thr3ads.net - Rails - Why can''t I hide passed parameters? [Nov 2006]

If this information is useful, please help other people find it:
Share via:

Taylor Strait

2006-Nov-19 00:53 UTC

Why can''t I hide passed parameters?

I don''t want to reveal ''agreed_to_disclaimer_at'' to
users.  What am I
doing wrong?

<%= link_to (''Continue'',  { :controller =>
''people'',
                            :action => ''new'',
                            :post => true,
                            :agreed_to_disclaimer_at => Time.now},
                            :confirm => ''I agree to
terms.'') %>

<%= link_to (''Continue'',  { :controller =>
''people'',
                            :action => ''new'',
                            :method => ''post'',
                            :agreed_to_disclaimer_at => Time.now},
                            :confirm => ''I agree to
terms.'') %>

BOTH return URLs of:

http://localhost:3000/people/new?post=true&agreed_to_disclaimer_at=Sat+Nov+18+19%3A49%3A49+-0500+2006

-- 
Posted via http://www.ruby-forum.com/.

--~--~---------~--~----~------------~-------~--~----~
 You received this message because you are subscribed to the Google Groups
"Ruby on Rails: Talk" group.
To post to this group, send email to
rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
To unsubscribe from this group, send email to
rubyonrails-talk-unsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
For more options, visit this group at
http://groups.google.com/group/rubyonrails-talk?hl=en
-~----------~----~----~----~------~----~------~--~---

ljredpath-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org

2006-Nov-19 01:02 UTC

head link

Re: Why can''t I hide passed parameters?

You could always use a button_to and POST it to the server.


--~--~---------~--~----~------------~-------~--~----~
 You received this message because you are subscribed to the Google Groups
"Ruby on Rails: Talk" group.
To post to this group, send email to
rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
To unsubscribe from this group, send email to
rubyonrails-talk-unsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
For more options, visit this group at
http://groups.google.com/group/rubyonrails-talk?hl=en
-~----------~----~----~----~------~----~------~--~---

ljredpath-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org

2006-Nov-19 01:03 UTC

head link

Re: Why can''t I hide passed parameters?

Ah I see you are trying to POST it - move the :post option outside of
the url_for hash.

<%= link_to (''Continue'',  { :controller =>
''people'',
                            :action => ''new'',
                            :agreed_to_disclaimer_at => Time.now},
                            :confirm => ''I agree to
terms.'',
                            :post => true, ) %>


--~--~---------~--~----~------------~-------~--~----~
 You received this message because you are subscribed to the Google Groups
"Ruby on Rails: Talk" group.
To post to this group, send email to
rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
To unsubscribe from this group, send email to
rubyonrails-talk-unsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
For more options, visit this group at
http://groups.google.com/group/rubyonrails-talk?hl=en
-~----------~----~----~----~------~----~------~--~---

Taylor Strait

2006-Nov-19 01:19 UTC

head link

Re: Why can''t I hide passed parameters?

unknown wrote:> Ah I see you are trying to POST it - move the :post option outside of
> the url_for hash.
That makes sense.  But I moved it an it still doesn''t work.  Wierd,
huh?

<%= link_to (''Continue'',  { :controller =>
''people'',
                            :action => ''new'',
                            :agreed_to_disclaimer_at => Time.now},
                            :post => true,
                            :confirm => ''I agree to
terms.'') %>

returns: 
http://localhost:3000/people/new?agreed_to_disclaimer_at=Sat+Nov+18+20%3A20%3A20+-0500+2006

-- 
Posted via http://www.ruby-forum.com/.

--~--~---------~--~----~------------~-------~--~----~
 You received this message because you are subscribed to the Google Groups
"Ruby on Rails: Talk" group.
To post to this group, send email to
rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
To unsubscribe from this group, send email to
rubyonrails-talk-unsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
For more options, visit this group at
http://groups.google.com/group/rubyonrails-talk?hl=en
-~----------~----~----~----~------~----~------~--~---

Alex Wayne

2006-Nov-19 05:39 UTC

head link

Re: Why can''t I hide passed parameters?

Taylor Strait wrote:> unknown wrote:
>> Ah I see you are trying to POST it - move the :post option outside of
>> the url_for hash.
> 
> That makes sense.  But I moved it an it still doesn''t work. 
Wierd, huh?
> 
> <%= link_to (''Continue'',  { :controller =>
''people'',
>                             :action => ''new'',
>                             :agreed_to_disclaimer_at => Time.now},
>                             :post => true,
>                             :confirm => ''I agree to
terms.'') %>
> 
> returns: 
>
http://localhost:3000/people/new?agreed_to_disclaimer_at=Sat+Nov+18+20%3A20%3A20+-0500+2006
that first hash is sent to url_for and url_for has no idea this is meant 
as a post request.  As always, if you want to post invisible data, use a 
form.

