Sync 'rails/rails/master'

26 files changed, 529 insertions, 681 deletions

diff --git a/actionpack/lib/action_controller/assertions/selector_assertions.rb b/actionpack/lib/action_controller/assertions/selector_assertions.rb
index 7f8fe9ab19..0d56ea5ef7 100644
--- a/actionpack/lib/action_controller/assertions/selector_assertions.rb
+++ b/actionpack/lib/action_controller/assertions/selector_assertions.rb
@@ -109,20 +109,27 @@ module ActionController
       # starting from (and including) that element and all its children in
       # depth-first order.
       #
-      # If no element if specified, calling +assert_select+ will select from the
-      # response HTML. Calling #assert_select inside an +assert_select+ block will
-      # run the assertion for each element selected by the enclosing assertion.
+      # If no element if specified, calling +assert_select+ selects from the
+      # response HTML unless +assert_select+ is called from within an +assert_select+ block.
+      #
+      # When called with a block +assert_select+ passes an array of selected elements
+      # to the block. Calling +assert_select+ from the block, with no element specified,
+      # runs the assertion on the complete set of elements selected by the enclosing assertion.
+      # Alternatively the array may be iterated through so that +assert_select+ can be called
+      # separately for each element.
+      #
       #
       # ==== Example
-      #   assert_select "ol>li" do |elements|
+      # If the response contains two ordered lists, each with four list elements then:
+      #   assert_select "ol" do |elements|
       #     elements.each do |element|
-      #       assert_select element, "li"
+      #       assert_select element, "li", 4
       #     end
       #   end
       #
-      # Or for short:
-      #   assert_select "ol>li" do
-      #     assert_select "li"
+      # will pass, as will:
+      #   assert_select "ol" do
+      #     assert_select "li", 8
       #   end
       #
       # The selector may be a CSS selector expression (String), an expression
diff --git a/actionpack/lib/action_controller/base.rb b/actionpack/lib/action_controller/base.rb
index e22114195c..36b80d5780 100644
--- a/actionpack/lib/action_controller/base.rb
+++ b/actionpack/lib/action_controller/base.rb
@@ -301,10 +301,7 @@ module ActionController #:nodoc:
     # A YAML parser is also available and can be turned on with:
     #
     #   ActionController::Base.param_parsers[Mime::YAML] = :yaml
-    @@param_parsers = { Mime::MULTIPART_FORM   => :multipart_form,
-                        Mime::URL_ENCODED_FORM => :url_encoded_form,
-                        Mime::XML              => :xml_simple,
-                        Mime::JSON             => :json }
+    @@param_parsers = {}
     cattr_accessor :param_parsers
 
     # Controls the default charset for all renders.
@@ -647,7 +644,7 @@ module ActionController #:nodoc:
       end
 
       def session_enabled?
-        request.session_options && request.session_options[:disabled] != false
+        ActiveSupport::Deprecation.warn("Sessions are now lazy loaded. So if you don't access them, consider them disabled.", caller)
       end
 
       self.view_paths = []
@@ -1318,10 +1315,6 @@ module ActionController #:nodoc:
         "#{request.protocol}#{request.host}#{request.request_uri}"
       end
 
-      def close_session
-        @_session.close if @_session && @_session.respond_to?(:close)
-      end
-
       def default_template(action_name = self.action_name)
         self.view_paths.find_template(default_template_name(action_name), default_template_format)
       end
@@ -1345,15 +1338,14 @@ module ActionController #:nodoc:
       end
 
       def process_cleanup
-        close_session
       end
   end
 
   Base.class_eval do
     [ Filters, Layout, Benchmarking, Rescue, Flash, MimeResponds, Helpers,
       Cookies, Caching, Verification, Streaming, SessionManagement,
-      HttpAuthentication::Basic::ControllerMethods, RecordIdentifier,
-      RequestForgeryProtection, Translation
+      HttpAuthentication::Basic::ControllerMethods, HttpAuthentication::Digest::ControllerMethods,
+      RecordIdentifier, RequestForgeryProtection, Translation
     ].each do |mod|
       include mod
     end
diff --git a/actionpack/lib/action_controller/caching/sweeping.rb b/actionpack/lib/action_controller/caching/sweeping.rb
index c7992d7769..c1be264ffb 100644
--- a/actionpack/lib/action_controller/caching/sweeping.rb
+++ b/actionpack/lib/action_controller/caching/sweeping.rb
@@ -87,9 +87,9 @@ module ActionController #:nodoc:
             __send__(action_callback_method_name)     if respond_to?(action_callback_method_name, true)
           end
 
