diff options
| author | Piotr Sarnacki <drogus@gmail.com> | 2012-03-28 17:54:06 +0200 |
|---|---|---|
| committer | Piotr Sarnacki <drogus@gmail.com> | 2012-03-28 18:03:16 +0200 |
| commit | 128cfbdf4d316a544a76e5c58dbeac153f3d4e36 (patch) | |
| tree | 1393451fb453e5199d7839c2b008990fb29ab115 /actionpack | |
| parent | 805b15ff35122f5fd0bb9c1742578b14eebfac32 (diff) | |
| download | rails-128cfbdf4d316a544a76e5c58dbeac153f3d4e36.tar.gz rails-128cfbdf4d316a544a76e5c58dbeac153f3d4e36.tar.bz2 rails-128cfbdf4d316a544a76e5c58dbeac153f3d4e36.zip | |
config.action_view.embed_authenticity_token_in_remote_forms is true by default
Changed default value for `config.action_view.embed_authenticity_token_in_remote_forms`
to `false`. This change breaks remote forms that need to work also without javascript,
so if you need such behavior, you can either set it to `true` or explicitly pass
`:authenticity_token => true` in form options
Diffstat (limited to 'actionpack')
| -rw-r--r-- | actionpack/CHANGELOG.md | 5 | ||||
| -rw-r--r-- | actionpack/lib/action_view/helpers/form_tag_helper.rb | 2 | ||||
| -rw-r--r-- | actionpack/lib/action_view/railtie.rb | 2 | ||||
| -rw-r--r-- | actionpack/test/controller/request_forgery_protection_test.rb | 33 |
4 files changed, 21 insertions, 21 deletions
diff --git a/actionpack/CHANGELOG.md b/actionpack/CHANGELOG.md index de62919c3c..f004a4fce7 100644 --- a/actionpack/CHANGELOG.md +++ b/actionpack/CHANGELOG.md @@ -1,5 +1,10 @@ ## Rails 4.0.0 (unreleased) ## +* Changed default value for `config.action_view.embed_authenticity_token_in_remote_forms` + to `false`. This change breaks remote forms that need to work also without javascript, + so if you need such behavior, you can either set it to `true` or explicitly pass + `:authenticity_token => true` in form options + * Added ActionDispatch::SSL middleware that when included force all the requests to be under HTTPS protocol. *Rafael Mendonça França* * Add `include_hidden` option to select tag. With `:include_hidden => false` select with `multiple` attribute doesn't generate hidden input with blank value. *Vasiliy Ermolovich* diff --git a/actionpack/lib/action_view/helpers/form_tag_helper.rb b/actionpack/lib/action_view/helpers/form_tag_helper.rb index be4e88c9b3..63451e2c36 100644 --- a/actionpack/lib/action_view/helpers/form_tag_helper.rb +++ b/actionpack/lib/action_view/helpers/form_tag_helper.rb @@ -19,7 +19,7 @@ module ActionView include TextHelper mattr_accessor :embed_authenticity_token_in_remote_forms - self.embed_authenticity_token_in_remote_forms = true + self.embed_authenticity_token_in_remote_forms = false # Starts a form tag that points the action to an url configured with <tt>url_for_options</tt> just like # ActionController::Base#url_for. The method for the form defaults to POST. diff --git a/actionpack/lib/action_view/railtie.rb b/actionpack/lib/action_view/railtie.rb index 5162e1955b..9f5e3be454 100644 --- a/actionpack/lib/action_view/railtie.rb +++ b/actionpack/lib/action_view/railtie.rb @@ -7,7 +7,7 @@ module ActionView config.action_view = ActiveSupport::OrderedOptions.new config.action_view.stylesheet_expansions = {} config.action_view.javascript_expansions = { :defaults => %w(jquery jquery_ujs) } - config.action_view.embed_authenticity_token_in_remote_forms = true + config.action_view.embed_authenticity_token_in_remote_forms = false initializer "action_view.embed_authenticity_token_in_remote_forms" do |app| ActiveSupport.on_load(:action_view) do diff --git a/actionpack/test/controller/request_forgery_protection_test.rb b/actionpack/test/controller/request_forgery_protection_test.rb index 7ded9ddc81..89f605b5ad 100644 --- a/actionpack/test/controller/request_forgery_protection_test.rb +++ b/actionpack/test/controller/request_forgery_protection_test.rb @@ -116,42 +116,37 @@ module RequestForgeryProtectionTests assert_select 'form>div>input[name=?][value=?]', 'custom_authenticity_token', @token end - def test_should_render_form_with_token_tag_if_remote + def test_should_render_form_without_token_tag_if_remote assert_not_blocked do get :form_for_remote end - assert_match(/authenticity_token/, response.body) + assert_no_match(/authenticity_token/, response.body) end - def test_should_render_form_without_token_tag_if_remote_and_embedding_token_is_off + def test_should_render_form_with_token_tag_if_remote_and_embedding_token_is_on + original = ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms begin - ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = false + ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = true assert_not_blocked do get :form_for_remote end - assert_no_match(/authenticity_token/, response.body) + assert_match(/authenticity_token/, response.body) ensure - ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = true + ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = original end end - def test_should_render_form_with_token_tag_if_remote_and_embedding_token_is_off_but_true_option_passed - begin - ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = false + def test_should_render_form_with_token_tag_if_remote_and_external_authenticity_token_requested_and_embedding_is_on + original = ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms + begin + ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = true assert_not_blocked do - get :form_for_remote_with_token + get :form_for_remote_with_external_token end - assert_match(/authenticity_token/, response.body) + assert_select 'form>div>input[name=?][value=?]', 'custom_authenticity_token', 'external_token' ensure - ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = true - end - end - - def test_should_render_form_with_token_tag_if_remote_and_external_authenticity_token_requested - assert_not_blocked do - get :form_for_remote_with_external_token + ActionView::Helpers::FormTagHelper.embed_authenticity_token_in_remote_forms = original end - assert_select 'form>div>input[name=?][value=?]', 'custom_authenticity_token', 'external_token' end def test_should_render_form_with_token_tag_if_remote_and_authenticity_token_requested |