Merge branch 'master' of git@github.com:lifo/docrails

13 files changed, 407 insertions, 127 deletions

diff --git a/actionpack/lib/action_controller/base.rb b/actionpack/lib/action_controller/base.rb
index 5b83494eb4..e22114195c 100644
--- a/actionpack/lib/action_controller/base.rb
+++ b/actionpack/lib/action_controller/base.rb
@@ -382,6 +382,13 @@ module ActionController #:nodoc:
     attr_accessor :action_name
 
     class << self
+      def call(env)
+        # HACK: For global rescue to have access to the original request and response
+        request = env["action_controller.rescue.request"] ||= Request.new(env)
+        response = env["action_controller.rescue.response"] ||= Response.new
+        process(request, response)
+      end
+
       # Factory for the standard create, process loop where the controller is discarded after processing.
       def process(request, response) #:nodoc:
         new.process(request, response)
@@ -862,7 +869,7 @@ module ActionController #:nodoc:
         validate_render_arguments(options, extra_options, block_given?)
 
         if options.nil?
-          options = { :template => default_template.filename, :layout => true }
+          options = { :template => default_template, :layout => true }
         elsif options == :update
           options = extra_options.merge({ :update => true })
         elsif options.is_a?(String) || options.is_a?(Symbol)
@@ -1118,7 +1125,7 @@ module ActionController #:nodoc:
       end
 
       # Sets the etag, last_modified, or both on the response and renders a
-      # "304 Not Modified" response if the request is already fresh. 
+      # "304 Not Modified" response if the request is already fresh.
       #
       # Example:
       #
@@ -1126,8 +1133,8 @@ module ActionController #:nodoc:
       #     @article = Article.find(params[:id])
       #     fresh_when(:etag => @article, :last_modified => @article.created_at.utc)
       #   end
-      # 
-      # This will render the show template if the request isn't sending a matching etag or 
+      #
+      # This will render the show template if the request isn't sending a matching etag or
       # If-Modified-Since header and just a "304 Not Modified" response if there's a match.
       def fresh_when(options)
         options.assert_valid_keys(:etag, :last_modified)
@@ -1232,7 +1239,7 @@ module ActionController #:nodoc:
           log_processing_for_parameters
         end
       end
-      
+
       def log_processing_for_request_id
         request_id = "\n\nProcessing #{self.class.name}\##{action_name} "
         request_id << "to #{params[:format]} " if params[:format]
@@ -1244,7 +1251,7 @@ module ActionController #:nodoc:
       def log_processing_for_parameters
         parameters = respond_to?(:filter_parameters) ? filter_parameters(params) : params.dup
         parameters = parameters.except!(:controller, :action, :format, :_method)
-        
+
         logger.info "  Parameters: #{parameters.inspect}" unless parameters.empty?
       end
 
@@ -1343,9 +1350,12 @@ module ActionController #:nodoc:
   end
 
   Base.class_eval do
-    include Flash, Filters, Layout, Benchmarking, Rescue, MimeResponds, Helpers
-    include Cookies, Caching, Verification, Streaming
-    include SessionManagement, HttpAuthentication::Basic::ControllerMethods
-    include RecordIdentifier, RequestForgeryProtection, Translation
+    [ Filters, Layout, Benchmarking, Rescue, Flash, MimeResponds, Helpers,
+      Cookies, Caching, Verification, Streaming, SessionManagement,
+      HttpAuthentication::Basic::ControllerMethods, RecordIdentifier,
+      RequestForgeryProtection, Translation
+    ].each do |mod|
+      include mod
+    end
   end
 end
diff --git a/actionpack/lib/action_controller/dispatcher.rb b/actionpack/lib/action_controller/dispatcher.rb
index 4dc76e1b49..781bc48887 100644
--- a/actionpack/lib/action_controller/dispatcher.rb
+++ b/actionpack/lib/action_controller/dispatcher.rb
@@ -8,6 +8,8 @@ module ActionController
           # Development mode callbacks
           before_dispatch :reload_application
           after_dispatch :cleanup_application
+
+          ActionView::Helpers::AssetTagHelper.cache_asset_timestamps = false
         end
 
         if defined?(ActiveRecord)
@@ -60,11 +62,10 @@ module ActionController
     def dispatch
       begin
         run_callbacks :before_dispatch
-        controller = Routing::Routes.recognize(@request)
-        controller.process(@request, @response).to_a
+        Routing::Routes.call(@env)
       rescue Exception => exception
         if controller ||= (::ApplicationController rescue Base)
-          controller.process_with_exception(@request, @response, exception).to_a
+          controller.call_with_exception(@env, exception).to_a
         else
           raise exception
         end
@@ -83,8 +84,7 @@ module ActionController
     end
 
     def _call(env)
-      @request = Request.new(env)
-      @response = Response.new
+      @env = env
       dispatch
     end
 
