Ticket #10055: in_place_editing_should_work_with_csrf_and_rjs.patch

test/in_place_editing_test.rb

@@ -20 +20 @@
-      end
-    end
-    @controller = @controller.new
+    @protect_against_forgery = false
-  end
-
+
+
+
+
+
-  def test_in_place_editor_external_control
-      assert_dom_equal %(<script type=\"text/javascript\">\n//<![CDATA[\nnew Ajax.InPlaceEditor('some_input', 'http://www.example.com/inplace_edit', {externalControl:'blah'})\n//]]>\n</script>),
-        in_place_editor('some_input', {:url => {:action => 'inplace_edit'}, :external_control => 'blah'})
@@ -59 +64 @@
-      :load_text_url => { :action => "action_to_get_value" })
-  end
-  
-eval_scripts
-evalScripts:tru
+html_response
+htmlResponse:fals
-    in_place_editor( 'id-goes-here', 
-      :url => { :action => "action_to_set_value" }, 
-      :script => true )
-  end
-  
+  def form_authenticity_token
+    "authenticity token"
+  end
+
+  def test_in_place_editor_with_forgery_protection
+    @protect_against_forgery = true
+    assert_match "Ajax.InPlaceEditor('id-goes-here', 'http://www.example.com/action_to_set_value', {callback:function(form) { return Form.serialize(form) + '&authenticity_token=' + encodeURIComponent('authenticity token') }})",
+    in_place_editor( 'id-goes-here', :url => { :action => "action_to_set_value" })
+  end
+  
+  def test_in_place_editor_text_between_controls
+    assert_match "Ajax.InPlaceEditor('id-goes-here', 'http://www.example.com/action_to_set_value', {textBetweenControls:'or'})",
+    in_place_editor( 'id-goes-here', 
+      :url => { :action => "action_to_set_value" }, 
+      :text_between_controls => "or" )
+  end
-end

lib/in_place_macros_helper.rb

@@ -40 +40 @@
-    function << "'#{url_for(options[:url])}'"
-
-    js_options = {}
+
+    if protect_against_forgery?
+      options[:with] ||= "Form.serialize(form)"
+      options[:with] += " + '&authenticity_token=' + encodeURIComponent('#{form_authenticity_token}')"
+    end
+    
-    js_options['cancelText'] = %('#{options[:cancel_text]}') if options[:cancel_text]
-    js_options['okText'] = %('#{options[:save_text]}') if options[:save_text]
-    js_options['loadingText'] = %('#{options[:loading_text]}') if options[:loading_text]
@@ -50 +56 @@
-    js_options['externalControl'] = "'#{options[:external_control]}'" if options[:external_control]
-    js_options['loadTextURL'] = "'#{url_for(options[:load_text_url])}'" if options[:load_text_url]        
-    js_options['ajaxOptions'] = options[:options] if options[:options]
-evalScripts'] = 
+htmlResponse'] = !
-    js_options['callback']   = "function(form) { return #{options[:with]} }" if options[:with]
-    js_options['clickToEditText'] = %('#{options[:click_to_edit_text]}') if options[:click_to_edit_text]
+    js_options['textBetweenControls'] = %('#{options[:text_between_controls]}') if options[:text_between_controls]
-    function << (', ' + options_for_javascript(js_options)) unless js_options.empty?
-    
-    function << ')'