Matthew Daubert's profile

~~6743~~ ~~CSRF not working Rails 3.0.7~~ was updated in Ruby on Rails

Matthew Daubert commented at 6:15 PM
mrbrdo - keep in mind that CSRF protection is meant to prevent session hijacking and has nothing to do with authorizing actions within your application. The Sec...
Matthew Daubert commented at 4:49 PM

Looks like this is the expected behavior as of Rails 3.0.4:
http://jasoncodes.com/posts/rails-csrf-vulnerability

For the old functionality you can add this to y...
Matthew Daubert commented at 4:39 PM
The request_forgery_protection tests pass for me for both 3.0.7 and master branches but I also see the same behavior with your test app. I wonder if the change ...

Matthew Daubert commented at 5:00 PM

Ary,

I suspect the low priority designation is because you an accomplish the same task by changing the last line. I plugged this into your test case and it seem...

Matthew Daubert commented at 2:22 PM
Rebased patch to master 2bc4856..d4bea35
Matthew Daubert created the ticket at 2:17 PM
The ActiveModel::SecurePassword module is outstanding but I think allowing a password to be optional would allow many more use cases for this feature. E.g. an a...

Matthew Daubert commented at 4:13 PM
My previous comment was truncated. Tero - I suggest changing your application's inflections file as suggested by the API documentation (quoted above).
Matthew Daubert commented at 4:10 PM
The Rails core team has stated patches for the inflections library will not be accepted in order to avoid breaking legacy applications which may be relying on e...

Matthew Daubert commented at 1:58 PM
Attached is a barebones app that fails for me (Rails 3.0.0, Ruby 1.9.2p0 x86_64-darwin10.4.0, OSX 10.6.4). The partial shared/messages has content_for(:script) ...
Matthew Daubert commented at 12:47 PM
Thank you Jeff - Your example works for me, too. I think the problem may be specifically with calling content_for from within a partial and yielding in a differ...