Add CSRF protection to management controllers

2019-11-10 19:19:42 +01:00
parent 0e7c3b4cc0
commit 58157beb01
2 changed files with 2 additions and 0 deletions
--- a/app/controllers/management/base_controller.rb
+++ b/app/controllers/management/base_controller.rb
@@ -2,6 +2,7 @@ class Management::BaseController < ActionController::Base
  include GlobalizeFallbacks
  layout "management"
  default_form_builder ConsulFormBuilder
+  protect_from_forgery with: :exception

  before_action :verify_manager
  before_action :set_locale
--- a/app/controllers/management/sessions_controller.rb
+++ b/app/controllers/management/sessions_controller.rb
@@ -4,6 +4,7 @@ class Management::SessionsController < ActionController::Base
  include GlobalizeFallbacks
  include AccessDeniedHandler
  default_form_builder ConsulFormBuilder
+  protect_from_forgery with: :exception

  def create
    destroy_session