@@ -93,7 +93,6 @@ module ActionController
       run_callbacks :prepare_dispatch
 
       Routing::Routes.reload
-      ActionView::Helpers::AssetTagHelper::AssetTag::Cache.clear
     end
 
     # Cleanup the application by clearing out loaded classes so they can
@@ -110,8 +109,7 @@ module ActionController
 
     def checkin_connections
       # Don't return connection (and peform implicit rollback) if this request is a part of integration test
-      # TODO: This callback should have direct access to env
-      return if @request.key?("rack.test")
+      return if @env.key?("rack.test")
       ActiveRecord::Base.clear_active_connections!
     end
   end
diff --git a/actionpack/lib/action_controller/http_authentication.rb b/actionpack/lib/action_controller/http_authentication.rb
index 2ed810db7d..3cb5829eca 100644
--- a/actionpack/lib/action_controller/http_authentication.rb
+++ b/actionpack/lib/action_controller/http_authentication.rb
@@ -55,7 +55,31 @@ module ActionController
     #       end
     #   end
     # 
-    # 
+    # Simple Digest example. Note the block must return the user's password so the framework 
+    # can appropriately hash it to check the user's credentials. Returning nil will cause authentication to fail. 
+    #  
+    #   class PostsController < ApplicationController 
+    #     Users = {"dhh" => "secret"} 
+    #    
+    #     before_filter :authenticate, :except => [ :index ] 
+    #    
+    #     def index 
+    #       render :text => "Everyone can see me!" 
+    #     end 
+    #    
+    #     def edit 
+    #       render :text => "I'm only accessible if you know the password" 
+    #     end 
+    #    
+    #     private 
+    #       def authenticate 
+    #         authenticate_or_request_with_http_digest(realm) do |user_name|  
+    #           Users[user_name] 
+    #         end 
+    #       end 
+    #   end
+    #
+    #
     # In your integration tests, you can do something like this:
     # 
     #   def test_access_granted_from_xml
@@ -108,7 +132,10 @@ module ActionController
       end
     
       def decode_credentials(request)
-        ActiveSupport::Base64.decode64(authorization(request).split.last || '')
+        # Properly decode credentials spanning a new-line
+        auth = authorization(request)
+        auth.slice!('Basic ')
+        ActiveSupport::Base64.decode64(auth || '')
       end
 
