Skip CSRF verification for changeset comment actions

Fixes #2057

diff --git a/app/controllers/changeset_comments_controller.rb b/app/controllers/changeset_comments_controller.rb
index 6a563f9b2c5cb92393260a77baedf3aa96b99f79..8442a4f360f34882030929f0f037d319abdd859b 100644 (file)
--- a/app/controllers/changeset_comments_controller.rb
+++ b/app/controllers/changeset_comments_controller.rb
@@ -1,4 +1,5 @@
 class ChangesetCommentsController < ApplicationController
 class ChangesetCommentsController < ApplicationController

+  skip_before_action :verify_authenticity_token, :except => [:index]

   before_action :authorize_web, :only => [:index]
   before_action :set_locale, :only => [:index]
   before_action :authorize, :only => [:create, :destroy, :restore]
   before_action :authorize_web, :only => [:index]
   before_action :set_locale, :only => [:index]
   before_action :authorize, :only => [:create, :destroy, :restore]