rooty/fab-manager
1
0
Fork 0
mirror of https://github.com/LaCasemate/fab-manager.git synced 2025-01-17 06:52:27 +01:00
Code Issues Releases Activity

added gem omniauth-rails_csrf_protection + [ongoing] moving from GET /users/auth/... to POST

Browse Source
This commit is contained in:
Sylvain 2019-10-01 17:14:16 +02:00
parent 0ab2cbdea1
commit 35b069a4db
6 changed files with 15 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
Gemfile
View File

@ -73,6 +73,7 @@ gem 'devise', ">= 4.6.0"
gem 'omniauth', '~> 1.6.0'
gem 'omniauth-oauth2'
gem 'omniauth-rails_csrf_protection', '~> 0.1'
gem 'rolify'

4
Gemfile.lock
View File

@ -265,6 +265,9 @@ GEM
omniauth-oauth2 (1.3.1)
oauth2 (~> 1.0)
omniauth (~> 1.2)
omniauth-rails_csrf_protection (0.1.2)
actionpack (>= 4.2)
omniauth (>= 1.3.1)
openlab_ruby (0.0.4)
httparty (~> 0.13)
orm_adapter (0.5.0)
@ -511,6 +514,7 @@ DEPENDENCIES
oj
omniauth (~> 1.6.0)
omniauth-oauth2
omniauth-rails_csrf_protection (~> 0.1)
openlab_ruby
pdf-reader
pg

1
app/assets/javascripts/controllers/application.js.erb
View File

@ -351,6 +351,7 @@ Application.Controllers.controller('ApplicationController', ['$rootScope', '$sco
var openLoginModal = function (toState, toParams, callback) {
<% active_provider = AuthProvider.active %>
<% if active_provider.providable_type != DatabaseProvider.name %>
$window.location.href = '<%="/users/auth/#{active_provider.strategy_name}"%>';
<% else %>
return $uibModal.open({

4
app/assets/javascripts/router.js.erb
View File

@ -38,7 +38,9 @@ angular.module('application.router', ['ui.router'])
logoBlackFile: ['CustomAsset', function (CustomAsset) { return CustomAsset.get({ name: 'logo-black-file' }).$promise; }],
commonTranslations: ['Translations', function (Translations) { return Translations.query(['app.public.common', 'app.shared.buttons', 'app.shared.elements']).$promise; }]
},
onEnter: ['$rootScope', 'logoFile', 'logoBlackFile', function ($rootScope, logoFile, logoBlackFile) {
onEnter: ['$rootScope', 'logoFile', 'logoBlackFile', 'CSRF', function ($rootScope, logoFile, logoBlackFile, CSRF) {
// Retrieve Anti-CSRF tokens from cookies
CSRF.setMetaTags();
// Application logo
$rootScope.logo = logoFile.custom_asset;
return $rootScope.logoBlack = logoBlackFile.custom_asset;

4
app/assets/templates/shared/header.html.erb
View File

@ -55,7 +55,9 @@
<% else %>
<li ng-if="!isAuthenticated()"><a href="<%= "/users/auth/#{active_provider.strategy_name}"%>" class="font-sbold label text-md"><i class="fa fa-rocket"></i> {{ 'sign_up' | translate }}</a></li>
<li ng-if="!isAuthenticated()">
<a href="<%= "/users/auth/#{active_provider.strategy_name}"%>" class="font-sbold label text-md"><i class="fa fa-sign-in"></i> {{ 'sign_in' | translate }}</a>
<%= link_to(raw("<i class='fa fa-sign-in'></i> {{ 'sign_in' | translate }}"),
"/users/auth/#{active_provider.strategy_name}",
{ method: :post, class: 'font-sbold label text-md' }) %>
</li>
<% end %>
</ul>

6
app/views/users_mailer/notify_user_account_created.html.erb
View File

@ -38,9 +38,9 @@
<p>
<%= t('.body.thanks_to_') %>
<a href="<%= "#{root_url}/users/auth/#{active_provider.strategy_name}?auth_token=#{@user.auth_token}"%>" target="_blank">
<%= t('body.logon_or_login', PROVIDER: active_provider.name )%>
</a>
<%= link_to(t('.body.logon_or_login', PROVIDER: active_provider.name ),
"#{root_url}/users/auth/#{active_provider.strategy_name}?auth_token=#{@user.auth_token}",
{ method: :post, target: '_blank' }) %>
</p>
<p><%= t('.body.token_if_link_problem') %></p>