Merge Session stuff into RackConvenience

1 files changed, 16 insertions, 16 deletions

diff --git a/actionpack/lib/action_controller/metal/request_forgery_protection.rb b/actionpack/lib/action_controller/metal/request_forgery_protection.rb
index 173df79ee7..2826b1e34c 100644
--- a/actionpack/lib/action_controller/metal/request_forgery_protection.rb
+++ b/actionpack/lib/action_controller/metal/request_forgery_protection.rb
@@ -5,7 +5,7 @@ module ActionController #:nodoc:
   module RequestForgeryProtection
     extend ActiveSupport::Concern
 
-    include AbstractController::Helpers, Session
+    include AbstractController::Helpers
 
     included do
       # Sets the token parameter name for RequestForgery. Calling +protect_from_forgery+
@@ -19,31 +19,31 @@ module ActionController #:nodoc:
       helper_method :form_authenticity_token
       helper_method :protect_against_forgery?
     end
-    
-    # Protecting controller actions from CSRF attacks by ensuring that all forms are coming from the current 
-    # web application, not a forged link from another site, is done by embedding a token based on a random 
+
+    # Protecting controller actions from CSRF attacks by ensuring that all forms are coming from the current
+    # web application, not a forged link from another site, is done by embedding a token based on a random
     # string stored in the session (which an attacker wouldn't know) in all forms and Ajax requests generated
-    # by Rails and then verifying the authenticity of that token in the controller.  Only HTML/JavaScript 
-    # requests are checked, so this will not protect your XML API (presumably you'll have a different 
-    # authentication scheme there anyway).  Also, GET requests are not protected as these should be 
+    # by Rails and then verifying the authenticity of that token in the controller.  Only HTML/JavaScript
+    # requests are checked, so this will not protect your XML API (presumably you'll have a different
+    # authentication scheme there anyway).  Also, GET requests are not protected as these should be
     # idempotent anyway.
     #
     # This is turned on with the <tt>protect_from_forgery</tt> method, which will check the token and raise an
-    # ActionController::InvalidAuthenticityToken if it doesn't match what was expected. You can customize the 
+    # ActionController::InvalidAuthenticityToken if it doesn't match what was expected. You can customize the
     # error message in production by editing public/422.html.  A call to this method in ApplicationController is
     # generated by default in post-Rails 2.0 applications.
     #
-    # The token parameter is named <tt>authenticity_token</tt> by default. If you are generating an HTML form 
-    # manually (without the use of Rails' <tt>form_for</tt>, <tt>form_tag</tt> or other helpers), you have to 
-    # include a hidden field named like that and set its value to what is returned by 
+    # The token parameter is named <tt>authenticity_token</tt> by default. If you are generating an HTML form
+    # manually (without the use of Rails' <tt>form_for</tt>, <tt>form_tag</tt> or other helpers), you have to
+    # include a hidden field named like that and set its value to what is returned by
     # <tt>form_authenticity_token</tt>.
     #
-    # Request forgery protection is disabled by default in test environment. If you are upgrading from Rails 
+    # Request forgery protection is disabled by default in test environment. If you are upgrading from Rails
     # 1.x, add this to config/environments/test.rb:
     #
     #   # Disable request forgery protection in test environment
     #   config.action_controller.allow_forgery_protection = false
-    # 
+    #
     # == Learn more about CSRF (Cross-Site Request Forgery) attacks
     #
     # Here are some resources:
@@ -52,11 +52,11 @@ module ActionController #:nodoc:
     #
     # Keep in mind, this is NOT a silver-bullet, plug 'n' play, warm security blanket for your rails application.
     # There are a few guidelines you should follow:
-    # 
+    #
     # * Keep your GET requests safe and idempotent.  More reading material:
     #   * http://www.xml.com/pub/a/2002/04/24/deviant.html
     #   * http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9.1.1
-    #   * Make sure the session cookies that Rails creates are non-persistent.  Check in Firefox and look 
+    #   * Make sure the session cookies that Rails creates are non-persistent.  Check in Firefox and look
     #     for "Expires: at end of session"
     #
     module ClassMethods
@@ -92,7 +92,7 @@ module ActionController #:nodoc:
       # * is it a GET request?  Gets should be safe and idempotent
       # * Does the form_authenticity_token match the given token value from the params?
       def verified_request?
-        !protect_against_forgery? || request.forgery_whitelisted? || 
+        !protect_against_forgery? || request.forgery_whitelisted? ||
           form_authenticity_token == params[request_forgery_protection_token]
       end