Daniel Axtens
4d85c27d1a
Several controlers set quite intricate Cache-Control headers in order to hopefully not be cached by any intermediate proxies or local caches. Unfortunately, these headers are processed by ActionDispatch::HTTP::Cache in a way that squashes and discards any values set alongside no-store other than private: https://github.com/rails/rails/blob/8015c2c2cf5c8718449677570f372ceb01318a32/actionpack/lib/action_dispatch/http/cache.rb#L207-L209 We want to preserve no-store on these responses, but we might as well remove parts that are going to be dropped anyway. As many of the endpoints in these controllers are private to a particular user, we should also add "private", which will be preserved alongside no-store.
24 lines
453 B
Ruby
24 lines
453 B
Ruby
# frozen_string_literal: true
|
|
|
|
class Settings::BaseController < ApplicationController
|
|
layout 'admin'
|
|
|
|
before_action :authenticate_user!
|
|
before_action :set_body_classes
|
|
before_action :set_cache_headers
|
|
|
|
private
|
|
|
|
def set_body_classes
|
|
@body_classes = 'admin'
|
|
end
|
|
|
|
def set_cache_headers
|
|
response.headers['Cache-Control'] = 'private, no-store'
|
|
end
|
|
|
|
def require_not_suspended!
|
|
forbidden if current_account.suspended?
|
|
end
|
|
end
|