Move readinglist trigger JS (#67)

* Remove verify_auth_token skips

* Move readinglist trigger JS

* Remove unneeded logs and add check for referer in cromulent

app/assets/javascripts/initializers/initializeReadingListPage.js.erb

@@ -7,10 +7,10 @@ function initializeReadingListPage(){
     document.getElementById('substories').dataset.tabs = '{"v": "'+(params.v || '')+'", "t": "'+(params.t || '')+'" }'
     postCommentFilter();
     getArticles("***onlytags***");
-  }
-  document.getElementById("load-more-cta").onclick = function(event) {
-    event.target.classList.remove("showing");
-    getArticles("");
+    document.getElementById("load-more-cta").onclick = function(event) {
+      event.target.classList.remove("showing");
+      getArticles("");
+    }
   }
 }
 

app/controllers/application_controller.rb

@@ -73,27 +73,6 @@ class ApplicationController < ActionController::Base
     request.referer.start_with?(ENV["APP_PROTOCOL"].to_s + ENV["APP_DOMAIN"].to_s)
   end
 
-  def csrf_logger_info(action)
-    sent_via_ajax = request.headers["X-CSRF-token"] ? true : false
-    logger_data = {
-      action: action,
-      sent_via_ajax: sent_via_ajax,
-      csrf_token: request.x_csrf_token,
-      form_token: form_authenticity_param,
-      any_authenticity_token_valid: any_authenticity_token_valid?,
-      valid_request_origin: valid_request_origin?,
-      valid_authenticity_token_form_token: valid_authenticity_token?(session, form_authenticity_param),
-      valid_authenticity_token_header_token: valid_authenticity_token?(session, request.x_csrf_token),
-      request_authenticity_tokens: request_authenticity_tokens,
-      current_user_id: current_user&.id,
-    }
-    logger.info "** SESSION STATE RIGHT NOW [#{current_user&.id}] #{session.to_hash} **"
-    logger.info "** SESSION STATE RIGHT NOW :: Any valid token? #{any_authenticity_token_valid?} **"
-    logger.info "** SESSION STATE RIGHT NOW --------------- **"
-    logger.info "**CSRF CHECK** Any valid token? #{any_authenticity_token_valid?}"
-    logger.info "Skipped unverified request", planned_unverified_request: logger_data
-  end
-  
   def set_no_cache_header
     response.headers["Cache-Control"] = "no-cache, no-store"
     response.headers["Pragma"] = "no-cache"

app/controllers/articles_controller.rb

@@ -53,7 +53,6 @@ class ArticlesController < ApplicationController
   end
 
   def preview
-    csrf_logger_info("article preview")
     begin
       fixed_body_markdown = MarkdownFixer.fix_for_preview(params[:article_body])
       parsed = FrontMatterParser::Parser.new(:md).call(fixed_body_markdown)

app/controllers/comments_controller.rb

@@ -51,7 +51,6 @@ class CommentsController < ApplicationController
   # POST /comments
   # POST /comments.json
   def create
-    csrf_logger_info("comment creation")
     unless current_user
       redirect_to "/"
       return

app/controllers/ga_events_controller.rb

@@ -1,10 +1,10 @@
 class GaEventsController < ApplicationController
   skip_before_action :verify_authenticity_token
   def create
-    # unless valid_request_origin?
-    #   render body: nil
-    #   return
-    # end
+    unless valid_request_origin?
+      render body: nil
+      return
+    end
     json = JSON.parse(request.raw_post)
     user_id = user_signed_in? ? current_user.id : nil
     client_id = "#{ip[0..12]}_#{json['user_agent']}_#{user_id}"

app/controllers/image_uploads_controller.rb

@@ -3,7 +3,6 @@ class ImageUploadsController < ApplicationController
   skip_before_action :verify_authenticity_token
 
   def create
-    csrf_logger_info("image upload")
     uploader = ArticleImageUploader.new
     uploader.store!(params[:image])
     link = uploader.url

app/controllers/internal/broadcasts_controller.rb

@@ -1,6 +1,5 @@
 class Internal::BroadcastsController < Internal::ApplicationController
   layout "internal"
-  skip_before_action :verify_authenticity_token
 
   def create
     @broadcast = Broadcast.new(broadcast_params)

app/controllers/internal/comments_controller.rb

@@ -1,6 +1,5 @@
 class Internal::CommentsController < Internal::ApplicationController
   layout 'internal'
-  skip_before_action :verify_authenticity_token
 
   def index
     if params[:state]&.start_with?("toplast-")

app/controllers/internal/tags_controller.rb

@@ -1,6 +1,5 @@
 class Internal::TagsController < Internal::ApplicationController
   layout 'internal'
-  skip_before_action :verify_authenticity_token
 
   def index
     if params[:state] == "supported"

app/controllers/reactions_controller.rb

@@ -61,7 +61,6 @@ class ReactionsController < ApplicationController
   end
 
   def create
-    csrf_logger_info("reaction creation")
     Rails.cache.delete "count_for_reactable-#{params[:reactable_type]}-#{params[:reactable_id]}"
     reaction = Reaction.where(
       user_id: current_user.id,