diff options
| author | Aaron Patterson <aaron.patterson@gmail.com> | 2012-07-26 15:07:19 -0700 |
|---|---|---|
| committer | Aaron Patterson <aaron.patterson@gmail.com> | 2012-07-26 15:07:19 -0700 |
| commit | 133754ef172706c10d6d1f9393d4fb1a1b19e2d7 (patch) | |
| tree | c1f96570993ead95bfb8615e42bdc155e17c895e /actionpack/lib/action_controller | |
| parent | 3dae4400989174c12730285397c58caf1a2685af (diff) | |
| parent | d1b9cf2d48b4e58da2da563107dd2783e326e287 (diff) | |
| download | rails-133754ef172706c10d6d1f9393d4fb1a1b19e2d7.tar.gz rails-133754ef172706c10d6d1f9393d4fb1a1b19e2d7.tar.bz2 rails-133754ef172706c10d6d1f9393d4fb1a1b19e2d7.zip | |
Merge branch '3-2-rel' into 3-2-stable
* 3-2-rel:
updating release date
bumping to 3.2.7
updating the changelog
* Do not convert digest auth strings to symbols. CVE-2012-3424
updating the version
updating changelogs
Diffstat (limited to 'actionpack/lib/action_controller')
| -rw-r--r-- | actionpack/lib/action_controller/metal/http_authentication.rb | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/actionpack/lib/action_controller/metal/http_authentication.rb b/actionpack/lib/action_controller/metal/http_authentication.rb index 9f2f5476fa..fe4ab65bba 100644 --- a/actionpack/lib/action_controller/metal/http_authentication.rb +++ b/actionpack/lib/action_controller/metal/http_authentication.rb @@ -227,9 +227,9 @@ module ActionController end def decode_credentials(header) - Hash[header.to_s.gsub(/^Digest\s+/,'').split(',').map do |pair| + HashWithIndifferentAccess[header.to_s.gsub(/^Digest\s+/,'').split(',').map do |pair| key, value = pair.split('=', 2) - [key.strip.to_sym, value.to_s.gsub(/^"|"$/,'').gsub(/'/, '')] + [key.strip, value.to_s.gsub(/^"|"$/,'').delete('\'')] end] end |