app/services/request_referer_service.rb
# We only allow urls that have all the params specified in ENTRY_POINTS
#
# We use request.request_method so that HEAD becomes GET.
#
# The header we are testing with 'xml_http_request?' is optional. So do not
#   trust this and make sure, that the whitelisted action sends only HTML. No JS!
#
We only allow urls that have all the params specified in ENTRY_POINTS
We use request.request_method so that HEAD becomes GET.

The header we are testing with 'xml_http_request?' is optional. So do not
trust this and make sure, that the whitelisted action sends only HTML. No JS!
We only allow urls that have all the params specified in ENTRY_POINTS We use request . request_method so that HEAD becomes GET . The header we are testing with ' xml_http_request? ' is optional . So do not trust this and make sure that the whitelisted action sends only HTML . No JS!
def access_whitelisted?(request, controller_name, action_name)
    controller_entry_points = ENTRY_POINTS[controller_name] || {}
    request.request_method == 'GET' &&
      controller_entry_points.key?(action_name) &&
      !controller_entry_points[action_name].detect { |param| !request.parameters[param].present? } &&
      !request.xml_http_request?
  end
def access_whitelisted? ( request , controller_name , action_name ) controller_entry_points = ENTRY_POINTS [ controller_name ] || { } request . request_method == 'GET' && controller_entry_points . key? ( action_name ) && ! controller_entry_points [ action_name ] . detect { | param | ! request . parameters [ param ] . present? } && ! request . xml_http_request? end
We only allow urls that have all the params specified in ENTRY_POINTS
We use request.request_method so that HEAD becomes GET.
We only allow urls that have all the params specified in ENTRY_POINTS We use request . request_method so that HEAD becomes GET .
request
<not_specific>
controller_name
<not_specific>
action_name
<not_specific>