Ruby on Rails | Screencasts | Download | Documentation | Weblog | Community | Source

Changeset 3864

Show
Ignore:
Timestamp:
03/14/06 01:57:12 (2 years ago)
Author:
nzkoz
Message:

Add verification to scaffolds (generated and reflection based). Require POST for unsafe actions [Michael Koziarski]. Closes #2601

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • trunk/actionpack/CHANGELOG

    r3861 r3864  
    11*SVN* 
     2 
     3* Add Verification to scaffolds.   Prevent destructive actions using GET [Michael Koziarski] 
    24 
    35* Avoid hitting the filesystem when using layouts by using a File.directory? cache. [Stefan Kaes, Nicholas Seckar] 

  • trunk/actionpack/lib/action_controller/scaffolding.rb

    r2167 r3864  
    9999         
    100100        module_eval <<-"end_eval", __FILE__, __LINE__ 
     101           
     102          verify :method=>:post, :only=>[:destroy#{suffix}, :create#{suffix}, :update#{suffix}], 
     103                 :redirect_to=>{:action=>:list#{suffix}} 
     104           
     105         
    101106          def list#{suffix} 
    102107            @#{singular_name}_pages, @#{plural_name} = paginate :#{plural_name}, :per_page => 10 

  • trunk/actionpack/lib/action_controller/templates/scaffolds/list.rhtml

    r1940 r3864  
    1515    <td><%= link_to "Show", :action => "show#{@scaffold_suffix}", :id => entry %></td> 
    1616    <td><%= link_to "Edit", :action => "edit#{@scaffold_suffix}", :id => entry %></td> 
    17     <td><%= link_to "Destroy", {:action => "destroy#{@scaffold_suffix}", :id => entry}, {:confirm => "Are you sure?"} %></td> 
     17    <td><%= link_to "Destroy", {:action => "destroy#{@scaffold_suffix}", :id => entry}, {:confirm => "Are you sure?", :post=>true} %></td> 
    1818  </tr> 
    1919<% end %> 

  • trunk/railties/CHANGELOG

    r3863 r3864  
    11*SVN* 
     2 
     3* Add verification to generated scaffolds,  don't allow get for unsafe actions [Michael Koziarski] 
    24 
    35* Don't replace application.js in public/javascripts if it already exists [Cody Fauser] 

  • trunk/railties/lib/rails_generator/generators/components/scaffold/templates/controller.rb

    r2879 r3864  
    1212 
    1313<% end -%> 
     14 
     15  # GET should only be used for operations which are 'safe', or read-only. So require 
     16  # post for all actions which change state. 
     17  #   
     18  # http://www.w3.org/2001/tag/doc/whenToUseGet.html 
     19  verify :method=>:post, :only=>[:destroy<%= suffix %>, :create<%= suffix %>, :update<%= suffix %>], 
     20         :redirect_to=> {:action=>:list<%= suffix %>} 
     21 
    1422  def list<%= suffix %> 
    1523    @<%= singular_name %>_pages, @<%= plural_name %> = paginate :<%= plural_name %>, :per_page => 10 

  • trunk/railties/lib/rails_generator/generators/components/scaffold/templates/view_list.rhtml

    r2492 r3864  
    1515    <td><%%= link_to 'Show', :action => 'show<%= suffix %>', :id => <%= singular_name %> %></td> 
    1616    <td><%%= link_to 'Edit', :action => 'edit<%= suffix %>', :id => <%= singular_name %> %></td> 
    17     <td><%%= link_to 'Destroy', { :action => 'destroy<%= suffix %>', :id => <%= singular_name %> }, :confirm => 'Are you sure?' %></td> 
     17    <td><%%= link_to 'Destroy', { :action => 'destroy<%= suffix %>', :id => <%= singular_name %> }, :confirm => 'Are you sure?', :post=>true %></td> 
    1818  </tr> 
    1919<%% end %>