require 'evidence_query_string_parser'
require 'evidence_query_string_builder'

class SelectPhoneController < ApplicationController
  def index
    @form = SelectPhoneForm.new({})
  end

  def select_phone
    ANALYTICS_REPORTER.report(request, 'Select Phone Next')
    @form = SelectPhoneForm.new(params[:select_phone_form] || {})
    if @form.valid?
      selected_evidence = @form.selected_evidence.concat EvidenceQueryStringParser.parse(request.query_string)
      if IDP_ELIGIBILITY_CHECKER.any?(selected_evidence, available_idps)
        uri = URI(will_it_work_for_me_path)
        uri.query = EvidenceQueryStringBuilder.build(selected_evidence)
        redirect_to uri.to_s
      else
        redirect_to no_mobile_phone_path
      end
    else
      flash.now[:errors] = @form.errors.full_messages.join(', ')
      render :index
    end
  end

private

  def available_idps
    SESSION_PROXY.federation_info_for_session(cookies).idps.collect { |idp| idp['simpleId'] }
  end
end

require 'evidence_query_string_parser'
require 'evidence_query_string_builder'

class SelectPhoneController < ApplicationController
  protect_from_forgery except: :select_phone

  def index
    @form = SelectPhoneForm.new({})
  end

  def select_phone
    ANALYTICS_REPORTER.report(request, 'Select Phone Next')
    @form = SelectPhoneForm.new(params[:select_phone_form] || {})
    if @form.valid?
      selected_evidence = @form.selected_evidence.concat EvidenceQueryStringParser.parse(request.query_string)
      if IDP_ELIGIBILITY_CHECKER.any?(selected_evidence, available_idps)
        uri = URI(will_it_work_for_me_path)
        uri.query = EvidenceQueryStringBuilder.build(selected_evidence)
        redirect_to uri.to_s
      else
        redirect_to no_mobile_phone_path
      end
    else
      flash.now[:errors] = @form.errors.full_messages.join(', ')
      render :index
    end
  end

private

  def available_idps
    SESSION_PROXY.federation_info_for_session(cookies).idps.collect { |idp| idp['simpleId'] }
  end
end

Disable CSRF protection on select-phone form
3491: Disable CSRF protection on select-phone form

This is so that requests from old frontend wont be rejected because they
do not contain the csrf value.

Authors: 4128f4e12f262ed8971b6235be968af8ca8e7344@vixus0
