From ae19e4141f27f80013c11e8b1da68e5c52c779ea Mon Sep 17 00:00:00 2001 From: Michael Koziarski Date: Wed, 5 Jan 2011 13:36:07 +1300 Subject: Change the CSRF whitelisting to only apply to get requests Unfortunately the previous method of browser detection and XHR whitelisting is unable to prevent requests issued from some Flash animations and Java applets. To ease the work required to include the CSRF token in ajax requests rails now supports providing the token in a custom http header: X-CSRF-Token: ... This fixes CVE-2011-0447 --- actionpack/lib/action_dispatch/http/request.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'actionpack/lib/action_dispatch/http/request.rb') diff --git a/actionpack/lib/action_dispatch/http/request.rb b/actionpack/lib/action_dispatch/http/request.rb index 08f30e068d..a5d4ecbba8 100644 --- a/actionpack/lib/action_dispatch/http/request.rb +++ b/actionpack/lib/action_dispatch/http/request.rb @@ -133,8 +133,9 @@ module ActionDispatch end def forgery_whitelisted? - get? || xhr? || content_mime_type.nil? || !content_mime_type.verify_request? + get? end + deprecate :forgery_whitelisted? => "it is just an alias for 'get?' now, update your code" def media_type content_mime_type.to_s -- cgit v1.2.3 From f23bf7dbdbc0e0590083f0f288aa24f5b830e685 Mon Sep 17 00:00:00 2001 From: Carlos Antonio da Silva Date: Fri, 11 Feb 2011 09:33:16 -0200 Subject: Add missing deprecation require Signed-off-by: Santiago Pastorino --- actionpack/lib/action_dispatch/http/request.rb | 1 + 1 file changed, 1 insertion(+) (limited to 'actionpack/lib/action_dispatch/http/request.rb') diff --git a/actionpack/lib/action_dispatch/http/request.rb b/actionpack/lib/action_dispatch/http/request.rb index a5d4ecbba8..f07ac44f7a 100644 --- a/actionpack/lib/action_dispatch/http/request.rb +++ b/actionpack/lib/action_dispatch/http/request.rb @@ -2,6 +2,7 @@ require 'tempfile' require 'stringio' require 'strscan' +require 'active_support/core_ext/module/deprecation' require 'active_support/core_ext/hash/indifferent_access' require 'active_support/core_ext/string/access' require 'active_support/inflector' -- cgit v1.2.3