erichmenge/signed_form — pull request #6 by schuetzm (2013-04-21 12:43:46+00:00)
Title: Fix comparison of URLs and request method.

* `String#casecmp` returns -1/0/1, not true/false
* use `request.request_method` instead of `request.method`, which contains the
intended method, not the physically used one (PATCH vs. POST)
* call `url_for` on the url, and compare with both full url and path; this fixes
the case where a symbol or array is specified as url in `signed_form_for`

After the first problem (casecmp) is fixed (which previously was always true), it can be seen that forms using PATCH or PUT don't work any more, because Rails turns this into a POST for compatibility reasons and store the actually wanted method in an additional parameter. This method can be read from request.request_method.

Second problem: If `signed_form_for` is called with an array or symbol, i.e.:
```signed_form_for @user, url: :settings ...```
The symbol itself is signed, not the actual URL/path. Thus, the comparison with the URL fails on verification. This is fixed by calling `url_for` on the signed url.

(I would have split this into seperate pull requests, but they all affect the same line.)