Attempt to avoid polynomial time matches on user supplied data

[rails.git] / app / controllers / api / nodes_controller.rb

diff --git a/app/controllers/api/nodes_controller.rb b/app/controllers/api/nodes_controller.rb
index 336aebc915793f05f4f7429214cb6ba74b169eb5..62eb76505b6228f4c6530476024e7c8afbdae397 100644 (file)
--- a/app/controllers/api/nodes_controller.rb
+++ b/app/controllers/api/nodes_controller.rb
@@ -13,13 +13,13 @@ module Api
     before_action :check_api_readable, :except => [:create, :update, :delete]
     around_action :api_call_handle_error, :api_call_timeout
 
-    before_action :set_default_request_format, :except => [:create, :update, :delete]
+    before_action :set_request_formats, :except => [:create, :update, :delete]
 
     # Create a node from XML.
     def create
       assert_method :put
 
-      node = Node.from_xml(request.raw_post, true)
+      node = Node.from_xml(request.raw_post, :create => true)
 
       # Assume that Node.from_xml has thrown an exception if there is an error parsing the xml
       node.create_with_history current_user