John Poulin forced-request

## timebased-user-enum.rb
def create
	user = Users.where(:username => params[:sessions][:username]).first
	unless user.nil?
		if user.password == compute
			render :text => "Login Successfully"
		else
			render :text => NOT_EXISTS
		end
	else
		render :text => NOT_EXISTS

## keybase.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                forced-request
                / keybase.md
            
            
              Created
              October 6, 2014 13:44
            
              
                keybase.md
              
          
    Keybase proof

I hereby claim:

I am forced-request on github.
I am forcedrequest (https://keybase.io/forcedrequest) on keybase.
I have a public key whose fingerprint is 5717 2014 FCD3 25E9 0676  55D9 7995 BE99 3DC8 6C86

To claim this, I am signing this object:

  
## gist:e491eea8860e889dc843
<html>
<head>
<title>Test</title>
<script src="jquery-1.11.1.min.js"></script>
<script>
$(document).ready(function () {
	alert('hiii');
});
</script>
</head>

## gist:74266013b36ee0de6f09
class ApplicationController < ActionController::Base
  protect_from_forgery with: :exception
end

## gist:a29212b17d12bf57a88f
class ApplicationController < ActionController::Base
  protect_from_forgery

  # Overload handle_unverified_request to ensure that
  # exception is raised each time a request does not
  # pass validation.
  def handle_unverified_request
    raise(ActionController::InvalidAuthenticityToken)
  end
end

## application_controller.rb
class ApplicationController < ActionController::Base
  protect_from_forgery

  # Overload handle_unverified_request to ensure that
  # exception is raised each time a request does not
  # pass validation.
  def handle_unverified_request
    raise(ActionController::InvalidAuthenticityToken)
  end
end

## gist:7656816db64f46689ce8
def reset_session
  session.destroy if session && session.respond_to?(:destroy)
  self.session = {}
  @env['action_dispatch.request.flash_hash'] = nil
end

## request_forgery_protection.rb
def handle_unverified_request
  reset_session
end

def verified_request?
    !protect_against_forgery? || request.get? ||
      form_authenticity_token == params[request_forgery_protection_token] ||
      form_authenticity_token == request.headers['X-CSRF-Token']
end

## gist:653acca0adb0e61554f6
def verify_authenticity_token
    unless verified_request?
      logger.warn "WARNING: Can't verify CSRF token authenticity" if logger
      handle_unverified_request
    end
end

## request_forgery_protection.rb
def protect_from_forgery(options = {})
    self.request_forgery_protection_token ||= :authenticity_token
    prepend_before_filter :verify_authenticity_token, options
end

def verify_authenticity_token
    unless verified_request?
      logger.warn "WARNING: Can't verify CSRF token authenticity" if logger
      handle_unverified_request
    end
	def create
	user = Users.where(:username => params[:sessions][:username]).first
	unless user.nil?
	if user.password == compute
	render :text => "Login Successfully"
	else
	render :text => NOT_EXISTS
	end
	else
	render :text => NOT_EXISTS
	<html>
	<head>
	<title>Test</title>
	<script src="jquery-1.11.1.min.js"></script>
	<script>
	$(document).ready(function () {
	alert('hiii');
	});
	</script>
	</head>
	class ApplicationController < ActionController::Base
	protect_from_forgery with: :exception
	end
	class ApplicationController < ActionController::Base
	protect_from_forgery

	# Overload handle_unverified_request to ensure that
	# exception is raised each time a request does not
	# pass validation.
	def handle_unverified_request
	raise(ActionController::InvalidAuthenticityToken)
	end
	end
	def reset_session
	session.destroy if session && session.respond_to?(:destroy)
	self.session = {}
	@env['action_dispatch.request.flash_hash'] = nil
	end
	def handle_unverified_request
	reset_session
	end

	def verified_request?
	!protect_against_forgery? \|\| request.get? \|\|
	form_authenticity_token == params[request_forgery_protection_token] \|\|
	form_authenticity_token == request.headers['X-CSRF-Token']
	end
	def verify_authenticity_token
	unless verified_request?
	logger.warn "WARNING: Can't verify CSRF token authenticity" if logger
	handle_unverified_request
	end
	end
	def protect_from_forgery(options = {})
	self.request_forgery_protection_token \|\|= :authenticity_token
	prepend_before_filter :verify_authenticity_token, options
	end

	def verify_authenticity_token
	unless verified_request?
	logger.warn "WARNING: Can't verify CSRF token authenticity" if logger
	handle_unverified_request
	end