This project is archived and is in readonly mode.
Add magic encoding comment to generated files
This patch adds an option to prevent the CSRF (Cross-Site Request Forgery) protection token being included for an individual form, whilst still having the forgery protection enabled.
This is intented only for situations where the form is being submitted to a third-party (e.g. an external search). In such cases, CSRF protection is not needed and revealing the token to the third party is a security risk as they could then submit requests as the user.
Passes existing tests and adds one new test.
-
Pratik- State changed from new to incomplete
- Assigned user set to Pratik
I think the option should be ":protect_against_forgery => false" to be consistent with the rest of the stuff. Could you please upload a new patch with that ?
Cheers.
-
Michael Trim- Title changed from Add :no_csrf_token option to form_tag to Add :protect_against_forgery option to form_tag
Updated patch attached, although thinking about it a bit more I'm not sure whether this is worth the bother since one can easily write the html directly.
-
Rohit Arondekar- State changed from incomplete to stale
- Tag set to actionpack, enhancement, patch, request-forgery-protection
- Importance changed from to Low
Marking ticket as stale. If this is still an issue please leave a comment with suggested changes, creating a patch with tests, rebasing an existing patch or just confirming the issue on a latest release or master/branches.
-
Ryan BiggAutomatic cleanup of spam.
-
Jeff Kreeftmeijer
Automatic cleanup of spam.
-