From: Tom Hughes <tom@compton.nu>
Date: Thu, 29 Jun 2017 18:14:55 +0000 (+0100)
Subject: Disable forgery protection for notes API methods
X-Git-Tag: live~3316
X-Git-Url: https://git.openstreetmap.org/rails.git/commitdiff_plain/3763cbc7d4cdf3fdead477ee093b3c82aabd49fe?ds=sidebyside

Disable forgery protection for notes API methods

Fixes #1571
---

diff --git a/app/controllers/notes_controller.rb b/app/controllers/notes_controller.rb
index 1de58af90..f4667bef5 100644
--- a/app/controllers/notes_controller.rb
+++ b/app/controllers/notes_controller.rb
@@ -1,6 +1,7 @@
 class NotesController < ApplicationController
   layout "site", :only => [:mine]
 
+  skip_before_action :verify_authenticity_token, :except => [:mine]
   before_action :check_api_readable
   before_action :authorize_web, :only => [:mine]
   before_action :setup_user_auth, :only => [:create, :comment]