Ruby on Rails | Screencasts | Download | Documentation | Weblog | Community | Source

Changeset 7623

Show
Ignore:
Timestamp:
09/24/07 23:12:25 (1 year ago)
Author:
david
Message:

Change from InvalidToken to InvalidAuthenticityToken to be more specific

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • trunk/actionpack/lib/action_controller/request_forgery_protection.rb

    r7614 r7623  
    11module ActionController #:nodoc: 
    2   class InvalidToken < ActionControllerError; end 
     2  class InvalidAuthenticityToken < ActionControllerError #:nodoc: 
     3  end 
    34 
    45  module RequestForgeryProtection 
    …… 
    1920      # scheme there anyway). Also, GET requests are not protected as these should be indempotent anyway. 
    2021      # 
    21       # You turn this on with the #protect_from_forgery method, which will perform the check and raise an ActionController::InvalidToken if 
    22       # the token doesn't match what was expected. And it will add a _token parameter to all forms that are automatically generated 
    23       # by Rails. You can customize the error message given through public/422.html. 
     22      # You turn this on with the #protect_from_forgery method, which will perform the check and raise  
     23      # an ActionController::InvalidAuthenticityToken if the token doesn't match what was expected. And it will add  
     24      # a _authenticity_token parameter to all forms that are automatically generated by Rails. You can customize the error message  
     25      # given through public/422.html. 
    2426      # 
    2527      # Learn more about CSRF (Cross-Site Request Forgery) attacks: 
    …… 
    2830      # * http://en.wikipedia.org/wiki/Cross-site_request_forgery 
    2931      # 
    30       # Keep in mind, this is NOT a silver-bullet, plug 'n' play, warm security blanket for your rails application.  There are a few guidelines you 
    31       # should follow: 
     32      # Keep in mind, this is NOT a silver-bullet, plug 'n' play, warm security blanket for your rails application. 
     33      # There are a few guidelines you should follow: 
    3234      #  
    3335      # * Keep your GET requests safe and idempotent.  More reading material: 
    …… 
    3537      #   * http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9.1.1 
    3638      # * Make sure the session cookies that Rails creates are non-persistent.  Check in Firefox and look for "Expires: at end of session" 
     39      # 
     40      # If you need to construct a request yourself, but still want to take advantage of forgery protection, you can grab the  
     41      # authenticity_token using the form_authenticity_token helper method and make it part of the parameters yourself. 
    3742      # 
    3843      # Example: 
    …… 
    6267      # The actual before_filter that is used.  Modify this to change how you handle unverified requests. 
    6368      def verify_authenticity_token 
    64         verified_request? || raise(ActionController::InvalidToken) 
     69        verified_request? || raise(ActionController::InvalidAuthenticityToken) 
    6570      end 
    6671       

  • trunk/actionpack/lib/action_controller/rescue.rb

    r7618 r7623  
    1414    DEFAULT_RESCUE_RESPONSE = :internal_server_error 
    1515    DEFAULT_RESCUE_RESPONSES = { 
    16       'ActionController::RoutingError'     => :not_found, 
    17       'ActionController::UnknownAction'    => :not_found, 
    18       'ActiveRecord::RecordNotFound'       => :not_found, 
    19       'ActiveRecord::StaleObjectError'     => :conflict, 
    20       'ActiveRecord::RecordInvalid'        => :unprocessable_entity, 
    21       'ActiveRecord::RecordNotSaved'       => :unprocessable_entity, 
    22       'ActionController::MethodNotAllowed' => :method_not_allowed, 
    23       'ActionController::NotImplemented'   => :not_implemented, 
    24       'ActionController::InvalidToken'    => :unprocessable_entity 
     16      'ActionController::RoutingError'             => :not_found, 
     17      'ActionController::UnknownAction'            => :not_found, 
     18      'ActiveRecord::RecordNotFound'               => :not_found, 
     19      'ActiveRecord::StaleObjectError'             => :conflict, 
     20      'ActiveRecord::RecordInvalid'                => :unprocessable_entity, 
     21      'ActiveRecord::RecordNotSaved'               => :unprocessable_entity, 
     22      'ActionController::MethodNotAllowed'         => :method_not_allowed, 
     23      'ActionController::NotImplemented'           => :not_implemented, 
     24      'ActionController::InvalidAuthenticityToken' => :unprocessable_entity 
    2525    } 
    2626 

