htwkmooc/codeocean
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update CSRF chain to prepend checks and resolve comments from PR

Browse Source 
Signed-off-by: Sebastian Serth <Sebastian.Serth@student.hpi.de>
This commit is contained in:
Sebastian Serth
2018-09-24 16:27:13 +02:00
parent 4809f7bc03
commit a77a006e8d
3 changed files with 3 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app/controllers/application_controller.rb
View File

@@ -6,7 +6,7 @@ class ApplicationController < ActionController::Base
after_action :verify_authorized, except: [:help, :welcome]
before_action :set_locale, :allow_iframe_requests
protect_from_forgery(with: :exception)
protect_from_forgery(with: :exception, prepend: true)
rescue_from Pundit::NotAuthorizedError, with: :render_not_authorized
def current_user

2
app/helpers/lti_helper.rb
View File

@@ -1,4 +1,4 @@
require 'oauth/request_proxy/action_controller_request'
require 'oauth/request_proxy/action_controller_request' # Rails 5 changed `Rack::Request` to `ActionDispatch::Request`
module LtiHelper
def lti_outcome_service?(exercise_id, external_user_id, consumer_id)