diff options
| author | Dmitriy Zaporozhets <dzaporozhets@gitlab.com> | 2015-05-14 14:22:26 +0000 |
|---|---|---|
| committer | Dmitriy Zaporozhets <dzaporozhets@gitlab.com> | 2015-05-14 14:22:26 +0000 |
| commit | c2ee828c19cb245809647428334b8ef215536a0d (patch) | |
| tree | 27a00bc43a61ad5a07a6577281cbb21ea71371d3 /app | |
| parent | 910794bae5a91479f41468ebc345db680a33b20e (diff) | |
| parent | b17f36f040a18ff6700881c56607ba6df436f652 (diff) | |
| download | gitlab-ce-c2ee828c19cb245809647428334b8ef215536a0d.tar.gz | |
Merge branch 'omniauth-csrf' into 'master'
Protect OmniAuth request phase against CSRF.
Addresses #2268.
See merge request !1793
Diffstat (limited to 'app')
| -rw-r--r-- | app/views/devise/shared/_omniauth_box.html.haml | 4 | ||||
| -rw-r--r-- | app/views/profiles/accounts/show.html.haml | 2 |
2 files changed, 3 insertions, 3 deletions
diff --git a/app/views/devise/shared/_omniauth_box.html.haml b/app/views/devise/shared/_omniauth_box.html.haml index 8dce0b16936..f8ba9d80ae8 100644 --- a/app/views/devise/shared/_omniauth_box.html.haml +++ b/app/views/devise/shared/_omniauth_box.html.haml @@ -5,6 +5,6 @@ - providers.each do |provider| %span.light - if default_providers.include?(provider) - = link_to oauth_image_tag(provider), omniauth_authorize_path(resource_name, provider), class: 'oauth-image-link' + = link_to oauth_image_tag(provider), omniauth_authorize_path(resource_name, provider), method: :post, class: 'oauth-image-link' - else - = link_to provider.to_s.titleize, omniauth_authorize_path(resource_name, provider), class: "btn", "data-no-turbolink" => "true" + = link_to provider.to_s.titleize, omniauth_authorize_path(resource_name, provider), method: :post, class: "btn", "data-no-turbolink" => "true" diff --git a/app/views/profiles/accounts/show.html.haml b/app/views/profiles/accounts/show.html.haml index 6ac60b01f85..06bad7dd84a 100644 --- a/app/views/profiles/accounts/show.html.haml +++ b/app/views/profiles/accounts/show.html.haml @@ -62,7 +62,7 @@ - enabled_social_providers.each do |provider| .btn-group = link_to oauth_image_tag(provider), omniauth_authorize_path(User, provider), - class: "btn btn-lg #{'active' if oauth_active?(provider)}" + method: :post, class: "btn btn-lg #{'active' if oauth_active?(provider)}" - if oauth_active?(provider) = link_to unlink_profile_account_path(provider: provider), method: :delete, class: 'btn btn-lg' do = icon('close') |