Ajax calls no longer whitelisted
As of Rails 3.0.4 and 2.3.11, Ajax calls are no longer whitelisted.
See: http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails/
Community contributions, tips, and corrections to the documentation. (1708 notes)
As of Rails 3.0.4 and 2.3.11, Ajax calls are no longer whitelisted.
See: http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-rails/
I just stumbled across this somewhere in our codebase. The first example is faulty, the second one is correct.
= f.check_box :public, {}, true, false
# <input id="event_public" name="event[public]" type="checkbox" value="true" />
and:
= f.check_box :public, {}, "true", "false"
If you want to use nested attributes in a i18n file (like person :has_many => :addresses), write:
en:
activerecord:
attributes:
person:
name:
"person/addresses":
street: "Street name"
"person/phones":
area: "Area code"
nu...
From what I've seen, it looks like the difference between this and #fullpath is that this method doesn't include parameters that weren't in the original url (i.e. parameters that were sent via POST instead of GET).
Normally when you create controllers, helpers and models inside an engine, they are treated as if they were created inside the application itself. This means that all helpers and named routes from the application will be available to your engine’s controllers as well.
However, sometimes you want to...
stub_chain provides a very good replacement of long lines of nested stubs, but never forget it violates Law of Demeter; i.e. it indicates an increase of coupling in your classes and this is a bad thing because it means your objects now are making more unnecessary calls to other objects. for example:...
Rails ignores the accept header when it contains ",/" or "/," and returns HTML (or JS if it's a xhr request).
This is by design to always return HTML when being accessed from a browser.
This doesn't follow the mime type negotiation specification but it was the only way to circumvent old browse...
accepts_nested_attributes_for has some detractors: http://blog.codeclimate.com/blog/2012/10/17/7-ways-to-decompose-fat-activerecord-models
But fields_for is defined both on FormBuilder and FormHelper and is still useful even when accepts_nested_attributes_for is not being used. Consider a "to do li...
==== where.not()
users.* FROM users WHERE (users.id != 1) AND (users.name IS NOT NULL)User.where.not(id: 1).where.not(name: nil)
This block if size = options.delete(:size) options[:width], options[:height] = size.split("x") if size =~ %{^\d+x\d+$} end has type mismatch %r{^\d+x\d+$}
Note that
<%= content_tag_for(:li, @person, :class => "bar") %>
does the right thing.
<%= content_tag_for(:li, @person, 'class' => "bar") %>
will not!
In the notes on this page people use: car_ids_#{c.id}
But you can use this function in stead:
dom_id(c)
I need this
It only listen for the messages we tell it to expect and ignore any other messages.
For example:
spec/codebreaker/game_spec.rb
module Codebreaker describe Game do describe "#start" do before(:each) do @output = double('output').as_null_object @game = Game.new(@outpu...
serialize seems very similar to other directives that work on attributes such as attr_accessible. One may mistakenly assume that serialize can take a list of attributes. For eg:
class Tuk < ActiveRecord::Base
attr_accessible :foo, :bar
serialize :foo, :bar
end
This may lead to a...
I recently found myself in the situation where I needed to generate URLs which included the ID instead of the value returned from the model's to_param method (since someone had overridden the to_param method). It turned out to be easier than I thought. You can simply pass an ID to the helper method...
You can use assert_select to test helpers, just have to set the @output_buffer before you do.
==== Code example
class CurrencyHelperTest < ActionView::TestCase
setup do
# can use helper methods here
@output_buffer = currency 54.78
end
test 'currency use...
See http://apidock.com/rails/String/inquiry
env = "production".inquiry
env.production? # => true
env.development? # => false