Fixed CSRF vulnerability with Rails < 5.2

ankane · Feb 2, 2023 · ec28965 · ec28965
1 parent 4b9c351
commit ec28965
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,3 +1,7 @@
+## 0.1.2 (unreleased)
+
+- Fixed CSRF vulnerability with Rails < 5.2 - [more info](https://github.com/ankane/clockwork_web/issues/4)
+
 ## 0.1.1 (2020-03-19)
 
 - Fixed load error

diff --git a/app/controllers/clockwork_web/home_controller.rb b/app/controllers/clockwork_web/home_controller.rb
@@ -3,6 +3,8 @@ class HomeController < ActionController::Base
     layout false
     helper ClockworkWeb::HomeHelper
 
+    protect_from_forgery with: :exception
+
     http_basic_authenticate_with name: ENV["CLOCKWORK_USERNAME"], password: ENV["CLOCKWORK_PASSWORD"] if ENV["CLOCKWORK_PASSWORD"]
 
     def index