tarrien/Mastodon
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix Web Push subscription deletion endpoint incorrectly expecting anti-CSRF tokens (#39918)

Browse Source
This commit is contained in:
Claire 2026-07-22 16:38:49 +02:00 committed by Tarrien
parent 15cca7599a
commit 6a17292c90
2 changed files with 11 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
app/controllers/api/web/push_subscriptions_controller.rb
View File

@ -6,6 +6,8 @@ class Api::Web::PushSubscriptionsController < Api::Web::BaseController
before_action :destroy_previous_subscriptions, only: :create, if: :prior_subscriptions? before_action :destroy_previous_subscriptions, only: :create, if: :prior_subscriptions?
after_action :update_session_with_subscription, only: :create after_action :update_session_with_subscription, only: :create
skip_forgery_protection only: :destroy
def create def create
@push_subscription = ::Web::PushSubscription.create!(web_push_subscription_params) @push_subscription = ::Web::PushSubscription.create!(web_push_subscription_params)

9
spec/requests/api/web/push_subscriptions_spec.rb
View File

@ -39,6 +39,15 @@ RSpec.describe 'API Web Push Subscriptions' do
describe 'DELETE /api/web/push_subscriptions/:id' do describe 'DELETE /api/web/push_subscriptions/:id' do
subject { delete api_web_push_subscription_path(token) } subject { delete api_web_push_subscription_path(token) }
around do |example|
old = ActionController::Base.allow_forgery_protection
ActionController::Base.allow_forgery_protection = true
example.run
ActionController::Base.allow_forgery_protection = old
end
context 'when the subscription exists' do context 'when the subscription exists' do
let!(:web_push_subscription) do let!(:web_push_subscription) do
Fabricate(:web_push_subscription) Fabricate(:web_push_subscription)