0

This part of an app worked in ruby 2.4.6 and rails 4.2.6:

def refresh_to(url='/', option={})
  if option[:alert]
    ma_log option[:alert]
  end
  render inline: "<script>window.location.replace('#{url}')</script>"
end

But in ruby 2.5 and Rails 5.2, it is not allowed any more. I get this error:

Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' https:". Either the 'unsafe-inline' keyword, a hash ('sha256-myVzA8nG9TALJ+lM9KxIly4S3wxH68o0ybnPpqphBBg='), or a nonce ('nonce-...') is required to enable inline execution.

Solutions to the previous related errors do not work with this.

How can I write or manage the script to let it work with (or replace) render with or without using inline? I am exploring to put a script in /assets/javascript. How do you do this?

Edited.

Refused to execute inline script because it violates the following 
Content Security Policy directive: "script-src 'self' https:". Either 
the 'unsafe-inline' keyword, a hash ('sha256-
myVzA8nG9TALJ+lM9KxIly4S3wxH68o0ybnPpqphBBg='), or a nonce 
('nonce-...') is required to enable inline execution.

From Content Security Protocol, the inline script no longer support. (which happened when upgrade to rails 5.2 all inline (#)script errors). Including inline js embedded like:

      #render inline: "<script>window.location.replace('#{url}')</script>"
      render js: "window.location.replace(\'#{url}\')"

Error:

ActionController::InvalidCrossOriginRequest at /logout
Security warning: an embedded <script> tag on another site requested 
protected JavaScript. If you know what you're doing, go ahead and 
disable forgery protection on this action to permit cross-origin 
JavaScript embedding.

From: Document about protect_from_forgery(options = {}). Is not work with Rails 5.2 Beta when I included the option in ApplicaitonController as:

class ApplicationController < ActionController::Base
  skip_before_action :refresh_to, raise: false

So: The following kind of inline code need to be rewrite 

render inline: "<script>window.location.replace('#{url}')</script>"

I will try and test with a few versions of rails, but if anyone could spare your code, I would appreciated.

Edited.

Another trial by seperat javascript

-Create a /app/assets/javascript/refresh.js

function refresh() {
  window.location.replace('/')
}

-In controller method use render js: "refresh.js"

def refresh_to(url='/', option={})
  if option[:alert]
    ma_log option[:alert]
  end
#render inline: "<script>window.location.replace('#{url}')</script>"
#render js: "window.location.replace(\'#{url}\')" 
render js: "refresh();"

Result: Not work! same error about C.S.P

My last problem: How to pass parameter(url) to refresh.js ?

PKul
  • 1,691
  • 2
  • 21
  • 41
  • 2
    do render js: "window.location.replace(\'#{url}\')" or something like that – sethi Jan 11 '18 at 05:56
  • Now error:Security warning: an embedded – PKul Jan 11 '18 at 06:23
  • 1
    As the comment says you have to disable/remove the line protect_from_forgery to do this. Basically, your rails site does not allow another site to make a JS request. – sethi Jan 11 '18 at 06:33
  • but my ApplicationController don't have protect_from_forgery in there yet. – PKul Jan 11 '18 at 07:06
  • Yes.. it's in there by default.. http://api.rubyonrails.org/classes/ActionController/RequestForgeryProtection/ClassMethods.html – ilan berci Jan 11 '18 at 14:48
  • I updated result of your comment in my question. – PKul Jan 11 '18 at 20:47
  • Is it true that there is another site which is making this call? In that case i would actually suggest you to send render json: {url: url} and move the script onto the client side. Please check the documentation of inline it does not exactly mean the way you are using it.The browser wont run it even if you successfully send it. – sethi Jan 12 '18 at 02:43
  • I tried render js: "refresh.js" and put refresh.js in assets/javascript with function refresh() { window.location.replace('/') } and it start working, Not CSP error, Now I need to pass parameter (url) from controller to refresh.js any suggestion ? – PKul Jan 12 '18 at 04:54
  • @T.Kul please refer to this documentation http://guides.rubyonrails.org/layouts_and_rendering.html#using-render refresh.js is a asset file not a partial when you send js: "refresh.js" you are actually sending the string refresh.js as a string not the contents of refresh.js file(just an educated guess). How are you calling the refresh function when your receive the response? Can i see that code? – sethi Jan 12 '18 at 09:49
  • @sethi You correct, It's still not work. It' not complain because of the wrong rails , then I mistaken read it as 5.2. Yes I am learning. Thanks – PKul Jan 12 '18 at 23:00

0 Answers0