-          def method_missing(method, *arguments)
+          def method_missing(method, *arguments, &block)
             return if @controller.nil?
-            @controller.__send__(method, *arguments)
+            @controller.__send__(method, *arguments, &block)
           end
       end
     end
diff --git a/actionpack/lib/action_controller/flash.rb b/actionpack/lib/action_controller/flash.rb
index 9856dbed2a..56ee9c67e2 100644
--- a/actionpack/lib/action_controller/flash.rb
+++ b/actionpack/lib/action_controller/flash.rb
@@ -4,20 +4,22 @@ module ActionController #:nodoc:
   # action that sets <tt>flash[:notice] = "Successfully created"</tt> before redirecting to a display action that can
   # then expose the flash to its template. Actually, that exposure is automatically done. Example:
   #
-  #   class WeblogController < ActionController::Base
+  #   class PostsController < ActionController::Base
   #     def create
   #       # save post
   #       flash[:notice] = "Successfully created post"
-  #       redirect_to :action => "display", :params => { :id => post.id }
+  #       redirect_to posts_path(@post)
   #     end
   #
-  #     def display
+  #     def show
   #       # doesn't need to assign the flash notice to the template, that's done automatically
   #     end
   #   end
   #
-  #   display.erb
-  #     <% if flash[:notice] %><div class="notice"><%= flash[:notice] %></div><% end %>
+  #   show.html.erb
+  #     <% if flash[:notice] %>
+  #       <div class="notice"><%= flash[:notice] %></div>
+  #     <% end %>
   #
   # This example just places a string in the flash, but you can put any object in there. And of course, you can put as
   # many as you like at a time too. Just remember: They'll be gone by the time the next action has been performed.
diff --git a/actionpack/lib/action_controller/http_authentication.rb b/actionpack/lib/action_controller/http_authentication.rb
index 2ed810db7d..5d915fda08 100644
--- a/actionpack/lib/action_controller/http_authentication.rb
+++ b/actionpack/lib/action_controller/http_authentication.rb
@@ -1,42 +1,42 @@
 module ActionController
   module HttpAuthentication
     # Makes it dead easy to do HTTP Basic authentication.
-    # 
+    #
     # Simple Basic example:
-    # 
+    #
     #   class PostsController < ApplicationController
     #     USER_NAME, PASSWORD = "dhh", "secret"
-    #   
+    #
     #     before_filter :authenticate, :except => [ :index ]
-    #   
+    #
     #     def index
     #       render :text => "Everyone can see me!"
     #     end
-    #   
+    #
     #     def edit
     #       render :text => "I'm only accessible if you know the password"
     #     end
-    #   
+    #
     #     private
     #       def authenticate
-    #         authenticate_or_request_with_http_basic do |user_name, password| 
+    #         authenticate_or_request_with_http_basic do |user_name, password|
     #           user_name == USER_NAME && password == PASSWORD
     #         end
     #       end
     #   end
-    # 
-    # 
-    # Here is a more advanced Basic example where only Atom feeds and the XML API is protected by HTTP authentication, 
+    #
+    #
+    # Here is a more advanced Basic example where only Atom feeds and the XML API is protected by HTTP authentication,
     # the regular HTML interface is protected by a session approach:
-    # 
+    #
     #   class ApplicationController < ActionController::Base
     #     before_filter :set_account, :authenticate
-    #   
+    #
     #     protected
     #       def set_account
     #         @account = Account.find_by_url_name(request.subdomains.first)
     #       end
-    #   
+    #
     #       def authenticate
     #         case request.format
     #         when Mime::XML, Mime::ATOM
@@ -54,24 +54,48 @@ module ActionController
     #         end
     #       end
     #   end
-    # 
-    # 
+    #
     # In your integration tests, you can do something like this:
-    # 
+    #
     #   def test_access_granted_from_xml
     #     get(
-    #       "/notes/1.xml", nil, 
+    #       "/notes/1.xml", nil,
     #       :authorization => ActionController::HttpAuthentication::Basic.encode_credentials(users(:dhh).name, users(:dhh).password)
     #     )
-    # 
+    #
     #     assert_equal 200, status
     #   end
-    #  
-    #  
+    #
+    # Simple Digest example:
+    #
+    #   class PostsController < ApplicationController
+    #     USERS = {"dhh" => "secret"}
+    #
+    #     before_filter :authenticate, :except => [:index]
+    #
+    #     def index
+    #       render :text => "Everyone can see me!"
+    #     end
+    #
+    #     def edit
+    #       render :text => "I'm only accessible if you know the password"
+    #     end
+    #
+    #     private
+    #       def authenticate
+    #         authenticate_or_request_with_http_digest(realm) do |username|
+    #           USERS[username]
+    #         end
+    #       end
+    #   end
+    #
+    # NOTE: The +authenticate_or_request_with_http_digest+ block must return the user's password so the framework can appropriately
+    #       hash it to check the user's credentials. Returning +nil+ will cause authentication to fail.
+    #
     # On shared hosts, Apache sometimes doesn't pass authentication headers to
     # FCGI instances. If your environment matches this description and you cannot
     # authenticate, try this rule in your Apache setup:
-    # 
+    #
     #   RewriteRule ^(.*)$ dispatch.fcgi [E=X-HTTP_AUTHORIZATION:%{HTTP:Authorization},QSA,L]
     module Basic
       extend self
@@ -99,14 +123,14 @@ module ActionController
       def user_name_and_password(request)
         decode_credentials(request).split(/:/, 2)
       end
-  
+
       def authorization(request)
         request.env['HTTP_AUTHORIZATION']   ||
         request.env['X-HTTP_AUTHORIZATION'] ||
         request.env['X_HTTP_AUTHORIZATION'] ||
         request.env['REDIRECT_X_HTTP_AUTHORIZATION']
       end
-    
+
       def decode_credentials(request)
         ActiveSupport::Base64.decode64(authorization(request).split.last || '')
       end
@@ -120,5 +144,131 @@ module ActionController
         controller.__send__ :render, :text => "HTTP Basic: Access denied.\n", :status => :unauthorized
       end
     end
+
+    module Digest
+      extend self
+
+      module ControllerMethods
+        def authenticate_or_request_with_http_digest(realm = "Application", &password_procedure)
+          authenticate_with_http_digest(realm, &password_procedure) || request_http_digest_authentication(realm)
+        end
+
+        # Authenticate with HTTP Digest, returns true or false
+        def authenticate_with_http_digest(realm = "Application", &password_procedure)
+          HttpAuthentication::Digest.authenticate(self, realm, &password_procedure)
+        end
+
+        # Render output including the HTTP Digest authentication header
+        def request_http_digest_authentication(realm = "Application", message = nil)
+          HttpAuthentication::Digest.authentication_request(self, realm, message)
+        end
+      end
+
+      # Returns false on a valid response, true otherwise
+      def authenticate(controller, realm, &password_procedure)
+        authorization(controller.request) && validate_digest_response(controller.request, realm, &password_procedure)
+      end
+
+      def authorization(request)
+        request.env['HTTP_AUTHORIZATION']   ||
+        request.env['X-HTTP_AUTHORIZATION'] ||
+        request.env['X_HTTP_AUTHORIZATION'] ||
+        request.env['REDIRECT_X_HTTP_AUTHORIZATION']
+      end
+
+      # Raises error unless the request credentials response value matches the expected value.
+      def validate_digest_response(request, realm, &password_procedure)
+        credentials = decode_credentials_header(request)
+        valid_nonce = validate_nonce(request, credentials[:nonce])
+
+        if valid_nonce && realm == credentials[:realm] && opaque(request.session.session_id) == credentials[:opaque]
+          password = password_procedure.call(credentials[:username])
+          expected = expected_response(request.env['REQUEST_METHOD'], request.url, credentials, password)
+          expected == credentials[:response]
+        end
+      end
+
+      # Returns the expected response for a request of +http_method+ to +uri+ with the decoded +credentials+ and the expected +password+
+      def expected_response(http_method, uri, credentials, password)
+        ha1 = ::Digest::MD5.hexdigest([credentials[:username], credentials[:realm], password].join(':'))
+        ha2 = ::Digest::MD5.hexdigest([http_method.to_s.upcase, uri].join(':'))
+        ::Digest::MD5.hexdigest([ha1, credentials[:nonce], credentials[:nc], credentials[:cnonce], credentials[:qop], ha2].join(':'))
+      end
+
+      def encode_credentials(http_method, credentials, password)
+        credentials[:response] = expected_response(http_method, credentials[:uri], credentials, password)
+        "Digest " + credentials.sort_by {|x| x[0].to_s }.inject([]) {|a, v| a << "#{v[0]}='#{v[1]}'" }.join(', ')
+      end
+
+      def decode_credentials_header(request)
+        decode_credentials(authorization(request))
+      end
+
+      def decode_credentials(header)
+        header.to_s.gsub(/^Digest\s+/,'').split(',').inject({}) do |hash, pair|
+          key, value = pair.split('=', 2)
+          hash[key.strip.to_sym] = value.to_s.gsub(/^"|"$/,'').gsub(/'/, '')
+          hash
+        end
+      end
+
+      def authentication_header(controller, realm)
+        session_id = controller.request.session.session_id
+        controller.headers["WWW-Authenticate"] = %(Digest realm="#{realm}", qop="auth", algorithm=MD5, nonce="#{nonce(session_id)}", opaque="#{opaque(session_id)}")
+      end
+
+      def authentication_request(controller, realm, message = nil)
+        message ||= "HTTP Digest: Access denied.\n"
+        authentication_header(controller, realm)
+        controller.__send__ :render, :text => message, :status => :unauthorized
+      end
+
+      # Uses an MD5 digest based on time to generate a value to be used only once.
+      #
+      # A server-specified data string which should be uniquely generated each time a 401 response is made.
+      # It is recommended that this string be base64 or hexadecimal data.
+      # Specifically, since the string is passed in the header lines as a quoted string, the double-quote character is not allowed.
+      #
+      # The contents of the nonce are implementation dependent.
+      # The quality of the implementation depends on a good choice.
+      # A nonce might, for example, be constructed as the base 64 encoding of
+      #
+      # => time-stamp H(time-stamp ":" ETag ":" private-key)
+      #
+      # where time-stamp is a server-generated time or other non-repeating value,
+      # ETag is the value of the HTTP ETag header associated with the requested entity,
+      # and private-key is data known only to the server.
+      # With a nonce of this form a server would recalculate the hash portion after receiving the client authentication header and
+      # reject the request if it did not match the nonce from that header or
+      # if the time-stamp value is not recent enough. In this way the server can limit the time of the nonce's validity.
+      # The inclusion of the ETag prevents a replay request for an updated version of the resource.
+      # (Note: including the IP address of the client in the nonce would appear to offer the server the ability
+      # to limit the reuse of the nonce to the same client that originally got it.
+      # However, that would break proxy farms, where requests from a single user often go through different proxies in the farm.
+      # Also, IP address spoofing is not that hard.)
+      #
+      # An implementation might choose not to accept a previously used nonce or a previously used digest, in order to
+      # protect against a replay attack. Or, an implementation might choose to use one-time nonces or digests for
+      # POST or PUT requests and a time-stamp for GET requests. For more details on the issues involved see Section 4
+      # of this document.
+      #
+      # The nonce is opaque to the client.
+      def nonce(session_id, time = Time.now)
+        t = time.to_i
+        hashed = [t, session_id]
+        digest = ::Digest::MD5.hexdigest(hashed.join(":"))
+        Base64.encode64("#{t}:#{digest}").gsub("\n", '')
+      end
+
+      def validate_nonce(request, value)
+        t = Base64.decode64(value).split(":").first.to_i
+        nonce(request.session.session_id, t) == value && (t - Time.now.to_i).abs <= 10 * 60
+      end
+
+      # Opaque based on digest of session_id
+      def opaque(session_id)
+        Base64.encode64(::Digest::MD5::hexdigest(session_id)).gsub("\n", '')
+      end
+    end
   end
 end
diff --git a/actionpack/lib/action_controller/layout.rb b/actionpack/lib/action_controller/layout.rb
index 159c5c7326..183d56c2e8 100644
--- a/actionpack/lib/action_controller/layout.rb
+++ b/actionpack/lib/action_controller/layout.rb
@@ -179,7 +179,7 @@ module ActionController #:nodoc:
       end
 
