aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAaron Patterson <aaron.patterson@gmail.com>2012-05-31 10:23:39 -0700
committerAaron Patterson <aaron.patterson@gmail.com>2012-05-31 10:23:39 -0700
commit44aca7b29502995b3e2ed94f7288646f134ff612 (patch)
treee19a96ec4624baa32064ff1807a8ffe3a083b96e
parent71827489e90f91da18ebac68c2d9e10379220a43 (diff)
downloadrails-44aca7b29502995b3e2ed94f7288646f134ff612.tar.gz
rails-44aca7b29502995b3e2ed94f7288646f134ff612.tar.bz2
rails-44aca7b29502995b3e2ed94f7288646f134ff612.zip
adding security notifications to CHANGELOGs
-rw-r--r--actionpack/CHANGELOG.md3
-rw-r--r--activerecord/CHANGELOG.md3
2 files changed, 6 insertions, 0 deletions
diff --git a/actionpack/CHANGELOG.md b/actionpack/CHANGELOG.md
index 1ec3a954fb..6f737001de 100644
--- a/actionpack/CHANGELOG.md
+++ b/actionpack/CHANGELOG.md
@@ -21,6 +21,9 @@
* Fix the redirect when it receive blocks with arity of 1. Closes #5677
+* Strip [nil] from parameters hash. Thanks to Ben Murphy for
+ reporting this! CVE-2012-2660
+
## Rails 3.2.3 (March 30, 2012) ##
* Allow to lazy load `default_form_builder` by passing a `String` instead of a constant. *Piotr Sarnacki*
diff --git a/activerecord/CHANGELOG.md b/activerecord/CHANGELOG.md
index 4c81698517..6767fb74f5 100644
--- a/activerecord/CHANGELOG.md
+++ b/activerecord/CHANGELOG.md
@@ -13,6 +13,9 @@
* Fix #5667. Preloading should ignore scoping.
+* Predicate builder should not recurse for determining where columns.
+ Thanks to Ben Murphy for reporting this! CVE-2012-2661
+
## Rails 3.2.3 (March 30, 2012) ##
* Added find_or_create_by_{attribute}! dynamic method. *Andrew White*