Mark sensitive auth_source forms with Cache-Control: no-store (#42998).

Patch by Holger Just (user:hjust).

git-svn-id: https://svn.redmine.org/redmine/trunk@23941 e93f8b46-1217-0410-a6f0-8f06a7374b81

app/controllers/auth_sources_controller.rb

@@ -32,6 +32,7 @@ class AuthSourcesController < ApplicationController
   end
 
   def new
+    no_store
   end
 
   def create
@@ -39,11 +40,13 @@ class AuthSourcesController < ApplicationController
       flash[:notice] = l(:notice_successful_create)
       redirect_to auth_sources_path
     else
+      no_store
       render :action => 'new'
     end
   end
 
   def edit
+    no_store
   end
 
   def update
@@ -52,6 +55,7 @@ class AuthSourcesController < ApplicationController
       flash[:notice] = l(:notice_successful_update)
       redirect_to auth_sources_path
     else
+      no_store
       render :action => 'edit'
     end
   end

test/functional/auth_sources_controller_test.rb

@@ -32,6 +32,7 @@ class AuthSourcesControllerTest < Redmine::ControllerTest
   def test_new
     get :new
     assert_response :success
+    assert_includes @response.headers['Cache-Control'], 'no-store'
 
     assert_select 'form#auth_source_form' do
       assert_select 'input[name=type][value=AuthSourceLdap]'
@@ -88,6 +89,7 @@ class AuthSourcesControllerTest < Redmine::ControllerTest
         }
       )
       assert_response :success
+      assert_includes @response.headers['Cache-Control'], 'no-store'
     end
     assert_select_error /host cannot be blank/i
   end
@@ -100,6 +102,7 @@ class AuthSourcesControllerTest < Redmine::ControllerTest
       }
     )
     assert_response :success
+    assert_includes @response.headers['Cache-Control'], 'no-store'
 
     assert_select 'form#auth_source_form' do
       assert_select 'input[name=?]', 'auth_source[host]'
@@ -163,6 +166,8 @@ class AuthSourcesControllerTest < Redmine::ControllerTest
       }
     )
     assert_response :success
+    assert_includes @response.headers['Cache-Control'], 'no-store'
+
     assert_select_error /host cannot be blank/i
   end