  • trunk/actionpack/test/controller/request_forgery_protection_test.rb

    r7596 r7623  
    5252   
    5353  def test_should_not_allow_post_without_token 
    54     assert_raises(ActionController::InvalidToken) { post :index } 
     54    assert_raises(ActionController::InvalidAuthenticityToken) { post :index } 
    5555  end 
    5656   
    5757  def test_should_not_allow_put_without_token 
    58     assert_raises(ActionController::InvalidToken) { put :index } 
     58    assert_raises(ActionController::InvalidAuthenticityToken) { put :index } 
    5959  end 
    6060   
    6161  def test_should_not_allow_delete_without_token 
    62     assert_raises(ActionController::InvalidToken) { delete :index } 
     62    assert_raises(ActionController::InvalidAuthenticityToken) { delete :index } 
    6363  end 
    6464   
    6565  def test_should_not_allow_xhr_post_without_token 
    66     assert_raises(ActionController::InvalidToken) { xhr :post, :index } 
     66    assert_raises(ActionController::InvalidAuthenticityToken) { xhr :post, :index } 
    6767  end 
    6868   
    6969  def test_should_not_allow_xhr_put_without_token 
    70     assert_raises(ActionController::InvalidToken) { xhr :put, :index } 
     70    assert_raises(ActionController::InvalidAuthenticityToken) { xhr :put, :index } 
    7171  end 
    7272   
    7373  def test_should_not_allow_xhr_delete_without_token 
    74     assert_raises(ActionController::InvalidToken) { xhr :delete, :index } 
     74    assert_raises(ActionController::InvalidAuthenticityToken) { xhr :delete, :index } 
    7575  end 
    7676   
    …… 
    162162   
    163163  def test_should_not_allow_post_without_token 
    164     assert_raises(ActionController::InvalidToken) { post :index } 
     164    assert_raises(ActionController::InvalidAuthenticityToken) { post :index } 
    165165  end 
    166166   
    167167  def test_should_not_allow_put_without_token 
    168     assert_raises(ActionController::InvalidToken) { put :index } 
     168    assert_raises(ActionController::InvalidAuthenticityToken) { put :index } 
    169169  end 
    170170   
    171171  def test_should_not_allow_delete_without_token 
    172     assert_raises(ActionController::InvalidToken) { delete :index } 
     172    assert_raises(ActionController::InvalidAuthenticityToken) { delete :index } 
    173173  end 
    174174   
    175175  def test_should_not_allow_xhr_post_without_token 
    176     assert_raises(ActionController::InvalidToken) { xhr :post, :index } 
     176    assert_raises(ActionController::InvalidAuthenticityToken) { xhr :post, :index } 
    177177  end 
    178178   
    179179  def test_should_not_allow_xhr_put_without_token 
    180     assert_raises(ActionController::InvalidToken) { xhr :put, :index } 
     180    assert_raises(ActionController::InvalidAuthenticityToken) { xhr :put, :index } 
    181181  end 
    182182   
    183183  def test_should_not_allow_xhr_delete_without_token 
    184     assert_raises(ActionController::InvalidToken) { xhr :delete, :index } 
     184    assert_raises(ActionController::InvalidAuthenticityToken) { xhr :delete, :index } 
    185185  end 
    186186   

  • trunk/railties/CHANGELOG

    r7619 r7623  
    11*SVN* 
    22 
    3 * Added a default 422.html page to be rendered when ActiveRecord::RecordInvalid, ActiveRecord::RecordNotSaved, or ActionController::InvalidToken is raised [DHH] 
     3* Added a default 422.html page to be rendered when ActiveRecord::RecordInvalid, ActiveRecord::RecordNotSaved, or ActionController::InvalidAuthenticityToken is raised [DHH] 
    44 
    55* Added --skip-fixture option to script/generate model #6862 [sandofsky]