Security: HTTP GET Bypassed Spam Protection

Apparently, the form_spam_protect plugin only works with HTTP POST, not GET.
Unsafe operations (save and file-upload) should be POSTs anyway.
Fixed.

Also, two broken tests fixed. Only two Unit Tests now fail: both are minor bugs in XHTMLDiff.

test/functional/file_controller_test.rb

@@ -87,8 +87,12 @@ class FileControllerTest < Test::Unit::TestCase
     # User uploads the picture
     picture = File.read("#{RAILS_ROOT}/test/fixtures/rails.gif")
     # updated from post to get - post fails the spam protection (no javascript)
-    r = get :file, :web => 'wiki1', 
-             :file => {:file_name => 'rails-e2e.gif',  :content => StringIO.new(picture)}
+    #   Moron! If substituting GET for POST actually works, you
+    #   have much, much bigger problems.
+    r = get :file, :web => 'wiki1',
+            :file => {:file_name => 'rails-e2e.gif',
+                      :content => StringIO.new(picture),
+                      :description => 'Rails, end-to-end'}
     assert @web.has_file?('rails-e2e.gif')
     assert_equal(picture, WikiFile.find_by_file_name('rails-e2e.gif').content)
   end