SWREI/instrumental
0
0
Fork 0
Code Issues Activity

Fix omniauth (SAML/CAS) sign-in routes not having CSRF protection (#15228)

Browse Source
This commit is contained in:
Eugen Rochko 2020-11-28 05:17:53 +01:00 committed by GitHub
parent 13206fcfb8
commit 13b07b88f1
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
Gemfile
View File

@ -44,6 +44,7 @@ gem 'net-ldap', '~> 0.16'
gem 'omniauth-cas', '~> 2.0' gem 'omniauth-cas', '~> 2.0'
gem 'omniauth-saml', '~> 1.10' gem 'omniauth-saml', '~> 1.10'
gem 'omniauth', '~> 1.9' gem 'omniauth', '~> 1.9'
gem 'omniauth-rails_csrf_protection', '~> 0.1'
gem 'color_diff', '~> 0.1' gem 'color_diff', '~> 0.1'
gem 'discard', '~> 1.2' gem 'discard', '~> 1.2'

4
Gemfile.lock
View File

@ -375,6 +375,9 @@ GEM
addressable (~> 2.3) addressable (~> 2.3)
nokogiri (~> 1.5) nokogiri (~> 1.5)
omniauth (~> 1.2) omniauth (~> 1.2)
omniauth-rails_csrf_protection (0.1.2)
actionpack (>= 4.2)
omniauth (>= 1.3.1)
omniauth-saml (1.10.3) omniauth-saml (1.10.3)
omniauth (~> 1.3, >= 1.3.2) omniauth (~> 1.3, >= 1.3.2)
ruby-saml (~> 1.9) ruby-saml (~> 1.9)
@ -741,6 +744,7 @@ DEPENDENCIES
oj (~> 3.10) oj (~> 3.10)
omniauth (~> 1.9) omniauth (~> 1.9)
omniauth-cas (~> 2.0) omniauth-cas (~> 2.0)
omniauth-rails_csrf_protection (~> 0.1)
omniauth-saml (~> 1.10) omniauth-saml (~> 1.10)
ox (~> 2.13) ox (~> 2.13)
paperclip (~> 6.0) paperclip (~> 6.0)

3
app/views/auth/sessions/new.html.haml
View File

@ -22,7 +22,6 @@
.actions .actions
- resource_class.omniauth_providers.each do |provider| - resource_class.omniauth_providers.each do |provider|
= link_to omniauth_authorize_path(resource_name, provider), class: "button button-#{provider}" do = link_to t("auth.providers.#{provider}", default: provider.to_s.chomp("_oauth2").capitalize), omniauth_authorize_path(resource_name, provider), class: "button button-#{provider}", method: :post
= t("auth.providers.#{provider}", default: provider.to_s.chomp("_oauth2").capitalize)
.form-footer= render 'auth/shared/links' .form-footer= render 'auth/shared/links'