midgard/tab
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Fix CSRF in form submission

Browse source
This commit is contained in:
redfast00 2019-04-10 14:14:17 +02:00
parent 51a045dae9
commit 4eb84e1c91
No known key found for this signature in database
GPG key ID: 5946E0E34FD0553C
3 changed files with 14 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
app/assets/javascripts/components/transaction_form.jsx.coffee
View file

@ -134,7 +134,7 @@ Step = React.createFactory React.createClass
e.preventDefault() e.preventDefault()
{ giving, peer } = @state { giving, peer } = @state
{ user } = @props { user, csrf_token } = @props
errors = @errors() errors = @errors()
if Object.keys(errors).length != 0 if Object.keys(errors).length != 0
@ -157,6 +157,11 @@ Step = React.createFactory React.createClass
.attr('value', creditor) .attr('value', creditor)
.attr('type', 'hidden') .attr('type', 'hidden')
.appendTo(@refs.form) .appendTo(@refs.form)
$('<input />')
.attr('name', 'authenticity_token')
.attr('value', csrf_token)
.attr('type', 'hidden')
.appendTo(@refs.form)
@refs.form.submit() @refs.form.submit()
errors: -> errors: ->

12
app/controllers/transactions_controller.rb
View file

@ -1,10 +1,12 @@
class TransactionsController < ApplicationController class TransactionsController < ApplicationController
skip_before_action :verify_authenticity_token, only: :create load_and_authorize_resource :user, find_by: :name
before_action :authenticate_user!, except: :create def index
before_action :authenticate_user_or_client!, only: :create @transactions = @user.transactions
respond_to do |format|
respond_to :js, only: :create format.json { render json: @transactions }
end
end
def create def create
@transaction = Transaction.new(transaction_params) @transaction = Transaction.new(transaction_params)

2
app/views/pages/_transaction_form.html.haml
View file

@ -1,3 +1,3 @@
.card-wrapper .card-wrapper
.card.padded .card.padded
= react_component 'TransactionForm', user: current_user, peers: User.all.order(:name).pluck(:name) = react_component 'TransactionForm', user: current_user, peers: User.all.order(:name).pluck(:name), csrf_token: form_authenticity_token