4 ms·
never heard of it before. the demo seems to leave itself open to CSRF though. shrug.
by newobj 17y ago
never heard of it before. the demo seems to leave itself open to CSRF though. shrug.
- rufugee 17y agoWell, glad you're paying attention, but that's not correct. Play escapes everything for you by default, just as Rails 3.0 does now (http://www.playframework.org/documentation/1.0.1/releasenotes http://www.playframework.org/documentation/1.0.1/releasenote...)
- newobj 17y agoNot talking about escaping. I'm talking about the fact that there doesn't appear to be anything like an authenticity token backing the POST that's used to create a new item.
- pepite 17y agoThere is now: http://groups.google.com/group/play-framework/browse_thread/thread/85d1863ca03af24e/c2aa265c99addb3f http://groups.google.com/group/play-framework/browse_thread/...