Note which verbs are allowed when there are multiple verbs.
Darren Cauthon
2 changed files with 9 additions and 1 deletions
+ 1
- 1
app/models/agents/webhook_agent.rb
@@ -40,7 +40,7 @@ module Agents |
||
| 40 | 40 |
def receive_web_request(params, method, format) |
| 41 | 41 |
secret = params.delete('secret')
|
| 42 | 42 |
verbs = (options['verbs'] ? options['verbs'] : 'post').split(';')
|
| 43 |
- return ["Please use #{verbs.first.upcase} requests only", 401] unless verbs.include?(method)
|
|
| 43 |
+ return ["Please use #{verbs.join('/').upcase} requests only", 401] unless verbs.include?(method)
|
|
| 44 | 44 |
return ["Not Authorized", 401] unless secret == interpolated['secret'] |
| 45 | 45 |
|
| 46 | 46 |
[payload_for(params)].flatten.each do |payload| |
+ 8
- 0
spec/models/agents/webhook_agent_spec.rb
@@ -80,6 +80,14 @@ describe Agents::WebhookAgent do |
||
| 80 | 80 |
expect(out).to eq(['Event Created', 201]) |
| 81 | 81 |
end |
| 82 | 82 |
|
| 83 |
+ it "should not accept PUT" do |
|
| 84 |
+ out = nil |
|
| 85 |
+ expect {
|
|
| 86 |
+ out = agent.receive_web_request({ 'secret' => 'foobar', 'some_key' => payload }, "put", "text/html")
|
|
| 87 |
+ }.to change { Event.count }.by(0)
|
|
| 88 |
+ expect(out).to eq(['Please use GET/POST requests only', 401]) |
|
| 89 |
+ end |
|
| 90 |
+ |
|
| 83 | 91 |
end |
| 84 | 92 |
|
| 85 | 93 |
context "accepting only get" do |