       def layout_list #:nodoc:
-        Array(view_paths).sum([]) { |path| Dir["#{path}/layouts/**/*"] }
+        Array(view_paths).sum([]) { |path| Dir["#{path.to_str}/layouts/**/*"] }
       end
 
       def find_layout(layout, *formats) #:nodoc:
diff --git a/actionpack/lib/action_controller/lock.rb b/actionpack/lib/action_controller/lock.rb
deleted file mode 100644
index c50762216e..0000000000
--- a/actionpack/lib/action_controller/lock.rb
+++ /dev/null
@@ -1,16 +0,0 @@
-module ActionController
-  class Lock
-    FLAG = 'rack.multithread'.freeze
-
-    def initialize(app, lock = Mutex.new)
-      @app, @lock = app, lock
-    end
-
-    def call(env)
-      old, env[FLAG] = env[FLAG], false
-      @lock.synchronize { @app.call(env) }
-    ensure
-      env[FLAG] = old
-    end
-  end
-end
diff --git a/actionpack/lib/action_controller/middleware_stack.rb b/actionpack/lib/action_controller/middleware_stack.rb
index b94bf6ec4a..dbc2fda41e 100644
--- a/actionpack/lib/action_controller/middleware_stack.rb
+++ b/actionpack/lib/action_controller/middleware_stack.rb
@@ -75,17 +75,22 @@ module ActionController
       block.call(self) if block_given?
     end
 
-    def insert(index, *objs)
+    def insert(index, *args, &block)
       index = self.index(index) unless index.is_a?(Integer)
-      objs = objs.map { |obj| Middleware.new(obj) }
-      super(index, *objs)
+      middleware = Middleware.new(*args, &block)
+      super(index, middleware)
     end
 
     alias_method :insert_before, :insert
 
-    def insert_after(index, *objs)
+    def insert_after(index, *args, &block)
       index = self.index(index) unless index.is_a?(Integer)
-      insert(index + 1, *objs)
+      insert(index + 1, *args, &block)
+    end
+
+    def swap(target, *args, &block)
+      insert_before(target, *args, &block)
+      delete(target)
     end
 
     def use(*args, &block)
diff --git a/actionpack/lib/action_controller/middlewares.rb b/actionpack/lib/action_controller/middlewares.rb
index 0f038b8856..f9cfc2b18e 100644
--- a/actionpack/lib/action_controller/middlewares.rb
+++ b/actionpack/lib/action_controller/middlewares.rb
@@ -1,11 +1,9 @@
-use "ActionController::Lock", :if => lambda {
+use "Rack::Lock", :if => lambda {
   !ActionController::Base.allow_concurrency
 }
 
 use "ActionController::Failsafe"
 
-use "ActiveRecord::QueryCache", :if => lambda { defined?(ActiveRecord) }
-
 ["ActionController::Session::CookieStore",
  "ActionController::Session::MemCacheStore",
  "ActiveRecord::SessionStore"].each do |store|
@@ -18,5 +16,6 @@ use "ActiveRecord::QueryCache", :if => lambda { defined?(ActiveRecord) }
     )
 end
 
