From 9381a17cf2728e642019cf66457bbed90b51d38b Mon Sep 17 00:00:00 2001 From: Ben Halpern Date: Fri, 9 Mar 2018 21:44:07 -0800 Subject: [PATCH] Move readinglist trigger JS (#67) * Remove verify_auth_token skips * Move readinglist trigger JS * Remove unneeded logs and add check for referer in cromulent --- .../initializeReadingListPage.js.erb | 8 +++---- app/controllers/application_controller.rb | 21 ------------------- app/controllers/articles_controller.rb | 1 - app/controllers/comments_controller.rb | 1 - app/controllers/ga_events_controller.rb | 8 +++---- app/controllers/image_uploads_controller.rb | 1 - .../internal/broadcasts_controller.rb | 1 - .../internal/comments_controller.rb | 1 - app/controllers/internal/tags_controller.rb | 1 - app/controllers/reactions_controller.rb | 1 - 10 files changed, 8 insertions(+), 36 deletions(-) diff --git a/app/assets/javascripts/initializers/initializeReadingListPage.js.erb b/app/assets/javascripts/initializers/initializeReadingListPage.js.erb index 9f03d43c3..31469de14 100644 --- a/app/assets/javascripts/initializers/initializeReadingListPage.js.erb +++ b/app/assets/javascripts/initializers/initializeReadingListPage.js.erb @@ -7,10 +7,10 @@ function initializeReadingListPage(){ document.getElementById('substories').dataset.tabs = '{"v": "'+(params.v || '')+'", "t": "'+(params.t || '')+'" }' postCommentFilter(); getArticles("***onlytags***"); - } - document.getElementById("load-more-cta").onclick = function(event) { - event.target.classList.remove("showing"); - getArticles(""); + document.getElementById("load-more-cta").onclick = function(event) { + event.target.classList.remove("showing"); + getArticles(""); + } } } diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index 4897c6958..6b60dccaa 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -73,27 +73,6 @@ class ApplicationController < ActionController::Base request.referer.start_with?(ENV["APP_PROTOCOL"].to_s + ENV["APP_DOMAIN"].to_s) end - def csrf_logger_info(action) - sent_via_ajax = request.headers["X-CSRF-token"] ? true : false - logger_data = { - action: action, - sent_via_ajax: sent_via_ajax, - csrf_token: request.x_csrf_token, - form_token: form_authenticity_param, - any_authenticity_token_valid: any_authenticity_token_valid?, - valid_request_origin: valid_request_origin?, - valid_authenticity_token_form_token: valid_authenticity_token?(session, form_authenticity_param), - valid_authenticity_token_header_token: valid_authenticity_token?(session, request.x_csrf_token), - request_authenticity_tokens: request_authenticity_tokens, - current_user_id: current_user&.id, - } - logger.info "** SESSION STATE RIGHT NOW [#{current_user&.id}] #{session.to_hash} **" - logger.info "** SESSION STATE RIGHT NOW :: Any valid token? #{any_authenticity_token_valid?} **" - logger.info "** SESSION STATE RIGHT NOW --------------- **" - logger.info "**CSRF CHECK** Any valid token? #{any_authenticity_token_valid?}" - logger.info "Skipped unverified request", planned_unverified_request: logger_data - end - def set_no_cache_header response.headers["Cache-Control"] = "no-cache, no-store" response.headers["Pragma"] = "no-cache" diff --git a/app/controllers/articles_controller.rb b/app/controllers/articles_controller.rb index c697b9bbd..caf9a5f53 100644 --- a/app/controllers/articles_controller.rb +++ b/app/controllers/articles_controller.rb @@ -53,7 +53,6 @@ class ArticlesController < ApplicationController end def preview - csrf_logger_info("article preview") begin fixed_body_markdown = MarkdownFixer.fix_for_preview(params[:article_body]) parsed = FrontMatterParser::Parser.new(:md).call(fixed_body_markdown) diff --git a/app/controllers/comments_controller.rb b/app/controllers/comments_controller.rb index 99a4d74ce..d9dc1d4ab 100644 --- a/app/controllers/comments_controller.rb +++ b/app/controllers/comments_controller.rb @@ -51,7 +51,6 @@ class CommentsController < ApplicationController # POST /comments # POST /comments.json def create - csrf_logger_info("comment creation") unless current_user redirect_to "/" return diff --git a/app/controllers/ga_events_controller.rb b/app/controllers/ga_events_controller.rb index 218e1d0ad..274ee2685 100644 --- a/app/controllers/ga_events_controller.rb +++ b/app/controllers/ga_events_controller.rb @@ -1,10 +1,10 @@ class GaEventsController < ApplicationController skip_before_action :verify_authenticity_token def create - # unless valid_request_origin? - # render body: nil - # return - # end + unless valid_request_origin? + render body: nil + return + end json = JSON.parse(request.raw_post) user_id = user_signed_in? ? current_user.id : nil client_id = "#{ip[0..12]}_#{json['user_agent']}_#{user_id}" diff --git a/app/controllers/image_uploads_controller.rb b/app/controllers/image_uploads_controller.rb index 4853ea4bd..0b56913b9 100644 --- a/app/controllers/image_uploads_controller.rb +++ b/app/controllers/image_uploads_controller.rb @@ -3,7 +3,6 @@ class ImageUploadsController < ApplicationController skip_before_action :verify_authenticity_token def create - csrf_logger_info("image upload") uploader = ArticleImageUploader.new uploader.store!(params[:image]) link = uploader.url diff --git a/app/controllers/internal/broadcasts_controller.rb b/app/controllers/internal/broadcasts_controller.rb index 79a29e230..080484c07 100644 --- a/app/controllers/internal/broadcasts_controller.rb +++ b/app/controllers/internal/broadcasts_controller.rb @@ -1,6 +1,5 @@ class Internal::BroadcastsController < Internal::ApplicationController layout "internal" - skip_before_action :verify_authenticity_token def create @broadcast = Broadcast.new(broadcast_params) diff --git a/app/controllers/internal/comments_controller.rb b/app/controllers/internal/comments_controller.rb index 1cb02e9da..35cf9dee6 100644 --- a/app/controllers/internal/comments_controller.rb +++ b/app/controllers/internal/comments_controller.rb @@ -1,6 +1,5 @@ class Internal::CommentsController < Internal::ApplicationController layout 'internal' - skip_before_action :verify_authenticity_token def index if params[:state]&.start_with?("toplast-") diff --git a/app/controllers/internal/tags_controller.rb b/app/controllers/internal/tags_controller.rb index ff026cbec..91c945f4e 100644 --- a/app/controllers/internal/tags_controller.rb +++ b/app/controllers/internal/tags_controller.rb @@ -1,6 +1,5 @@ class Internal::TagsController < Internal::ApplicationController layout 'internal' - skip_before_action :verify_authenticity_token def index if params[:state] == "supported" diff --git a/app/controllers/reactions_controller.rb b/app/controllers/reactions_controller.rb index 43232f556..6f3d4f37d 100644 --- a/app/controllers/reactions_controller.rb +++ b/app/controllers/reactions_controller.rb @@ -61,7 +61,6 @@ class ReactionsController < ApplicationController end def create - csrf_logger_info("reaction creation") Rails.cache.delete "count_for_reactable-#{params[:reactable_type]}-#{params[:reactable_id]}" reaction = Reaction.where( user_id: current_user.id,