diff options
author | Rick Olson <technoweenie@gmail.com> | 2007-09-23 02:32:55 +0000 |
---|---|---|
committer | Rick Olson <technoweenie@gmail.com> | 2007-09-23 02:32:55 +0000 |
commit | 4e3ed5bc44f6cd20c9e353ab63fd24b92a7942be (patch) | |
tree | 1904187d3254fdc42681471e67608615993a355d /actionpack/lib/action_view/helpers/prototype_helper.rb | |
parent | 3dea8b580b9c67bb27c01290fb3b17f446544b78 (diff) | |
download | rails-4e3ed5bc44f6cd20c9e353ab63fd24b92a7942be.tar.gz rails-4e3ed5bc44f6cd20c9e353ab63fd24b92a7942be.tar.bz2 rails-4e3ed5bc44f6cd20c9e353ab63fd24b92a7942be.zip |
Merge csrf_killer plugin into rails. Adds RequestForgeryProtection model that verifies session-specific _tokens for non-GET requests. [Rick]
git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@7592 5ecf4fe2-1ee6-0310-87b1-e25e094e27de
Diffstat (limited to 'actionpack/lib/action_view/helpers/prototype_helper.rb')
-rw-r--r-- | actionpack/lib/action_view/helpers/prototype_helper.rb | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/actionpack/lib/action_view/helpers/prototype_helper.rb b/actionpack/lib/action_view/helpers/prototype_helper.rb index cc8c5ad54f..df28a0395b 100644 --- a/actionpack/lib/action_view/helpers/prototype_helper.rb +++ b/actionpack/lib/action_view/helpers/prototype_helper.rb @@ -738,6 +738,15 @@ module ActionView elsif options[:with] js_options['parameters'] = options[:with] end + + if request_forgery_protection_token + if js_options['parameters'] + js_options['parameters'] << " + '&" + else + js_options['parameters'] = "'" + end + js_options['parameters'] << "_token=' + encodeURIComponent('#{escape_javascript form_token}')" + end options_for_javascript(js_options) end |