-use ActionController::RewindableInput
-use Rack::MethodOverride
+use "ActionController::RewindableInput"
+use "ActionController::ParamsParser"
+use "Rack::MethodOverride"
diff --git a/actionpack/lib/action_controller/params_parser.rb b/actionpack/lib/action_controller/params_parser.rb
new file mode 100644
index 0000000000..d269fe07fa
--- /dev/null
+++ b/actionpack/lib/action_controller/params_parser.rb
@@ -0,0 +1,71 @@
+module ActionController
+  class ParamsParser
+    ActionController::Base.param_parsers[Mime::XML] = :xml_simple
+    ActionController::Base.param_parsers[Mime::JSON] = :json
+
+    def initialize(app)
+      @app = app
+    end
+
+    def call(env)
+      if params = parse_formatted_parameters(env)
+        env["action_controller.request.request_parameters"] = params
+      end
+
+      @app.call(env)
+    end
+
+    private
+      def parse_formatted_parameters(env)
+        request = Request.new(env)
+
+        return false if request.content_length.zero?
+
+        mime_type = content_type_from_legacy_post_data_format_header(env) || request.content_type
+        strategy = ActionController::Base.param_parsers[mime_type]
+
+        return false unless strategy
+
+        case strategy
+          when Proc
+            strategy.call(request.raw_post)
+          when :xml_simple, :xml_node
+            body = request.raw_post
+            body.blank? ? {} : Hash.from_xml(body).with_indifferent_access
+          when :yaml
+            YAML.load(request.raw_post)
+          when :json
+            body = request.raw_post
+            if body.blank?
+              {}
+            else
+              data = ActiveSupport::JSON.decode(body)
+              data = {:_json => data} unless data.is_a?(Hash)
+              data.with_indifferent_access
+            end
+          else
+            false
+        end
+      rescue Exception => e # YAML, XML or Ruby code block errors
+        raise
+          { "body" => request.raw_post,
+            "content_type" => request.content_type,
+            "content_length" => request.content_length,
+            "exception" => "#{e.message} (#{e.class})",
+            "backtrace" => e.backtrace }
+      end
+
+      def content_type_from_legacy_post_data_format_header(env)
+        if x_post_format = env['HTTP_X_POST_DATA_FORMAT']
+          case x_post_format.to_s.downcase
+            when 'yaml'
+              return Mime::YAML
+            when 'xml'
+              return Mime::XML
+          end
+        end
+
+        nil
+      end
+  end
+end
diff --git a/actionpack/lib/action_controller/rack_ext.rb b/actionpack/lib/action_controller/rack_ext.rb
index 3b142307e9..2ba6654e3d 100644
--- a/actionpack/lib/action_controller/rack_ext.rb
+++ b/actionpack/lib/action_controller/rack_ext.rb
@@ -1,22 +1,3 @@
-module Rack
-  module Utils
-    module Multipart
-      class << self
-        def parse_multipart_with_rewind(env)
-          result = parse_multipart_without_rewind(env)
-
-          begin
-            env['rack.input'].rewind if env['rack.input'].respond_to?(:rewind)
-          rescue Errno::ESPIPE
-            # Handles exceptions raised by input streams that cannot be rewound
-            # such as when using plain CGI under Apache
-          end
-
-          result
-        end
-
-        alias_method_chain :parse_multipart, :rewind
-      end
-    end
-  end
-end
+require 'action_controller/rack_ext/lock'
+require 'action_controller/rack_ext/multipart'
+require 'action_controller/rack_ext/parse_query'
diff --git a/actionpack/lib/action_controller/rack_ext/lock.rb b/actionpack/lib/action_controller/rack_ext/lock.rb
new file mode 100644
index 0000000000..9bf1889065
--- /dev/null
+++ b/actionpack/lib/action_controller/rack_ext/lock.rb
@@ -0,0 +1,21 @@
+module Rack
+  # Rack::Lock was commited to Rack core
+  # http://github.com/rack/rack/commit/7409b0c
+  # Remove this when Rack 1.0 is released
+  unless defined? Lock
+    class Lock
+      FLAG = 'rack.multithread'.freeze
+
+      def initialize(app, lock = Mutex.new)
+        @app, @lock = app, lock
+      end
+
+      def call(env)
+        old, env[FLAG] = env[FLAG], false
+        @lock.synchronize { @app.call(env) }
+      ensure
+        env[FLAG] = old
+      end
+    end
+  end
+end
diff --git a/actionpack/lib/action_controller/rack_ext/multipart.rb b/actionpack/lib/action_controller/rack_ext/multipart.rb
new file mode 100644
index 0000000000..3b142307e9
--- /dev/null
+++ b/actionpack/lib/action_controller/rack_ext/multipart.rb
@@ -0,0 +1,22 @@
+module Rack
+  module Utils
+    module Multipart
+      class << self
+        def parse_multipart_with_rewind(env)
+          result = parse_multipart_without_rewind(env)
+
+          begin
+            env['rack.input'].rewind if env['rack.input'].respond_to?(:rewind)
+          rescue Errno::ESPIPE
+            # Handles exceptions raised by input streams that cannot be rewound
+            # such as when using plain CGI under Apache
+          end
+
+          result
+        end
+
+        alias_method_chain :parse_multipart, :rewind
+      end
+    end
+  end
+end
diff --git a/actionpack/lib/action_controller/rack_ext/parse_query.rb b/actionpack/lib/action_controller/rack_ext/parse_query.rb
new file mode 100644
index 0000000000..2f21a57770
--- /dev/null
+++ b/actionpack/lib/action_controller/rack_ext/parse_query.rb
@@ -0,0 +1,18 @@
+# Rack does not automatically cleanup Safari 2 AJAX POST body
+# This has not yet been commited to Rack, please +1 this ticket:
+# http://rack.lighthouseapp.com/projects/22435/tickets/19
+
+module Rack
+  module Utils
+    alias_method :parse_query_without_ajax_body_cleanup, :parse_query
+    module_function :parse_query_without_ajax_body_cleanup
+
+    def parse_query(qs, d = '&;')
+      qs = qs.dup
+      qs.chop! if qs[-1] == 0
+      qs.gsub!(/&_=$/, '')
+      parse_query_without_ajax_body_cleanup(qs, d)
+    end
+    module_function :parse_query
+  end
+end
diff --git a/actionpack/lib/action_controller/request.rb b/actionpack/lib/action_controller/request.rb
index 791ddf3308..a8729bb6f5 100755
--- a/actionpack/lib/action_controller/request.rb
+++ b/actionpack/lib/action_controller/request.rb
@@ -7,12 +7,6 @@ require 'action_controller/cgi_ext'
 
 module ActionController
   class Request < Rack::Request
-    extend ActiveSupport::Memoizable
-
-    def initialize(env)
-      super
-      @parser = ActionController::RequestParser.new(env)
-    end
 
     %w[ AUTH_TYPE GATEWAY_INTERFACE
         PATH_TRANSLATED REMOTE_HOST
@@ -34,16 +28,17 @@ module ActionController
     HTTP_METHODS = %w(get head put post delete options)
     HTTP_METHOD_LOOKUP = HTTP_METHODS.inject({}) { |h, m| h[m] = h[m.upcase] = m.to_sym; h }
 
-    # The true HTTP request \method as a lowercase symbol, such as <tt>:get</tt>.
-    # UnknownHttpMethod is raised for invalid methods not listed in ACCEPTED_HTTP_METHODS.
+    # Returns the true HTTP request \method as a lowercase symbol, such as
+    # <tt>:get</tt>. If the request \method is not listed in the HTTP_METHODS
+    # constant above, an UnknownHttpMethod exception is raised.
     def request_method
-      HTTP_METHOD_LOOKUP[super] || raise(UnknownHttpMethod, "#{super}, accepted HTTP methods are #{HTTP_METHODS.to_sentence}")
+      @request_method ||= HTTP_METHOD_LOOKUP[super] || raise(UnknownHttpMethod, "#{super}, accepted HTTP methods are #{HTTP_METHODS.to_sentence}")
     end
-    memoize :request_method
 
-    # The HTTP request \method as a lowercase symbol, such as <tt>:get</tt>.
-    # Note, HEAD is returned as <tt>:get</tt> since the two are functionally
-    # equivalent from the application's perspective.
+    # Returns the HTTP request \method used for action processing as a
+    # lowercase symbol, such as <tt>:post</tt>. (Unlike #request_method, this
+    # method returns <tt>:get</tt> for a HEAD request because the two are
+    # functionally equivalent from the application's perspective.)
     def method
       request_method == :head ? :get : request_method
     end
@@ -78,9 +73,8 @@ module ActionController
     #
     #   request.headers["Content-Type"] # => "text/plain"
     def headers
-      ActionController::Http::Headers.new(@env)
+      @headers ||= ActionController::Http::Headers.new(@env)
     end
-    memoize :headers
 
     # Returns the content length of the request as an integer.
     def content_length
@@ -92,28 +86,33 @@ module ActionController
     # For backward compatibility, the post \format is extracted from the
     # X-Post-Data-Format HTTP header if present.
     def content_type
-      Mime::Type.lookup(@parser.content_type_without_parameters)
+      @content_type ||= begin
+        if @env['CONTENT_TYPE'] =~ /^([^,\;]*)/
+          Mime::Type.lookup($1.strip.downcase)
+        else
+          nil
+        end
+      end
     end
-    memoize :content_type
 
     # Returns the accepted MIME type for the request.
     def accepts
-      header = @env['HTTP_ACCEPT'].to_s.strip
+      @accepts ||= begin
+        header = @env['HTTP_ACCEPT'].to_s.strip
 
-      if header.empty?
-        [content_type, Mime::ALL].compact
-      else
-        Mime::Type.parse(header)
+        if header.empty?
+          [content_type, Mime::ALL].compact
+        else
+          Mime::Type.parse(header)
+        end
       end
     end
-    memoize :accepts
 
     def if_modified_since
       if since = env['HTTP_IF_MODIFIED_SINCE']
         Time.rfc2822(since) rescue nil
       end
     end
-    memoize :if_modified_since
 
     def if_none_match
       env['HTTP_IF_NONE_MATCH']
@@ -256,25 +255,21 @@ EOM
 
       @env['REMOTE_ADDR']
     end
-    memoize :remote_ip
 
     # Returns the lowercase name of the HTTP server software.
     def server_software
       (@env['SERVER_SOFTWARE'] && /^([a-zA-Z]+)/ =~ @env['SERVER_SOFTWARE']) ? $1.downcase : nil
     end
-    memoize :server_software
 
     # Returns the complete URL used for this request.
     def url
       protocol + host_with_port + request_uri
     end
-    memoize :url
 
     # Returns 'https://' if this is an SSL request and 'http://' otherwise.
     def protocol
       ssl? ? 'https://' : 'http://'
     end
-    memoize :protocol
 
