panda_pal 2.0.2 → 2.0.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: dec363ec0b5ca735237ea01b194dda78320eadf5
-  data.tar.gz: 397cf50a70cac0e961a96f01f95ee2eea8666f9d
+  metadata.gz: 894962973c1c791c1cc756014123e94abb43e471
+  data.tar.gz: a6ce46be2f4676c03d38c23e65579376a0094750
 SHA512:
-  metadata.gz: 8f3a1e05a1ac97b39816a77f7c29c587ff252b148a683ae1139821c883ecbf7368a9abdf6b21280292c85732df785d132e3e5c474798346be18ab9feff85e1ff
-  data.tar.gz: 82789e5edf44b8dd4a1ec30e1f70b70b662f5ed8657265490900d8c3fdcd3c40fa6258805c38057454833ee4efae01b27b0b33a3cdcb8c7a6408ad394000f9e3
+  metadata.gz: 12542132e7b4ad67657805aded0c7ae44933af03baf23d7b9318156e08985e3ee8823e4e5739ab127914adfd603cc03f58e73698ebcad6baa52a4476fb5afb5a
+  data.tar.gz: 82030c6a2c4c1b82871ac2dd74334462528d6215742ed84e17aa67f5fd0a71ae881ae4f49c1f1e4b5682892aa9cfecee2f7ed3ee3b4410406164f22ef49e3221

data/app/views/panda_pal/lti/iframe_cookie_fix.html.erb

@@ -0,0 +1,4 @@
+<script>
+  var referrer = document.referrer;
+  top.window.location='?safari_cookie_fix=true&return_to='.concat(encodeURI(referrer));
+</script>

data/lib/panda_pal/helpers/controller_helper.rb

@@ -1,3 +1,5 @@
+require 'browser'
+
 module PandaPal::Helpers::ControllerHelper
   def save_session
     current_session.try(:save)
@@ -41,8 +43,29 @@ module PandaPal::Helpers::ControllerHelper
     end
   end
 
+  # Browsers that prevent 3rd party cookies by default (Safari and IE) run into problems
+  # with CSRF handling because the Rails session cookie isn't set. To fix this, we
+  # redirect the current page to the LTI using JavaScript, which will set the cookie,
+  # and then immediately redirect back to Canvas.
+  def fix_iframe_cookies
+    if params[:safari_cookie_fix].present?
+      session[:safari_cookie_fixed] = true
+      redirect_to params[:return_to]
+    else
+      render 'panda_pal/lti/iframe_cookie_fix', layout: false
+    end
+  end
+
+  def cookies_need_iframe_fix?
+    (browser.safari? || browser.ie?) && !request.referrer.include?('sessionless_launch') && !session[:safari_cookie_fixed]
+  end
+
   def forbid_access_if_lacking_session
-    render plain: 'You should do an LTI Tool Launch.', status: :unauthorized unless valid_session?
+    if cookies_need_iframe_fix?
+      fix_iframe_cookies
+    else
+      render plain: 'You should do an LTI Tool Launch.', status: :unauthorized unless valid_session?
+    end
   end
 
   def valid_session?

data/lib/panda_pal/version.rb

@@ -1,3 +1,3 @@
 module PandaPal
-  VERSION = "2.0.2"
+  VERSION = "2.0.3"
 end

data/panda_pal.gemspec

@@ -19,6 +19,7 @@ Gem::Specification.new do |s|
   s.add_dependency "pg", '~> 0.20'
   s.add_dependency 'apartment', '~> 1.2.0'
   s.add_dependency 'ims-lti', '~> 2.1.0'
+  s.add_dependency 'browser', '2.5.0'
 
   s.add_development_dependency 'rspec-rails'
   s.add_development_dependency 'factory_girl_rails'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: panda_pal
 version: !ruby/object:Gem::Version
-  version: 2.0.2
+  version: 2.0.3
 platform: ruby
 authors:
 - Ben Young
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-06-14 00:00:00.000000000 Z
+date: 2017-08-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -67,6 +67,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 2.1.0
+- !ruby/object:Gem::Dependency
+  name: browser
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 2.5.0
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - '='
+      - !ruby/object:Gem::Version
+        version: 2.5.0
 - !ruby/object:Gem::Dependency
   name: rspec-rails
   requirement: !ruby/object:Gem::Requirement
@@ -129,6 +143,7 @@ files:
 - app/models/panda_pal/organization.rb
 - app/models/panda_pal/session.rb
 - app/views/layouts/panda_pal/application.html.erb
+- app/views/panda_pal/lti/iframe_cookie_fix.html.erb
 - app/views/panda_pal/lti/launch.html.erb
 - config/initializers/apartment.rb
 - config/routes.rb
@@ -209,7 +224,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.2.2
+rubygems_version: 2.5.2
 signing_key: 
 specification_version: 4
 summary: LTI mountable engine
@@ -258,4 +273,3 @@ test_files:
 - spec/models/panda_pal/session_spec.rb
 - spec/rails_helper.rb
 - spec/spec_helper.rb
-has_rdoc: