tqt/Ghost
2
1
Fork 0
mirror of https://github.com/TryGhost/Ghost.git synced 2023-12-13 21:00:40 +01:00
Code Issues 1 Releases Wiki Activity

Returns 404 page instead of crashing a server whenever special characters are used for tag filtering

Browse source 
closes #5808
refs #5816
- adds additional filtering any 'slug' containing content in `renderChannel` for frontend
- adds test for invalid characters in tag slug
This commit is contained in:
Nazar Gargol 2015-09-10 19:16:16 +02:00
parent ed7bfe8f4a
commit fd7e118ed5
2 changed files with 11 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
core/server/controllers/frontend.js
View file

@ -14,6 +14,7 @@ var _ = require('lodash'),
Promise = require('bluebird'),
template = require('../helpers/template'),
routeMatch = require('path-match')(),
safeString = require('../utils/index').safeString,
frontendControllers,
staticPostPermalink = routeMatch('/:slug/:edit?');
@ -160,8 +161,8 @@ function renderChannel(channelOpts) {
filter, filterKey;
// Add the slug if it exists in the route
if (channelOpts.route.indexOf(':slug') !== -1) {
options[channelOpts.name] = req.params.slug;
if (channelOpts.route.indexOf(':slug') !== -1 && req.params.slug) {
options[channelOpts.name] = safeString(req.params.slug);
hasSlug = true;
}

8
core/test/functional/routes/frontend_spec.js
View file

@ -79,6 +79,14 @@ describe('Frontend Routing', function () {
.end(doEnd(done));
});
it('should 404 for unknown tag with invalid characters', function (done) {
request.get('/tag/~$pectacular~/')
.expect('Cache-Control', testUtils.cacheRules['private'])
.expect(404)
.expect(/Page not found/)
.end(doEnd(done));
});
it('should 404 for unknown author', function (done) {
request.get('/author/spectacular/')
.expect('Cache-Control', testUtils.cacheRules['private'])