Fix scheduler csrf (#1519)

* Initial commit * Replace button_to with link_to
autolab · May 13, 2022 · af5eb69 · af5eb69
1 parent a0a2412
commit af5eb69
Show file tree

Hide file tree

Showing 5 changed files with 7 additions and 21 deletions.
diff --git a/app/assets/stylesheets/style.css.scss b/app/assets/stylesheets/style.css.scss
@@ -1078,20 +1078,6 @@ form p:last-child {
   padding-left: 14px;
 }
 
-.danger-side input {
-  background: none;
-  border: none;
-  padding-left: 14px;
-  text-decoration: none;
-  color: #0882af;
-  font-family: "Source Sans Pro", sans-serif;
-  font-weight: 300;
-  font-size: 16px;
-  text-align: left;
-  width: 100%;
-  cursor: pointer;
-}
-
 /* Form Tables */
 
 .verticalTable tr {

diff --git a/app/views/assessments/show.html.erb b/app/views/assessments/show.html.erb
@@ -76,10 +76,10 @@
               <li class="collection-item red-text danger-bottom no-hover"><h4>Danger Zone</h4></li>
 
               <li class="danger-side">
-                <%= button_to "Release all grades", { :action => "releaseAllGrades" }, { :title=> "Make all scores for this assessment visible to students", data: {confirm: "Are you sure you want to release all grades?"}} %>
+                <%= link_to "Release all grades", { :action => "releaseAllGrades" }, { :title=> "Make all scores for this assessment visible to students", data: {confirm: "Are you sure you want to release all grades?", method: "post"}} %>
               </li>
               <li class="danger-side">
-                <%= button_to "Withdraw all grades", { :action => "withdrawAllGrades" }, {:title=> "Hide all scores for this assessment from students", data: {confirm: "Are you sure you want to withdraw all grades?"}} %>
+                <%= link_to "Withdraw all grades", { :action => "withdrawAllGrades" }, {:title=> "Hide all scores for this assessment from students", data: {confirm: "Are you sure you want to withdraw all grades?", method: "post"}} %>
               </li>
               <li class="danger-side danger-bottom"> <%= link_to "Reload config file", {:action => "reload" }, {:title=> "Reload the assessment config file (provided for backward compatibility with legacy assessments)", data: {confirm: "Are you sure you want to reload the config file?"}} %></li>
             </ul>
@@ -107,7 +107,7 @@
               <li class="danger-side"><%= link_to "Reload config file", url_for(:action => 'reload'),
                 :title=> "Reload the assessment configuration file (provided for backward compatibility with legacy assessments)", data: {confirm: "Are you sure you want to reload the config file?"} %></li>
               <li class="danger-side danger-bottom">
-                <%= button_to "Release section grades", { :action => "releaseSectionGrades" }, { :title=> "Make all scores visible to the students in your section. This will work only if your instructor has assigned you to a lecture and section in your Autolab account.", data: {confirm: "Are you sure you want to release section grades?"}} %>
+                <%= link_to "Release section grades", { :action => "releaseSectionGrades" }, { :title=> "Make all scores visible to the students in your section. This will work only if your instructor has assigned you to a lecture and section in your Autolab account.", data: {confirm: "Are you sure you want to release section grades?", method: "post"}} %>
               </li>
             </ul>
           </div>

diff --git a/app/views/schedulers/index.html.erb b/app/views/schedulers/index.html.erb
@@ -17,7 +17,7 @@
     <td><%=h scheduler.action %></td>
     <td><%=h scheduler.next %></td>
     <td><%=h scheduler.interval %></td>
-    <td><%= link_to 'Visual Run', {:action=>"run", :scheduler_id=>scheduler.id} %></td>
+    <td><%= link_to 'Visual Run', {:action=>"run", :scheduler_id=>scheduler.id}, data: { method: "post" } %></td>
     <td><%= link_to 'Show', {:action=>"show",:id=>scheduler.id} %>
     <%= link_to 'Edit', edit_course_scheduler_path(@course, scheduler) %>
     <%= link_to 'Destroy', course_scheduler_path(@course, scheduler), method: "delete", data: {confirm: 'Are you sure?'} %></td>

diff --git a/app/views/schedulers/run.html.erb b/app/views/schedulers/run.html.erb
@@ -1,7 +1,7 @@
 <% content_for :javascripts do %>
     <script type="text/javascript">
         $(function () {
-            $.get("visualRun", function (returned) {
+            $.post("visualRun", function (returned) {
                 $(".output").html(returned)
             })
         })

diff --git a/config/routes.rb b/config/routes.rb
@@ -71,8 +71,8 @@
 
   resources :courses, param: :name do
     resources :schedulers do
-      get "visualRun", action: :visual_run
-      get "run"
+      post "visualRun", action: :visual_run
+      post "run"
     end
 
     resource :metrics, only: :index do