search

evendis / mandrill-rails

Webhook processing and event decoration to make using Mandrill with Rails just that much easier
MIT License
288 stars 36 forks source link

Help Avoid Authentication Errors from Extraneous Controller Params #11

Closed zmoshansky closed 10 years ago

zmoshansky commented 10 years ago

I want to lead with thanks for this Gem!

I noticed while working on a project that the Webhook Processor fails to generate the correct signature if there are additional controller params. This was caused by a default 'format' tag inherited in my routes file (<-Totally my bad, but not easy to track down). Is it worthwhile to add format to { 'actions', 'controller' } to avoid this issue or simply whitelist the known good params from mandrill?

tardate commented 10 years ago

@zmoshansky .. thanks, happy it's helping!

Ahah, you mean in generate_signature where it does this?

 params.except(:action, :controller).keys.sort.each ...

Yes, definitely a good fix.

zmoshansky commented 10 years ago

yes, exactly :+1:

aliang commented 10 years ago

Would the correct way to do this be to use request.request_parameters instead? It should give you the raw POST data, unlike params which is the hash after some parsing, etc. has occurred.

If so, I can whip up a quick pull request.

mguillemot commented 10 years ago

Same problem here, with a subdomain param added in my routes file. I definitely second the suggestion to use request.request_parameters.

tardate commented 10 years ago

:beer: everyone - I pulled @gspiers fix into the 1.0.2 release