How do I prevent users from calling a method "doAction" in my controller using GET requests? I only want it to be called开发者_C百科 using POST requests?
I heard I need to use "verify" but I'm unsure where to put that code, or how I need to use it.
You can specify which methods are allowed for any action in your routes.rb
.
Rails 2:
map.connect '/posts/doAction', :controller => 'posts,
:action => 'doAction',
:conditions => { :method => :post }
Rails 3:
match 'posts/doAction' => "posts#doAction', :via => :post
post 'posts/doAction', :to => "posts#doAction'
You can add a constraint to the route in routes.rb
.
match "/doAction" => "controller#doAction", :via => :post
Refer to http://guides.rubyonrails.org/routing.html for more.
精彩评论