diff options
author | David Heinemeier Hansson <david@loudthinking.com> | 2012-03-14 19:03:39 -0400 |
---|---|---|
committer | David Heinemeier Hansson <david@loudthinking.com> | 2012-03-14 19:08:34 -0400 |
commit | a4c120f165c5a0b7976ba72638261c3342364e38 (patch) | |
tree | 1154cd77870aac85e05a11f6372929349590bdad /actionpack/lib | |
parent | e1824c5991f0e694cf041c3aacd43a53ce97b0dd (diff) | |
download | rails-a4c120f165c5a0b7976ba72638261c3342364e38.tar.gz rails-a4c120f165c5a0b7976ba72638261c3342364e38.tar.bz2 rails-a4c120f165c5a0b7976ba72638261c3342364e38.zip |
Do not include the authenticity token in forms where remote: true as ajax forms use the meta-tag value
Diffstat (limited to 'actionpack/lib')
-rw-r--r-- | actionpack/lib/action_view/helpers/form_tag_helper.rb | 11 |
1 files changed, 9 insertions, 2 deletions
diff --git a/actionpack/lib/action_view/helpers/form_tag_helper.rb b/actionpack/lib/action_view/helpers/form_tag_helper.rb index 9fad30a48f..696688a5dd 100644 --- a/actionpack/lib/action_view/helpers/form_tag_helper.rb +++ b/actionpack/lib/action_view/helpers/form_tag_helper.rb @@ -616,8 +616,15 @@ module ActionView # responsibility of the caller to escape all the values. html_options["action"] = url_for(url_for_options) html_options["accept-charset"] = "UTF-8" - html_options["data-remote"] = true if html_options.delete("remote") - html_options["authenticity_token"] = html_options.delete("authenticity_token") if html_options.has_key?("authenticity_token") + + if html_options.delete("remote") + html_options["data-remote"] = true + + # The authenticity token is taken from the meta tag in this case + html_options["authenticity_token"] = false + else + html_options["authenticity_token"] = html_options.delete("authenticity_token") if html_options.has_key?("authenticity_token") + end end end |