| @@ -27,7 +27,7 module Redmine | |||||
| 27 | super |
|
27 | super | |
| 28 | callback = request.params[:callback] || request.params[:jsonp] |
|
28 | callback = request.params[:callback] || request.params[:jsonp] | |
| 29 | if callback && Setting.jsonp_enabled? |
|
29 | if callback && Setting.jsonp_enabled? | |
| 30 | self.jsonp = callback.to_s.gsub(/[^a-zA-Z0-9_]/, '') |
|
30 | self.jsonp = callback.to_s.gsub(/[^a-zA-Z0-9_.]/, '') | |
| 31 | end |
|
31 | end | |
| 32 | end |
|
32 | end | |
| 33 |
|
33 | |||
| @@ -52,11 +52,11 class Redmine::ApiTest::JsonpTest < Redmine::ApiTest::Base | |||||
| 52 |
|
52 | |||
| 53 | def test_jsonp_should_strip_invalid_characters_from_callback |
|
53 | def test_jsonp_should_strip_invalid_characters_from_callback | |
| 54 | with_settings :jsonp_enabled => '1' do |
|
54 | with_settings :jsonp_enabled => '1' do | |
| 55 | get '/trackers.json?callback=+-aA$1_' |
|
55 | get '/trackers.json?callback=+-aA$1_.' | |
| 56 | end |
|
56 | end | |
| 57 |
|
57 | |||
| 58 | assert_response :success |
|
58 | assert_response :success | |
| 59 | assert_match %r{^aA1_\(\{"trackers":.+\}\)$}, response.body |
|
59 | assert_match %r{^aA1_.\(\{"trackers":.+\}\)$}, response.body | |
| 60 | assert_equal 'application/javascript; charset=utf-8', response.headers['Content-Type'] |
|
60 | assert_equal 'application/javascript; charset=utf-8', response.headers['Content-Type'] | |
| 61 | end |
|
61 | end | |
| 62 |
|
62 | |||
General Comments 0
You need to be logged in to leave comments.
Login now