From 62c6e12fa58adea57954e395d10d0ffc2c0cd73c Mon Sep 17 00:00:00 2001 From: Claire Date: Wed, 6 Apr 2022 20:57:18 +0200 Subject: Fix admin API unconditionally requiring CSRF token (#17975) Fixes #17898 Since #17204, the admin API has only been available through the web application because of the unconditional requirement to provide a valid CSRF token. This commit changes it back to `null_session`, which should make it work both with session-based authentication (provided a CSRF token) and with a bearer token. --- app/controllers/api/v1/admin/retention_controller.rb | 2 -- 1 file changed, 2 deletions(-) (limited to 'app/controllers/api/v1/admin/retention_controller.rb') diff --git a/app/controllers/api/v1/admin/retention_controller.rb b/app/controllers/api/v1/admin/retention_controller.rb index 4af5a5c4d..98d1a3d81 100644 --- a/app/controllers/api/v1/admin/retention_controller.rb +++ b/app/controllers/api/v1/admin/retention_controller.rb @@ -1,8 +1,6 @@ # frozen_string_literal: true class Api::V1::Admin::RetentionController < Api::BaseController - protect_from_forgery with: :exception - before_action -> { authorize_if_got_token! :'admin:read' } before_action :require_staff! before_action :set_cohorts -- cgit