     # Is this an SSL request?
     def ssl?
@@ -294,14 +289,12 @@ EOM
     def host
       raw_host_with_port.sub(/:\d+$/, '')
     end
-    memoize :host
 
     # Returns a \host:\port string for this request, such as "example.com" or
     # "example.com:8080".
     def host_with_port
       "#{host}#{port_string}"
     end
-    memoize :host_with_port
 
     # Returns the port number of this request as an integer.
     def port
@@ -311,7 +304,6 @@ EOM
         standard_port
       end
     end
-    memoize :port
 
     # Returns the standard \port number for this request's protocol.
     def standard_port
@@ -349,7 +341,6 @@ EOM
     def query_string
       @env['QUERY_STRING'].present? ? @env['QUERY_STRING'] : (@env['REQUEST_URI'].split('?', 2)[1] || '')
     end
-    memoize :query_string
 
     # Returns the request URI, accounting for server idiosyncrasies.
     # WEBrick includes the full URL. IIS leaves REQUEST_URI blank.
@@ -375,7 +366,6 @@ EOM
         end
       end
     end
-    memoize :request_uri
 
     # Returns the interpreted \path to requested resource after all the installation
     # directory of this application was taken into account.
@@ -384,12 +374,15 @@ EOM
       path.sub!(/\A#{ActionController::Base.relative_url_root}/, '')
       path
     end
-    memoize :path
 
     # Read the request \body. This is useful for web services that need to
     # work with raw requests directly.
     def raw_post
-      @parser.raw_post
+      unless @env.include? 'RAW_POST_DATA'
+        @env['RAW_POST_DATA'] = body.read(@env['CONTENT_LENGTH'].to_i)
+        body.rewind if body.respond_to?(:rewind)
+      end
+      @env['RAW_POST_DATA']
     end
 
     # Returns both GET and POST \parameters in a single hash.
@@ -418,19 +411,30 @@ EOM
       @env["rack.routing_args"] ||= {}
     end
 
+    # The request body is an IO input stream. If the RAW_POST_DATA environment
+    # variable is already set, wrap it in a StringIO.
     def body
-      @parser.body
+      if raw_post = @env['RAW_POST_DATA']
+        raw_post.force_encoding(Encoding::BINARY) if raw_post.respond_to?(:force_encoding)
+        StringIO.new(raw_post)
+      else
+        @env['rack.input']
+      end
+    end
+
+    def form_data?
+      FORM_DATA_MEDIA_TYPES.include?(content_type.to_s)
     end
 
     # Override Rack's GET method to support nested query strings
     def GET
-      @parser.query_parameters
+      @env["action_controller.request.query_parameters"] ||= UrlEncodedPairParser.parse_query_parameters(query_string)
     end
     alias_method :query_parameters, :GET
 
     # Override Rack's POST method to support nested query strings
     def POST
-      @parser.request_parameters
+      @env["action_controller.request.request_parameters"] ||= UrlEncodedPairParser.parse_hash_parameters(super)
     end
     alias_method :request_parameters, :POST
 
