代码之家 › 专栏 › 技术社区 › Ceilingfish

Uploadify和rails 3真实性令牌

ruby-on-rails-3 uploadify cookies ruby-on-rails

Ceilingfish · 技术社区 · 16 年前

http://www.uploadify.com )我被真伪代币困住了。我当前上传的配置看起来像

            <script type="text/javascript" charset="utf-8">
             $(document).ready(function() {
                   $("#zip_input").uploadify({
                    'uploader': '/flash/uploadify.swf',
                    'script': $("#upload").attr('action'),
                    'scriptData': { 'format': 'json', 'authenticity_token': encodeURIComponent('<%= form_authenticity_token if protect_against_forgery? %>') },
                    'fileDataName': "world[zip]",
                    //'scriptAccess': 'always', // Incomment this, if for some reason it doesn't work
                    'auto': true,
                    'fileDesc': 'Zip files only',
                    'fileExt': '*.zip',
                    'width': 120, 
                    'height': 24,
                    'cancelImg': '/images/cancel.png',
                    'onComplete': function(event, data) { $.getScript(location.href) }, // We assume that we can refresh the list by doing a js get on the current page
                   'displayData': 'speed'
                   });
                 });
            </script>

Started POST "/worlds" for 127.0.0.1 at 2010-04-22 12:39:44

ActionController::InvalidAuthenticityToken (ActionController::InvalidAuthenticityToken):


Rendered /opt/local/lib/ruby/gems/1.8/gems/actionpack-3.0.0.beta3/lib/action_dispatch/middleware/templates/rescues/_trace.erb (1.0ms)
Rendered /opt/local/lib/ruby/gems/1.8/gems/actionpack-3.0.0.beta3/lib/action_dispatch/middleware/templates/rescues/_request_and_response.erb (6.6ms)
Rendered /opt/local/lib/ruby/gems/1.8/gems/actionpack-3.0.0.beta3/lib/action_dispatch/middleware/templates/rescues/diagnostics.erb within rescues/layout (12.2ms)

这似乎是因为我没有将身份验证cookie与请求一起发送。有没有人知道我如何获得应该发送到那里的值,以及我如何让rails从HTTPPOST读取这些值,而不是试图将其作为cookie来查找?

3 回复 | 直到 16 年前

dxg 15 年前

跳过真实性令牌检查并不理想,因为它会打开XSS攻击向量。另一种方法是: http://metautonomo.us/2010/07/09/uploadify-and-rails-3/

请注意,您可能需要双重url编码的东西。在本例中,使用了rails'u'和encodeURLComponent()。但是,如果您设置了更为奇特的/rails3类型,并从页面标题中的meta标记中获取会话数据/真实性令牌,则需要调用encodeURLComponent()两次。

Ceilingfish 16 年前

这似乎是Rails3的一个bug。

https://rails.lighthouseapp.com/projects/8994-ruby-on-rails/tickets/3913

更改自

protect_from_forgery :except => :upload

skip_before_filter :verify_authenticity_token, :only => :upload

看起来还不错

iwasrobbed 15 年前

var token = ($('input[name=authenticity_token]').val());
scriptData : {'authenticity_token':token}