diff options
| author | Eileen M. Uchitelle <eileencodes@users.noreply.github.com> | 2018-05-30 09:20:43 -0400 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2018-05-30 09:20:43 -0400 |
| commit | 10e1f1f9a129f2f197a44009a99b73b8ff9dbc0d (patch) | |
| tree | 4cd7feb281301bf327d530e08fa47e5818cec9f1 /actionpack/test | |
| parent | ced104d57997c7bceef3d1e6c8a713431363c3bb (diff) | |
| parent | d3a2c53955f28e0f3dfe0403ef691b903496e957 (diff) | |
| download | rails-10e1f1f9a129f2f197a44009a99b73b8ff9dbc0d.tar.gz rails-10e1f1f9a129f2f197a44009a99b73b8ff9dbc0d.tar.bz2 rails-10e1f1f9a129f2f197a44009a99b73b8ff9dbc0d.zip | |
Merge pull request #32998 from gregmolnar/protect-from-application-javascript
Include application/javascript when checking content_type
Diffstat (limited to 'actionpack/test')
| -rw-r--r-- | actionpack/test/controller/request_forgery_protection_test.rb | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/actionpack/test/controller/request_forgery_protection_test.rb b/actionpack/test/controller/request_forgery_protection_test.rb index 7a02c27c99..ea94a3e048 100644 --- a/actionpack/test/controller/request_forgery_protection_test.rb +++ b/actionpack/test/controller/request_forgery_protection_test.rb @@ -521,6 +521,11 @@ module RequestForgeryProtectionTests get :negotiate_same_origin end + assert_cross_origin_blocked do + @request.accept = "application/javascript" + get :negotiate_same_origin + end + assert_cross_origin_not_blocked { get :same_origin_js, xhr: true } assert_cross_origin_not_blocked { get :same_origin_js, xhr: true, format: "js" } assert_cross_origin_not_blocked do |