diff options
author | David Heinemeier Hansson <david@loudthinking.com> | 2012-03-14 19:28:36 -0400 |
---|---|---|
committer | David Heinemeier Hansson <david@loudthinking.com> | 2012-03-14 19:28:36 -0400 |
commit | e50abbad4f4141642bf5c4c27ec77852803a3a72 (patch) | |
tree | b3321bfaef0ba23d9987b18fdd11edff3a58bbfd /actionpack/lib/action_view | |
parent | 16ee611fad37b6b271088eda4cdbe3d6be088af1 (diff) | |
download | rails-e50abbad4f4141642bf5c4c27ec77852803a3a72.tar.gz rails-e50abbad4f4141642bf5c4c27ec77852803a3a72.tar.bz2 rails-e50abbad4f4141642bf5c4c27ec77852803a3a72.zip |
Allow you to force the authenticity_token to be rendered even on remote forms if you pass true
Diffstat (limited to 'actionpack/lib/action_view')
-rw-r--r-- | actionpack/lib/action_view/helpers/form_tag_helper.rb | 14 |
1 files changed, 9 insertions, 5 deletions
diff --git a/actionpack/lib/action_view/helpers/form_tag_helper.rb b/actionpack/lib/action_view/helpers/form_tag_helper.rb index 74b6034c8d..4ce878f26a 100644 --- a/actionpack/lib/action_view/helpers/form_tag_helper.rb +++ b/actionpack/lib/action_view/helpers/form_tag_helper.rb @@ -27,7 +27,9 @@ module ActionView # is added to simulate the verb over post. # * <tt>:authenticity_token</tt> - Authenticity token to use in the form. Use only if you need to # pass custom authenticity token string, or to not add authenticity_token field at all - # (by passing <tt>false</tt>). + # (by passing <tt>false</tt>). If this is a remote form, the authenticity_token will by default + # not be included as the ajax handler will get it from the meta-tag (but you can force it to be + # rendered anyway in that case by passing <tt>true</tt>). # * A list of parameters to feed to the URL the form will be posted to. # * <tt>:remote</tt> - If set to true, will allow the Unobtrusive JavaScript drivers to control the # submit behavior. By default this behavior is an ajax submit. @@ -610,13 +612,15 @@ module ActionView html_options["action"] = url_for(url_for_options) html_options["accept-charset"] = "UTF-8" - if html_options.delete("remote") - html_options["data-remote"] = true + html_options["data-remote"] = true if html_options.delete("remote") + if html_options["data-remote"] && html_options["authenticity_token"] == true + # Include the default authenticity_token, which is only generated when its set to nil, + # but we needed the true value to override the default of no authenticity_token on data-remote. + html_options["authenticity_token"] = nil + elsif html_options["data-remote"] # The authenticity token is taken from the meta tag in this case html_options["authenticity_token"] = false - else - html_options["authenticity_token"] = html_options.delete("authenticity_token") if html_options.has_key?("authenticity_token") end end end |