github-mirror/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-05-24 03:36:18 +08:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

SECURITY: correct our CSRF implementation to be much more aggressive

Browse Source
This commit is contained in:
Sam
2013-07-29 15:13:13 +10:00
parent 4a20d09523
commit aa6c92922d
8 changed files with 58 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
app/controllers/users/omniauth_callbacks_controller.rb
View File

@ -15,7 +15,8 @@ class Users::OmniauthCallbacksController < ApplicationController
# need to be able to call this
skip_before_filter :check_xhr
# must be done, cause we may trigger a POST
# this is the only spot where we allow CSRF, our openid / oauth redirect
# will not have a CSRF token, however the payload is all validated so its safe
skip_before_filter :verify_authenticity_token, only: :complete
def complete