mirror of
https://github.com/discourse/discourse.git
synced 2025-06-02 02:05:49 +08:00
DEV: Handle bad parameters in TopicsController#wordpress (#23404)
We're seeing a large number of log noise from this endpoint due to malicious scanners that are trying to send clever params and seeing if they can break something. This change simply rescues any NoMethodError during parameter parsing and re-raises a Discourse::InvalidParameters exception, which will be caught and render a 400.
This commit is contained in:
@ -78,6 +78,12 @@ RSpec.describe TopicsController do
|
||||
"#{Discourse.base_url_no_prefix}#{moderator.avatar_template}",
|
||||
)
|
||||
end
|
||||
|
||||
it "does not error out when using invalid parameters" do
|
||||
get "/t/#{p1.topic.id}/wordpress.json", params: { topic_id: 1, best: { leet: "haxx0r" } }
|
||||
|
||||
expect(response.status).to eq(400)
|
||||
end
|
||||
end
|
||||
|
||||
describe "#move_posts" do
|
||||
|
Reference in New Issue
Block a user