       def encode_credentials(user_name, password)
@@ -120,5 +147,165 @@ module ActionController
         controller.__send__ :render, :text => "HTTP Basic: Access denied.\n", :status => :unauthorized
       end
     end
+    
+    module Digest
+      extend self
+    
+      module ControllerMethods
+        def authenticate_or_request_with_http_digest(realm = "Application", &password_procedure)
+          begin 
+            authenticate_with_http_digest!(realm, &password_procedure)
+          rescue ActionController::HttpAuthentication::Error => e
+            msg = e.message
+            msg = "#{msg} expected '#{e.expected}' was '#{e.was}'" unless e.expected.nil?
+            raise msg if e.fatal?
+            request_http_digest_authentication(realm, msg)
+          end
+        end
+
+        # Authenticate using HTTP Digest, throwing ActionController::HttpAuthentication::Error on failure.
+        # This allows more detailed analysis of authentication failures
+        # to be relayed to the client.
+        def authenticate_with_http_digest!(realm = "Application", &login_procedure)
+            HttpAuthentication::Digest.authenticate(self, realm, &login_procedure)
+        end
+
+        # Authenticate with HTTP Digest, returns true or false
+        def authenticate_with_http_digest(realm = "Application", &login_procedure)
+          HttpAuthentication::Digest.authenticate(self, realm, &login_procedure) rescue false
+        end
+
+        # Render output including the HTTP Digest authentication header
+        def request_http_digest_authentication(realm = "Application", message = nil)
+          HttpAuthentication::Digest.authentication_request(self, realm, message)
+        end
+        
+        # Add HTTP Digest authentication header to result headers
+        def http_digest_authentication_header(realm = "Application")
+          HttpAuthentication::Digest.authentication_header(self, realm)
+        end
+      end
+
+      # Raises error unless authentictaion succeeds, returns true otherwise
+      def authenticate(controller, realm, &password_procedure)
+        raise Error.new(false), "No authorization header found" unless authorization(controller.request)
+        validate_digest_response(controller, realm, &password_procedure)
+        true
+      end
+
+      def authorization(request)
+        request.env['HTTP_AUTHORIZATION']   ||
+        request.env['X-HTTP_AUTHORIZATION'] ||
+        request.env['X_HTTP_AUTHORIZATION'] ||
+        request.env['REDIRECT_X_HTTP_AUTHORIZATION']
+      end
+
+      # Raises error unless the request credentials response value matches the expected value.
+      def validate_digest_response(controller, realm, &password_procedure) 
+        credentials = decode_credentials(controller.request) 
+
+        # Check the nonce, opaque and realm.
+        # Ignore nc, as we have no way to validate the number of times this nonce has been used
+        validate_nonce(controller.request, credentials[:nonce])
+        raise Error.new(false, realm, credentials[:realm]), "Realm doesn't match" unless realm == credentials[:realm]
+        raise Error.new(true, opaque(controller.request), credentials[:opaque]),"Opaque doesn't match" unless opaque(controller.request) == credentials[:opaque]
+
+        password = password_procedure.call(credentials[:username])
+        raise Error.new(false), "No password" if password.nil?
+        expected = expected_response(controller.request.env['REQUEST_METHOD'], controller.request.url, credentials, password)
+        raise Error.new(false, expected, credentials[:response]), "Invalid response" unless expected == credentials[:response]
+      end 
+
+      # Returns the expected response for a request of +http_method+ to +uri+ with the decoded +credentials+ and the expected +password+ 
+      def expected_response(http_method, uri, credentials, password) 
+        ha1 = ::Digest::MD5.hexdigest([credentials[:username], credentials[:realm], password].join(':')) 
+        ha2 = ::Digest::MD5.hexdigest([http_method.to_s.upcase,uri].join(':')) 
+        ::Digest::MD5.hexdigest([ha1,credentials[:nonce], credentials[:nc], credentials[:cnonce],credentials[:qop],ha2].join(':')) 
+      end  
+
+      def encode_credentials(http_method, credentials, password) 
+        credentials[:response] = expected_response(http_method, credentials[:uri], credentials, password) 
+        "Digest " + credentials.sort_by {|x| x[0].to_s }.inject([]) {|a, v| a << "#{v[0]}='#{v[1]}'" }.join(', ') 
+      end 
+
+      def decode_credentials(request) 
+        authorization(request).to_s.gsub(/^Digest\s+/,'').split(',').inject({}) do |hash, pair| 
+          key, value = pair.split('=', 2) 
+          hash[key.strip.to_sym] = value.to_s.gsub(/^"|"$/,'').gsub(/'/, '') 
+          hash 
+        end 
+      end 
+
+      def authentication_header(controller, realm)
+        controller.headers["WWW-Authenticate"] = %(Digest realm="#{realm}", qop="auth", algorithm=MD5, nonce="#{nonce(controller.request)}", opaque="#{opaque(controller.request)}") 
+      end
+
+      def authentication_request(controller, realm, message = "HTTP Digest: Access denied")
+        authentication_header(controller, realm)
+        controller.send! :render, :text => message, :status => :unauthorized
+      end
+
+      # Uses an MD5 digest based on time to generate a value to be used only once.
+      #
+      # A server-specified data string which should be uniquely generated each time a 401 response is made.
+      # It is recommended that this string be base64 or hexadecimal data.
+      # Specifically, since the string is passed in the header lines as a quoted string, the double-quote character is not allowed.
+      #
+      # The contents of the nonce are implementation dependent.
+      # The quality of the implementation depends on a good choice.
+      # A nonce might, for example, be constructed as the base 64 encoding of
+      #
+      # => time-stamp H(time-stamp ":" ETag ":" private-key)
+      #
+      # where time-stamp is a server-generated time or other non-repeating value,
+      # ETag is the value of the HTTP ETag header associated with the requested entity,
+      # and private-key is data known only to the server.
+      # With a nonce of this form a server would recalculate the hash portion after receiving the client authentication header and
+      # reject the request if it did not match the nonce from that header or
+      # if the time-stamp value is not recent enough. In this way the server can limit the time of the nonce's validity.
+      # The inclusion of the ETag prevents a replay request for an updated version of the resource.
+      # (Note: including the IP address of the client in the nonce would appear to offer the server the ability
+      # to limit the reuse of the nonce to the same client that originally got it.
+      # However, that would break proxy farms, where requests from a single user often go through different proxies in the farm.
+      # Also, IP address spoofing is not that hard.)
+      #
+      # An implementation might choose not to accept a previously used nonce or a previously used digest, in order to
+      # protect against a replay attack. Or, an implementation might choose to use one-time nonces or digests for
+      # POST or PUT requests and a time-stamp for GET requests. For more details on the issues involved see Section 4
+      # of this document.
+      #
+      # The nonce is opaque to the client.
+      def nonce(request, time = Time.now)
+        session_id = request.is_a?(String) ? request : request.session.session_id
+        t = time.to_i
+        hashed = [t, session_id]
+        digest = ::Digest::MD5.hexdigest(hashed.join(":"))
+        Base64.encode64("#{t}:#{digest}").gsub("\n", '')
+      end
+
+      def validate_nonce(request, value)
+        t = Base64.decode64(value).split(":").first.to_i
+        raise Error.new(true), "Stale Nonce" if (t - Time.now.to_i).abs > 10 * 60
+        n = nonce(request, t)
+        raise Error.new(true, value, n), "Bad Nonce" unless n == value
+      end
+
+      # Opaque based on digest of session_id
+      def opaque(request)
+        session_id = request.is_a?(String) ? request : request.session.session_id
+        @opaque ||= Base64.encode64(::Digest::MD5::hexdigest(session_id)).gsub("\n", '')
+      end
+    end
+
+    class Error < RuntimeError
+      attr_accessor :expected, :was
+      def initialize(fatal = false, expected = nil, was = nil)
+        @fatal = fatal
+        @expected = expected
+        @was = was
+      end
+
+      def fatal?; @fatal; end
+    end
   end
 end
diff --git a/actionpack/lib/action_controller/integration.rb b/actionpack/lib/action_controller/integration.rb
index 71e2524e81..ded72a71fb 100644
--- a/actionpack/lib/action_controller/integration.rb
+++ b/actionpack/lib/action_controller/integration.rb
@@ -68,12 +68,21 @@ module ActionController
       # A running counter of the number of requests processed.
       attr_accessor :request_count
 
