From: Marius Balteanu <marius.balteanu@zitec.com>
Date: Sat, 22 Jan 2022 08:43:42 +0000 (+0000)
Subject: Set default protect from forgery true (#36317).
X-Git-Tag: 5.0.0~96
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=9cda1638bda7800b6f0f67d621ab04e1dbb7388a;p=redmine.git

Set default protect from forgery true (#36317).

Patch by Takashi Kato.

git-svn-id: http://svn.redmine.org/redmine/trunk@21379 e93f8b46-1217-0410-a6f0-8f06a7374b81
---

diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb
index 2dc99a01f..8878026f3 100644
--- a/app/controllers/application_controller.rb
+++ b/app/controllers/application_controller.rb
@@ -38,8 +38,6 @@ class ApplicationController < ActionController::Base
 
   layout 'base'
 
-  protect_from_forgery
-
   def verify_authenticity_token
     unless api_request?
       super
@@ -48,11 +46,16 @@ class ApplicationController < ActionController::Base
 
   def handle_unverified_request
     unless api_request?
-      super
-      cookies.delete(autologin_cookie_name)
-      self.logged_user = nil
-      set_localization
-      render_error :status => 422, :message => l(:error_invalid_authenticity_token)
+      begin
+        super
+      rescue ActionController::InvalidAuthenticityToken => e
+        logger.error("ActionController::InvalidAuthenticityToken: #{e.message}") if logger
+      ensure
+        cookies.delete(autologin_cookie_name)
+        self.logged_user = nil
+        set_localization
+        render_error :status => 422, :message => l(:error_invalid_authenticity_token)
+      end
     end
   end
 
diff --git a/config/application.rb b/config/application.rb
index 902007d03..bba468f38 100644
--- a/config/application.rb
+++ b/config/application.rb
@@ -58,6 +58,9 @@ module RedmineApp
     # Do not include all helpers
     config.action_controller.include_all_helpers = false
 
+    # Add forgery protection
+    config.action_controller.default_protect_from_forgery = true
+
     # Sets the Content-Length header on responses with fixed-length bodies
     config.middleware.insert_before Rack::Sendfile, Rack::ContentLength