kolan
/
Redmine
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Code cleanup: unverified request no longer raises a InvalidAuthenticityToken exception. 

git-svn-id: http://svn.redmine.org/redmine/trunk@12267 e93f8b46-1217-0410-a6f0-8f06a7374b81
This commit is contained in:
Jean-Philippe Lang 2013-11-11 20:59:17 +00:00
parent 81d6952587
commit 0569005759
2 changed files with 13 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
app/controllers/application_controller.rb
View File

@ -36,11 +36,14 @@ class ApplicationController < ActionController::Base
def handle_unverified_request def handle_unverified_request
super super
cookies.delete(autologin_cookie_name) cookies.delete(autologin_cookie_name)
if api_request?
logger.error "API calls must include a proper Content-type header (application/xml or application/json)."
end
render_error :status => 422, :message => "Invalid form authenticity token."
end end
before_filter :session_expiration, :user_setup, :check_if_login_required, :check_password_change, :set_localization before_filter :session_expiration, :user_setup, :check_if_login_required, :check_password_change, :set_localization
rescue_from ActionController::InvalidAuthenticityToken, :with => :invalid_authenticity_token
rescue_from ::Unauthorized, :with => :deny_access rescue_from ::Unauthorized, :with => :deny_access
rescue_from ::ActionView::MissingTemplate, :with => :missing_template rescue_from ::ActionView::MissingTemplate, :with => :missing_template
@ -450,13 +453,6 @@ class ApplicationController < ActionController::Base
request.xhr? ? false : 'base' request.xhr? ? false : 'base'
end end
def invalid_authenticity_token
if api_request?
logger.error "Form authenticity token is missing or is invalid. API calls must include a proper Content-type header (text/xml or text/json)."
end
render_error "Invalid form authenticity token."
end
def render_feed(items, options={}) def render_feed(items, options={})
@items = items || [] @items = items || []
@items.sort! {|x,y| y.event_datetime <=> x.event_datetime } @items.sort! {|x,y| y.event_datetime <=> x.event_datetime }

9
test/integration/application_test.rb
View File

@ -67,4 +67,13 @@ class ApplicationTest < ActionController::IntegrationTest
get '/login.png' get '/login.png'
assert_response 404 assert_response 404
end end
def test_invalid_token_should_call_custom_handler
ActionController::Base.allow_forgery_protection = true
post '/issues'
assert_response 422
assert_include "Invalid form authenticity token.", response.body
ensure
ActionController::Base.allow_forgery_protection = false
end
end end