kotovalexarian-likes-github/rails--rails
1
0
Fork 0
mirror of https://github.com/rails/rails.git synced 2022-11-09 12:12:34 -05:00
Code Releases Activity

Cover one more case in auth_token and remote forms

Browse source 
If embedding auth_token in remote forms is off and we
pass a value for auth_token it should respect it.
This commit is contained in:
Piotr Sarnacki 2012-03-28 17:58:15 +02:00
parent 128cfbdf4d
commit 5a5ca14cb2
2 changed files with 8 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
actionpack/lib/action_view/helpers/form_tag_helper.rb
View file

@ -629,7 +629,7 @@ module ActionView
if html_options["data-remote"] &&
!embed_authenticity_token_in_remote_forms &&
html_options["authenticity_token"] != true
html_options["authenticity_token"].blank?
# The authenticity token is taken from the meta tag in this case
html_options["authenticity_token"] = false
elsif html_options["authenticity_token"] == true

7
actionpack/test/controller/request_forgery_protection_test.rb
View file

@ -149,6 +149,13 @@ module RequestForgeryProtectionTests
end
end
def test_should_render_form_with_token_tag_if_remote_and_external_authenticity_token_requested
assert_not_blocked do
get :form_for_remote_with_external_token
end
assert_select 'form>div>input[name=?][value=?]', 'custom_authenticity_token', 'external_token'
end
def test_should_render_form_with_token_tag_if_remote_and_authenticity_token_requested
assert_not_blocked do
get :form_for_remote_with_token