+      # Nonce value for Digest Authentication, implicitly set on response with WWW-Authentication
+      attr_accessor :nonce
+
+      # Opaque value for Digest Authentication, implicitly set on response with WWW-Authentication
+      attr_accessor :opaque
+
+      # Opaque value for Authentication, implicitly set on response with WWW-Authentication
+      attr_accessor :realm
+
       class MultiPartNeededException < Exception
       end
 
       # Create and initialize a new Session instance.
-      def initialize(app)
-        @application = app
+      def initialize(app = nil)
+        @application = app || ActionController::Dispatcher.new
         reset!
       end
 
@@ -243,6 +252,53 @@ module ActionController
       end
       alias xhr :xml_http_request
 
+      def request_with_noauth(http_method, uri, parameters, headers) 
+        process_with_auth http_method, uri, parameters, headers
+      end 
+
+      # Performs a request with the given http_method and parameters, including HTTP Basic authorization headers. 
+      # See get() for more details on paramters and headers. 
+      # 
+      # You can perform GET, POST, PUT, DELETE, and HEAD requests with #get_with_basic, #post_with_basic, 
+      # #put_with_basic, #delete_with_basic, and #head_with_basic. 
+      def request_with_basic(http_method, uri, parameters, headers, user_name, password) 
+        process_with_auth http_method, uri, parameters, headers.merge(:authorization => ActionController::HttpAuthentication::Basic.encode_credentials(user_name, password)) 
+      end 
+
+      # Performs a request with the given http_method and parameters, including HTTP Digest authorization headers. 
+      # See get() for more details on paramters and headers. 
+      # 
+      # You can perform GET, POST, PUT, DELETE, and HEAD requests with #get_with_digest, #post_with_digest, 
+      # #put_with_digest, #delete_with_digest, and #head_with_digest. 
+      def request_with_digest(http_method, uri, parameters, headers, user_name, password) 
+        # Realm, Nonce, and Opaque taken from previoius 401 response
+        
+        credentials = {
+          :username => user_name,
+          :realm    => @realm,
+          :nonce    => @nonce,
+          :qop      => "auth",
+          :nc       => "00000001",
+          :cnonce   => "0a4f113b",
+          :opaque   => @opaque,
+          :uri      => uri
+        }
+        
+        raise "Digest request without previous 401 response" if @opaque.nil?
+ 
+        process_with_auth http_method, uri, parameters, headers.merge(:authorization => ActionController::HttpAuthentication::Digest.encode_credentials(http_method, credentials, password)) 
+      end 
+
+      # def get_with_basic, def post_with_basic, def put_with_basic, def delete_with_basic, def head_with_basic 
+      # def get_with_digest, def post_with_digest, def put_with_digest, def delete_with_digest, def head_with_digest 
+      [:get, :post, :put, :delete, :head].each do |method| 
+        [:noauth, :basic, :digest].each do |auth_type| 
+          define_method("#{method}_with_#{auth_type}") do |uri, parameters, headers, *auth| 
+            send("request_with_#{auth_type}", method, uri, parameters, headers, *auth) 
+          end 
+        end 
+      end
+
       # Returns the URL for the given options, according to the rules specified
       # in the application's routes.
       def url_for(options)
@@ -311,8 +367,10 @@ module ActionController
             env[key] = value
           end
 
