X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/d1a29bade4facd38e67c22ee58a02bfdba742ab7..da546af22e724f81f441417aaff11b24e6051267:/test/controllers/api/nodes_controller_test.rb

diff --git a/test/controllers/api/nodes_controller_test.rb b/test/controllers/api/nodes_controller_test.rb
index 645408dd4..b085dee9d 100644
--- a/test/controllers/api/nodes_controller_test.rb
+++ b/test/controllers/api/nodes_controller_test.rb
@@ -527,7 +527,7 @@ module Api
       # try and put something into a string that the API might
       # use unquoted and therefore allow code injection...
       xml = "<osm><node lat='0' lon='0' changeset='#{private_changeset.id}'>" \
-            '<tag k="#{@user.inspect}" v="0"/>' \
+            "<tag k='\#{@user.inspect}' v='0'/>" \
             "</node></osm>"
       put node_create_path, :params => xml, :headers => auth_header
       assert_require_public_data "Shouldn't be able to create with non-public user"
@@ -538,7 +538,7 @@ module Api
       # try and put something into a string that the API might
       # use unquoted and therefore allow code injection...
       xml = "<osm><node lat='0' lon='0' changeset='#{changeset.id}'>" \
-            '<tag k="#{@user.inspect}" v="0"/>' \
+            "<tag k='\#{@user.inspect}' v='0'/>" \
             "</node></osm>"
       put node_create_path, :params => xml, :headers => auth_header
       assert_response :success
@@ -559,6 +559,8 @@ module Api
       assert_includes apinode.tags, "\#{@user.inspect}"
     end
 
+    private
+
     ##
     # update the changeset_id of a node element
     def update_changeset(xml, changeset_id)