diff --git a/actionpack/lib/action_controller/request_parser.rb b/actionpack/lib/action_controller/request_parser.rb
deleted file mode 100644
index d1739ef4d0..0000000000
--- a/actionpack/lib/action_controller/request_parser.rb
+++ /dev/null
@@ -1,315 +0,0 @@
-module ActionController
-  class RequestParser
-    def initialize(env)
-      @env = env
-      freeze
-    end
-
-    def request_parameters
-      @env["action_controller.request_parser.request_parameters"] ||= parse_formatted_request_parameters
-    end
-
-    def query_parameters
-      @env["action_controller.request_parser.query_parameters"] ||= self.class.parse_query_parameters(query_string)
-    end
-
-    # Returns the query string, accounting for server idiosyncrasies.
-    def query_string
-      @env['QUERY_STRING'].present? ? @env['QUERY_STRING'] : (@env['REQUEST_URI'].split('?', 2)[1] || '')
-    end
-
-    # The request body is an IO input stream. If the RAW_POST_DATA environment
-    # variable is already set, wrap it in a StringIO.
-    def body
-      if raw_post = @env['RAW_POST_DATA']
-        raw_post.force_encoding(Encoding::BINARY) if raw_post.respond_to?(:force_encoding)
-        StringIO.new(raw_post)
-      else
-        @env['rack.input']
-      end
-    end
-
-    # The raw content type string with its parameters stripped off.
-    def content_type_without_parameters
-      self.class.extract_content_type_without_parameters(content_type_with_parameters)
-    end
-
-    def raw_post
-      unless @env.include? 'RAW_POST_DATA'
-        @env['RAW_POST_DATA'] = body.read(content_length)
-        body.rewind if body.respond_to?(:rewind)
-      end
-      @env['RAW_POST_DATA']
-    end
-
-    private
-
-    def parse_formatted_request_parameters
-      return {} if content_length.zero?
-
-      content_type, boundary = self.class.extract_multipart_boundary(content_type_with_parameters)
-
-      # Don't parse params for unknown requests.
-      return {} if content_type.blank?
-
-      mime_type = Mime::Type.lookup(content_type)
-      strategy = ActionController::Base.param_parsers[mime_type]
-
-      # Only multipart form parsing expects a stream.
-      body = (strategy && strategy != :multipart_form) ? raw_post : self.body
-
-      case strategy
-        when Proc
-          strategy.call(body)
-        when :url_encoded_form
-          self.class.clean_up_ajax_request_body! body
-          self.class.parse_query_parameters(body)
-        when :multipart_form
-          self.class.parse_multipart_form_parameters(body, boundary, content_length, @env)
-        when :xml_simple, :xml_node
-          body.blank? ? {} : Hash.from_xml(body).with_indifferent_access
-        when :yaml
-          YAML.load(body)
-        when :json
-          if body.blank?
-            {}
-          else
-            data = ActiveSupport::JSON.decode(body)
-            data = {:_json => data} unless data.is_a?(Hash)
-            data.with_indifferent_access
-          end
-        else
-          {}
-      end
-    rescue Exception => e # YAML, XML or Ruby code block errors
-      raise
-      { "body" => body,
-        "content_type" => content_type_with_parameters,
-        "content_length" => content_length,
-        "exception" => "#{e.message} (#{e.class})",
-        "backtrace" => e.backtrace }
-    end
-
-    def content_length
-      @env['CONTENT_LENGTH'].to_i
-    end
-
-    # The raw content type string. Use when you need parameters such as
-    # charset or boundary which aren't included in the content_type MIME type.
-    # Overridden by the X-POST_DATA_FORMAT header for backward compatibility.
-    def content_type_with_parameters
-      content_type_from_legacy_post_data_format_header || @env['CONTENT_TYPE'].to_s
-    end
-
-    def content_type_from_legacy_post_data_format_header
-      if x_post_format = @env['HTTP_X_POST_DATA_FORMAT']
-        case x_post_format.to_s.downcase
-          when 'yaml';  'application/x-yaml'
-          when 'xml';   'application/xml'
-        end
-      end
-    end
-
-    class << self
-      def parse_query_parameters(query_string)
-        return {} if query_string.blank?
-
-        pairs = query_string.split('&').collect do |chunk|
-          next if chunk.empty?
-          key, value = chunk.split('=', 2)
-          next if key.empty?
-          value = value.nil? ? nil : CGI.unescape(value)
-          [ CGI.unescape(key), value ]
-        end.compact
-
-        UrlEncodedPairParser.new(pairs).result
-      end
-
-      def parse_request_parameters(params)
-        parser = UrlEncodedPairParser.new
-
-        params = params.dup
-        until params.empty?
-          for key, value in params
-            if key.blank?
-              params.delete key
-            elsif !key.include?('[')
-              # much faster to test for the most common case first (GET)
-              # and avoid the call to build_deep_hash
-              parser.result[key] = get_typed_value(value[0])
-              params.delete key
-            elsif value.is_a?(Array)
-              parser.parse(key, get_typed_value(value.shift))
-              params.delete key if value.empty?
-            else
-              raise TypeError, "Expected array, found #{value.inspect}"
-            end
-          end
-        end
-
-        parser.result
-      end
-
-      def parse_multipart_form_parameters(body, boundary, body_size, env)
-        parse_request_parameters(read_multipart(body, boundary, body_size, env))
-      end
-
-      def extract_multipart_boundary(content_type_with_parameters)
-        if content_type_with_parameters =~ MULTIPART_BOUNDARY
-          ['multipart/form-data', $1.dup]
-        else
-          extract_content_type_without_parameters(content_type_with_parameters)
-        end
-      end
-
-      def extract_content_type_without_parameters(content_type_with_parameters)
-        $1.strip.downcase if content_type_with_parameters =~ /^([^,\;]*)/
-      end
-
-      def clean_up_ajax_request_body!(body)
-        body.chop! if body[-1] == 0
-        body.gsub!(/&_=$/, '')
-      end
-
-
-      private
-        def get_typed_value(value)
-          case value
-            when String
-              value
-            when NilClass
-              ''
-            when Array
-              value.map { |v| get_typed_value(v) }
-            else
-              if value.respond_to? :original_filename
-                # Uploaded file
-                if value.original_filename
-                  value
-                # Multipart param
-                else
-                  result = value.read
-                  value.rewind
-                  result
-                end
-              # Unknown value, neither string nor multipart.
-              else
-                raise "Unknown form value: #{value.inspect}"
-              end
-          end
-        end
-
-        MULTIPART_BOUNDARY = %r|\Amultipart/form-data.*boundary=\"?([^\";,]+)\"?|n
-
-        EOL = "\015\012"
-
-        def read_multipart(body, boundary, body_size, env)
-          params = Hash.new([])
-          boundary = "--" + boundary
-          quoted_boundary = Regexp.quote(boundary)
-          buf = ""
-          bufsize = 10 * 1024
-          boundary_end=""
-
-          # start multipart/form-data
-          body.binmode if defined? body.binmode
-          case body
-          when File
-            body.set_encoding(Encoding::BINARY) if body.respond_to?(:set_encoding)
-          when StringIO
-            body.string.force_encoding(Encoding::BINARY) if body.string.respond_to?(:force_encoding)
-          end
-          boundary_size = boundary.size + EOL.size
-          body_size -= boundary_size
-          status = body.read(boundary_size)
-          if nil == status
-            raise EOFError, "no content body"
-          elsif boundary + EOL != status
-            raise EOFError, "bad content body"
-          end
-
-          loop do
-            head = nil
-            content =
-              if 10240 < body_size
-                UploadedTempfile.new("CGI")
-              else
-                UploadedStringIO.new
-              end
-            content.binmode if defined? content.binmode
-
-            until head and /#{quoted_boundary}(?:#{EOL}|--)/n.match(buf)
-
-              if (not head) and /#{EOL}#{EOL}/n.match(buf)
-                buf = buf.sub(/\A((?:.|\n)*?#{EOL})#{EOL}/n) do
-                  head = $1.dup
-                  ""
-                end
-                next
-              end
-
-              if head and ( (EOL + boundary + EOL).size < buf.size )
-                content.print buf[0 ... (buf.size - (EOL + boundary + EOL).size)]
-                buf[0 ... (buf.size - (EOL + boundary + EOL).size)] = ""
-              end
-
-              c = if bufsize < body_size
-                    body.read(bufsize)
-                  else
-                    body.read(body_size)
-                  end
-              if c.nil? || c.empty?
-                raise EOFError, "bad content body"
-              end
-              buf.concat(c)
-              body_size -= c.size
-            end
-
-            buf = buf.sub(/\A((?:.|\n)*?)(?:[\r\n]{1,2})?#{quoted_boundary}([\r\n]{1,2}|--)/n) do
-              content.print $1
-              if "--" == $2
-                body_size = -1
-              end
-              boundary_end = $2.dup
-              ""
-            end
-
-            content.rewind
-
-            head =~ /Content-Disposition:.* filename=(?:"((?:\\.|[^\"])*)"|([^;]*))/ni
-            if filename = $1 || $2
-              if /Mac/ni.match(env['HTTP_USER_AGENT']) and
-                  /Mozilla/ni.match(env['HTTP_USER_AGENT']) and
-                  (not /MSIE/ni.match(env['HTTP_USER_AGENT']))
-                filename = CGI.unescape(filename)
-              end
-              content.original_path = filename.dup
-            end
-
-            head =~ /Content-Type: ([^\r]*)/ni
-            content.content_type = $1.dup if $1
-
-            head =~ /Content-Disposition:.* name="?([^\";]*)"?/ni
-            name = $1.dup if $1
-
-            if params.has_key?(name)
-              params[name].push(content)
-            else
-              params[name] = [content]
-            end
-            break if body_size == -1
-          end
-          raise EOFError, "bad boundary end of body part" unless boundary_end=~/--/
-
-          begin
-            body.rewind if body.respond_to?(:rewind)
-          rescue Errno::ESPIPE
-            # Handles exceptions raised by input streams that cannot be rewound
-            # such as when using plain CGI under Apache
-          end
-
-          params
-        end
-    end # class << self
-  end
-end
diff --git a/actionpack/lib/action_controller/request_profiler.rb b/actionpack/lib/action_controller/request_profiler.rb
deleted file mode 100644
index 80cd55334f..0000000000
--- a/actionpack/lib/action_controller/request_profiler.rb
+++ /dev/null
@@ -1,168 +0,0 @@
-require 'optparse'
-
-module ActionController
-  class RequestProfiler
-    # Wrap up the integration session runner.
-    class Sandbox
-      include Integration::Runner
-
-      def self.benchmark(n, script)
-        new(script).benchmark(n)
-      end
-
-      def initialize(script_path)
-        @quiet = false
-        define_run_method(script_path)
-        reset!
-      end
-
-      def benchmark(n, profiling = false)
-        @quiet = true
-        print '  '
-
-        ms = Benchmark.ms do
-          n.times do |i|
-            run(profiling)
-            print_progress(i)
-          end
-        end
-
-        puts
-        ms
-      ensure
-        @quiet = false
-      end
-
-      def say(message)
-        puts "  #{message}" unless @quiet
-      end
-
-      private
-        def define_run_method(script_path)
-          script = File.read(script_path)
-
-          source = <<-end_source
-            def run(profiling = false)
-              if profiling
-                RubyProf.resume do
-                  #{script}
-                end
-              else
-                #{script}
-              end
-
-              old_request_count = request_count
-              reset!
-              self.request_count = old_request_count
-            end
-          end_source
-
-          instance_eval source, script_path, 1
-        end
-
-        def print_progress(i)
-          print "\n  " if i % 60 == 0
-          print ' ' if i % 10 == 0
-          print '.'
-          $stdout.flush
-        end
-    end
-
-
-    attr_reader :options
-
-    def initialize(options = {})
-      @options = default_options.merge(options)
-    end
-
-
-    def self.run(args = nil, options = {})
-      profiler = new(options)
-      profiler.parse_options(args) if args
-      profiler.run
-    end
-
-    def run
-      sandbox = Sandbox.new(options[:script])
-
-      puts 'Warming up once'
-
-      elapsed = warmup(sandbox)
-      puts '%.0f ms, %d requests, %d req/sec' % [elapsed, sandbox.request_count, 1000 * sandbox.request_count / elapsed]
-      puts "\n#{options[:benchmark] ? 'Benchmarking' : 'Profiling'} #{options[:n]}x"
-
-      options[:benchmark] ? benchmark(sandbox) : profile(sandbox)
-    end
-
-    def profile(sandbox)
-      load_ruby_prof
-
-      benchmark(sandbox, true)
-      results = RubyProf.stop
-
-      show_profile_results results
-      results
-    end
-
-    def benchmark(sandbox, profiling = false)
-      sandbox.request_count = 0
-      elapsed = sandbox.benchmark(options[:n], profiling)
-      count = sandbox.request_count.to_i
-      puts '%.0f ms, %d requests, %d req/sec' % [elapsed, count, 1000 * count / elapsed]
-    end
-
-    def warmup(sandbox)
-      Benchmark.ms { sandbox.run(false) }
-    end
-
-    def default_options
-      { :n => 100, :open => 'open %s &' }
-    end
-
-    # Parse command-line options
-    def parse_options(args)
-      OptionParser.new do |opt|
-        opt.banner = "USAGE: #{$0} [options] [session script path]"
-
-        opt.on('-n', '--times [100]', 'How many requests to process. Defaults to 100.') { |v| options[:n] = v.to_i if v }
-        opt.on('-b', '--benchmark', 'Benchmark instead of profiling') { |v| options[:benchmark] = v }
-        opt.on('-m', '--measure [mode]', 'Which ruby-prof measure mode to use: process_time, wall_time, cpu_time, allocations, or memory. Defaults to process_time.') { |v| options[:measure] = v }
-        opt.on('--open [CMD]', 'Command to open profile results. Defaults to "open %s &"') { |v| options[:open] = v }
-        opt.on('-h', '--help', 'Show this help') { puts opt; exit }
-
-        opt.parse args
-
-        if args.empty?
-          puts opt
-          exit
-        end
-        options[:script] = args.pop
-      end
-    end
-
-    protected
-      def load_ruby_prof
-        begin
-          gem 'ruby-prof', '>= 0.6.1'
-          require 'ruby-prof'
-          if mode = options[:measure]
-            RubyProf.measure_mode = RubyProf.const_get(mode.upcase)
-          end
-        rescue LoadError
-          abort '`gem install ruby-prof` to use the profiler'
-        end
-      end
-
-      def show_profile_results(results)
-        File.open "#{RAILS_ROOT}/tmp/profile-graph.html", 'w' do |file|
-          RubyProf::GraphHtmlPrinter.new(results).print(file)
-          `#{options[:open] % file.path}` if options[:open]
-        end
-
-        File.open "#{RAILS_ROOT}/tmp/profile-flat.txt", 'w' do |file|
-          RubyProf::FlatPrinter.new(results).print(file)
-          `#{options[:open] % file.path}` if options[:open]
-        end
-      end
-  end
-end
diff --git a/actionpack/lib/action_controller/rewindable_input.rb b/actionpack/lib/action_controller/rewindable_input.rb
index 058453ea68..cedfb7fd75 100644
--- a/actionpack/lib/action_controller/rewindable_input.rb
+++ b/actionpack/lib/action_controller/rewindable_input.rb
@@ -3,33 +3,17 @@ module ActionController
     class RewindableIO < ActiveSupport::BasicObject
       def initialize(io)
         @io = io
-      end
-
-      def read(*args)
-        read_original_io
-        @io.read(*args)
-      end
-
-      def rewind
-        read_original_io
-        @io.rewind
-      end
-
-      def string
-        @string
+        @rewindable = io.is_a?(::StringIO)
       end
 
