diff --git a/app/controllers/embed_controller.rb b/app/controllers/embed_controller.rb index db0fc722121..2a063adaed6 100644 --- a/app/controllers/embed_controller.rb +++ b/app/controllers/embed_controller.rb @@ -34,6 +34,10 @@ class EmbedController < ApplicationController raise Discourse::InvalidParameters.new(:embed_id) unless @embed_id =~ /^de\-[a-zA-Z0-9]+$/ end + if @embed_class = params[:embed_class] + raise Discourse::InvalidParameters.new(:embed_class) unless @embed_class =~ /^[a-zA-Z0-9\-_]+$/ + end + if params.has_key?(:template) && params[:template] == "complete" @template = "complete" else diff --git a/app/views/embed/topics.html.erb b/app/views/embed/topics.html.erb index 10b825f7273..f7444fa90f6 100644 --- a/app/views/embed/topics.html.erb +++ b/app/views/embed/topics.html.erb @@ -7,7 +7,7 @@ <%- end %> <%- end %> -