search

fgrehm / letter_opener_web

A web interface for browsing Ruby on Rails sent emails
MIT License
711 stars 111 forks source link

Add Rails' built-in CSRF protection #111

Closed dee-see closed 2 years ago

dee-see commented 2 years ago

The HTML contains the anti-CSRF token in https://github.com/fgrehm/letter_opener_web/blob/feea82d0b279bfabe8e61891eecdc6098287f77e/app/views/layouts/letter_opener_web/letters.html.erb#L9 however the protect_from_forgery call was missing from ApplicationController.

fgrehm commented 2 years ago

Hey @dee-see , just a heads up that this is something that will come along with the upcoming 2.0 I got in the works, see the PR linked above for more.

If you have the time, it'd be great if you could give that branch a try as well, tks in advance!

fgrehm commented 2 years ago

Just got a pre-release ready to go. Please give that a try when you get a chance and I'll also just ping more folks for testing before a final release. This PR should auto close after code is on master.

Thanks for your contribution!

dee-see commented 2 years ago

Seems to be working well. There's only a clear button now and no way to delete an individual "letter" is that right?

fgrehm commented 2 years ago

Seems to be working well. There's only a clear button now and no way to delete an individual "letter" is that right?

Good catch! I've updated the TODO list on the PR to remind me of that before final release. If by any chance you or someone else has the time to implement that feel free to submit a PR. I'll also try to get that done next week

fgrehm commented 2 years ago

Hey @dee-see, just pushed https://github.com/fgrehm/letter_opener_web/pull/113/commits/3ab59e4c6356dde0174aae6014e72a2022df305d and cut a new 2.0.0.pre.beta release of the gem. Please give that a shot when you get a chance and report back in https://github.com/fgrehm/letter_opener_web/pull/113 if things look good to ya