From 84b25e3a5401aa0bd8c70a0bb709e95bb234d834 Mon Sep 17 00:00:00 2001 From: Henne Vogelsang Date: Fri, 24 May 2019 14:07:39 +0200 Subject: [PATCH 1/2] Remove protect_from_forgery This is handled in ApplicationController --- app/controllers/schedules_controller.rb | 1 - 1 file changed, 1 deletion(-) diff --git a/app/controllers/schedules_controller.rb b/app/controllers/schedules_controller.rb index 677feff0..14c8888b 100644 --- a/app/controllers/schedules_controller.rb +++ b/app/controllers/schedules_controller.rb @@ -2,7 +2,6 @@ class SchedulesController < ApplicationController load_and_authorize_resource - protect_from_forgery with: :null_session before_action :respond_to_options load_resource :conference, find_by: :short_title load_resource :program, through: :conference, singleton: true, except: :index From 7338bc264850262911ce4cf9cbd01ba887a43cd6 Mon Sep 17 00:00:00 2001 From: Henne Vogelsang Date: Fri, 24 May 2019 14:08:23 +0200 Subject: [PATCH 2/2] Skip CSRF authenticity The way we are handling adding commercials (preload with javascript) leads to an outdated token otherwise. --- app/controllers/commercials_controller.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/app/controllers/commercials_controller.rb b/app/controllers/commercials_controller.rb index 1967d0d1..aa48a406 100644 --- a/app/controllers/commercials_controller.rb +++ b/app/controllers/commercials_controller.rb @@ -4,6 +4,7 @@ class CommercialsController < ApplicationController load_resource :conference, find_by: :short_title before_action :set_event load_and_authorize_resource through: :event + skip_before_action :verify_authenticity_token def create @commercial = @event.commercials.build(commercial_params)