From 70e0f42bbb6c396afa4d13b41dc3a29ba3451084 Mon Sep 17 00:00:00 2001 From: Rob Smith Date: Sun, 11 Sep 2016 22:27:30 -0700 Subject: [PATCH 1/2] Support JSONP callbacks for the API/v1 endpoints SeaGL currently uses OSEM as a backend, but still has a static website serving as our public interface. The API endpoints have a great amount of data, but without the jsonp callback paramater, embedding the data is a bit difficult. This change just adds the jsonp callback param to all the API endpoints. This should be a NOOP for anyone using direct json calls, but will allow cross domain requests that require jsonp. --- app/controllers/api/v1/conferences_controller.rb | 4 ++-- app/controllers/api/v1/events_controller.rb | 2 +- app/controllers/api/v1/rooms_controller.rb | 4 ++-- app/controllers/api/v1/speakers_controller.rb | 2 +- app/controllers/api/v1/tracks_controller.rb | 2 +- 5 files changed, 7 insertions(+), 7 deletions(-) diff --git a/app/controllers/api/v1/conferences_controller.rb b/app/controllers/api/v1/conferences_controller.rb index e37c6d55..1fddf1b4 100644 --- a/app/controllers/api/v1/conferences_controller.rb +++ b/app/controllers/api/v1/conferences_controller.rb @@ -5,11 +5,11 @@ module Api respond_to :json def index - render json: @conferences, serializer: ConferencesArraySerializer + render json: @conferences, serializer: ConferencesArraySerializer, callback: params['callback'] end def show - render json: [@conference], serializer: ConferencesArraySerializer + render json: [@conference], serializer: ConferencesArraySerializer, callback: params['callback'] end end end diff --git a/app/controllers/api/v1/events_controller.rb b/app/controllers/api/v1/events_controller.rb index eb77cd4f..20578dd8 100644 --- a/app/controllers/api/v1/events_controller.rb +++ b/app/controllers/api/v1/events_controller.rb @@ -11,7 +11,7 @@ module Api events = events.where(program: @conference.program) end - respond_with events.confirmed + respond_with events.confirmed, callback: params[:callback] end end end diff --git a/app/controllers/api/v1/rooms_controller.rb b/app/controllers/api/v1/rooms_controller.rb index fe70fcfe..3046d51f 100644 --- a/app/controllers/api/v1/rooms_controller.rb +++ b/app/controllers/api/v1/rooms_controller.rb @@ -6,9 +6,9 @@ module Api def index if @conference - respond_with @conference.venue ? @conference.venue.rooms : Room.none + respond_with @conference.venue ? @conference.venue.rooms : Room.none, callback: params[:callback] else - respond_with Room.all + respond_with Room.all, callback: params[:callback] end end end diff --git a/app/controllers/api/v1/speakers_controller.rb b/app/controllers/api/v1/speakers_controller.rb index b0eb9cf6..cbdb4379 100644 --- a/app/controllers/api/v1/speakers_controller.rb +++ b/app/controllers/api/v1/speakers_controller.rb @@ -13,7 +13,7 @@ module Api end users = users.where(event_users: {event_role: :speaker}).uniq - render json: users, each_serializer: SpeakerSerializer + render json: users, each_serializer: SpeakerSerializer, callback: params['callback'] end end end diff --git a/app/controllers/api/v1/tracks_controller.rb b/app/controllers/api/v1/tracks_controller.rb index 879713cf..a2033867 100644 --- a/app/controllers/api/v1/tracks_controller.rb +++ b/app/controllers/api/v1/tracks_controller.rb @@ -7,7 +7,7 @@ module Api def index tracks = @conference ? @conference.program.tracks : Track.all - respond_with tracks + respond_with tracks, callback: params[:callback] end end end From de4563ddb1a2ef95e58de2eaae4b102ac8275de4 Mon Sep 17 00:00:00 2001 From: Rob Smith Date: Thu, 15 Sep 2016 20:33:44 -0700 Subject: [PATCH 2/2] Remote forgery protection for json requests to the api/v1 endpoints Due to my testing, I incorrectly removed the forgery protection skip action from the controllers in the api. This fixes that and allows jsonp calls to work correctly --- app/controllers/api/v1/conferences_controller.rb | 3 +++ app/controllers/api/v1/events_controller.rb | 3 +++ app/controllers/api/v1/rooms_controller.rb | 3 +++ app/controllers/api/v1/speakers_controller.rb | 3 +++ app/controllers/api/v1/tracks_controller.rb | 3 +++ 5 files changed, 15 insertions(+) diff --git a/app/controllers/api/v1/conferences_controller.rb b/app/controllers/api/v1/conferences_controller.rb index 1fddf1b4..60578587 100644 --- a/app/controllers/api/v1/conferences_controller.rb +++ b/app/controllers/api/v1/conferences_controller.rb @@ -4,6 +4,9 @@ module Api load_resource find_by: :short_title respond_to :json + # Disable forgery protection for any json requests. This is required for jsonp support + skip_before_action :verify_authenticity_token + def index render json: @conferences, serializer: ConferencesArraySerializer, callback: params['callback'] end diff --git a/app/controllers/api/v1/events_controller.rb b/app/controllers/api/v1/events_controller.rb index 20578dd8..1cb01ad9 100644 --- a/app/controllers/api/v1/events_controller.rb +++ b/app/controllers/api/v1/events_controller.rb @@ -4,6 +4,9 @@ module Api load_resource :conference, find_by: :short_title respond_to :json + # Disable forgery protection for any json requests. This is required for jsonp support + skip_before_action :verify_authenticity_token + def index events = Event.includes(:track, :event_type, event_users: :user) diff --git a/app/controllers/api/v1/rooms_controller.rb b/app/controllers/api/v1/rooms_controller.rb index 3046d51f..ecc959fa 100644 --- a/app/controllers/api/v1/rooms_controller.rb +++ b/app/controllers/api/v1/rooms_controller.rb @@ -4,6 +4,9 @@ module Api load_resource :conference, find_by: :short_title respond_to :json + # Disable forgery protection for any json requests. This is required for jsonp support + skip_before_action :verify_authenticity_token + def index if @conference respond_with @conference.venue ? @conference.venue.rooms : Room.none, callback: params[:callback] diff --git a/app/controllers/api/v1/speakers_controller.rb b/app/controllers/api/v1/speakers_controller.rb index cbdb4379..2706d2e9 100644 --- a/app/controllers/api/v1/speakers_controller.rb +++ b/app/controllers/api/v1/speakers_controller.rb @@ -4,6 +4,9 @@ module Api load_resource :conference, find_by: :short_title respond_to :json + # Disable forgery protection for any json requests. This is required for jsonp support + skip_before_action :verify_authenticity_token + def index if @conference users = User.joins(event_users: { event: { program: :conference} }) diff --git a/app/controllers/api/v1/tracks_controller.rb b/app/controllers/api/v1/tracks_controller.rb index a2033867..48a9450f 100644 --- a/app/controllers/api/v1/tracks_controller.rb +++ b/app/controllers/api/v1/tracks_controller.rb @@ -4,6 +4,9 @@ module Api load_resource :conference, find_by: :short_title respond_to :json + # Disable forgery protection for any json requests. This is required for jsonp support + skip_before_action :verify_authenticity_token + def index tracks = @conference ? @conference.program.tracks : Track.all