kotovalexarian-likes-github/rails--rails
1
0
Fork 0
mirror of https://github.com/rails/rails.git synced 2022-11-09 12:12:34 -05:00
Code Releases Activity

Make csrf_meta_tags use the tag helper

Browse source 
Improved formatting of csrf_helper and improved test coverage
This commit is contained in:
James Robinson 2011-04-08 02:18:33 +02:00 committed by Xavier Noria
parent a7c5d40d80
commit 2cdc1f0cd5
2 changed files with 9 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
actionpack/lib/action_view/helpers/csrf_helper.rb
View file

@ -17,10 +17,12 @@ module ActionView
# Note that regular forms generate hidden fields, and that Ajax calls are whitelisted, # Note that regular forms generate hidden fields, and that Ajax calls are whitelisted,
# so they do not use these tags. # so they do not use these tags.
def csrf_meta_tags def csrf_meta_tags
<<-METAS.strip_heredoc.chomp.html_safe if protect_against_forgery? if protect_against_forgery?
<meta name="csrf-param" content="#{Rack::Utils.escape_html(request_forgery_protection_token)}"/> [
<meta name="csrf-token" content="#{Rack::Utils.escape_html(form_authenticity_token)}"/> tag('meta', :name => 'csrf-param', :content => request_forgery_protection_token),
METAS tag('meta', :name => 'csrf-token', :content => form_authenticity_token)
].join("\n").html_safe
end
end end
# For backwards compatibility. # For backwards compatibility.

8
actionpack/test/controller/request_forgery_protection_test.rb
View file

@ -172,13 +172,11 @@ end
class RequestForgeryProtectionControllerTest < ActionController::TestCase class RequestForgeryProtectionControllerTest < ActionController::TestCase
include RequestForgeryProtectionTests include RequestForgeryProtectionTests
test 'should emit a csrf-token meta tag' do test 'should emit a csrf-param meta tag and a csrf-token meta tag' do
ActiveSupport::SecureRandom.stubs(:base64).returns(@token + '<=?') ActiveSupport::SecureRandom.stubs(:base64).returns(@token + '<=?')
get :meta get :meta
assert_equal <<-METAS.strip_heredoc.chomp, @response.body assert_select 'meta[name=?][content=?]', 'csrf-param', 'authenticity_token'
<meta name="csrf-param" content="authenticity_token"/> assert_select 'meta[name=?][content=?]', 'csrf-token', 'cf50faa3fe97702ca1ae&lt;=?'
<meta name="csrf-token" content="cf50faa3fe97702ca1ae&lt;=?"/>
METAS
end end
end end