  <%= form_tag :controller => ''people'', :action =>
''new'' %>
    <%= hidden_field ''person'',
''agreed_to_disclaimer_at'', Time.now %>
    <%= submit_tag ''Continue'' %>
  </form>


-- 
Posted via http://www.ruby-forum.com/.

--~--~---------~--~----~------------~-------~--~----~
 You received this message because you are subscribed to the Google Groups
"Ruby on Rails: Talk" group.
To post to this group, send email to
rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
To unsubscribe from this group, send email to
rubyonrails-talk-unsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
For more options, visit this group at
http://groups.google.com/group/rubyonrails-talk?hl=en
-~----------~----~----~----~------~----~------~--~---

Taylor Strait

2006-Nov-19 06:52 UTC

head link

Re: Why can''t I hide passed parameters?

> that first hash is sent to url_for and url_for has no idea this is meant 
> as a post request.  As always, if you want to post invisible data, use a 
> form.
> 
>   <%= form_tag :controller => ''people'', :action
=> ''new'' %>
>     <%= hidden_field ''person'',
''agreed_to_disclaimer_at'', Time.now %>
>     <%= submit_tag ''Continue'' %>
>   </form>
I see.  Thanks for our help.  I guess :method => ''post'' is
just for
grabbing data and not obscuring parameters.  Unfortunately, 
ActionController gives me an exception with the new code:
> ''undefined method `delete'' for Sun Nov 19 01:37:11 -0500
2006:Time''
I''ve read the documentation and assume it is creating some kind of 
object but why would it be trying to call a ''delete'' method?

-- 
Posted via http://www.ruby-forum.com/.

--~--~---------~--~----~------------~-------~--~----~
 You received this message because you are subscribed to the Google Groups
"Ruby on Rails: Talk" group.
To post to this group, send email to
rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
To unsubscribe from this group, send email to
rubyonrails-talk-unsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
For more options, visit this group at
http://groups.google.com/group/rubyonrails-talk?hl=en
-~----------~----~----~----~------~----~------~--~---

Vishnu Gopal

2006-Nov-19 19:57 UTC

head link

Re: Why can''t I hide passed parameters?

Try:

<%= link_to (''Continue'',  { :controller =>
''people'',
                           :action => ''new'',
                           :agreed_to_disclaimer_at => Time.now},
                          {:confirm => ''I agree to terms.'',
                           :method => ''post''}) %>

Vish

On 11/19/06, Taylor Strait
<rails-mailing-list-ARtvInVfO7ksV2N9l4h3zg@public.gmane.org>
wrote:>
> > that first hash is sent to url_for and url_for has no idea this is
meant
> > as a post request.  As always, if you want to post invisible data, use
a
> > form.
> >
> >   <%= form_tag :controller => ''people'',
:action => ''new'' %>
> >     <%= hidden_field ''person'',
''agreed_to_disclaimer_at'', Time.now %>
> >     <%= submit_tag ''Continue'' %>
> >   </form>
>
> I see.  Thanks for our help.  I guess :method =>
''post'' is just for
> grabbing data and not obscuring parameters.  Unfortunately,
> ActionController gives me an exception with the new code:
>
> > ''undefined method `delete'' for Sun Nov 19 01:37:11
-0500 2006:Time''
>
> I''ve read the documentation and assume it is creating some kind of
> object but why would it be trying to call a ''delete''
method?
>
> --
> Posted via http://www.ruby-forum.com/.
>
> >
>
--~--~---------~--~----~------------~-------~--~----~
 You received this message because you are subscribed to the Google Groups
"Ruby on Rails: Talk" group.
To post to this group, send email to
rubyonrails-talk-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
To unsubscribe from this group, send email to
rubyonrails-talk-unsubscribe-/JYPxA39Uh5TLH3MbocFFw@public.gmane.org
For more options, visit this group at
http://groups.google.com/group/rubyonrails-talk?hl=en
-~----------~----~----~----~------~----~------~--~---

Rails - Nov 2006 - Why can't I hide passed parameters?

Why can''t I hide passed parameters?

Re: Why can''t I hide passed parameters?

Re: Why can''t I hide passed parameters?

Re: Why can''t I hide passed parameters?

Re: Why can''t I hide passed parameters?

Re: Why can''t I hide passed parameters?

Re: Why can''t I hide passed parameters?