-          unless ActionController::Base.respond_to?(:clear_last_instantiation!)
-            ActionController::Base.module_eval { include ControllerCapture }
+          [ControllerCapture, ActionController::ProcessWithTest].each do |mod|
+            unless ActionController::Base < mod
+              ActionController::Base.class_eval { include mod }
+            end
           end
 
           ActionController::Base.clear_last_instantiation!
@@ -340,6 +398,7 @@ module ActionController
           if @controller = ActionController::Base.last_instantiation
             @request = @controller.request
             @response = @controller.response
+            @controller.send(:set_test_assigns)
           else
             # Decorate responses from Rack Middleware and Rails Metal
             # as an Response for the purposes of integration testing
@@ -364,6 +423,32 @@ module ActionController
           return status
         end
 
+        # Same as process, but handles authentication returns to perform
+        # Basic or Digest authentication
+        def process_with_auth(method, path, parameters = nil, headers = nil)
+          status = process(method, path, parameters, headers)
+
+          if status == 401
+            # Extract authentication information from response
+            auth_data = @response.headers['WWW-Authenticate']
+            if /^Basic /.match(auth_data)
+              # extract realm, to be used in subsequent request
+              @realm = auth_header.split(' ')[1]
+            elsif /^Digest/.match(auth_data)
+              creds = auth_data.to_s.gsub(/^Digest\s+/,'').split(',').inject({}) do |hash, pair| 
+                key, value = pair.split('=', 2) 
+                hash[key.strip.to_sym] = value.to_s.gsub(/^"|"$/,'').gsub(/'/, '') 
+                hash 
+              end 
+              @realm = creds[:realm]
+              @nonce = creds[:nonce]
+              @opaque = creds[:opaque]
+            end
+          end
+
+          return status
+        end
+
         # Encode the cookies hash in a format suitable for passing to a
         # request.
         def encode_cookies
@@ -509,7 +594,6 @@ EOF
       # can use this method to open multiple sessions that ought to be tested
       # simultaneously.
       def open_session(application = nil)
-        application ||= ActionController::Dispatcher.new
         session = Integration::Session.new(application)
 
         # delegate the fixture accessors back to the test instance
diff --git a/actionpack/lib/action_controller/middleware_stack.rb b/actionpack/lib/action_controller/middleware_stack.rb
index 74f28565c0..2bccba2ba1 100644
--- a/actionpack/lib/action_controller/middleware_stack.rb
+++ b/actionpack/lib/action_controller/middleware_stack.rb
@@ -1,6 +1,14 @@
 module ActionController
   class MiddlewareStack < Array
     class Middleware
+      def self.new(klass, *args, &block)
+        if klass.is_a?(self)
+          klass
+        else
+          super
+        end
+      end
+
       attr_reader :args, :block
 
       def initialize(klass, *args, &block)
@@ -65,6 +73,19 @@ module ActionController
       block.call(self) if block_given?
     end
 
+    def insert(index, *objs)
+      index = self.index(index) unless index.is_a?(Integer)
+      objs = objs.map { |obj| Middleware.new(obj) }
+      super(index, *objs)
+    end
+
+    alias_method :insert_before, :insert
+
+    def insert_after(index, *objs)
+      index = self.index(index) unless index.is_a?(Integer)
+      insert(index + 1, *objs)
+    end
+
     def use(*args, &block)
       middleware = Middleware.new(*args, &block)
       push(middleware)
diff --git a/actionpack/lib/action_controller/request.rb b/actionpack/lib/action_controller/request.rb
index ab028b9eb2..3d13705f8f 100755
--- a/actionpack/lib/action_controller/request.rb
+++ b/actionpack/lib/action_controller/request.rb
@@ -6,24 +6,17 @@ require 'active_support/memoizable'
 require 'action_controller/cgi_ext'
 
 module ActionController
-  # CgiRequest and TestRequest provide concrete implementations.
-  class Request
+  class Request < Rack::Request
     extend ActiveSupport::Memoizable
 
-    class SessionFixationAttempt < StandardError #:nodoc:
-    end
-
-    # The hash of environment variables for this request,
-    # such as { 'RAILS_ENV' => 'production' }.
-    attr_reader :env
-
     def initialize(env)
-      @env = env
+      super
+      @parser = ActionController::RequestParser.new(env)
     end
 
-    %w[ AUTH_TYPE GATEWAY_INTERFACE PATH_INFO
+    %w[ AUTH_TYPE GATEWAY_INTERFACE
         PATH_TRANSLATED REMOTE_HOST
-        REMOTE_IDENT REMOTE_USER SCRIPT_NAME
+        REMOTE_IDENT REMOTE_USER REMOTE_ADDR
         SERVER_NAME SERVER_PROTOCOL
 
