Protect google_calendar_service.import_controller route against against Denial of Service

danrod → credited prudloff → .

Thanks a lot to @prudloff for reporting this issue.

After some thinking, I've decided to just disable the importing of all the calendar events at /calendar/all/import and let the user to sync their calendars at /admin/calendar, there's already a cron hook that imports all the events from all the calendars that can be run at midnight and allowing the user to do it from /calendar/all/import it's an invitation for a potential DoS.

Now, all the requests to /calendar/all/import will go to /admin/calendar.

I still added CSRF tokens for importe single calendars, for example: http://example.com/admin/calendar/1/import?token=Pe1Mz72klJE5yeV9xMaksh32Xj_Kl8FYH_yOyLnbW40

Ready for review.

I'll close this issue and mark it as "Fixed" for now, any anyone has any questions/concerns about this fix, please let me know and I'll re-open the task.

Automatically closed - issue fixed for 2 weeks with no activity.