diff options
author | David Heinemeier Hansson <david@loudthinking.com> | 2007-09-25 16:50:35 +0000 |
---|---|---|
committer | David Heinemeier Hansson <david@loudthinking.com> | 2007-09-25 16:50:35 +0000 |
commit | 82c1fed89fe6dae8f44b6647dd94fc68f01eaa81 (patch) | |
tree | 481c9021fa02f203b2cbba797ff45100f19c6dd8 /actionpack/lib/action_view | |
parent | 106b236824bbdf1cc9675b9531bac0c30a1926b0 (diff) | |
download | rails-82c1fed89fe6dae8f44b6647dd94fc68f01eaa81.tar.gz rails-82c1fed89fe6dae8f44b6647dd94fc68f01eaa81.tar.bz2 rails-82c1fed89fe6dae8f44b6647dd94fc68f01eaa81.zip |
Protect button_to behind protect_from_forgery (closes #9675) [lifo]
git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@7636 5ecf4fe2-1ee6-0310-87b1-e25e094e27de
Diffstat (limited to 'actionpack/lib/action_view')
-rw-r--r-- | actionpack/lib/action_view/helpers/url_helper.rb | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/actionpack/lib/action_view/helpers/url_helper.rb b/actionpack/lib/action_view/helpers/url_helper.rb index 96e4fdda48..490b2c1215 100644 --- a/actionpack/lib/action_view/helpers/url_helper.rb +++ b/actionpack/lib/action_view/helpers/url_helper.rb @@ -201,7 +201,12 @@ module ActionView end form_method = method.to_s == 'get' ? 'get' : 'post' - + + request_token_tag = '' + if form_method == 'post' && request_forgery_protection_token + request_token_tag = tag(:input, :type => "hidden", :name => request_forgery_protection_token.to_s, :value => form_authenticity_token) + end + if confirm = html_options.delete("confirm") html_options["onclick"] = "return #{confirm_javascript_function(confirm)};" end @@ -212,7 +217,7 @@ module ActionView html_options.merge!("type" => "submit", "value" => name) "<form method=\"#{form_method}\" action=\"#{escape_once url}\" class=\"button-to\"><div>" + - method_tag + tag("input", html_options) + "</div></form>" + method_tag + tag("input", html_options) + request_token_tag + "</div></form>" end |