diff options
6 files changed, 19 insertions, 2 deletions
diff --git a/actionpack/CHANGELOG b/actionpack/CHANGELOG index 8beff49f54..7e5289cb9d 100644 --- a/actionpack/CHANGELOG +++ b/actionpack/CHANGELOG @@ -1,5 +1,7 @@ *SVN* +* Add Verification to scaffolds. Prevent destructive actions using GET [Michael Koziarski] + * Avoid hitting the filesystem when using layouts by using a File.directory? cache. [Stefan Kaes, Nicholas Seckar] * Simplify ActionController::Base#controller_path [Nicholas Seckar] diff --git a/actionpack/lib/action_controller/scaffolding.rb b/actionpack/lib/action_controller/scaffolding.rb index f79a21a173..3b612df357 100644 --- a/actionpack/lib/action_controller/scaffolding.rb +++ b/actionpack/lib/action_controller/scaffolding.rb @@ -98,6 +98,11 @@ module ActionController end module_eval <<-"end_eval", __FILE__, __LINE__ + + verify :method=>:post, :only=>[:destroy#{suffix}, :create#{suffix}, :update#{suffix}], + :redirect_to=>{:action=>:list#{suffix}} + + def list#{suffix} @#{singular_name}_pages, @#{plural_name} = paginate :#{plural_name}, :per_page => 10 render#{suffix}_scaffold "list#{suffix}" diff --git a/actionpack/lib/action_controller/templates/scaffolds/list.rhtml b/actionpack/lib/action_controller/templates/scaffolds/list.rhtml index f0e36fdbfe..37e761679c 100644 --- a/actionpack/lib/action_controller/templates/scaffolds/list.rhtml +++ b/actionpack/lib/action_controller/templates/scaffolds/list.rhtml @@ -14,7 +14,7 @@ <% end %> <td><%= link_to "Show", :action => "show#{@scaffold_suffix}", :id => entry %></td> <td><%= link_to "Edit", :action => "edit#{@scaffold_suffix}", :id => entry %></td> - <td><%= link_to "Destroy", {:action => "destroy#{@scaffold_suffix}", :id => entry}, {:confirm => "Are you sure?"} %></td> + <td><%= link_to "Destroy", {:action => "destroy#{@scaffold_suffix}", :id => entry}, {:confirm => "Are you sure?", :post=>true} %></td> </tr> <% end %> </table> diff --git a/railties/CHANGELOG b/railties/CHANGELOG index 6b50897638..112d91d355 100644 --- a/railties/CHANGELOG +++ b/railties/CHANGELOG @@ -1,5 +1,7 @@ *SVN* +* Add verification to generated scaffolds, don't allow get for unsafe actions [Michael Koziarski] + * Don't replace application.js in public/javascripts if it already exists [Cody Fauser] * Change test:uncommitted to delay execution of `svn status` by using internal Rake API's. [Nicholas Seckar] diff --git a/railties/lib/rails_generator/generators/components/scaffold/templates/controller.rb b/railties/lib/rails_generator/generators/components/scaffold/templates/controller.rb index ddc03e63ba..9595fcca61 100644 --- a/railties/lib/rails_generator/generators/components/scaffold/templates/controller.rb +++ b/railties/lib/rails_generator/generators/components/scaffold/templates/controller.rb @@ -11,6 +11,14 @@ class <%= controller_class_name %>Controller < ApplicationController end <% end -%> + + # GET should only be used for operations which are 'safe', or read-only. So require + # post for all actions which change state. + # + # http://www.w3.org/2001/tag/doc/whenToUseGet.html + verify :method=>:post, :only=>[:destroy<%= suffix %>, :create<%= suffix %>, :update<%= suffix %>], + :redirect_to=> {:action=>:list<%= suffix %>} + def list<%= suffix %> @<%= singular_name %>_pages, @<%= plural_name %> = paginate :<%= plural_name %>, :per_page => 10 end diff --git a/railties/lib/rails_generator/generators/components/scaffold/templates/view_list.rhtml b/railties/lib/rails_generator/generators/components/scaffold/templates/view_list.rhtml index 09d5f87cf3..2c6314f4bb 100644 --- a/railties/lib/rails_generator/generators/components/scaffold/templates/view_list.rhtml +++ b/railties/lib/rails_generator/generators/components/scaffold/templates/view_list.rhtml @@ -14,7 +14,7 @@ <%% end %> <td><%%= link_to 'Show', :action => 'show<%= suffix %>', :id => <%= singular_name %> %></td> <td><%%= link_to 'Edit', :action => 'edit<%= suffix %>', :id => <%= singular_name %> %></td> - <td><%%= link_to 'Destroy', { :action => 'destroy<%= suffix %>', :id => <%= singular_name %> }, :confirm => 'Are you sure?' %></td> + <td><%%= link_to 'Destroy', { :action => 'destroy<%= suffix %>', :id => <%= singular_name %> }, :confirm => 'Are you sure?', :post=>true %></td> </tr> <%% end %> </table> |