From c6abe81b1eebd741b2a36e6618bf6f1c07b87588 Mon Sep 17 00:00:00 2001
From: Michael Koziarski <michael@koziarski.com>
Date: Tue, 14 Mar 2006 01:57:12 +0000
Subject: Add verification to scaffolds (generated and reflection based). 
 Require POST for unsafe actions [Michael Koziarski]. Closes #2601

git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@3864 5ecf4fe2-1ee6-0310-87b1-e25e094e27de
---
 actionpack/CHANGELOG                                            | 2 ++
 actionpack/lib/action_controller/scaffolding.rb                 | 5 +++++
 actionpack/lib/action_controller/templates/scaffolds/list.rhtml | 2 +-
 3 files changed, 8 insertions(+), 1 deletion(-)

(limited to 'actionpack')

diff --git a/actionpack/CHANGELOG b/actionpack/CHANGELOG
index 8beff49f54..7e5289cb9d 100644
--- a/actionpack/CHANGELOG
+++ b/actionpack/CHANGELOG
@@ -1,5 +1,7 @@
 *SVN*
 
+* Add Verification to scaffolds.   Prevent destructive actions using GET [Michael Koziarski]
+
 * Avoid hitting the filesystem when using layouts by using a File.directory? cache. [Stefan Kaes, Nicholas Seckar]
 
 * Simplify ActionController::Base#controller_path [Nicholas Seckar]
diff --git a/actionpack/lib/action_controller/scaffolding.rb b/actionpack/lib/action_controller/scaffolding.rb
index f79a21a173..3b612df357 100644
--- a/actionpack/lib/action_controller/scaffolding.rb
+++ b/actionpack/lib/action_controller/scaffolding.rb
@@ -98,6 +98,11 @@ module ActionController
         end
         
         module_eval <<-"end_eval", __FILE__, __LINE__
+          
+          verify :method=>:post, :only=>[:destroy#{suffix}, :create#{suffix}, :update#{suffix}],
+                 :redirect_to=>{:action=>:list#{suffix}}
+          
+        
           def list#{suffix}
             @#{singular_name}_pages, @#{plural_name} = paginate :#{plural_name}, :per_page => 10
             render#{suffix}_scaffold "list#{suffix}"
diff --git a/actionpack/lib/action_controller/templates/scaffolds/list.rhtml b/actionpack/lib/action_controller/templates/scaffolds/list.rhtml
index f0e36fdbfe..37e761679c 100644
--- a/actionpack/lib/action_controller/templates/scaffolds/list.rhtml
+++ b/actionpack/lib/action_controller/templates/scaffolds/list.rhtml
@@ -14,7 +14,7 @@
   <% end %>
     <td><%= link_to "Show", :action => "show#{@scaffold_suffix}", :id => entry %></td>
     <td><%= link_to "Edit", :action => "edit#{@scaffold_suffix}", :id => entry %></td>
-    <td><%= link_to "Destroy", {:action => "destroy#{@scaffold_suffix}", :id => entry}, {:confirm => "Are you sure?"} %></td>
+    <td><%= link_to "Destroy", {:action => "destroy#{@scaffold_suffix}", :id => entry}, {:confirm => "Are you sure?", :post=>true} %></td>
   </tr>
 <% end %>
 </table>
-- 
cgit v1.2.3