diff options
| author | Guillermo Iguaran <guilleiguaran@gmail.com> | 2014-10-23 22:57:26 -0300 |
|---|---|---|
| committer | Guillermo Iguaran <guilleiguaran@gmail.com> | 2014-10-23 22:57:26 -0300 |
| commit | 1d9ebec0a9e84aa680313b17ceb800f1b10df3b9 (patch) | |
| tree | 530d4abf3fe7573c29815615c90946391cbfb02e /actionpack | |
| parent | be49ec4b1f4256146b963a781a02748a342c6b6e (diff) | |
| parent | 0073d274de5bf3894f6da27f798238908eed43b5 (diff) | |
| download | rails-1d9ebec0a9e84aa680313b17ceb800f1b10df3b9.tar.gz rails-1d9ebec0a9e84aa680313b17ceb800f1b10df3b9.tar.bz2 rails-1d9ebec0a9e84aa680313b17ceb800f1b10df3b9.zip | |
Merge pull request #17369 from rails/secure_compare
Secure compare
Diffstat (limited to 'actionpack')
| -rw-r--r-- | actionpack/lib/action_controller/metal/request_forgery_protection.rb | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/actionpack/lib/action_controller/metal/request_forgery_protection.rb b/actionpack/lib/action_controller/metal/request_forgery_protection.rb index a4f376816f..fd20682f8f 100644 --- a/actionpack/lib/action_controller/metal/request_forgery_protection.rb +++ b/actionpack/lib/action_controller/metal/request_forgery_protection.rb @@ -1,5 +1,6 @@ require 'rack/session/abstract/id' require 'action_controller/metal/exceptions' +require 'active_support/security_utils' module ActionController #:nodoc: class InvalidAuthenticityToken < ActionControllerError #:nodoc: @@ -305,8 +306,7 @@ module ActionController #:nodoc: end def compare_with_real_token(token, session) - # Borrow a constant-time comparison from Rack - Rack::Utils.secure_compare(token, real_csrf_token(session)) + ActiveSupport::SecurityUtils.secure_compare(token, real_csrf_token(session)) end def real_csrf_token(session) |