This project is archived and is in readonly mode.
Changeset [0697d17d121fcf9f46b5dd2dd1034dffa19ebdf2] by rick
Revision 0697d17d121fcf9f46b5dd2dd1034dffa19ebdf2,
committed by Repository
· May 6th, 2008 @ 08:42 AM
Change the request forgery protection to go by Content-Type instead of request.format so that you can't bypass it by POSTing to "#{request.uri}.xml" [#73 state:resolved]
3 changed files
-
M
actionpack/CHANGELOG -
M
actionpack/lib/action_controller/request_forgery_protection.rb -
M
actionpack/test/controller/request_forgery_protection_test.rb