API: return status code 400 if filepath of raw file blob not given

2 files changed, 8 insertions, 1 deletions

diff --git a/lib/api/projects.rb b/lib/api/projects.rb
index 02f10b60cb7..24761cd5b55 100644
--- a/lib/api/projects.rb
+++ b/lib/api/projects.rb
@@ -451,6 +451,8 @@ module Gitlab
       get ":id/repository/commits/:sha/blob" do
         authorize! :download_code, user_project
 
+        error!("Filepath must be specified", 400) if !params.has_key? :filepath
+
         ref = params[:sha]
 
         commit = user_project.repository.commit ref
diff --git a/spec/requests/api/projects_spec.rb b/spec/requests/api/projects_spec.rb
index a04c2318a79..de1b1b09e5f 100644
--- a/spec/requests/api/projects_spec.rb
+++ b/spec/requests/api/projects_spec.rb
@@ -468,7 +468,7 @@ describe Gitlab::API do
     end
   end
 
-  describe "GET /projects/:id/:sha/blob" do
+  describe "GET /projects/:id/repository/commits/:sha/blob" do
     it "should get the raw file contents" do
       get api("/projects/#{project.id}/repository/commits/master/blob?filepath=README.md", user)
       response.status.should == 200
@@ -483,5 +483,10 @@ describe Gitlab::API do
       get api("/projects/#{project.id}/repository/commits/master/blob?filepath=README.invalid", user)
       response.status.should == 404
     end
+
+    it "should return a 400 error if filepath is missing" do
+      get api("/projects/#{project.id}/repository/commits/master/blob", user)
+      response.status.should == 400
+    end
   end
 end