app/controllers/documents_v2_controller.rb
# don't check for csrf token
don't check for csrf token
don ' t check for csrf token
def patch
    @document = Document.find_by(id: params[:id])
    render_not_found && return unless @document
    if ENV['SHARED_DOCS_DISABLED'] && @document.shared
      render_shared_docs_error && return
    end
    return unless require_valid_read_write_access_key
    begin
      patchset = JSON.parse(request.raw_post)
      raise "Empty patchset" unless patchset && patchset.is_a?(Array)
    rescue => e
      render json: {status: "Error", errors: ["Invalid patch JSON (parsing)", e.to_s, patchset], valid: false, message: 'error.writeFailed' }, status: 400
      return
    end
    begin
      patchedContent = JSON::Patch.new(@document.content, patchset).call
      doc_updates = {updated_at: Time.current}
      doc_updates[:shared] = shared_param_value() if params[:shared].present?
      if @document.update_columns(doc_updates) && @document.contents.update_columns({content: patchedContent, updated_at: Time.current})
        render json: {status: "Patched", valid: true, id: @document.id}, status: 200
      else
        render json: {status: "Error", errors: @document.errors.full_messages + @document.contents.errors.full_messages, valid: false, message: 'error.writeFailed' }, status: 400
      end
    rescue => e
      render json: {status: "Error", errors: ["Invalid patch JSON (executing)", e.to_s], valid: false, message: 'error.writeFailed' }, status: 400
    end
  end
def patch @document = Document . find_by ( id : params [ :id ] ) render_not_found && return unless @document if ENV [ 'SHARED_DOCS_DISABLED' ] && @document . shared render_shared_docs_error && return end return unless require_valid_read_write_access_key begin patchset = JSON . parse ( request . raw_post ) raise "Empty patchset" unless patchset && patchset . is_a? ( Array ) rescue => e render json : { status : "Error" , errors : [ "Invalid patch JSON (parsing)" , e . to_s , patchset ] , valid : false , message : 'error.writeFailed' } , status : 400 return end begin patchedContent = JSON :: Patch . new ( @document . content , patchset ) . call doc_updates = { updated_at : Time . current } doc_updates [ :shared ] = shared_param_value ( ) if params [ :shared ] . present? if @document . update_columns ( doc_updates ) && @document . contents . update_columns ( { content : patchedContent , updated_at : Time . current } ) render json : { status : "Patched" , valid : true , id : @document . id } , status : 200 else render json : { status : "Error" , errors : @document . errors . full_messages + @document . contents . errors . full_messages , valid : false , message : 'error.writeFailed' } , status : 400 end rescue => e render json : { status : "Error" , errors : [ "Invalid patch JSON (executing)" , e . to_s ] , valid : false , message : 'error.writeFailed' } , status : 400 end end
don't check for csrf token
don ' t check for csrf token