Merge branch 'master' of github.com:rails/rails

Conflicts:
	guides/source/security.md

1 files changed, 78 insertions, 42 deletions

diff --git a/actionpack/lib/action_dispatch/http/request.rb b/actionpack/lib/action_dispatch/http/request.rb
index 3c62c055e5..4748a54550 100644
--- a/actionpack/lib/action_dispatch/http/request.rb
+++ b/actionpack/lib/action_dispatch/http/request.rb
@@ -20,8 +20,6 @@ module ActionDispatch
     include ActionDispatch::Http::FilterParameters
     include ActionDispatch::Http::URL
 
-    HTTP_X_REQUEST_ID = "HTTP_X_REQUEST_ID".freeze # :nodoc:
-
     autoload :Session, 'action_dispatch/request/session'
     autoload :Utils,   'action_dispatch/request/utils'
 
@@ -31,15 +29,19 @@ module ActionDispatch
         PATH_TRANSLATED REMOTE_HOST
         REMOTE_IDENT REMOTE_USER REMOTE_ADDR
         SERVER_NAME SERVER_PROTOCOL
+        ORIGINAL_SCRIPT_NAME
 
         HTTP_ACCEPT HTTP_ACCEPT_CHARSET HTTP_ACCEPT_ENCODING
         HTTP_ACCEPT_LANGUAGE HTTP_CACHE_CONTROL HTTP_FROM
-        HTTP_NEGOTIATE HTTP_PRAGMA ].freeze
+        HTTP_NEGOTIATE HTTP_PRAGMA HTTP_CLIENT_IP
+        HTTP_X_FORWARDED_FOR HTTP_VERSION
+        HTTP_X_REQUEST_ID
+        ].freeze
 
     ENV_METHODS.each do |env|
       class_eval <<-METHOD, __FILE__, __LINE__ + 1
         def #{env.sub(/^HTTP_/n, '').downcase}  # def accept_charset
-          @env["#{env}"]                        #   @env["HTTP_ACCEPT_CHARSET"]
+          get_header "#{env}".freeze            #   get_header "HTTP_ACCEPT_CHARSET".freeze
         end                                     # end
       METHOD
     end
@@ -65,8 +67,20 @@ module ActionDispatch
       end
     end
 
+    def controller_class
+      check_path_parameters!
+      params = path_parameters
+      controller_param = params[:controller].underscore if params.key?(:controller)
+      params[:action] ||= 'index'
+
+      yield unless controller_param
+
+      const_name = "#{controller_param.camelize}Controller"
+      ActiveSupport::Dependencies.constantize(const_name)
+    end
+
     def key?(key)
-      @env.key?(key)
+      has_header? key
     end
 
     # List of HTTP request methods from the following RFCs:
@@ -103,27 +117,46 @@ module ActionDispatch
     # the application should use), this \method returns the overridden
     # value, not the original.
     def request_method
-      @request_method ||= check_method(env["REQUEST_METHOD"])
+      @request_method ||= check_method(super)
     end
 
     def routes # :nodoc:
-      env["action_dispatch.routes".freeze]
+      get_header("action_dispatch.routes".freeze)
     end
 
-    def original_script_name # :nodoc:
-      env['ORIGINAL_SCRIPT_NAME'.freeze]
+    def routes=(routes) # :nodoc:
+      set_header("action_dispatch.routes".freeze, routes)
     end
 
     def engine_script_name(_routes) # :nodoc:
-      env[_routes.env_key]
+      get_header(_routes.env_key)
+    end
+
+    def engine_script_name=(name) # :nodoc:
+      set_header(routes.env_key, name.dup)
     end
 
     def request_method=(request_method) #:nodoc:
       if check_method(request_method)
-        @request_method = env["REQUEST_METHOD"] = request_method
+        @request_method = set_header("REQUEST_METHOD", request_method)
       end
     end
 
+    def controller_instance # :nodoc:
+      get_header('action_controller.instance'.freeze)
+    end
+
+    def controller_instance=(controller) # :nodoc:
+      set_header('action_controller.instance'.freeze, controller)
+    end
+
+    def show_exceptions? # :nodoc:
+      # We're treating `nil` as "unset", and we want the default setting to be
+      # `true`.  This logic should be extracted to `env_config` and calculated
+      # once.
+      !(get_header('action_dispatch.show_exceptions'.freeze) == false)
+    end
+
     # Returns a symbol form of the #request_method
     def request_method_symbol
       HTTP_METHOD_LOOKUP[request_method]
@@ -133,7 +166,7 @@ module ActionDispatch
     # even if it was overridden by middleware. See #request_method for
     # more information.
     def method
-      @method ||= check_method(env["rack.methodoverride.original_method"] || env['REQUEST_METHOD'])
+      @method ||= check_method(get_header("rack.methodoverride.original_method") || get_header('REQUEST_METHOD'))
     end
 
     # Returns a symbol form of the #method
@@ -145,7 +178,7 @@ module ActionDispatch
     #
     #   request.headers["Content-Type"] # => "text/plain"
     def headers
-      @headers ||= Http::Headers.new(@env)
+      @headers ||= Http::Headers.new(self)
     end
 
