diff options
author | David Heinemeier Hansson <david@loudthinking.com> | 2012-03-14 19:03:39 -0400 |
---|---|---|
committer | David Heinemeier Hansson <david@loudthinking.com> | 2012-03-14 19:03:39 -0400 |
commit | 16ee611fad37b6b271088eda4cdbe3d6be088af1 (patch) | |
tree | c02d89f1d21b2ff37aace538f7e3c17ed06f3e5a /actionpack/test | |
parent | f2aea24d3b2c3aeabdab5ead632d68b97c76aa58 (diff) | |
download | rails-16ee611fad37b6b271088eda4cdbe3d6be088af1.tar.gz rails-16ee611fad37b6b271088eda4cdbe3d6be088af1.tar.bz2 rails-16ee611fad37b6b271088eda4cdbe3d6be088af1.zip |
Do not include the authenticity token in forms where remote: true as ajax forms use the meta-tag value
Diffstat (limited to 'actionpack/test')
-rw-r--r-- | actionpack/test/controller/request_forgery_protection_test.rb | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/actionpack/test/controller/request_forgery_protection_test.rb b/actionpack/test/controller/request_forgery_protection_test.rb index fd5a41a0bb..f4e7336834 100644 --- a/actionpack/test/controller/request_forgery_protection_test.rb +++ b/actionpack/test/controller/request_forgery_protection_test.rb @@ -37,6 +37,10 @@ module RequestForgeryProtectionActions render :inline => "<%= form_for(:some_resource, :authenticity_token => false ) {} %>" end + def form_for_remote + render :inline => "<%= form_for(:some_resource, :remote => true ) {} %>" + end + def rescue_action(e) raise e end end @@ -103,6 +107,13 @@ module RequestForgeryProtectionTests assert_select 'form>div>input[name=?][value=?]', 'custom_authenticity_token', @token end + def test_should_render_form_without_token_tag_if_remote + assert_not_blocked do + get :form_for_remote + end + assert_no_match /authenticity_token/, response.body + end + def test_should_allow_get assert_not_blocked { get :index } end |