X-Git-Url: https://git.openstreetmap.org./rails.git/blobdiff_plain/fd6f00b069af5a7b87227ea4c3401dc461d7311a..1a2f6c29c6d1d0fa7b2d23715dde78936c3bc8e5:/app/controllers/user_preference_controller.rb

diff --git a/app/controllers/user_preference_controller.rb b/app/controllers/user_preference_controller.rb
index 59573047a..377e78313 100644
--- a/app/controllers/user_preference_controller.rb
+++ b/app/controllers/user_preference_controller.rb
@@ -1,6 +1,9 @@
 # Update and read user preferences, which are arbitrayr key/val pairs
 class UserPreferenceController < ApplicationController
+  skip_before_filter :verify_authenticity_token
   before_filter :authorize
+  before_filter :require_allow_read_prefs, :only => [:read_one, :read]
+  before_filter :require_allow_write_prefs, :except => [:read_one, :read]
 
   def read_one
     pref = UserPreference.find(@user.id, params[:preference_key])