Permalink
Browse files

Allow you to force the authenticity_token to be rendered even on remo…

…te forms if you pass true
  • Loading branch information...
1 parent a4c120f commit e884f4b6b7440ccbeec2149669f34d2a2c14d4fb @dhh dhh committed Mar 14, 2012
@@ -27,7 +27,9 @@ module FormTagHelper
# is added to simulate the verb over post.
# * <tt>:authenticity_token</tt> - Authenticity token to use in the form. Use only if you need to
# pass custom authenticity token string, or to not add authenticity_token field at all
- # (by passing <tt>false</tt>).
+ # (by passing <tt>false</tt>). If this is a remote form, the authenticity_token will by default
+ # not be included as the ajax handler will get it from the meta-tag (but you can force it to be
+ # rendered anyway in that case by passing <tt>true</tt>).
# * A list of parameters to feed to the URL the form will be posted to.
# * <tt>:remote</tt> - If set to true, will allow the Unobtrusive JavaScript drivers to control the
# submit behavior. By default this behavior is an ajax submit.
@@ -617,13 +619,15 @@ def html_options_for_form(url_for_options, options)
html_options["action"] = url_for(url_for_options)
html_options["accept-charset"] = "UTF-8"
- if html_options.delete("remote")
- html_options["data-remote"] = true
+ html_options["data-remote"] = true if html_options.delete("remote")
+ if html_options["data-remote"] && html_options["authenticity_token"] == true
+ # Include the default authenticity_token, which is only generated when its set to nil,
+ # but we needed the true value to override the default of no authenticity_token on data-remote.
+ html_options["authenticity_token"] = nil
+ elsif html_options["data-remote"]
# The authenticity token is taken from the meta tag in this case
html_options["authenticity_token"] = false
- else
- html_options["authenticity_token"] = html_options.delete("authenticity_token") if html_options.has_key?("authenticity_token")
end
end
end
@@ -40,6 +40,10 @@ def form_for_remote
render :inline => "<%= form_for(:some_resource, :remote => true ) {} %>"
end
+ def form_for_remote_with_token
+ render :inline => "<%= form_for(:some_resource, :remote => true, :authenticity_token => true ) {} %>"
+ end
+
def rescue_action(e) raise e end
end
@@ -111,6 +115,13 @@ def test_should_render_form_without_token_tag_if_remote
assert_no_match /authenticity_token/, response.body
end
+ def test_should_render_form_with_token_tag_if_remote_and_authenticity_token_requested
+ assert_not_blocked do
+ get :form_for_remote_with_token
+ end
+ assert_select 'form>div>input[name=?][value=?]', 'custom_authenticity_token', @token
+ end
+
def test_should_allow_get
assert_not_blocked { get :index }
end

0 comments on commit e884f4b

Please sign in to comment.