Skip to content

Commit ec211f5

Browse files
DevDev
Dev
authored and
Dev
committed
Fixed jquery-ujs vulnerbility issue
1 parent 83b041b commit ec211f5

File tree

1 file changed

+2
-18
lines changed

1 file changed

+2
-18
lines changed

src/rails.js

+2-18
Original file line numberDiff line numberDiff line change
@@ -212,24 +212,8 @@
212212

213213
// Handles "data-method" on links such as:
214214
// <a href="/users/5" data-method="delete" rel="nofollow" data-confirm="Are you sure?">Delete</a>
215-
handleMethod: function(link) {
216-
var href = rails.href(link),
217-
method = link.data('method'),
218-
target = link.attr('target'),
219-
csrfToken = rails.csrfToken(),
220-
csrfParam = rails.csrfParam(),
221-
form = $('<form method="post" action="' + href + '"></form>'),
222-
metadataInput = '<input name="_method" value="' + method + '" type="hidden" />';
223-
224-
if (csrfParam !== undefined && csrfToken !== undefined && !rails.isCrossDomain(href)) {
225-
metadataInput += '<input name="' + csrfParam + '" value="' + csrfToken + '" type="hidden" />';
226-
}
227-
228-
if (target) { form.attr('target', target); }
229-
230-
form.hide().append(metadataInput).appendTo('body');
231-
form.submit();
232-
},
215+
// Handles "data-method" on links such as:
216+
// <a href="/users/5" data-method="delete" rel="nofollow" data-confirm="Are you sure?">Delete</a>
233217

234218
// Helper function that returns form elements that match the specified CSS selector
235219
// If form is actually a "form" element this will return associated elements outside the from that have

0 commit comments

Comments
 (0)