diff options
author | Piotr Sarnacki <drogus@gmail.com> | 2012-03-28 17:58:15 +0200 |
---|---|---|
committer | Piotr Sarnacki <drogus@gmail.com> | 2012-03-28 18:10:44 +0200 |
commit | db2c1354eb37bc2f5747a2b3faaa7964ed0df986 (patch) | |
tree | a02fd5336081348d7696924f274c93cd34ed7412 | |
parent | 84ca8c8cd07d700598e87b418370268f146b122c (diff) | |
download | rails-db2c1354eb37bc2f5747a2b3faaa7964ed0df986.tar.gz rails-db2c1354eb37bc2f5747a2b3faaa7964ed0df986.tar.bz2 rails-db2c1354eb37bc2f5747a2b3faaa7964ed0df986.zip |
Cover one more case in auth_token and remote forms
If embedding auth_token in remote forms is off and we
pass a value for auth_token it should respect it.
-rw-r--r-- | actionpack/lib/action_view/helpers/form_tag_helper.rb | 2 | ||||
-rw-r--r-- | actionpack/test/controller/request_forgery_protection_test.rb | 38 |
2 files changed, 23 insertions, 17 deletions
diff --git a/actionpack/lib/action_view/helpers/form_tag_helper.rb b/actionpack/lib/action_view/helpers/form_tag_helper.rb index 3fd91fed2d..066b98d4a2 100644 --- a/actionpack/lib/action_view/helpers/form_tag_helper.rb +++ b/actionpack/lib/action_view/helpers/form_tag_helper.rb @@ -622,7 +622,7 @@ module ActionView if html_options["data-remote"] && !embed_authenticity_token_in_remote_forms && - html_options["authenticity_token"] != true + html_options["authenticity_token"].blank? # The authenticity token is taken from the meta tag in this case html_options["authenticity_token"] = false elsif html_options["authenticity_token"] == true diff --git a/actionpack/test/controller/request_forgery_protection_test.rb b/actionpack/test/controller/request_forgery_protection_test.rb index 77c1fc4ed7..144003a59b 100644 --- a/actionpack/test/controller/request_forgery_protection_test.rb +++ b/actionpack/test/controller/request_forgery_protection_test.rb @@ -127,27 +127,33 @@ module RequestForgeryProtectionTests end def test_should_render_form_without_token_tag_if_remote_and_embedding_token_is_off - begin - ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = false - assert_not_blocked do - get :form_for_remote - end - assert_no_match(/authenticity_token/, response.body) - ensure - ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = true + ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = false + assert_not_blocked do + get :form_for_remote end + assert_no_match(/authenticity_token/, response.body) + ensure + ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = true end def test_should_render_form_with_token_tag_if_remote_and_embedding_token_is_off_but_true_option_passed - begin - ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = false - assert_not_blocked do - get :form_for_remote_with_token - end - assert_match(/authenticity_token/, response.body) - ensure - ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = true + ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = false + assert_not_blocked do + get :form_for_remote_with_token end + assert_match(/authenticity_token/, response.body) + ensure + ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = true + end + + def test_should_render_form_with_token_tag_if_remote_and_external_authenticity_token_requested_and_embedding_is_off + ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = false + assert_not_blocked do + get :form_for_remote_with_external_token + end + assert_select 'form>div>input[name=?][value=?]', 'custom_authenticity_token', 'external_token' + ensure + ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = true end def test_should_render_form_with_token_tag_if_remote_and_external_authenticity_token_requested |