app/controllers/documents_v2_controller.rb
# don't check for csrf token
don't check for csrf token
don ' t check for csrf token
def open
    @document = Document.find_by(id: params[:id])
    render_not_found && return unless @document
    access_key = parse_access_key
    if access_key || !@document.shared
      render_missing_param("accessKey") && return unless access_key
      render_invalid_access_key_format && return unless access_key.valid_format?
      render_invalid_access_key && return unless valid_document_access_key(access_key)
    end
    read_only = !access_key || access_key.read_only?
    response.headers['Allow'] = "GET, HEAD, OPTIONS#{read_only ? '' : ', PUT, PATCH'}"
    render json: @document.content
  end
def open @document = Document . find_by ( id : params [ :id ] ) render_not_found && return unless @document access_key = parse_access_key if access_key || ! @document . shared render_missing_param ( "accessKey" ) && return unless access_key render_invalid_access_key_format && return unless access_key . valid_format? render_invalid_access_key && return unless valid_document_access_key ( access_key ) end read_only = ! access_key || access_key . read_only? response . headers [ 'Allow' ] = "GET, HEAD, OPTIONS#{read_only ? '' : ', PUT, PATCH'}" render json : @document . content end
don't check for csrf token
don ' t check for csrf token
# If an access key is present it must be checked. Shared documents without access keys are ok, unshared documents need to have a valid access key of either type.