diff options
author | David Heinemeier Hansson <david@loudthinking.com> | 2012-03-14 19:03:39 -0400 |
---|---|---|
committer | David Heinemeier Hansson <david@loudthinking.com> | 2012-03-14 19:03:39 -0400 |
commit | 16ee611fad37b6b271088eda4cdbe3d6be088af1 (patch) | |
tree | c02d89f1d21b2ff37aace538f7e3c17ed06f3e5a /actionpack/lib/action_view/helpers/form_tag_helper.rb | |
parent | f2aea24d3b2c3aeabdab5ead632d68b97c76aa58 (diff) | |
download | rails-16ee611fad37b6b271088eda4cdbe3d6be088af1.tar.gz rails-16ee611fad37b6b271088eda4cdbe3d6be088af1.tar.bz2 rails-16ee611fad37b6b271088eda4cdbe3d6be088af1.zip |
Do not include the authenticity token in forms where remote: true as ajax forms use the meta-tag value
Diffstat (limited to 'actionpack/lib/action_view/helpers/form_tag_helper.rb')
-rw-r--r-- | actionpack/lib/action_view/helpers/form_tag_helper.rb | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/actionpack/lib/action_view/helpers/form_tag_helper.rb b/actionpack/lib/action_view/helpers/form_tag_helper.rb index e3ad96ec1b..74b6034c8d 100644 --- a/actionpack/lib/action_view/helpers/form_tag_helper.rb +++ b/actionpack/lib/action_view/helpers/form_tag_helper.rb @@ -609,8 +609,15 @@ module ActionView # responsibility of the caller to escape all the values. html_options["action"] = url_for(url_for_options) html_options["accept-charset"] = "UTF-8" - html_options["data-remote"] = true if html_options.delete("remote") - html_options["authenticity_token"] = html_options.delete("authenticity_token") if html_options.has_key?("authenticity_token") + + if html_options.delete("remote") + html_options["data-remote"] = true + + # The authenticity token is taken from the meta tag in this case + html_options["authenticity_token"] = false + else + html_options["authenticity_token"] = html_options.delete("authenticity_token") if html_options.has_key?("authenticity_token") + end end end |