mirror of
https://github.com/discourse/discourse.git
synced 2024-11-22 09:42:02 +08:00
29 lines
691 B
Ruby
29 lines
691 B
Ruby
|
# frozen_string_literal: true
|
||
|
|
|
||
|
|
# Provides a way to check a CSRF token outside of a controller
|
||
|
|
class CSRFTokenVerifier
|
||
|
|
include ActiveSupport::Configurable
|
||
|
|
include ActionController::RequestForgeryProtection
|
||
|
|
|
||
|
|
# Use config from ActionController::Base
|
||
|
|
config.each_key do |configuration_name|
|
||
|
|
undef_method configuration_name
|
||
|
|
define_method configuration_name do
|
||
|
|
ActionController::Base.config[configuration_name]
|
||
|
|
end
|
||
|
|
end
|
||
|
|
|
||
|
|
def call(env)
|
||
|
|
@request = ActionDispatch::Request.new(env.dup)
|
||
|
|
|
||
|
|
unless verified_request?
|
||
|
|
raise ActionController::InvalidAuthenticityToken
|
||
|
|
end
|
||
|
|
end
|
||
|
|
|
||
|
|
private
|
||
|
|
|
||
|
|
attr_reader :request
|
||
|
|
delegate :params, :session, to: :request
|
||
|
|
end
|