zydronium/neocities
1
0
Fork 0
mirror of https://github.com/neocities/neocities.git synced 2025-04-25 01:32:36 +02:00
Code Issues Projects Releases Packages Wiki Activity

Use a random token and verify it on POST requests

Browse source
This commit is contained in:
mikeycgto 2013-06-22 12:00:43 -04:00
parent 538c22f61a
commit be9c7cad5a
1 changed files with 12 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
app.rb
View file

@ -232,6 +232,10 @@ get '/privacy' do
slim :'privacy' slim :'privacy'
end end
before do
redirect '/' if request.post? && !csrf_safe?
end
def sites_name_redirect def sites_name_redirect
path = request.path.gsub "/sites/#{params[:name]}", '' path = request.path.gsub "/sites/#{params[:name]}", ''
# path += "/#{params[:file]}" unless params[:file].nil? # path += "/#{params[:file]}" unless params[:file].nil?
@ -244,15 +248,19 @@ def dashboard_if_signed_in
end end
def require_login_ajax def require_login_ajax
halt 'You are not logged in!' unless signed_in? && csrf_safe halt 'You are not logged in!' unless signed_in?
end end
def csrf_safe def csrf_safe?
(request.referer =~ /.+\.neocities\.org/i).nil? csrf_token == params[:csrf_token]
end
def csrf_token
session[:_csrf_token] ||= SecureRandom.base64(32)
end end
def require_login def require_login
redirect '/' unless signed_in? && csrf_safe redirect '/' unless signed_in?
end end
def signed_in? def signed_in?