github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-22 04:01:18 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: correct our CSRF implementation to be much more aggressive

Browse Source
This commit is contained in:
Sam
2013-07-29 15:13:13 +10:00
parent 4a20d09523
commit aa6c92922d
8 changed files with 58 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
app/controllers/application_controller.rb
View File

@ -14,6 +14,18 @@ class ApplicationController < ActionController::Base
protect_from_forgery
# Default Rails 3.2 lets the request through with a blank session
# we are being more pedantic here and nulling session / current_user
# and then raising a CSRF exception
def handle_unverified_request
# NOTE: API key is secret, having it invalidates the need for a CSRF token
unless is_api?
super
clear_current_user
raise Discourse::CSRF
end
end
before_filter :inject_preview_style
before_filter :block_if_maintenance_mode
before_filter :authorize_mini_profiler