FIX: Only allow intergers for page params.

This commit is contained in:
Guo Xiang Tan 2017-10-02 10:45:54 +08:00
parent 77ea063751
commit 4e07bbfbbf
2 changed files with 14 additions and 0 deletions

View File

@ -331,6 +331,8 @@ class ListController < ApplicationController
def build_topic_list_options
options = {}
params[:page] = params[:page].to_i rescue 1
TopicQuery.public_valid_options.each do |key|
options[key] = params[key]
end

View File

@ -3,6 +3,18 @@ require 'rails_helper'
RSpec.describe ListController do
let(:topic) { Fabricate(:topic) }
describe '#index' do
it "doesn't throw an error with a negative page" do
get "/#{Discourse.anonymous_filters[1]}", params: { page: -1024 }
expect(response).to be_success
end
it "doesn't throw an error with page params as an array" do
get "/#{Discourse.anonymous_filters[1]}", params: { page: ['7'] }
expect(response).to be_success
end
end
describe 'titles for crawler layout' do
it 'has no title for the default URL' do
topic