Discourse/discourse
Discourse/discourse
2
0
Fork 0
mirror of https://github.com/discourse/discourse.git synced 2025-09-07 12:02:53 +08:00
Code Packages Activity Actions 5

we can't trust CSRF for anon the way it is designed.

Browse source 
The page they have loaded may be cached we need a different way of delivering the CSRF potentially
This commit is contained in:
Sam 2013-05-03 16:43:11 +10:00
parent 4d2c28e8b2
commit 42494b5bb1
5 changed files with 21 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

5
app/controllers/session_controller.rb
View file

@ -1,4 +1,9 @@
class SessionController < ApplicationController
# we need to allow account login with bad CSRF tokens, if people are caching, the CSRF token on the
# page is going to be empty, this means that server will see an invalid CSRF and blow the session
# once that happens you can't log in with social
skip_before_filter :verify_authenticity_token, only: [:create]
def create
requires_parameter(:login, :password)