Commit c2ee828c authored by Dmitriy Zaporozhets's avatar Dmitriy Zaporozhets
Browse files

Merge branch 'omniauth-csrf' into 'master' 

Protect OmniAuth request phase against CSRF.

Addresses #2268.

See merge request !1793
parents 910794ba b17f36f0

CHANGELOG

+3 −0
Original line number Diff line number Diff line
@@ -42,6 +42,9 @@ v 7.11.0 (unreleased) 
  - Task lists are now usable in comments, and will show up in Markdown previews.

  - Fix bug where avatar filenames were not actually deleted from the database during removal (Stan Hu)

  - Fix bug where Slack service channel was not saved in admin template settings. (Stan Hu)

  - Protect OmniAuth request phase against CSRF.

  -

  -

  - Move snippets UI to fluid layout

  - Improve UI for sidebar. Increase separation between navigation and content

  - Improve new project command options (Ben Bodenmiller)

Gemfile

+1 −1
Original line number Diff line number Diff line
@@ -23,7 +23,7 @@ gem "pg", group: :postgres 
# Auth

gem "devise", '3.2.4'

gem "devise-async", '0.9.0'

gem 'omniauth', "~> 1.1.3"

gem 'omniauth', "~> 1.2.2"

gem 'omniauth-google-oauth2'

gem 'omniauth-twitter'

gem 'omniauth-github'

Gemfile.lock

+4 −4
Original line number Diff line number Diff line
@@ -362,9 +362,9 @@ GEM 
      rack (~> 1.2)

    octokit (3.7.0)

      sawyer (~> 0.6.0, >= 0.5.3)

    omniauth (1.1.4)

      hashie (>= 1.2, < 3)

      rack

    omniauth (1.2.2)

      hashie (>= 1.2, < 4)

      rack (~> 1.0)

    omniauth-bitbucket (0.0.2)

      multi_json (~> 1.7)

      omniauth (~> 1.1)
@@ -751,7 +751,7 @@ DEPENDENCIES 
  newrelic_rpm

  nprogress-rails

  octokit (= 3.7.0)

  omniauth (~> 1.1.3)

  omniauth (~> 1.2.2)

  omniauth-bitbucket

  omniauth-github

  omniauth-gitlab

app/views/devise/shared/_omniauth_box.html.haml

+2 −2
Original line number Diff line number Diff line
@@ -5,6 +5,6 @@ 
  - providers.each do |provider|

    %span.light

      - if default_providers.include?(provider)

        = link_to oauth_image_tag(provider), omniauth_authorize_path(resource_name, provider), class: 'oauth-image-link'

        = link_to oauth_image_tag(provider), omniauth_authorize_path(resource_name, provider), method: :post, class: 'oauth-image-link'

      - else

        = link_to provider.to_s.titleize, omniauth_authorize_path(resource_name, provider), class: "btn", "data-no-turbolink" => "true"
 
        = link_to provider.to_s.titleize, omniauth_authorize_path(resource_name, provider), method: :post, class: "btn", "data-no-turbolink" => "true"

app/views/profiles/accounts/show.html.haml

+1 −1
Original line number Diff line number Diff line
@@ -62,7 +62,7 @@ 
        - enabled_social_providers.each do |provider|

          .btn-group

            = link_to oauth_image_tag(provider), omniauth_authorize_path(User, provider),

              class: "btn btn-lg #{'active' if oauth_active?(provider)}"

              method: :post, class: "btn btn-lg #{'active' if oauth_active?(provider)}"

            - if oauth_active?(provider)

              = link_to unlink_profile_account_path(provider: provider), method: :delete, class: 'btn btn-lg' do

                = icon('close')