Disable forgery protection for notes API methods

[rails.git] / app / controllers / notes_controller.rb

diff --git a/app/controllers/notes_controller.rb b/app/controllers/notes_controller.rb
index fde27e8b29e05dd1a512a5e15989bb1c0dcb0127..f4667bef5f47beaad0ff4da13a95f99e03beeb15 100644 (file)
--- a/app/controllers/notes_controller.rb
+++ b/app/controllers/notes_controller.rb
@@ -1,6 +1,7 @@
 class NotesController < ApplicationController
   layout "site", :only => [:mine]
 
+  skip_before_action :verify_authenticity_token, :except => [:mine]
   before_action :check_api_readable
   before_action :authorize_web, :only => [:mine]
   before_action :setup_user_auth, :only => [:create, :comment]
@@ -285,7 +286,7 @@ class NotesController < ApplicationController
         @page_size = 10
         @notes = @this_user.notes
         @notes = @notes.visible unless @user && @user.moderator?
-        @notes = @notes.order("updated_at DESC, id").uniq.offset((@page - 1) * @page_size).limit(@page_size).preload(:comments => :author).to_a
+        @notes = @notes.order("updated_at DESC, id").distinct.offset((@page - 1) * @page_size).limit(@page_size).preload(:comments => :author).to_a
       else
         @title = t "user.no_such_user.title"
         @not_found_user = params[:display_name]
@@ -345,7 +346,7 @@ class NotesController < ApplicationController
       attributes[:author_ip] = request.remote_ip
     end
 
-    comment = note.comments.create(attributes)
+    comment = note.comments.create!(attributes)
 
     note.comments.map(&:author).uniq.each do |user|
       if notify && user && user != @user && user.visible?