diff options
| author | Genadi Samokovarov <gsamokovarov@gmail.com> | 2018-12-26 21:10:37 +0200 |
|---|---|---|
| committer | Genadi Samokovarov <gsamokovarov@gmail.com> | 2018-12-27 11:33:54 +0200 |
| commit | a58db74c4feda7b8e2a02882c030b252d6fa8611 (patch) | |
| tree | cdb5496cc0faaf4315ef4e5e40304b7fc6b0a7ab /actionview/CHANGELOG.md | |
| parent | b5ed468492387d42a44ca6af525d4a274cda756d (diff) | |
| download | rails-a58db74c4feda7b8e2a02882c030b252d6fa8611.tar.gz rails-a58db74c4feda7b8e2a02882c030b252d6fa8611.tar.bz2 rails-a58db74c4feda7b8e2a02882c030b252d6fa8611.zip | |
Don't expect defined protect_against_forgery? in {token,csrf_meta}_tag
The `#csrf_meta_tags` and `#token_tag` Action View helper methods are
expecting the class in which are included to explicitly define the
method `#protect_against_forgery?` or else they will fail with
`NoMethodError`.
This is a problem if you want to use Action View outside of Rails
applications. For example, in #34788 I used the `#button_to` helper
inside of the error pages templates that have a custom
`ActionView::Base` subclass, which did not defined
`#protect_against_forgery?` and trying to call the button failed.
I had to dig inside of Action View to find-out what's was going on. I
think we should either set a default method implementation in the
helpers or check for the method definition, but don't explicitly require
the presence of `#protect_against_forgery?` in every `ActionViews::Base`
subclass as the errors are hard to figure out.
Diffstat (limited to 'actionview/CHANGELOG.md')
| -rw-r--r-- | actionview/CHANGELOG.md | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/actionview/CHANGELOG.md b/actionview/CHANGELOG.md index df4036a5a7..36f10958b6 100644 --- a/actionview/CHANGELOG.md +++ b/actionview/CHANGELOG.md @@ -1,9 +1,13 @@ +* Fix the need of `#protect_against_forgery?` method defined in + `ActionView::Base` subclasses. This prevents the use of forms and buttons. + + *Genadi Samokovarov* + * Fix UJS permanently showing disabled text in a[data-remote][data-disable-with] elements within forms. Fixes #33889 *Wolfgang Hobmaier* - * Prevent non-primary mouse keys from triggering Rails UJS click handlers. Firefox fires click events even if the click was triggered by non-primary mouse keys such as right- or scroll-wheel-clicks. For example, right-clicking a link such as the one described below (with an underlying ajax request registered on click) should not cause that request to occur. @@ -16,7 +20,6 @@ *Wolfgang Hobmaier* - * Prevent `ActionView::TextHelper#word_wrap` from unexpectedly stripping white space from the _left_ side of lines. For example, given input like this: @@ -34,7 +37,6 @@ *Lyle Mullican* - * Add allocations to template rendering instrumentation. Adds the allocations for template and partial rendering to the server output on render. |