Permalink
Browse files

Do not include the authenticity token in forms where remote: true as …

…ajax forms use the meta-tag value
  • Loading branch information...
1 parent e1824c5 commit a4c120f165c5a0b7976ba72638261c3342364e38 @dhh dhh committed Mar 14, 2012
View
@@ -89,6 +89,9 @@
* check_box with `:form` html5 attribute will now replicate the `:form`
attribute to the hidden field as well. *Carlos Antonio da Silva*
+* Turn off verbose mode of rack-cache, we still have X-Rack-Cache to
+ check that info. Closes #5245. *Santiago Pastorino*
+
* `label` form helper accepts :for => nil to not generate the attribute. *Carlos Antonio da Silva*
* Add `:format` option to number_to_percentage *Rodrigo Flores*
@@ -123,6 +126,8 @@
## Rails 3.2.3 (unreleased) ##
+* Do not include the authenticity token in forms where remote: true as ajax forms use the meta-tag value *DHH*
+
* Upgrade rack-cache to 1.2. *José Valim*
* ActionController::SessionManagement is removed. *Santiago Pastorino*
@@ -616,8 +616,15 @@ def html_options_for_form(url_for_options, options)
# responsibility of the caller to escape all the values.
html_options["action"] = url_for(url_for_options)
html_options["accept-charset"] = "UTF-8"
- html_options["data-remote"] = true if html_options.delete("remote")
- html_options["authenticity_token"] = html_options.delete("authenticity_token") if html_options.has_key?("authenticity_token")
+
+ if html_options.delete("remote")
+ html_options["data-remote"] = true
+
+ # The authenticity token is taken from the meta tag in this case
+ html_options["authenticity_token"] = false
+ else
+ html_options["authenticity_token"] = html_options.delete("authenticity_token") if html_options.has_key?("authenticity_token")
+ end
end
end
@@ -35,6 +35,12 @@ def external_form_for
def form_for_without_protection
render :inline => "<%= form_for(:some_resource, :authenticity_token => false ) {} %>"
end
+
+ def form_for_remote
+ render :inline => "<%= form_for(:some_resource, :remote => true ) {} %>"
+ end
+
+ def rescue_action(e) raise e end
end
# sample controllers
@@ -98,6 +104,13 @@ def test_should_render_button_to_with_token_tag
assert_select 'form>div>input[name=?][value=?]', 'custom_authenticity_token', @token
end
+ def test_should_render_form_without_token_tag_if_remote
+ assert_not_blocked do
+ get :form_for_remote
+ end
+ assert_no_match /authenticity_token/, response.body
+ end
+
def test_should_allow_get
assert_not_blocked { get :index }
end

4 comments on commit a4c120f

Contributor

pacoguzman replied Mar 15, 2012

What happens now if the client has javascript disabled?

Member

drogus replied Mar 15, 2012

@pacoguzman this is new default behavior, but there should be an option to explicitly enable auth token, I will push fix shortly

Member

drogus replied Mar 15, 2012

@pacoguzman actually it was added in one of the next commits: e884f4b, you can past :authenticity_token => ture if you want it to work without javascript

Contributor

pacoguzman replied Mar 16, 2012

@drogus yep, that commit resolve it. Thanks

Please sign in to comment.