Ruby on Rails | Screencasts | Download | Documentation | Weblog | Community | Source

Changeset 7596

Show
Ignore:
Timestamp:
09/23/07 18:14:44 (2 years ago)
Author:
rick
Message:

Rename some RequestForgeryProtection methods. The class method is now #protect_from_forgery, and the default parameter is now 'authenticity_token'. [Rick]

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • trunk/actionpack/CHANGELOG

    r7592 r7596  
    11*SVN* 
     2 
     3* Rename some RequestForgeryProtection methods.  The class method is now #protect_from_forgery, and the default parameter is now 'authenticity_token'.  [Rick] 
    24 
    35* Merge csrf_killer plugin into rails.  Adds RequestForgeryProtection model that verifies session-specific _tokens for non-GET requests.  [Rick] 

  • trunk/actionpack/lib/action_controller/base.rb

    r7592 r7596  
    328328    cattr_accessor :resource_action_separator 
    329329     
    330     # Sets the token parameter name for RequestForgery.  Calling #verify_token sets it to :_token by default 
     330    # Sets the token parameter name for RequestForgery.  Calling #protect_from_forgery sets it to :authenticity_token by default 
    331331    @@request_forgery_protection_token = nil 
    332332    cattr_accessor :request_forgery_protection_token 

  • trunk/actionpack/lib/action_controller/request_forgery_protection.rb

    r7592 r7596  
    22  class InvalidToken < ActionControllerError; end 
    33 
    4   # Protect a controller's actions with the #verify_token method.  Failure to validate will result in a ActionController::InvalidToken  
     4  # Protect a controller's actions with the #protect_from_forgery method.  Failure to validate will result in a ActionController::InvalidToken  
    55  # exception.  Customize the error message through the use of rescue_templates and rescue_action_in_public. 
    66  # 
    77  #   class FooController < ApplicationController 
    88  #     # uses the cookie session store 
    9   #     verify_token :except => :index 
     9  #     protect_from_forgery :except => :index 
    1010  # 
    1111  #     # uses one of the other session stores that uses a session_id value. 
    12   #     verify_token :secret => 'my-little-pony', :except => :index 
     12  #     protect_from_forgery :secret => 'my-little-pony', :except => :index 
    1313  #   end 
    1414  # 
    …… 
    1616  # 
    1717  # * <tt>:only/:except</tt> - passed to the before_filter call.  Set which actions are verified. 
    18   # * <tt>:secret</tt> - Custom salt used to generate the form_token.  Leave this off if you are using the cookie session store. 
     18  # * <tt>:secret</tt> - Custom salt used to generate the form_authenticity_token.  Leave this off if you are using the cookie session store. 
    1919  # * <tt>:digest</tt> - Message digest used for hashing.  Defaults to 'SHA1' 
    2020  module RequestForgeryProtection 
    2121    def self.included(base) 
    2222      base.class_eval do 
    23         class_inheritable_accessor :verify_token_options 
    24         self.verify_token_options = {} 
    25         helper_method :form_token 
     23        class_inheritable_accessor :request_forgery_protection_options 
     24        self.request_forgery_protection_options = {} 
     25        helper_method :form_authenticity_token 
    2626      end 
    2727      base.extend(ClassMethods) 
    …… 
    2929     
    3030    module ClassMethods 
    31       def verify_token(options = {}) 
    32         self.request_forgery_protection_token ||= :_token 
    33         before_filter :verify_request_token, :only => options.delete(:only), :except => options.delete(:except) 
    34         verify_token_options.update(options) 
     31      def protect_from_forgery(options = {}) 
     32        self.request_forgery_protection_token ||= :authenticity_token 
     33        before_filter :verify_authenticity_token, :only => options.delete(:only), :except => options.delete(:except) 
     34        request_forgery_protection_options.update(options) 
    3535      end 
    3636    end 
    …… 
    3838    protected 
    3939      # The actual before_filter that is used.  Modify this to change how you handle unverified requests. 
    40       def verify_request_token 
     40      def verify_authenticity_token 
    4141        verified_request? || raise(ActionController::InvalidToken) 
    4242      end 
    …… 
    4646      # * is the format restricted?  By default, only HTML and AJAX requests are checked. 
    4747      # * is it a GET request?  Gets should be safe and idempotent 
    48       # * Does the form_token match the given _token value from the params? 
     48      # * Does the form_authenticity_token match the given _token value from the params? 
    4949      def verified_request? 
    50         request_forgery_protection_token.nil? || request.method == :get || !verifiable_request_format? || form_token == params[request_forgery_protection_token] 
     50        request_forgery_protection_token.nil? || 
     51          request.method == :get              || 
     52          !verifiable_request_format?         || 
     53          form_authenticity_token == params[request_forgery_protection_token] 
    5154      end 
    5255     
    …… 
    5659     
    5760      # Sets the token value for the current session.  Pass a :secret option in #verify_token to add a custom salt to the hash. 
    58       def form_token 
    59         @form_token ||= verify_token_options[:secret] ? token_from_session_id : token_from_cookie_session 
     61      def form_authenticity_token 
     62        @form_authenticity_token ||= if request_forgery_protection_options[:secret] 
     63          authenticity_token_from_session_id 
     64        else 
     65          authenticity_token_from_cookie_session 
     66        end 
    6067      end 
    6168       
    6269      # Generates a unique digest using the session_id and the CSRF secret. 
    63       def token_from_session_id 
    64         key    = verify_token_options[:secret].respond_to?(:call) ? verify_token_options[:secret].call(@session) : verify_token_options[:secret] 
    65         digest = verify_token_options[:digest] || 'SHA1' 
     70      def authenticity_token_from_session_id 
     71        key = if request_forgery_protection_options[:secret].respond_to?(:call) 
     72          request_forgery_protection_options[:secret].call(@session) 
     73        else 
     74          request_forgery_protection_options[:secret] 
     75        end 
     76        digest = request_forgery_protection_options[:digest] ||= 'SHA1' 
    6677        OpenSSL::HMAC.hexdigest(OpenSSL::Digest::Digest.new(digest), key.to_s, session.session_id.to_s) 
    6778      end 
    6879       
    6980      # No secret was given, so assume this is a cookie session store. 
    70       def token_from_cookie_session 
     81      def authenticity_token_from_cookie_session 
    7182        session[:csrf_id] ||= CGI::Session.generate_unique_id 
    7283        session.dbman.generate_digest(session[:csrf_id]) 

