kotovalexarian-likes-github/rails--rails
1
0
Fork 0
mirror of https://github.com/rails/rails.git synced 2022-11-09 12:12:34 -05:00
Code Releases Activity

Include application/javascript when checking content_type

Browse source
This commit is contained in:
Gabriel Jaldon 2014-12-10 23:21:01 +08:00 committed by Greg Molnar
parent 17bf62033e
commit d3a2c53955
2 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
actionpack/lib/action_controller/metal/request_forgery_protection.rb
View file

@ -275,7 +275,7 @@ module ActionController #:nodoc:
# Check for cross-origin JavaScript responses.
def non_xhr_javascript_response? # :doc:
content_type =~ %r(\Atext/javascript) && !request.xhr?
content_type =~ %r(\A(text|application)/javascript) && !request.xhr?
end
AUTHENTICITY_TOKEN_LENGTH = 32

5
actionpack/test/controller/request_forgery_protection_test.rb
View file

@ -521,6 +521,11 @@ module RequestForgeryProtectionTests
get :negotiate_same_origin
end
assert_cross_origin_blocked do
@request.accept = "application/javascript"
get :negotiate_same_origin
end
assert_cross_origin_not_blocked { get :same_origin_js, xhr: true }
assert_cross_origin_not_blocked { get :same_origin_js, xhr: true, format: "js" }
assert_cross_origin_not_blocked do