         HTTP_ACCEPT HTTP_ACCEPT_CHARSET HTTP_ACCEPT_ENCODING
@@ -45,8 +38,7 @@ module ActionController
     # <tt>:get</tt>. If the request \method is not listed in the HTTP_METHODS
     # constant above, an UnknownHttpMethod exception is raised.
     def request_method
-      method = @env['REQUEST_METHOD']
-      HTTP_METHOD_LOOKUP[method] || raise(UnknownHttpMethod, "#{method}, accepted HTTP methods are #{HTTP_METHODS.to_sentence}")
+      HTTP_METHOD_LOOKUP[super] || raise(UnknownHttpMethod, "#{super}, accepted HTTP methods are #{HTTP_METHODS.to_sentence}")
     end
     memoize :request_method
 
@@ -94,16 +86,15 @@ module ActionController
 
     # Returns the content length of the request as an integer.
     def content_length
-      @env['CONTENT_LENGTH'].to_i
+      super.to_i
     end
-    memoize :content_length
 
     # The MIME type of the HTTP request, such as Mime::XML.
     #
     # For backward compatibility, the post \format is extracted from the
     # X-Post-Data-Format HTTP header if present.
     def content_type
-      Mime::Type.lookup(parser.content_type_without_parameters)
+      Mime::Type.lookup(@parser.content_type_without_parameters)
     end
     memoize :content_type
 
@@ -391,16 +382,17 @@ EOM
     # Read the request \body. This is useful for web services that need to
     # work with raw requests directly.
     def raw_post
-      parser.raw_post
+      @parser.raw_post
     end
 
     # Returns both GET and POST \parameters in a single hash.
     def parameters
       @parameters ||= request_parameters.merge(query_parameters).update(path_parameters).with_indifferent_access
     end
+    alias_method :params, :parameters
 
     def path_parameters=(parameters) #:nodoc:
-      @path_parameters = parameters
+      @env["rack.routing_args"] = parameters
       @symbolized_path_parameters = @parameters = nil
     end
 
@@ -416,44 +408,35 @@ EOM
     #
     # See <tt>symbolized_path_parameters</tt> for symbolized keys.
     def path_parameters
-      @path_parameters ||= {}
+      @env["rack.routing_args"] ||= {}
     end
 
     def body
-      parser.body
-    end
-
-    def remote_addr
-      @env['REMOTE_ADDR']
+      @parser.body
     end
 
-    def referrer
-      @env['HTTP_REFERER']
+    # Override Rack's GET method to support nested query strings
+    def GET
+      @parser.query_parameters
     end
-    alias referer referrer
+    alias_method :query_parameters, :GET
 
-    def query_parameters
-      @query_parameters ||= parser.query_parameters
-    end
-
-    def request_parameters
-      @request_parameters ||= parser.request_parameters
+    # Override Rack's POST method to support nested query strings
+    def POST
+      @parser.request_parameters
     end
+    alias_method :request_parameters, :POST
 
     def body_stream #:nodoc:
       @env['rack.input']
     end
 
-    def cookies
-      Rack::Request.new(@env).cookies
-    end
-
     def session
       @env['rack.session'] ||= {}
     end
 
     def session=(session) #:nodoc:
-      @session = session
+      @env['rack.session'] = session
     end
 
     def reset_session
@@ -476,9 +459,5 @@ EOM
       def named_host?(host)
         !(host.nil? || /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.match(host))
       end
-
-      def parser
-        @parser ||= ActionController::RequestParser.new(@env)
-      end
   end
 end
diff --git a/actionpack/lib/action_controller/request_parser.rb b/actionpack/lib/action_controller/request_parser.rb
index 82ee4c84c4..d1739ef4d0 100644
--- a/actionpack/lib/action_controller/request_parser.rb
+++ b/actionpack/lib/action_controller/request_parser.rb
@@ -2,14 +2,15 @@ module ActionController
   class RequestParser
     def initialize(env)
       @env = env
+      freeze
     end
 
     def request_parameters
-      @request_parameters ||= parse_formatted_request_parameters
+      @env["action_controller.request_parser.request_parameters"] ||= parse_formatted_request_parameters
     end
 
     def query_parameters
-      @query_parameters ||= self.class.parse_query_parameters(query_string)
+      @env["action_controller.request_parser.query_parameters"] ||= self.class.parse_query_parameters(query_string)
     end
 
