Merge pull request #5919 from avalonmediasystem/sup_api_response

Fail SupplementalFile Binary update if no Accept header
avalonmediasystem · Jul 10, 2024 · da00ee6 · da00ee6
2 parents b37b981 + aaf3d4f
commit da00ee6
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 0 deletions.
diff --git a/app/controllers/supplemental_files_controller.rb b/app/controllers/supplemental_files_controller.rb
@@ -100,6 +100,7 @@ def update
       raise Avalon::BadRequest, "Missing required Content-type headers" unless request.headers["Content-Type"] == 'application/json'
     elsif request.headers['Avalon-Api-Key'].present?
       raise Avalon::BadRequest, "Incorrect request format. Use JSON if updating metadata." unless attachment
+      raise Avalon::BadRequest, "Missing required Accept headers" unless request.headers["Accept"] == 'application/json'
     end
     raise Avalon::BadRequest, "Missing required parameters" unless validate_params
 

diff --git a/spec/support/supplemental_files_controller_examples.rb b/spec/support/supplemental_files_controller_examples.rb
@@ -527,6 +527,14 @@
           expect(response).to have_http_status(:ok)
           expect(response.body).to eq({ "id": supplemental_file.id }.to_json)
         end
+
+        context "without Accept header" do
+          it "returns a 400" do
+            request.headers['Avalon-Api-Key'] = 'secret_token'
+            put :update, params: { class_id => object.id, id: supplemental_file.id, file: file_update, format: :html }, session: valid_session
+            expect(response).to have_http_status(400)
+          end
+        end
       end
 
       context "API without file" do