diff options
| author | Santiago Pastorino <santiago@wyeworks.com> | 2014-03-08 15:22:42 -0200 |
|---|---|---|
| committer | Santiago Pastorino <santiago@wyeworks.com> | 2014-03-08 15:22:42 -0200 |
| commit | 2af7a7b19cd7735530f5fd4762896694f5955051 (patch) | |
| tree | 9324445c7bd58aa3d53ed5a5a2e7dd92bb7f9652 /actionpack/lib | |
| parent | dc8bfc8ab62c3e3a776297226ef43027bc7d09c1 (diff) | |
| parent | 67584c6ae37c88f8abba6f4fbdeedc7c1a6dfa1b (diff) | |
| download | rails-2af7a7b19cd7735530f5fd4762896694f5955051.tar.gz rails-2af7a7b19cd7735530f5fd4762896694f5955051.tar.bz2 rails-2af7a7b19cd7735530f5fd4762896694f5955051.zip | |
Merge pull request #14280 from joho/make_csrf_failure_logging_optional
Make CSRF failure logging optional/configurable.
Diffstat (limited to 'actionpack/lib')
| -rw-r--r-- | actionpack/lib/action_controller/metal/request_forgery_protection.rb | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/actionpack/lib/action_controller/metal/request_forgery_protection.rb b/actionpack/lib/action_controller/metal/request_forgery_protection.rb index c88074d4c6..e3b1f5ae7c 100644 --- a/actionpack/lib/action_controller/metal/request_forgery_protection.rb +++ b/actionpack/lib/action_controller/metal/request_forgery_protection.rb @@ -68,6 +68,10 @@ module ActionController #:nodoc: config_accessor :allow_forgery_protection self.allow_forgery_protection = true if allow_forgery_protection.nil? + # Controls whether a CSRF failure logs a warning. On by default. + config_accessor :log_warning_on_csrf_failure + self.log_warning_on_csrf_failure = true + helper_method :form_authenticity_token helper_method :protect_against_forgery? end @@ -193,7 +197,9 @@ module ActionController #:nodoc: mark_for_same_origin_verification! if !verified_request? - logger.warn "Can't verify CSRF token authenticity" if logger + if logger && log_warning_on_csrf_failure + logger.warn "Can't verify CSRF token authenticity" + end handle_unverified_request end end |