Brad Trick 880a1bedb9 Allow skip_forgery_protection if no protection set ... Calling `skip_forgery_protection` without first calling `protect_from_forgery`--either manually or through default settings--raises an `ArgumentError` because `verify_authenticity_token` has not been defined as a callback. Since Rails 7.0 adds `skip_forgery_protection` to the `Rails::WelcomeController` (PR #42864), this behavior means that setting `default_protect_from_forgery` to false and visiting the Rails Welcome page (`/`) raises an error. This behavior also created an issue for `ActionMailbox` that was previously fixed in the Mailbox controller by running `skip_forgery_protection` only if `default_protect_from_forgery` was true (PR #35935). This PR addresses the underlying issue by setting the `raise` option for `skip_before_action` to default to false inside `skip_forgery_protection`. The fix is implemented in `request_forgery_protection.rb`. The change to `ActionMailbox`'s `base_controller.rb` removes the now-unnecessary check of `default_protect_from_forgery`. The tests added in `request_forgery_protection_test.rb` and `routing_test.rb` both raise an error when run against the current codebase and pass with the changes noted above.		2022-02-27 21:58:42 -05:00
..
abstract_controller	Cross-link API docs [ci-skip]	2022-02-21 11:45:25 -06:00
action_controller	Allow skip_forgery_protection if no protection set	2022-02-27 21:58:42 -05:00
action_dispatch	Remove body content from redirect responses	2022-02-25 13:31:54 -04:00
action_pack	Start Rails 7.1 development	2021-12-07 15:52:30 +00:00
abstract_controller.rb	Make sure to require active_support.rb before requiring active_support/rails.rb	2019-07-12 18:30:58 +09:00
action_controller.rb	Extract ActiveSupport::ExecutionContext out of ActiveRecord::QueryLogs	2021-11-10 09:36:02 +01:00
action_dispatch.rb	Bump license years to 2022 [ci-skip]	2022-01-01 15:22:15 +09:00
action_pack.rb	Bump license years to 2022 [ci-skip]	2022-01-01 15:22:15 +09:00