       def method_missing(method, *args, &block)
-        @io.send(method, *args, &block)
-      end
-
-      private
-        def read_original_io
-          unless @string
-            @string = @io.read
-            @io = StringIO.new(@string)
-          end
+        unless @rewindable
+          @io = ::StringIO.new(@io.read)
+          @rewindable = true
         end
+
+        @io.__send__(method, *args, &block)
+      end
     end
 
     def initialize(app)
diff --git a/actionpack/lib/action_controller/routing.rb b/actionpack/lib/action_controller/routing.rb
index da9b56fdf9..a2141a77dc 100644
--- a/actionpack/lib/action_controller/routing.rb
+++ b/actionpack/lib/action_controller/routing.rb
@@ -193,9 +193,8 @@ module ActionController
   #
   #   map.connect '*path' , :controller => 'blog' , :action => 'unrecognized?'
   #
-  # will glob all remaining parts of the route that were not recognized earlier. This idiom
-  # must appear at the end of the path. The globbed values are in <tt>params[:path]</tt> in
-  # this case.
+  # will glob all remaining parts of the route that were not recognized earlier. 
+  # The globbed values are in <tt>params[:path]</tt> as an array of path segments.
   #
   # == Route conditions
   #
diff --git a/actionpack/lib/action_controller/session/abstract_store.rb b/actionpack/lib/action_controller/session/abstract_store.rb
index bf09fd33c5..9434c2e05e 100644
--- a/actionpack/lib/action_controller/session/abstract_store.rb
+++ b/actionpack/lib/action_controller/session/abstract_store.rb
@@ -102,8 +102,10 @@ module ActionController
         response = @app.call(env)
 
         session_data = env[ENV_SESSION_KEY]
-        if !session_data.is_a?(AbstractStore::SessionHash) || session_data.send(:loaded?)
-          options = env[ENV_SESSION_OPTIONS_KEY]
+        options = env[ENV_SESSION_OPTIONS_KEY]
+
+        if !session_data.is_a?(AbstractStore::SessionHash) || session_data.send(:loaded?) || options[:expire_after]
+          session_data.send(:load!) if session_data.is_a?(AbstractStore::SessionHash) && !session_data.send(:loaded?)
 
           if session_data.is_a?(AbstractStore::SessionHash)
             sid = session_data.id
diff --git a/actionpack/lib/action_controller/session/cookie_store.rb b/actionpack/lib/action_controller/session/cookie_store.rb
index e061c4d4a1..5a728d1877 100644
--- a/actionpack/lib/action_controller/session/cookie_store.rb
+++ b/actionpack/lib/action_controller/session/cookie_store.rb
@@ -45,7 +45,7 @@ module ActionController
         :domain       => nil,
         :path         => "/",
         :expire_after => nil,
-        :httponly     => false
+        :httponly     => true
       }.freeze
 
       ENV_SESSION_KEY = "rack.session".freeze
@@ -56,8 +56,6 @@ module ActionController
       class CookieOverflow < StandardError; end
 
       def initialize(app, options = {})
-        options = options.dup
-
         # Process legacy CGI options
         options = options.symbolize_keys
         if options.has_key?(:session_path)
@@ -95,12 +93,14 @@ module ActionController
         status, headers, body = @app.call(env)
 
         session_data = env[ENV_SESSION_KEY]
-        if !session_data.is_a?(AbstractStore::SessionHash) || session_data.send(:loaded?)
+        options = env[ENV_SESSION_OPTIONS_KEY]
+
+        if !session_data.is_a?(AbstractStore::SessionHash) || session_data.send(:loaded?) || options[:expire_after]
+          session_data.send(:load!) if session_data.is_a?(AbstractStore::SessionHash) && !session_data.send(:loaded?)
           session_data = marshal(session_data.to_hash)
 
           raise CookieOverflow if session_data.size > MAX
 
-          options = env[ENV_SESSION_OPTIONS_KEY]
           cookie = Hash.new
           cookie[:value] = session_data
           unless options[:expire_after].nil?
diff --git a/actionpack/lib/action_controller/session_management.rb b/actionpack/lib/action_controller/session_management.rb
index f06a0da75c..b556f04649 100644
--- a/actionpack/lib/action_controller/session_management.rb
+++ b/actionpack/lib/action_controller/session_management.rb
@@ -37,7 +37,7 @@ module ActionController #:nodoc:
 