     # Returns the query string, accounting for server idiosyncrasies.
@@ -90,7 +91,7 @@ module ActionController
     end
 
     def content_length
-      @content_length ||= @env['CONTENT_LENGTH'].to_i
+      @env['CONTENT_LENGTH'].to_i
     end
 
     # The raw content type string. Use when you need parameters such as
diff --git a/actionpack/lib/action_controller/rescue.rb b/actionpack/lib/action_controller/rescue.rb
index 5ef79a36ce..4b7d1e32fd 100644
--- a/actionpack/lib/action_controller/rescue.rb
+++ b/actionpack/lib/action_controller/rescue.rb
@@ -38,8 +38,8 @@ module ActionController #:nodoc:
       'ActionView::TemplateError'         => 'template_error'
     }
 
-    RESCUES_TEMPLATE_PATH = ActionView::PathSet::Path.new(
-      File.join(File.dirname(__FILE__), "templates"), true)
+    RESCUES_TEMPLATE_PATH = ActionView::Template::EagerPath.new(
+      File.join(File.dirname(__FILE__), "templates"))
 
     def self.included(base) #:nodoc:
       base.cattr_accessor :rescue_responses
@@ -59,7 +59,9 @@ module ActionController #:nodoc:
     end
 
     module ClassMethods
-      def process_with_exception(request, response, exception) #:nodoc:
+      def call_with_exception(env, exception) #:nodoc:
+        request = env["action_controller.rescue.request"] ||= Request.new(env)
+        response = env["action_controller.rescue.response"] ||= Response.new
         new.process(request, response, :rescue_action, exception)
       end
     end
diff --git a/actionpack/lib/action_controller/response.rb b/actionpack/lib/action_controller/response.rb
index 64319fe102..27860a6207 100644
--- a/actionpack/lib/action_controller/response.rb
+++ b/actionpack/lib/action_controller/response.rb
@@ -231,10 +231,13 @@ module ActionController # :nodoc:
       # Don't set the Content-Length for block-based bodies as that would mean
       # reading it all into memory. Not nice for, say, a 2GB streaming file.
       def set_content_length!
-        unless body.respond_to?(:call) || (status && status.to_s[0..2] == '304')
-          self.headers["Content-Length"] ||= body.size
+        if status && status.to_s[0..2] == '204'
+          headers.delete('Content-Length')
+        elsif length = headers['Content-Length']
+          headers['Content-Length'] = length.to_s
+        elsif !body.respond_to?(:call) && (!status || status.to_s[0..2] != '304')
+          headers["Content-Length"] = body.size.to_s
         end
-        headers["Content-Length"] = headers["Content-Length"].to_s if headers["Content-Length"]
       end
 
       def convert_language!
diff --git a/actionpack/lib/action_controller/routing/route_set.rb b/actionpack/lib/action_controller/routing/route_set.rb
index 5975977365..044ace7de1 100644
--- a/actionpack/lib/action_controller/routing/route_set.rb
+++ b/actionpack/lib/action_controller/routing/route_set.rb
@@ -195,8 +195,8 @@ module ActionController
               def formatted_#{selector}(*args)                                              # def formatted_users_url(*args)
                 ActiveSupport::Deprecation.warn(                                            #   ActiveSupport::Deprecation.warn(
                   "formatted_#{selector}() has been deprecated. " +                         #     "formatted_users_url() has been deprecated. " +
-                  "please pass format to the standard" +                                    #     "please pass format to the standard" +
-                  "#{selector}() method instead.", caller)                                  #     "users_url() method instead.", caller)
+                  "Please pass format to the standard " +                                   #     "Please pass format to the standard " +
+                  "#{selector} method instead.", caller)                                    #     "users_url method instead.", caller)
                 #{selector}(*args)                                                          #   users_url(*args)
               end                                                                           # end
               protected :#{selector}                                                        # protected :users_url
@@ -427,6 +427,12 @@ module ActionController
         end
       end
 
+      def call(env)
+        request = Request.new(env)
+        app = Routing::Routes.recognize(request)
+        app.call(env).to_a
+      end
+
       def recognize(request)
         params = recognize_path(request.path, extract_request_environment(request))
         request.path_parameters = params.with_indifferent_access
diff --git a/actionpack/lib/action_controller/test_case.rb b/actionpack/lib/action_controller/test_case.rb
index 7ed1a3e160..0b0d0c799b 100644
--- a/actionpack/lib/action_controller/test_case.rb
+++ b/actionpack/lib/action_controller/test_case.rb
@@ -1,4 +1,5 @@
 require 'active_support/test_case'
+require 'action_controller/test_process'
 
 module ActionController
   # Superclass for ActionController functional tests. Functional tests allow you to
@@ -102,6 +103,8 @@ module ActionController
   #
   #  assert_redirected_to page_url(:title => 'foo')
   class TestCase < ActiveSupport::TestCase
+    include TestProcess
+
     module Assertions
       %w(response selector tag dom routing model).each do |kind|
         include ActionController::Assertions.const_get("#{kind.camelize}Assertions")
@@ -124,17 +127,18 @@ module ActionController
     #
     # The exception is stored in the exception accessor for further inspection.
     module RaiseActionExceptions
-      attr_accessor :exception
+      protected
+        attr_accessor :exception
 
