Added sanitize to api/proposal

Carlos Purificação
1 parent 1149736b
Showing 2 changed files with 34 additions and 30 deletions Show diff stats
lib/noosfero/api/helpers.rb
lib/sanitize_params.rb
@@ -4,6 +4,8 @@
       PRIVATE_TOKEN_PARAM = :private_token
       ALLOWED_PARAMETERS = [:parent_id, :from, :until, :content_type]
+      include SanitizeParams
+
       def current_user
         private_token = (params[PRIVATE_TOKEN_PARAM] || headers['Private-Token']).to_s
         @current_user ||= User.find_by_private_token(private_token)
@@ -2,38 +2,40 @@ module SanitizeParams
   protected
-  # Check each request parameter for 
-  # improper HTML or Script tags
-  def sanitize_params
-    sanitize_params_array(request.params)    
-  end
+    # Check each request parameter for 
+    # improper HTML or Script tags
+    def sanitize_params
+      sanitize_params_hash(request.params)    
+    end
-  # Given a params list sanitize all
-  def sanitize_params_array(params)
-    params.each { |k, v|
-      if v.is_a?(String)        
-        params[k] = sanitize_param v
-      elsif v.is_a?(Array)
-        params[k] = sanitize_array v
-      end
-    }    
-  end
+    # Given a params list sanitize all
+    def sanitize_params_hash(params)
+      params.each { |k, v|
+        if v.is_a?(String)        
+          params[k] = sanitize_param v
+        elsif v.is_a?(Array)
+          params[k] = sanitize_array v
+        elsif v.kind_of?(Hash)
+          params[k] = sanitize_params_hash(v)
+        end
+      }    
+    end
-  # If the parameter was an array, 
-  # try to sanitize each element in the array
-  def sanitize_array(array)
-    array.map! { |e| 
-      if e.is_a?(String)
-        sanitize_param e
-      end
-    }
-    return array
-  end
+    # If the parameter was an array, 
+    # try to sanitize each element in the array
+    def sanitize_array(array)
+      array.map! { |e| 
+        if e.is_a?(String)
+          sanitize_param e
+        end
+      }
+      return array
+    end
-  # Santitize a single value
-  def sanitize_param(value)
-    allowed_tags = %w(a acronym b strong i em li ul ol h1 h2 h3 h4 h5 h6 blockquote br cite sub sup ins p)
-    ActionController::Base.helpers.sanitize(value, tags: allowed_tags, attributes: %w(href title))
-  end
+    # Santitize a single value
+    def sanitize_param(value)
+      allowed_tags = %w(a acronym b strong i em li ul ol h1 h2 h3 h4 h5 h6 blockquote br cite sub sup ins p)
+      ActionController::Base.helpers.sanitize(value, tags: allowed_tags, attributes: %w(href title))
+    end
 end