From dec2f29c6a77dd97383ebdbabdc0bff8e524bfa4 Mon Sep 17 00:00:00 2001
From: zach <zach@controlyourself.ca>
Date: Tue, 30 Sep 2008 22:09:59 -0400
Subject: Twitter-compatible API - Added content-type checks to several
 methods. Calling an API

method with a bad content type used to return a blank page.

darcs-hash:20081001020959-462f3-83b0241ba7dc99c4e3a52148a46deb8182e005b0.gz
---
 actions/twitapiaccount.php | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'actions/twitapiaccount.php')

diff --git a/actions/twitapiaccount.php b/actions/twitapiaccount.php
index 3a9b8ba3e..5baf0e3e3 100644
--- a/actions/twitapiaccount.php
+++ b/actions/twitapiaccount.php
@@ -61,6 +61,11 @@ class TwitapiaccountAction extends TwitterapiAction {
 	function update_location($args, $apidata) {
 		parent::handle($args);
 
+		if (!in_array($apidata['content-type'], array('xml', 'json'))) {
+			common_user_error(_('API method not found!'), $code = 404);
+			exit;
+		}
+
 		if ($_SERVER['REQUEST_METHOD'] != 'POST') {
 			$this->client_error(_('This method requires a POST.'), 400, $apidata['content-type']);
 			exit();
-- 
cgit v1.2.3-54-g00ecf