Ensure the previous pages params aren't passed through redirect

This commit is contained in:
Bryan Helmkamp 2009-01-19 13:56:22 -05:00
parent ced63f6e5a
commit 14d114ce1d
5 changed files with 37 additions and 4 deletions

View File

@ -112,7 +112,7 @@ For example:
@http_method = http_method
@data = data
request_page(response_location, :get, data) if internal_redirect?
request_page(response_location, :get, {}) if internal_redirect?
return response
end

View File

@ -12,13 +12,24 @@ class WebratController < ApplicationController
def submit
render :text => "OK"
end
def internal_redirect
redirect_to :submit
redirect_to submit_path
end
def external_redirect
redirect_to "http://google.com"
end
def before_redirect_form
end
def redirect_to_show_params
redirect_to show_params_path(:custom_param => "123")
end
def show_params
render :text => params.to_json
end
end

View File

@ -0,0 +1,7 @@
<% form_tag redirect_to_show_params_path do %>
<label>
Text field <%= text_field_tag "text_field" %>
</label>
<%= submit_tag "Test" %>
<% end %>

View File

@ -3,7 +3,11 @@ ActionController::Routing::Routes.draw do |map|
webrat.submit "/submit", :action => "submit"
webrat.internal_redirect "/internal_redirect", :action => "internal_redirect"
webrat.external_redirect "/external_redirect", :action => "external_redirect"
webrat.before_redirect_form "/before_redirect_form", :action => "before_redirect_form"
webrat.redirect_to_show_params "/redirect_to_show_params", :action => "redirect_to_show_params"
webrat.show_params "/show_params", :action => "show_params"
webrat.root :action => "form"
end
end

View File

@ -21,8 +21,19 @@ class WebratTest < ActionController::IntegrationTest
assert field_labeled("Prefilled").value, "text"
end
test "should not carry params through redirects" do
visit before_redirect_form_path
fill_in "Text field", :with => "value"
click_button
assert response.body !~ /value/
assert response.body =~ /custom_param/
end
test "should follow internal redirects" do
visit internal_redirect_path
assert !response.redirect?
assert response.body.include?("OK")
end