Lighthouse has a new layout. Prefer the old one? Return to the old layout, and switch back any time from the link at the top of each page.

This project is archived and is in readonly mode.

All changesets

Changeset [7e86f9b4d2b7dfa974c10ae7e6d8ef90f3d77f06] by Michael Koziarski

Revision 7e86f9b4d2b7dfa974c10ae7e6d8ef90f3d77f06, committed by Michael Koziarski · February 8th, 2011 @ 08:20 PM

Change the CSRF whitelisting to only apply to get requests

Unfortunately the previous method of browser detection and XHR whitelisting is unable to prevent requests issued from some Flash animations and Java applets. To ease the work required to include the CSRF token in ajax requests rails now supports providing the token in a custom http header:

X-CSRF-Token: ...

This fixes CVE-2011-0447
https://github.com/rails/rails/commit/7e86f9b4d2b7dfa974c10ae7e6d8e...

4 changed files

  • A actionpack/lib/action_view/helpers/csrf_helper.rb
  • M actionpack/lib/action_controller/request_forgery_protection.rb
  • M actionpack/lib/action_view/helpers.rb
  • M actionpack/test/controller/request_forgery_protection_test.rb