BUGZZZ

jaspermayone · jaspermayone · commit 2b5efd26507a · 2026-06-17T22:48:59.000-04:00
diff --git a/app/controllers/admin/faculties_controller.rb b/app/controllers/admin/faculties_controller.rb
@@ -30,6 +30,7 @@ def show
     end
 
     def missing_rmp_ids
+      authorize Faculty, :missing_rmp_ids?
       @faculties = policy_scope(Faculty).with_courses.where(rmp_id: nil).order(:last_name, :first_name)
 
       if params[:search].present?
diff --git a/app/controllers/errors_controller.rb b/app/controllers/errors_controller.rb
@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 class ErrorsController < ApplicationController
+  layout false
+
   def unauthorized
     render status: :forbidden
   end
diff --git a/app/views/layouts/admin.html.erb b/app/views/layouts/admin.html.erb
@@ -3,7 +3,6 @@
 <head>
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
-  <meta name="csrf-token" content="<%= form_authenticity_token %>">
   <title><%= content_for(:title) { "Admin" } %> — WIT Calendar</title>
   <%= csrf_meta_tags %>
   <%= csp_meta_tag %>
diff --git a/config/initializers/rack_attack.rb b/config/initializers/rack_attack.rb
@@ -112,14 +112,12 @@ class Rack::Attack
   # ===========================================================================
 
   throttle("admin/session", limit: 1000, period: 5.minutes) do |req|
-    if req.path.start_with?("/admin")
-      req.session[:session_id] || req.cookies["_session_id"]
-    end
+    req.cookies["_calendar_session"] if req.path.start_with?("/admin")
   end
 
   throttle("admin/destructive", limit: 100, period: 1.minute) do |req|
     if req.path.start_with?("/admin") && (req.delete? || req.path.include?("revoke") || req.path.include?("destroy"))
-      req.session[:session_id] || req.cookies["_session_id"]
+      req.cookies["_calendar_session"]
     end
   end
 