       # Returns the hash used to configure the session. Example use:
       #
-      #   ActionController::Base.session_options[:session_secure] = true # session only available over HTTPS
+      #   ActionController::Base.session_options[:secure] = true # session only available over HTTPS
       def session_options
         @session_options ||= {}
       end
diff --git a/actionpack/lib/action_controller/test_process.rb b/actionpack/lib/action_controller/test_process.rb
index 22b97fc157..4b5fc3a3c1 100644
--- a/actionpack/lib/action_controller/test_process.rb
+++ b/actionpack/lib/action_controller/test_process.rb
@@ -15,7 +15,7 @@ module ActionController #:nodoc:
     end
 
     def reset_session
-      @session = TestSession.new
+      @session.reset
     end
 
     # Wraps raw_post in a StringIO.
@@ -35,7 +35,6 @@ module ActionController #:nodoc:
 
     def port=(number)
       @env["SERVER_PORT"] = number.to_i
-      port(true)
     end
 
     def action=(action_name)
@@ -49,8 +48,6 @@ module ActionController #:nodoc:
       @env["REQUEST_URI"] = value
       @request_uri = nil
       @path = nil
-      request_uri(true)
-      path(true)
     end
 
     def request_uri=(uri)
@@ -58,9 +55,13 @@ module ActionController #:nodoc:
       @path = uri.split("?").first
     end
 
+    def request_method=(method)
+      @request_method = method
+    end
+
     def accept=(mime_types)
       @env["HTTP_ACCEPT"] = Array(mime_types).collect { |mime_types| mime_types.to_s }.join(",")
-      accepts(true)
+      @accepts = nil
     end
 
     def if_modified_since=(last_modified)
@@ -76,11 +77,11 @@ module ActionController #:nodoc:
     end
 
     def request_uri(*args)
-      @request_uri || super
+      @request_uri || super()
     end
 
     def path(*args)
-      @path || super
+      @path || super()
     end
 
     def assign_parameters(controller_path, action, parameters)
@@ -107,7 +108,7 @@ module ActionController #:nodoc:
     def recycle!
       self.query_parameters   = {}
       self.path_parameters    = {}
-      unmemoize_all
+      @headers, @request_method, @accepts, @content_type = nil, nil, nil, nil
     end
 
     def user_agent=(user_agent)
@@ -279,38 +280,62 @@ module ActionController #:nodoc:
     end
   end
 
-  class TestSession #:nodoc:
+  class TestSession < Hash #:nodoc:
     attr_accessor :session_id
 
     def initialize(attributes = nil)
-      @session_id = ''
-      @attributes = attributes.nil? ? nil : attributes.stringify_keys
-      @saved_attributes = nil
+      reset_session_id
+      replace_attributes(attributes)
+    end
+
+    def reset
+      reset_session_id
+      replace_attributes({ })
     end
 
     def data
-      @attributes ||= @saved_attributes || {}
+      to_hash
     end
 
     def [](key)
-      data[key.to_s]
+      super(key.to_s)
     end
 
     def []=(key, value)
-      data[key.to_s] = value
+      super(key.to_s, value)
     end
 
-    def update
-      @saved_attributes = @attributes
+    def update(hash = nil)
+      if hash.nil?
+        ActiveSupport::Deprecation.warn('use replace instead', caller)
+        replace({})
+      else
+        super(hash)
+      end
     end
 
-    def delete
-      @attributes = nil
+    def delete(key = nil)
+      if key.nil?
+        ActiveSupport::Deprecation.warn('use clear instead', caller)
+        clear
+      else
+        super(key.to_s)
+      end
     end
 
     def close
-      update
-      delete
+      ActiveSupport::Deprecation.warn('sessions should no longer be closed', caller)
+    end
+
+  private
+
+    def reset_session_id
+      @session_id = ''
+    end
+
+    def replace_attributes(attributes = nil)
+      attributes ||= {}
+      replace(attributes.stringify_keys)
     end
   end
 
diff --git a/actionpack/lib/action_controller/uploaded_file.rb b/actionpack/lib/action_controller/uploaded_file.rb
index ea4845c68f..376ba3621a 100644
--- a/actionpack/lib/action_controller/uploaded_file.rb
+++ b/actionpack/lib/action_controller/uploaded_file.rb
@@ -7,6 +7,13 @@ module ActionController
       end
     end
 
+    def self.extended(object)
+      object.class_eval do
+        attr_accessor :original_path, :content_type
+        alias_method :local_path, :path
+      end
+    end
+
     # Take the basename of the upload's original filename.
     # This handles the full Windows paths given by Internet Explorer
     # (and perhaps other broken user agents) without affecting
diff --git a/actionpack/lib/action_controller/url_encoded_pair_parser.rb b/actionpack/lib/action_controller/url_encoded_pair_parser.rb
index 9883ad0d85..57594c4259 100644
--- a/actionpack/lib/action_controller/url_encoded_pair_parser.rb
+++ b/actionpack/lib/action_controller/url_encoded_pair_parser.rb
@@ -1,5 +1,66 @@
 module ActionController
   class UrlEncodedPairParser < StringScanner #:nodoc:
+    class << self
+      def parse_query_parameters(query_string)
+        return {} if query_string.blank?
+
+        pairs = query_string.split('&').collect do |chunk|
+          next if chunk.empty?
+          key, value = chunk.split('=', 2)
+          next if key.empty?
+          value = value.nil? ? nil : CGI.unescape(value)
+          [ CGI.unescape(key), value ]
+        end.compact
+
+        new(pairs).result
+      end
+
+      def parse_hash_parameters(params)
+        parser = new
+
+        params = params.dup
+        until params.empty?
+          for key, value in params
+            if key.blank?
+              params.delete(key)
+            elsif value.is_a?(Array)
+              parser.parse(key, get_typed_value(value.shift))
+              params.delete(key) if value.empty?
+            else
+              parser.parse(key, get_typed_value(value))
+              params.delete(key)
+            end
+          end
+        end
+
+        parser.result
+      end
+
+      private
+        def get_typed_value(value)
+          case value
+          when String
+            value
+          when NilClass
+            ''
+          when Array
+            value.map { |v| get_typed_value(v) }
+          when Hash
+            if value.has_key?(:tempfile) && value[:filename].any?
+              upload = value[:tempfile]
+              upload.extend(UploadedFile)
+              upload.original_path = value[:filename]
+              upload.content_type = value[:type]
+              upload
+            else
+              nil
+            end
+          else
+            raise "Unknown form value: #{value.inspect}"
+          end
+        end
+    end
+
     attr_reader :top, :parent, :result
 
     def initialize(pairs = [])
diff --git a/actionpack/lib/action_controller/url_rewriter.rb b/actionpack/lib/action_controller/url_rewriter.rb
index d86e2db67d..bb6cb437b7 100644
--- a/actionpack/lib/action_controller/url_rewriter.rb
+++ b/actionpack/lib/action_controller/url_rewriter.rb
@@ -92,15 +92,12 @@ module ActionController
   #     end
   #   end
   module UrlWriter
-    # The default options for urls written by this writer. Typically a <tt>:host</tt>
-    # pair is provided.
-    mattr_accessor :default_url_options
-    self.default_url_options = {}
-
     def self.included(base) #:nodoc:
       ActionController::Routing::Routes.install_helpers(base)
       base.mattr_accessor :default_url_options
-      base.default_url_options ||= default_url_options
+
+      # The default options for urls written by this writer. Typically a <tt>:host</tt> pair is provided.
+      base.default_url_options ||= {}
     end
 
     # Generate a url based on the options provided, default_url_options and the