path for csrf risk on rails 2.3.11

rails2311_csrf_path.rb

module ActionController
  module RequestForgeryProtection
    protected
    def verify_authenticity_token
      verified_request? || handle_unverified_request
    end

    # Process logout
    def handle_unverified_request
      reset_session
    end

    def verified_request?
      !protect_against_forgery?                            ||
        request.get?                                       ||
        form_authenticity_token == form_authenticity_param ||
        form_authenticity_token == request.headers['X-CSRF-Token']
    end
  end
end