El Wednesday 25 February 2009 11:47:30 [email protected] escribió: > Hi Wes, > > This page gives a bit more details about the protect_from_forgery > method: > http://api.rubyonrails.org/classes/ActionController/RequestForgeryProtectio >n/ClassMethods.html > > It seems the method can be applied to any action in your controller > (and is the default for Rails app >= 2.0). > But it will only work for POST requests. > > It seems that AS doesn't include the authenticity token in the subform > (at least in some cases). At least, that is my understanding of the > problem.
I suppose it's a bug in AS with rails 2.3 because it works in rails 2.2, but I haven't had time to look at this yet. > > Hope this helps. > > Christian. > > On Feb 24, 3:59 pm, Wes Gamble <[email protected]> wrote: > > Christian, > > > > I disabled all of my protect_from_forgery stuff to get around it for now > > > > :). > > > > This does make me wonder if either: > > > > 1) protect_from_forgery doesn't apply to all POST requests, but only > > certain actions implicitly (e.g. "create" "update" "delete" etc.) > > 2) the edit_associated call is actually a GET and not a POST or > > something weird like that (I'm not sure that really makes sense though). > > > > Wes > > -- Sergio Cambra .:: entreCables S.L. ::. Nicolás Guillén 6, locales 2 y 3. 50.018 Zaragoza T) 902 021 404 F) 976 52 98 07 E) [email protected] --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "ActiveScaffold : Ruby on Rails plugin" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [email protected] For more options, visit this group at http://groups.google.com/group/activescaffold?hl=en -~----------~----~----~----~------~----~------~--~---
