github/rails
1
1
Fork 0
mirror of https://github.com/github/rails.git synced 2026-01-10 07:07:54 -05:00
Code Issues Packages Projects Releases Wiki Activity

Cover one more case in auth_token and remote forms

Browse Source 
If embedding auth_token in remote forms is off and we
pass a value for auth_token it should respect it.
This commit is contained in:
Piotr Sarnacki
2012-03-28 17:58:15 +02:00
parent 1b9fd797b3
commit d5980b5f52
2 changed files with 23 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
actionpack/lib/action_view/helpers/form_tag_helper.rb
View File

@@ -622,7 +622,7 @@ module ActionView
if html_options["data-remote"] &&
!embed_authenticity_token_in_remote_forms &&
html_options["authenticity_token"] != true
html_options["authenticity_token"].blank?
# The authenticity token is taken from the meta tag in this case
html_options["authenticity_token"] = false
elsif html_options["authenticity_token"] == true

38
actionpack/test/controller/request_forgery_protection_test.rb
View File

@@ -127,27 +127,33 @@ module RequestForgeryProtectionTests
end
def test_should_render_form_without_token_tag_if_remote_and_embedding_token_is_off
begin
ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = false
assert_not_blocked do
get :form_for_remote
end
assert_no_match(/authenticity_token/, response.body)
ensure
ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = true
ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = false
assert_not_blocked do
get :form_for_remote
end
assert_no_match(/authenticity_token/, response.body)
ensure
ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = true
end
def test_should_render_form_with_token_tag_if_remote_and_embedding_token_is_off_but_true_option_passed
begin
ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = false
assert_not_blocked do
get :form_for_remote_with_token
end
assert_match(/authenticity_token/, response.body)
ensure
ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = true
ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = false
assert_not_blocked do
get :form_for_remote_with_token
end
assert_match(/authenticity_token/, response.body)
ensure
ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = true
end
def test_should_render_form_with_token_tag_if_remote_and_external_authenticity_token_requested_and_embedding_is_off
ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = false
assert_not_blocked do
get :form_for_remote_with_external_token
end
assert_select 'form>div>input[name=?][value=?]', 'custom_authenticity_token', 'external_token'
ensure
ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = true
end
def test_should_render_form_with_token_tag_if_remote_and_external_authenticity_token_requested