Escape PuSH challenge and change subscriptions and salmon APIs to text/plain

8 years ago · 2ba6537f52
parent 68931c1ee8
commit 2ba6537f52
2 changed files with 3 additions and 1 deletions
--- a/app/controllers/api/salmon_controller.rb
+++ b/app/controllers/api/salmon_controller.rb
@ -1,5 +1,6 @@
 class Api::SalmonController < ApiController
  before_action :set_account
+  respond_to :txt

  def update
    ProcessInteractionService.new.(request.body.read, @account)
--- a/app/controllers/api/subscriptions_controller.rb
+++ b/app/controllers/api/subscriptions_controller.rb
@ -1,9 +1,10 @@
 class Api::SubscriptionsController < ApiController
  before_action :set_account
+  respond_to :txt

  def show
    if @account.subscription(api_subscription_url(@account.id)).valid?(params['hub.topic'], params['hub.verify_token'])
-      render text: params['hub.challenge'], status: 200
+      render text: HTMLEntities.new.encode(params['hub.challenge']), status: 200
    else
      render nothing: true, status: 404
    end