-      def rescue_action_without_handler(e)
-        self.exception = e
-        
-        if request.remote_addr == "0.0.0.0"
-          raise(e)
-        else
-          super(e)
+        def rescue_action_without_handler(e)
+          self.exception = e
+
+          if request.remote_addr == "0.0.0.0"
+            raise(e)
+          else
+            super(e)
+          end
         end
-      end
     end
 
     setup :setup_controller_request_and_response
diff --git a/actionpack/lib/action_controller/test_process.rb b/actionpack/lib/action_controller/test_process.rb
index 285a8b09e4..8180d4ee93 100644
--- a/actionpack/lib/action_controller/test_process.rb
+++ b/actionpack/lib/action_controller/test_process.rb
@@ -1,32 +1,4 @@
-require 'action_controller/test_case'
-
 module ActionController #:nodoc:
-  class Base
-    attr_reader :assigns
-
-    # Process a test request called with a TestRequest object.
-    def self.process_test(request)
-      new.process_test(request)
-    end
-
-    def process_test(request) #:nodoc:
-      process(request, TestResponse.new)
-    end
-
-    def process_with_test(*args)
-      returning process_without_test(*args) do
-        @assigns = {}
-        (instance_variable_names - @@protected_instance_variables).each do |var|
-          value = instance_variable_get(var)
-          @assigns[var[1..-1]] = value
-          response.template.assigns[var[1..-1]] = value if response
-        end
-      end
-    end
-
-    alias_method_chain :process, :test
-  end
-
   class TestRequest < Request #:nodoc:
     attr_accessor :cookies, :session_options
     attr_accessor :query_parameters, :path, :session
@@ -433,7 +405,9 @@ module ActionController #:nodoc:
       @request.session = ActionController::TestSession.new(session) unless session.nil?
       @request.session["flash"] = ActionController::Flash::FlashHash.new.update(flash) if flash
       build_request_uri(action, parameters)
-      @controller.process(@request, @response)
+
+      Base.class_eval { include ProcessWithTest } unless Base < ProcessWithTest
+      @controller.process_with_test(@request, @response)
     end
 
     def xml_http_request(request_method, action, parameters = nil, session = nil, flash = nil)
@@ -545,12 +519,24 @@ module ActionController #:nodoc:
       ActionController::Routing.const_set(:Routes, real_routes) if real_routes
     end
   end
-end
 
-module Test
-  module Unit
-    class TestCase #:nodoc:
-      include ActionController::TestProcess
+  module ProcessWithTest #:nodoc:
+    def self.included(base)
+      base.class_eval { attr_reader :assigns }
+    end
+
+    def process_with_test(*args)
+      process(*args).tap { set_test_assigns }
     end
+
+    private
+      def set_test_assigns
+        @assigns = {}
+        (instance_variable_names - self.class.protected_instance_variables).each do |var|
+          name, value = var[1..-1], instance_variable_get(var)
+          @assigns[name] = value
+          response.template.assigns[name] = value if response
+        end
+      end
   end
 end
diff --git a/actionpack/lib/action_controller/url_encoded_pair_parser.rb b/actionpack/lib/action_controller/url_encoded_pair_parser.rb
index bea96c711d..9883ad0d85 100644
--- a/actionpack/lib/action_controller/url_encoded_pair_parser.rb
+++ b/actionpack/lib/action_controller/url_encoded_pair_parser.rb
@@ -70,11 +70,12 @@ module ActionController
               top[-1][key] = value
             else
               top << {key => value}.with_indifferent_access
-              push top.last
-              value = top[key]
             end
+            push top.last
+            return top[key]
           else
             top << value
+            return value
           end
         elsif top.is_a? Hash
           key = CGI.unescape(key)
@@ -84,12 +85,10 @@ module ActionController
         else
           raise ArgumentError, "Don't know what to do: top is #{top.inspect}"
         end
-
-        return value
       end
 
       def type_conflict!(klass, value)
         raise TypeError, "Conflicting types for parameter containers. Expected an instance of #{klass} but found an instance of #{value.class}. This can be caused by colliding Array and Hash parameters like qs[]=value&qs[key]=value. (The parameters received were #{value.inspect}.)"
       end
   end
-end
\ No newline at end of file
+end