Changeset 8601

Timestamp:

01/08/08 21:22:01 (6 months ago)

Author:

nzkoz

Message:

Don't append the forgery token to an ajax request if it's serializing a form, prevents duplicate tokens. References #10684 [macournoyer]

Files:

• branches/2-0-stable/actionpack/lib/action_view/helpers/prototype_helper.rb (modified) (1 diff)
• branches/2-0-stable/actionpack/test/controller/request_forgery_protection_test.rb (modified) (2 diffs)

branches/2-0-stable/actionpack/lib/action_view/helpers/prototype_helper.rb

@@ -1020 +1020 @@
-        end
-        
-
+ && !options[:form]
-          if js_options['parameters']
-            js_options['parameters'] << " + '&"

branches/2-0-stable/actionpack/test/controller/request_forgery_protection_test.rb

@@ -23 +23 @@
-  end
-  
+  def remote_form
+    render :inline => "<% form_remote_tag(:url => '/') {} %>"
+  end
+
-  def unsafe
-    render :text => 'pwn'
@@ -76 +80 @@
-  end
-
+  def test_should_render_remote_form_with_only_one_token_parameter
+    get :remote_form
+    assert_equal 1, @response.body.scan(@token).size
+  end
+
-  def test_should_allow_get
-    get :index