Cover one more case in auth_token and remote forms

If embedding auth_token in remote forms is off and we
pass a value for auth_token it should respect it.

1 files changed, 22 insertions, 16 deletions

diff --git a/actionpack/test/controller/request_forgery_protection_test.rb b/actionpack/test/controller/request_forgery_protection_test.rb
index 77c1fc4ed7..144003a59b 100644
--- a/actionpack/test/controller/request_forgery_protection_test.rb
+++ b/actionpack/test/controller/request_forgery_protection_test.rb
@@ -127,27 +127,33 @@ module RequestForgeryProtectionTests
   end
 
   def test_should_render_form_without_token_tag_if_remote_and_embedding_token_is_off
-    begin
-      ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = false
-      assert_not_blocked do
-        get :form_for_remote
-      end
-      assert_no_match(/authenticity_token/, response.body)
-    ensure
-      ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = true
+    ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = false
+    assert_not_blocked do
+      get :form_for_remote
     end
+    assert_no_match(/authenticity_token/, response.body)
+  ensure
+    ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = true
   end
 
   def test_should_render_form_with_token_tag_if_remote_and_embedding_token_is_off_but_true_option_passed
-     begin
-      ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = false
-      assert_not_blocked do
-        get :form_for_remote_with_token
-      end
-      assert_match(/authenticity_token/, response.body)
-    ensure
-      ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = true
+    ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = false
+    assert_not_blocked do
+      get :form_for_remote_with_token
     end
+    assert_match(/authenticity_token/, response.body)
+  ensure
+    ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = true
+  end
+
+  def test_should_render_form_with_token_tag_if_remote_and_external_authenticity_token_requested_and_embedding_is_off
+    ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = false
+    assert_not_blocked do
+      get :form_for_remote_with_external_token
+    end
+    assert_select 'form>div>input[name=?][value=?]', 'custom_authenticity_token', 'external_token'
+  ensure
+    ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = true
   end
 
   def test_should_render_form_with_token_tag_if_remote_and_external_authenticity_token_requested