gunghogeoduck/osem-fcy
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Support JSONP exports of conference schedules for embedding

Browse source 
Currently, it's rather difficult to use OSEM and embed a schedule into another website. We currently use OSEM for the backend, but still use a different system for our main site. This change allows us to dynamically embed the schedule in our main website as well as allow us a simple way to get data for the use in mobile applications or similar.

This limits the JSONP support to only GETS on json formatted requests. This prevents any XSS even though we don't require a authenticity token.
This commit is contained in:
Rob Smith 2015-10-09 22:28:45 -07:00
parent eface6a91b
commit b9a2a80a75
3 changed files with 82 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

12
app/controllers/conference_controller.rb
View file

@ -1,6 +1,13 @@
class ConferenceController < ApplicationController
before_filter :respond_to_options
load_and_authorize_resource find_by: :short_title
skip_before_filter :verify_authenticity_token, if: :json_request?
def json_request?
return false if request.request_method != 'GET'
return false if !request.format.json?
true
end
def index
@current = Conference.where('end_date >= ?', Date.current).order('start_date ASC')
@ -19,6 +26,11 @@ class ConferenceController < ApplicationController
else
@today = @conference.start_date.strftime('%Y-%m-%d')
end
respond_to do |format|
format.html
format.json { render json: @conference.as_json, callback: params[:callback] }
end
end
def gallery_photos