  • trunk/actionpack/lib/action_view/helpers/form_tag_helper.rb

    r7592 r7596  
    425425            '' 
    426426          else 
    427             tag(:input, :type => "hidden", :name => request_forgery_protection_token.to_s, :value => form_token) 
     427            tag(:input, :type => "hidden", :name => request_forgery_protection_token.to_s, :value => form_authenticity_token) 
    428428          end 
    429429        end 

  • trunk/actionpack/lib/action_view/helpers/prototype_helper.rb

    r7592 r7596  
    746746            js_options['parameters'] = "'" 
    747747          end 
    748           js_options['parameters'] << "_token=' + encodeURIComponent('#{escape_javascript form_token}')" 
     748          js_options['parameters'] << "#{request_forgery_protection_token}=' + encodeURIComponent('#{escape_javascript form_authenticity_token}')" 
    749749        end 
    750750       

  • trunk/actionpack/lib/action_view/helpers/url_helper.rb

    r7592 r7596  
    475475          if request_forgery_protection_token 
    476476            submit_function << "var s = document.createElement('input'); s.setAttribute('type', 'hidden'); " 
    477             submit_function << "s.setAttribute('name', '_token'); s.setAttribute('value', '#{escape_javascript form_token}'); f.appendChild(s);" 
     477            submit_function << "s.setAttribute('name', '#{request_forgery_protection_token}'); s.setAttribute('value', '#{escape_javascript form_authenticity_token}'); f.appendChild(s);" 
    478478          end 
    479479          submit_function << "f.submit();" 

