Discource-C
/
discourse
mirror of https://github.com/discourse/discourse.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

FIX: BAD CSRF on login. Don't check csrf in the fake login form since it doesn't actually do anything.

This commit is contained in:
Neil Lalonde 2013-08-27 11:30:58 -04:00
parent 07328e5e4b
commit 89265c3a8b
3 changed files with 1 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
app/assets/javascripts/discourse/controllers/login_controller.js
View File

@ -56,7 +56,6 @@ Discourse.LoginController = Discourse.Controller.extend(Discourse.ModalFunctiona
$hidden_login_form.find('input[name=username]').val(loginController.get('loginName')); $hidden_login_form.find('input[name=username]').val(loginController.get('loginName'));
$hidden_login_form.find('input[name=password]').val(loginController.get('loginPassword')); $hidden_login_form.find('input[name=password]').val(loginController.get('loginPassword'));
$hidden_login_form.find('input[name=redirect]').val(window.location.href); $hidden_login_form.find('input[name=redirect]').val(window.location.href);
$hidden_login_form.find('input[name=authenticity_token]').val($('meta[name=csrf-token]').attr('content'));
$hidden_login_form.submit(); $hidden_login_form.submit();
} }

1
app/controllers/static_controller.rb
View File

@ -1,6 +1,7 @@
class StaticController < ApplicationController class StaticController < ApplicationController
skip_before_filter :check_xhr, :redirect_to_login_if_required skip_before_filter :check_xhr, :redirect_to_login_if_required
skip_before_filter :verify_authenticity_token, only: [:enter]
def show def show

1
app/views/layouts/application.html.erb
View File

@ -51,7 +51,6 @@
<input name="username" type="text" id="signin_username"> <input name="username" type="text" id="signin_username">
<input name="password" type="password" id="signin_password"> <input name="password" type="password" id="signin_password">
<input name="redirect" type="hidden"> <input name="redirect" type="hidden">
<input name="authenticity_token" type="hidden" />
<input type="submit" id="signin-button" value="Log In"> <input type="submit" id="signin-button" value="Log In">
</form> </form>
<% end %> <% end %>