diff --git a/app/controllers/embed_controller.rb b/app/controllers/embed_controller.rb index db0fc722121..2a063adaed6 100644 --- a/app/controllers/embed_controller.rb +++ b/app/controllers/embed_controller.rb @@ -34,6 +34,10 @@ class EmbedController < ApplicationController raise Discourse::InvalidParameters.new(:embed_id) unless @embed_id =~ /^de\-[a-zA-Z0-9]+$/ end + if @embed_class = params[:embed_class] + raise Discourse::InvalidParameters.new(:embed_class) unless @embed_class =~ /^[a-zA-Z0-9\-_]+$/ + end + if params.has_key?(:template) && params[:template] == "complete" @template = "complete" else diff --git a/app/views/embed/topics.html.erb b/app/views/embed/topics.html.erb index 10b825f7273..f7444fa90f6 100644 --- a/app/views/embed/topics.html.erb +++ b/app/views/embed/topics.html.erb @@ -7,7 +7,7 @@ <%- end %> <%- end %> -
data-embed-id="<%= @embed_id %>"<%- end %>> +
data-embed-id="<%= @embed_id %>"<%- end %>> <%- @list.topics.each do |t| %>
<%- if @template == "complete" %> @@ -49,7 +49,9 @@ diff --git a/spec/requests/embed_controller_spec.rb b/spec/requests/embed_controller_spec.rb index 965a78fa337..ff89614634f 100644 --- a/spec/requests/embed_controller_spec.rb +++ b/spec/requests/embed_controller_spec.rb @@ -100,7 +100,7 @@ describe EmbedController do expect(response.body).to match("data-referer=\"https://example.com/evil-trout\"") end - it "returns a list of topics" do + it "returns a list of top topics" do bad_topic = Fabricate(:topic) good_topic = Fabricate(:topic, like_count: 1000, posts_count: 100) TopTopic.refresh! @@ -116,6 +116,16 @@ describe EmbedController do expect(response.body).to match("data-referer=\"https://example.com/evil-trout\"") end + it "wraps the list in a custom class" do + topic = Fabricate(:topic) + get '/embed/topics?discourse_embed_id=de-1234&embed_class=my-special-class', headers: { + 'REFERER' => 'https://example.com/evil-trout' + } + expect(response.status).to eq(200) + expect(response.headers['X-Frame-Options']).to be_nil + expect(response.body).to match("class='topics-list my-special-class'") + end + it "returns no referer if not supplied" do get '/embed/topics?discourse_embed_id=de-1234' expect(response.status).to eq(200)