From e50abbad4f4141642bf5c4c27ec77852803a3a72 Mon Sep 17 00:00:00 2001 From: David Heinemeier Hansson Date: Wed, 14 Mar 2012 19:28:36 -0400 Subject: Allow you to force the authenticity_token to be rendered even on remote forms if you pass true --- actionpack/test/controller/request_forgery_protection_test.rb | 11 +++++++++++ 1 file changed, 11 insertions(+) (limited to 'actionpack/test') diff --git a/actionpack/test/controller/request_forgery_protection_test.rb b/actionpack/test/controller/request_forgery_protection_test.rb index f4e7336834..37b9de350b 100644 --- a/actionpack/test/controller/request_forgery_protection_test.rb +++ b/actionpack/test/controller/request_forgery_protection_test.rb @@ -41,6 +41,10 @@ module RequestForgeryProtectionActions render :inline => "<%= form_for(:some_resource, :remote => true ) {} %>" end + def form_for_remote_with_token + render :inline => "<%= form_for(:some_resource, :remote => true, :authenticity_token => true ) {} %>" + end + def rescue_action(e) raise e end end @@ -114,6 +118,13 @@ module RequestForgeryProtectionTests assert_no_match /authenticity_token/, response.body end + def test_should_render_form_with_token_tag_if_remote_and_authenticity_token_requested + assert_not_blocked do + get :form_for_remote_with_token + end + assert_select 'form>div>input[name=?][value=?]', 'custom_authenticity_token', @token + end + def test_should_allow_get assert_not_blocked { get :index } end -- cgit v1.2.3