Changeset 105

Show
Ignore:
Timestamp:
11/08/10 13:47:41 (2 years ago)
Author:
hlu
Message:

Change from GET to POST to prevent XSRF for all destroy and give error message is GET is used instead

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved
  • app/controllers/author_controller.rb

    r104 r105  
    66 
    77  # GETs should be safe (see http://www.w3.org/2001/tag/doc/whenToUseGet.html) 
    8   verify :method => :post, :only => [ :create, :update ], 
    9          :redirect_to => { :action => :list
     8  verify :method => :post, :only => [ :create, :update, :destroy ], 
     9         :redirect_to => { :action => :wrong
    1010 
    1111    # get all public for not logged in users and 
     
    105105    redirect_to :action => 'list' 
    106106  end 
     107 
     108  def wrong 
     109    flash[:error] = "Da ist etwas schiefgegangen." 
     110    redirect_to :action => 'list' 
     111  end 
     112 
    107113end 
  • app/controllers/category_controller.rb

    r104 r105  
    22 
    33# GETs should be safe (see http://www.w3.org/2001/tag/doc/whenToUseGet.html) 
    4 verify :method => :post, :only => [ :create, :update ], 
    5        :redirect_to => { :action => :list
     4verify :method => :post, :only => [ :create, :update, :destroy ], 
     5       :redirect_to => { :action => :wrong
    66 
    77    def index 
     
    105105    redirect_to :action => 'list' 
    106106  end 
     107 
     108  def wrong 
     109    flash[:error] = "Da ist etwas schiefgegangen." 
     110    redirect_to :action => 'list' 
     111  end 
     112 
    107113end 
  • app/controllers/quotation_controller.rb

    r104 r105  
    66 
    77  # GETs should be safe (see http://www.w3.org/2001/tag/doc/whenToUseGet.html) 
    8   verify :method => :post, :only => [ :create, :update ], 
    9          :redirect_to => { :action => :list
     8  verify :method => :post, :only => [ :create, :update, :destroy ], 
     9         :redirect_to => { :action => :wrong
    1010 
    1111    # get all public for not logged in users and 
     
    165165    redirect_to :action => 'list' 
    166166  end 
     167 
     168  def wrong 
     169    flash[:error] = "Da ist etwas schiefgegangen." 
     170    redirect_to :action => 'list' 
     171  end 
     172 
    167173end 
  • app/views/author/_list_content.rhtml

    r63 r105  
    2727                      
    2828                    <% if quotations == 0 %> 
    29                         <%= link_to image_tag("cancel.png", :alt => 'rotes Kreuz', :title => 'L&ouml;schen', :border => 0), { :action => 'destroy', :id => author }, :confirm => "Wirklich den Author \"#{author.firstname} #{author.name}\" l&ouml;schen?", :post => true %> 
     29                        <%= link_to image_tag("cancel.png", :alt => 'rotes Kreuz', :title => 'L&ouml;schen', :border => 0), { :action => 'destroy', :id => author }, :confirm => "Wirklich den Author \"#{author.firstname} #{author.name}\" l&ouml;schen?", :method => :post %> 
    3030                    <% end %> 
    3131                <% end %> 
  • app/views/category/_list_content.rhtml

    r63 r105  
    2626                &nbsp; 
    2727                <% if quotations == 0 %> 
    28                     <%= link_to image_tag("cancel.png", :alt => 'rotes Kreuz', :title => 'L&ouml;schen', :border => 0), { :action => 'destroy', :id => category }, :confirm => "Wirklich die Kategorie \"#{category.category}\" l&ouml;schen?", :post => true %> 
     28                    <%= link_to image_tag("cancel.png", :alt => 'rotes Kreuz', :title => 'L&ouml;schen', :border => 0), { :action => 'destroy', :id => category }, :confirm => "Wirklich die Kategorie \"#{category.category}\" l&ouml;schen?", :method => :post %> 
    2929                <% end %> 
    3030            <% end %> 
  • app/views/quotation/_list_content.rhtml

    r46 r105  
    2424                <%= link_to image_tag("pencil.png", :alt => 'Stift', :title => 'Bearbeiten', :border => 0), :action => 'edit', :id => quotation %> 
    2525                &nbsp; 
    26                 <%= link_to image_tag("cancel.png", :alt => 'rotes Kreuz', :title => 'L&ouml;schen', :border => 0), { :action => 'destroy', :id => quotation }, :confirm => "Wirklich das Zitat \"" + truncate(quotation.quotation, 20) + "\" l&ouml;schen?", :post => true %> 
     26                <%= link_to image_tag("cancel.png", :alt => 'rotes Kreuz', :title => 'L&ouml;schen', :border => 0), { :action => 'destroy', :id => quotation }, :confirm => "Wirklich das Zitat \"" + truncate(quotation.quotation, 20) + "\" l&ouml;schen?", :method => :post %> 
    2727        <% end %> 
    2828        </td>