diff options
| author | Michael Koziarski <michael@koziarski.com> | 2006-03-14 01:57:12 +0000 |
|---|---|---|
| committer | Michael Koziarski <michael@koziarski.com> | 2006-03-14 01:57:12 +0000 |
| commit | c6abe81b1eebd741b2a36e6618bf6f1c07b87588 (patch) | |
| tree | e93e0fe02b650b3eb5e5a3269b445de296b8f09a /actionpack | |
| parent | e9d6fea533e6b6fd1d9a6024de113370fdd13926 (diff) | |
| download | rails-c6abe81b1eebd741b2a36e6618bf6f1c07b87588.tar.gz rails-c6abe81b1eebd741b2a36e6618bf6f1c07b87588.tar.bz2 rails-c6abe81b1eebd741b2a36e6618bf6f1c07b87588.zip | |
Add verification to scaffolds (generated and reflection based). Require POST for unsafe actions [Michael Koziarski]. Closes #2601
git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@3864 5ecf4fe2-1ee6-0310-87b1-e25e094e27de
Diffstat (limited to 'actionpack')
| -rw-r--r-- | actionpack/CHANGELOG | 2 | ||||
| -rw-r--r-- | actionpack/lib/action_controller/scaffolding.rb | 5 | ||||
| -rw-r--r-- | actionpack/lib/action_controller/templates/scaffolds/list.rhtml | 2 |
3 files changed, 8 insertions, 1 deletions
diff --git a/actionpack/CHANGELOG b/actionpack/CHANGELOG index 8beff49f54..7e5289cb9d 100644 --- a/actionpack/CHANGELOG +++ b/actionpack/CHANGELOG @@ -1,5 +1,7 @@ *SVN* +* Add Verification to scaffolds. Prevent destructive actions using GET [Michael Koziarski] + * Avoid hitting the filesystem when using layouts by using a File.directory? cache. [Stefan Kaes, Nicholas Seckar] * Simplify ActionController::Base#controller_path [Nicholas Seckar] diff --git a/actionpack/lib/action_controller/scaffolding.rb b/actionpack/lib/action_controller/scaffolding.rb index f79a21a173..3b612df357 100644 --- a/actionpack/lib/action_controller/scaffolding.rb +++ b/actionpack/lib/action_controller/scaffolding.rb @@ -98,6 +98,11 @@ module ActionController end module_eval <<-"end_eval", __FILE__, __LINE__ + + verify :method=>:post, :only=>[:destroy#{suffix}, :create#{suffix}, :update#{suffix}], + :redirect_to=>{:action=>:list#{suffix}} + + def list#{suffix} @#{singular_name}_pages, @#{plural_name} = paginate :#{plural_name}, :per_page => 10 render#{suffix}_scaffold "list#{suffix}" diff --git a/actionpack/lib/action_controller/templates/scaffolds/list.rhtml b/actionpack/lib/action_controller/templates/scaffolds/list.rhtml index f0e36fdbfe..37e761679c 100644 --- a/actionpack/lib/action_controller/templates/scaffolds/list.rhtml +++ b/actionpack/lib/action_controller/templates/scaffolds/list.rhtml @@ -14,7 +14,7 @@ <% end %> <td><%= link_to "Show", :action => "show#{@scaffold_suffix}", :id => entry %></td> <td><%= link_to "Edit", :action => "edit#{@scaffold_suffix}", :id => entry %></td> - <td><%= link_to "Destroy", {:action => "destroy#{@scaffold_suffix}", :id => entry}, {:confirm => "Are you sure?"} %></td> + <td><%= link_to "Destroy", {:action => "destroy#{@scaffold_suffix}", :id => entry}, {:confirm => "Are you sure?", :post=>true} %></td> </tr> <% end %> </table> |