diff options
author | David Heinemeier Hansson <david@loudthinking.com> | 2012-03-14 19:28:36 -0400 |
---|---|---|
committer | David Heinemeier Hansson <david@loudthinking.com> | 2012-03-14 19:28:57 -0400 |
commit | e884f4b6b7440ccbeec2149669f34d2a2c14d4fb (patch) | |
tree | 1e9531d78816fd125b0f823022c7ad5bf00a82a3 /actionpack/test | |
parent | a4c120f165c5a0b7976ba72638261c3342364e38 (diff) | |
download | rails-e884f4b6b7440ccbeec2149669f34d2a2c14d4fb.tar.gz rails-e884f4b6b7440ccbeec2149669f34d2a2c14d4fb.tar.bz2 rails-e884f4b6b7440ccbeec2149669f34d2a2c14d4fb.zip |
Allow you to force the authenticity_token to be rendered even on remote forms if you pass true
Diffstat (limited to 'actionpack/test')
-rw-r--r-- | actionpack/test/controller/request_forgery_protection_test.rb | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/actionpack/test/controller/request_forgery_protection_test.rb b/actionpack/test/controller/request_forgery_protection_test.rb index 77db4969a7..8d4b76849f 100644 --- a/actionpack/test/controller/request_forgery_protection_test.rb +++ b/actionpack/test/controller/request_forgery_protection_test.rb @@ -40,6 +40,10 @@ module RequestForgeryProtectionActions render :inline => "<%= form_for(:some_resource, :remote => true ) {} %>" end + def form_for_remote_with_token + render :inline => "<%= form_for(:some_resource, :remote => true, :authenticity_token => true ) {} %>" + end + def rescue_action(e) raise e end end @@ -111,6 +115,13 @@ module RequestForgeryProtectionTests assert_no_match /authenticity_token/, response.body end + def test_should_render_form_with_token_tag_if_remote_and_authenticity_token_requested + assert_not_blocked do + get :form_for_remote_with_token + end + assert_select 'form>div>input[name=?][value=?]', 'custom_authenticity_token', @token + end + def test_should_allow_get assert_not_blocked { get :index } end |