gunghogeoduck/osem-fcy
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Remote forgery protection for json requests to the api/v1 endpoints

Browse source 
Due to my testing, I incorrectly removed the forgery protection
skip action from the controllers in the api. This fixes that and allows jsonp
calls to work correctly
This commit is contained in:
Rob Smith 2016-09-15 20:33:44 -07:00
parent 70e0f42bbb
commit de4563ddb1
5 changed files with 15 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
app/controllers/api/v1/conferences_controller.rb
View file

@ -4,6 +4,9 @@ module Api
load_resource find_by: :short_title load_resource find_by: :short_title
respond_to :json respond_to :json
# Disable forgery protection for any json requests. This is required for jsonp support
skip_before_action :verify_authenticity_token
def index def index
render json: @conferences, serializer: ConferencesArraySerializer, callback: params['callback'] render json: @conferences, serializer: ConferencesArraySerializer, callback: params['callback']
end end

3
app/controllers/api/v1/events_controller.rb
View file

@ -4,6 +4,9 @@ module Api
load_resource :conference, find_by: :short_title load_resource :conference, find_by: :short_title
respond_to :json respond_to :json
# Disable forgery protection for any json requests. This is required for jsonp support
skip_before_action :verify_authenticity_token
def index def index
events = Event.includes(:track, :event_type, event_users: :user) events = Event.includes(:track, :event_type, event_users: :user)

3
app/controllers/api/v1/rooms_controller.rb
View file

@ -4,6 +4,9 @@ module Api
load_resource :conference, find_by: :short_title load_resource :conference, find_by: :short_title
respond_to :json respond_to :json
# Disable forgery protection for any json requests. This is required for jsonp support
skip_before_action :verify_authenticity_token
def index def index
if @conference if @conference
respond_with @conference.venue ? @conference.venue.rooms : Room.none, callback: params[:callback] respond_with @conference.venue ? @conference.venue.rooms : Room.none, callback: params[:callback]

3
app/controllers/api/v1/speakers_controller.rb
View file

@ -4,6 +4,9 @@ module Api
load_resource :conference, find_by: :short_title load_resource :conference, find_by: :short_title
respond_to :json respond_to :json
# Disable forgery protection for any json requests. This is required for jsonp support
skip_before_action :verify_authenticity_token
def index def index
if @conference if @conference
users = User.joins(event_users: { event: { program: :conference} }) users = User.joins(event_users: { event: { program: :conference} })

3
app/controllers/api/v1/tracks_controller.rb
View file

@ -4,6 +4,9 @@ module Api
load_resource :conference, find_by: :short_title load_resource :conference, find_by: :short_title
respond_to :json respond_to :json
# Disable forgery protection for any json requests. This is required for jsonp support
skip_before_action :verify_authenticity_token
def index def index
tracks = @conference ? @conference.program.tracks : Track.all tracks = @conference ? @conference.program.tracks : Track.all