From 6477b7908632121050201b87aad9d132a9edd960 Mon Sep 17 00:00:00 2001
From: honzapatCZ <honzapatCZ@email.cz>
Date: Mon, 14 Sep 2026 20:36:13 +0200
Subject: [PATCH] restrict ibnder to query, form and route

---
 Models/Api/ModelBinder.cs | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/Models/Api/ModelBinder.cs b/Models/Api/ModelBinder.cs
index 40f3915..e537a84 100644
--- a/Models/Api/ModelBinder.cs
+++ b/Models/Api/ModelBinder.cs
@@ -76,6 +76,23 @@ namespace NejCommon.Models
             _routeValues = routeValues;
         }
 
+        private static string? GetValue(ModelBindingContext context, string name)
+        {
+            // Route first
+            if (context.ActionContext.RouteData.Values.TryGetValue(name, out var routeValue))
+                return routeValue?.ToString();
+
+            // Then query string
+            if (context.HttpContext.Request.Query.TryGetValue(name, out var queryValue))
+                return queryValue.FirstOrDefault();
+
+            // Then form
+            if (context.HttpContext.Request.HasFormContentType  && context.HttpContext.Request.Form.TryGetValue(name, out var formValue))
+                return formValue.FirstOrDefault();
+
+            return null;
+        }
+
         public async Task BindModelAsync(ModelBindingContext bindingContext)
         {
             if (bindingContext == null)
@@ -100,17 +117,17 @@ namespace NejCommon.Models
                         ? bindingContext.ModelName
                         : routeValue.Name;
 
-                var result = bindingContext.ValueProvider.GetValue(name);
+                var result = GetValue(bindingContext, name);
                 // If these really are route values, don't go through the entire
                 // MVC ValueProvider infrastructure.
-                if (result == ValueProviderResult.None)
+                if (result == null)
                 {
                     bindingContext.ModelState.AddModelError(name, "Route value not found");
                     bindingContext.Result = ModelBindingResult.Failed();
                     return;
                 }
 
-                values[i] = result.FirstValue!;
+                values[i] = result;
             }
 
             // Check if all the required route values are present