Strip HTML tags in API error messages (#14213)

* Strip HTML tags in API error messages

* check if root request is api request

* fix some tests

2 files changed, 4 insertions, 4 deletions

diff --git a/plugins/API/Renderer/Json.php b/plugins/API/Renderer/Json.php
index 34b82b9c8a..37427969e3 100644
--- a/plugins/API/Renderer/Json.php
+++ b/plugins/API/Renderer/Json.php
@@ -37,7 +37,7 @@ class Json extends ApiRenderer
      */
     public function renderException($message, $exception)
     {
-        $exceptionMessage = str_replace(array("\r\n", "\n"), "", $message);
+        $exceptionMessage = str_replace(array("\r\n", "\n"), " ", $message);
 
         $result = json_encode(array('result' => 'error', 'message' => $exceptionMessage));
 
diff --git a/plugins/API/tests/Unit/JsonRendererTest.php b/plugins/API/tests/Unit/JsonRendererTest.php
index d71d7068ef..388826da80 100644
--- a/plugins/API/tests/Unit/JsonRendererTest.php
+++ b/plugins/API/tests/Unit/JsonRendererTest.php
@@ -76,12 +76,12 @@ class JsonRendererTest extends \PHPUnit_Framework_TestCase
         $this->assertNoJsonError($response);
     }
 
-    public function test_renderException_shouldRemoveWhitespace()
+    public function test_renderException_shouldRemoveNewlines()
     {
         $response = $this->jsonBuilder->renderException("The\nerror\r\nmessage", new \Exception());
 
-        $this->assertEquals('{"result":"error","message":"Theerrormessage"}', $response);
-        $this->assertEquals((array) array('result' => 'error', 'message' => 'Theerrormessage'), json_decode($response, true));
+        $this->assertEquals('{"result":"error","message":"The error message"}', $response);
+        $this->assertEquals((array) array('result' => 'error', 'message' => 'The error message'), json_decode($response, true));
         $this->assertNoJsonError($response);
     }