config.action_view.embed_authenticity_token_in_remote_forms is true by default

Changed default value for `config.action_view.embed_authenticity_token_in_remote_forms`
to `false`. This change breaks remote forms that need to work also without javascript,
so if you need such behavior, you can either set it to `true` or explicitly pass
`:authenticity_token => true` in form options

1 files changed, 14 insertions, 19 deletions

diff --git a/actionpack/test/controller/request_forgery_protection_test.rb b/actionpack/test/controller/request_forgery_protection_test.rb
index 7ded9ddc81..89f605b5ad 100644
--- a/actionpack/test/controller/request_forgery_protection_test.rb
+++ b/actionpack/test/controller/request_forgery_protection_test.rb
@@ -116,42 +116,37 @@ module RequestForgeryProtectionTests
     assert_select 'form>div>input[name=?][value=?]', 'custom_authenticity_token', @token
   end
 
-  def test_should_render_form_with_token_tag_if_remote
+  def test_should_render_form_without_token_tag_if_remote
     assert_not_blocked do
       get :form_for_remote
     end
-    assert_match(/authenticity_token/, response.body)
+    assert_no_match(/authenticity_token/, response.body)
   end
 
-  def test_should_render_form_without_token_tag_if_remote_and_embedding_token_is_off
+  def test_should_render_form_with_token_tag_if_remote_and_embedding_token_is_on
+    original = ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms
     begin
-      ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = false
+      ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = true
       assert_not_blocked do
         get :form_for_remote
       end
-      assert_no_match(/authenticity_token/, response.body)
+      assert_match(/authenticity_token/, response.body)
     ensure
-      ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = true
+      ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = original
     end
   end
 
-  def test_should_render_form_with_token_tag_if_remote_and_embedding_token_is_off_but_true_option_passed
-     begin
-      ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = false
+  def test_should_render_form_with_token_tag_if_remote_and_external_authenticity_token_requested_and_embedding_is_on
+    original = ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms
+    begin
+      ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = true
       assert_not_blocked do
-        get :form_for_remote_with_token
+        get :form_for_remote_with_external_token
       end
-      assert_match(/authenticity_token/, response.body)
+      assert_select 'form>div>input[name=?][value=?]', 'custom_authenticity_token', 'external_token'
     ensure
-      ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = true
-    end
-  end
-
-  def test_should_render_form_with_token_tag_if_remote_and_external_authenticity_token_requested
-    assert_not_blocked do
-      get :form_for_remote_with_external_token
+      ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = original
     end
-    assert_select 'form>div>input[name=?][value=?]', 'custom_authenticity_token', 'external_token'
   end
 
   def test_should_render_form_with_token_tag_if_remote_and_authenticity_token_requested