Merge branch 'master' into sk-references-2

services/web/app.coffee

@@ -19,6 +19,10 @@ argv = require("optimist")
 	.argv
 
 Server.app.use (error, req, res, next) ->
+	if error?.code is 'EBADCSRFTOKEN'
+		logger.log err: error,url:req.url, method:req.method, user:req?.sesson?.user, "invalid csrf"
+		res.sendStatus(403)
+		return
 	logger.error err: error, url:req.url, method:req.method, user:req?.sesson?.user, "error passed to top level next middlewear"
 	res.statusCode = error.status or 500
 	if res.statusCode == 500

services/web/app/coffee/Features/Authentication/AuthenticationController.coffee

@@ -35,11 +35,11 @@ module.exports = AuthenticationController =
 						return next(error) if error?
 						req.session.justLoggedIn = true
 						logger.log email: email, user_id: user._id.toString(), "successful log in"
-						res.send redir: redir
+						res.json redir: redir
 				else
 					AuthenticationController._recordFailedLogin()
 					logger.log email: email, "failed log in"
-					res.send message:
+					res.json message:
 						text: req.i18n.translate("email_or_password_wrong_try_again"),
 						type: 'error'
 

services/web/package.json

@@ -27,7 +27,7 @@
     "http-proxy": "^1.8.1",
     "jade": "~1.3.1",
     "ldapjs": "^0.7.1",
-    "logger-sharelatex": "git+https://github.com/sharelatex/logger-sharelatex.git#v1.3.0",
+    "logger-sharelatex": "git+https://github.com/sharelatex/logger-sharelatex.git#v1.3.1",
     "lynx": "0.1.1",
     "marked": "^0.3.3",
     "method-override": "^2.3.3",

services/web/test/UnitTests/coffee/helpers/MockResponse.coffee

@@ -48,6 +48,20 @@ class MockResponse
 			@success = false
 		@body = body if body
 		@callback() if @callback?
+		
+	json: (status, body) ->
+		if arguments.length < 2
+			if typeof status != "number"
+				body = status
+				status = 200
+		@statusCode = status
+		@returned = true
+		if 200 <= status < 300
+			@success = true
+		else
+			@success = false
+		@body = body if body
+		@callback() if @callback?
 
 	setHeader: (header, value) ->
 		@headers[header] = value