  • trunk/actionpack/test/controller/request_forgery_protection_test.rb

    r7592 r7596  
    66 
    77class RequestForgeryProtectionController < ActionController::Base 
    8   verify_token :only => :index, :secret => 'abc' 
     8  protect_from_forgery :only => :index, :secret => 'abc' 
    99 
    1010  def index 
    …… 
    2828    end 
    2929    @token = OpenSSL::HMAC.hexdigest(OpenSSL::Digest::Digest.new('SHA1'), 'abc', '123') 
    30     ActionController::Base.request_forgery_protection_token = :_token 
     30    ActionController::Base.request_forgery_protection_token = :authenticity_token 
    3131  end 
    3232   
    …… 
    3737  def test_should_render_form_with_token_tag 
    3838    get :index 
    39     assert_select 'form>div>input[name=?][value=?]', '_token', @token 
     39    assert_select 'form>div>input[name=?][value=?]', 'authenticity_token', @token 
    4040  end 
    4141 
    …… 
    7676   
    7777  def test_should_allow_post_with_token 
    78     post :index, :_token => @token 
     78    post :index, :authenticity_token => @token 
    7979    assert_response :success 
    8080  end 
    8181   
    8282  def test_should_allow_put_with_token 
    83     put :index, :_token => @token 
     83    put :index, :authenticity_token => @token 
    8484    assert_response :success 
    8585  end 
    8686   
    8787  def test_should_allow_delete_with_token 
    88     delete :index, :_token => @token 
     88    delete :index, :authenticity_token => @token 
    8989    assert_response :success 
    9090  end 
    …… 
    108108# no token is given, assume the cookie store is used 
    109109class CsrfCookieMonsterController < ActionController::Base 
    110   verify_token :only => :index 
     110  protect_from_forgery :only => :index 
    111111 
    112112  def index 
    …… 
    138138    end 
    139139    @token = Digest::SHA1.hexdigest("secure") 
    140     ActionController::Base.request_forgery_protection_token = :_token 
     140    ActionController::Base.request_forgery_protection_token = :authenticity_token 
    141141  end 
    142142   
    …… 
    147147  def test_should_render_form_with_token_tag 
    148148    get :index 
    149     assert_select 'form>div>input[name=?][value=?]', '_token', @token 
     149    assert_select 'form>div>input[name=?][value=?]', 'authenticity_token', @token 
    150150  end 
    151151 
    …… 
    186186   
    187187  def test_should_allow_post_with_token 
    188     post :index, :_token => @token 
     188    post :index, :authenticity_token => @token 
    189189    assert_response :success 
    190190  end 
    191191   
    192192  def test_should_allow_put_with_token 
    193     put :index, :_token => @token 
     193    put :index, :authenticity_token => @token 
    194194    assert_response :success 
    195195  end 
    196196   
    197197  def test_should_allow_delete_with_token 
    198     delete :index, :_token => @token 
     198    delete :index, :authenticity_token => @token 
    199199    assert_response :success 
    200200  end 

  • trunk/actionpack/test/template/text_helper_test.rb

    r7589 r7596  
    290290  end 
    291291 
    292   ActionView::Base.sanitized_allowed_tags.each do |tag_name| 
     292  ActionView::Helpers::TextHelper.sanitized_allowed_tags.each do |tag_name| 
    293293    define_method "test_should_allow_#{tag_name}_tag" do 
    294294      assert_sanitized "start <#{tag_name} title=\"1\" onclick=\"foo\">foo <bad>bar</bad> baz</#{tag_name}> end", %(start <#{tag_name} title="1">foo bar baz</#{tag_name}> end) 
    …… 
    552552    assert_equal((expected || text), sanitize(text)) 
    553553  end 
    554  
    555   # pull in configuration values from ActionView::Base 
    556   [:sanitized_protocol_separator, :sanitized_protocol_attributes, :sanitized_bad_tags, :sanitized_allowed_tags, :sanitized_allowed_attributes, :sanitized_allowed_protocols, :sanitized_allowed_css_properties, :sanitized_allowed_css_keywords, :sanitized_shorthand_css_properties, :sanitized_uri_attributes].each do |attr| 
    557     define_method attr do 
    558       ActionView::Base.send(attr) 
    559     end 
    560   end 
    561554end