github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-21 18:12:32 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: correct our CSRF implementation to be much more aggressive

Browse Source
This commit is contained in:
Sam
2013-07-29 15:13:13 +10:00
parent 4a20d09523
commit aa6c92922d
8 changed files with 58 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
app/controllers/session_controller.rb
View File

@ -1,10 +1,11 @@
class SessionController < ApplicationController
# we need to allow account login with bad CSRF tokens, if people are caching, the CSRF token on the
# page is going to be empty, this means that server will see an invalid CSRF and blow the session
# once that happens you can't log in with social
skip_before_filter :verify_authenticity_token, only: [:create]
skip_before_filter :redirect_to_login_if_required
def csrf
render json: {csrf: form_authenticity_token }
end
def create
params.require(:login)
params.require(:password)