comfy/comfortable-mexican-sofa — pull request #531 by arBmind (2014-10-01 19:58:17+00:00)
Title: JSON-API leaks ERB sourcecode

I use the erb-templating feature heavily. It allows us to control all the text on all pages and embed functionality where it is required.

If I would allow the json api for these ERB-pages. Any visitor can see the ERB code before it is executed. This code may contain internal comments, model-names, methods or even credentials for external APIs.

Normal Rich-Text only Pages do not have any of these issues. Therefore it is safe to publish them through a JSON-API.

I could live with an enable_json_api option to the config. But I think it would still be a security risk for most users.