consul/nairobi
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Enable forgery protection in ActionController

Browse Source 
We were manually adding forgery protection to all our controllers, but
in Rails 5.2 there's an option (enabled by default for new applications)
which adds this protection to all controllers.
This commit is contained in:
Javi Martín
2020-09-05 17:51:56 +02:00
parent e58bd7f6f9
commit 305bf9161c
4 changed files with 1 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
app/controllers/application_controller.rb
View File

@@ -7,7 +7,6 @@ class ApplicationController < ActionController::Base
include AccessDeniedHandler include AccessDeniedHandler
default_form_builder ConsulFormBuilder default_form_builder ConsulFormBuilder
protect_from_forgery with: :exception
before_action :authenticate_http_basic, if: :http_basic_auth_site? before_action :authenticate_http_basic, if: :http_basic_auth_site?

1
app/controllers/management/base_controller.rb
View File

@@ -2,7 +2,6 @@ class Management::BaseController < ActionController::Base
include GlobalizeFallbacks include GlobalizeFallbacks
layout "management" layout "management"
default_form_builder ConsulFormBuilder default_form_builder ConsulFormBuilder
protect_from_forgery with: :exception
before_action :verify_manager before_action :verify_manager
before_action :set_locale before_action :set_locale

1
app/controllers/management/sessions_controller.rb
View File

@@ -4,7 +4,6 @@ class Management::SessionsController < ActionController::Base
include GlobalizeFallbacks include GlobalizeFallbacks
include AccessDeniedHandler include AccessDeniedHandler
default_form_builder ConsulFormBuilder default_form_builder ConsulFormBuilder
protect_from_forgery with: :exception
def create def create
destroy_session destroy_session

2
config/initializers/new_framework_defaults_5_2.rb
View File

@@ -25,7 +25,7 @@
# Add default protection from forgery to ActionController::Base instead of in # Add default protection from forgery to ActionController::Base instead of in
# ApplicationController. # ApplicationController.
# Rails.application.config.action_controller.default_protect_from_forgery = true Rails.application.config.action_controller.default_protect_from_forgery = true
# Use SHA-1 instead of MD5 to generate non-sensitive digests, such as the ETag header. # Use SHA-1 instead of MD5 to generate non-sensitive digests, such as the ETag header.
# Rails.application.config.active_support.use_sha1_digests = true # Rails.application.config.active_support.use_sha1_digests = true