diff --git a/app/controllers/docs/docs_controller.rb b/app/controllers/docs/docs_controller.rb index be42595..744d689 100644 --- a/app/controllers/docs/docs_controller.rb +++ b/app/controllers/docs/docs_controller.rb @@ -7,6 +7,10 @@ module Docs skip_before_action :check_xhr, only: [:index] def index + if params[:tags].is_a?(Array) || params[:tags].is_a?(ActionController::Parameters) + raise Discourse::InvalidParameters.new("Only strings are accepted for tag lists") + end + filters = { topic: params[:topic], tags: params[:tags], diff --git a/spec/requests/docs_controller_spec.rb b/spec/requests/docs_controller_spec.rb index 83a4ff9..71f003c 100644 --- a/spec/requests/docs_controller_spec.rb +++ b/spec/requests/docs_controller_spec.rb @@ -106,6 +106,18 @@ describe Docs::DocsController do expect(topics.size).to eq(1) end + it "should not error out when tags is an array" do + get "/#{GlobalSetting.docs_path}.json?tags[]=test" + + expect(response.status).to eq(400) + end + + it "should not error out when tags is a nested parameter" do + get "/#{GlobalSetting.docs_path}.json?tags[foo]=test" + + expect(response.status).to eq(400) + end + context "when show_tags_by_group is enabled" do fab!(:tag4) { Fabricate(:tag, topics: [topic], name: "test4") }