * @param array|null $allowedQueryItems whitelist
     * @return bool true if validate
     * @throws \Cake\Core\Exception\CakeException if the group name does not validate
     * @deprecated Use the ApiPaginationComponent
     */
    public static function validateOrders(?array $orders = null, ?array $allowedQueryItems = null): bool
    {
        if (isset($orders)) {
            foreach ($orders as $orderName) {
                if (!self::isOrder($orderName)) {
                    throw new CakeException(__('"{0}" is not a valid order.', $orderName));
                }
                $order = explode(' ', $orderName); // remove ASC DESC if any
                if (!isset($allowedQueryItems) || !in_array($order[0], $allowedQueryItems['order'])) {
                    throw new CakeException(__('"{0}" is not in the list of allowed order.', $orderName));
                }
            }
        }

        return true;
    }

    /**
     * Validate Contain
     *
     * @param array|null $contain conditions
     * @return bool true if validate
     * @throws \Cake\Core\Exception\CakeException if the contain value is not 0 or 1
     */

View on GitHub (pinned to 31c1bbc10f)