     # Returns a +String+ with the last requested path including their params.
@@ -156,7 +189,7 @@ module ActionDispatch
     #    # get '/foo?bar'
     #    request.original_fullpath # => '/foo?bar'
     def original_fullpath
-      @original_fullpath ||= (env["ORIGINAL_FULLPATH"] || fullpath)
+      @original_fullpath ||= (get_header("ORIGINAL_FULLPATH") || fullpath)
     end
 
     # Returns the +String+ full path including params of the last URL requested.
@@ -195,7 +228,7 @@ module ActionDispatch
     # (case-insensitive), which may need to be manually added depending on the
     # choice of JavaScript libraries and frameworks.
     def xml_http_request?
-      @env['HTTP_X_REQUESTED_WITH'] =~ /XMLHttpRequest/i
+      get_header('HTTP_X_REQUESTED_WITH') =~ /XMLHttpRequest/i
     end
     alias :xhr? :xml_http_request?
 
@@ -207,7 +240,11 @@ module ActionDispatch
     # Returns the IP address of client as a +String+,
     # usually set by the RemoteIp middleware.
     def remote_ip
-      @remote_ip ||= (@env["action_dispatch.remote_ip"] || ip).to_s
+      @remote_ip ||= (get_header("action_dispatch.remote_ip") || ip).to_s
+    end
+
+    def remote_ip=(remote_ip)
+      set_header "action_dispatch.remote_ip".freeze, remote_ip
     end
 
     ACTION_DISPATCH_REQUEST_ID = "action_dispatch.request_id".freeze # :nodoc:
@@ -219,43 +256,39 @@ module ActionDispatch
     # This unique ID is useful for tracing a request from end-to-end as part of logging or debugging.
     # This relies on the rack variable set by the ActionDispatch::RequestId middleware.
     def request_id
-      env[ACTION_DISPATCH_REQUEST_ID]
+      get_header ACTION_DISPATCH_REQUEST_ID
     end
 
     def request_id=(id) # :nodoc:
-      env[ACTION_DISPATCH_REQUEST_ID] = id
+      set_header ACTION_DISPATCH_REQUEST_ID, id
     end
 
     alias_method :uuid, :request_id
 
-    def x_request_id # :nodoc:
-      @env[HTTP_X_REQUEST_ID]
-    end
-
     # Returns the lowercase name of the HTTP server software.
     def server_software
-      (@env['SERVER_SOFTWARE'] && /^([a-zA-Z]+)/ =~ @env['SERVER_SOFTWARE']) ? $1.downcase : nil
+      (get_header('SERVER_SOFTWARE') && /^([a-zA-Z]+)/ =~ get_header('SERVER_SOFTWARE')) ? $1.downcase : nil
     end
 
     # Read the request \body. This is useful for web services that need to
     # work with raw requests directly.
     def raw_post
-      unless @env.include? 'RAW_POST_DATA'
+      unless has_header? 'RAW_POST_DATA'
         raw_post_body = body
-        @env['RAW_POST_DATA'] = raw_post_body.read(content_length)
+        set_header('RAW_POST_DATA', raw_post_body.read(content_length))
         raw_post_body.rewind if raw_post_body.respond_to?(:rewind)
       end
-      @env['RAW_POST_DATA']
+      get_header 'RAW_POST_DATA'
     end
 
     # The request body is an IO input stream. If the RAW_POST_DATA environment
     # variable is already set, wrap it in a StringIO.
     def body
-      if raw_post = @env['RAW_POST_DATA']
+      if raw_post = get_header('RAW_POST_DATA')
         raw_post.force_encoding(Encoding::BINARY)
         StringIO.new(raw_post)
       else
-        @env['rack.input']
+        body_stream
       end
     end
 
@@ -266,7 +299,7 @@ module ActionDispatch
     end
 
     def body_stream #:nodoc:
-      @env['rack.input']
+      get_header('rack.input')
     end
 
     # TODO This should be broken apart into AD::Request::Session and probably
@@ -277,20 +310,20 @@ module ActionDispatch
       else
         self.session = {}
       end
-      @env['action_dispatch.request.flash_hash'] = nil
+      set_header('action_dispatch.request.flash_hash', nil)
     end
 
     def session=(session) #:nodoc:
-      Session.set @env, session
+      Session.set self, session
     end
 
     def session_options=(options)
-      Session::Options.set @env, options
+      Session::Options.set self, options
     end
 
     # Override Rack's GET method to support indifferent access
     def GET
-      @env["action_dispatch.request.query_parameters"] ||= Utils.deep_munge(normalize_encode_params(super || {}))
+      @env["action_dispatch.request.query_parameters"] ||= normalize_encode_params(super || {})
     rescue Rack::Utils::ParameterTypeError, Rack::Utils::InvalidParameterError => e
       raise ActionController::BadRequest.new(:query, e)
     end
@@ -298,7 +331,7 @@ module ActionDispatch
 
     # Override Rack's POST method to support indifferent access
     def POST
-      @env["action_dispatch.request.request_parameters"] ||= Utils.deep_munge(normalize_encode_params(super || {}))
+      @env["action_dispatch.request.request_parameters"] ||= normalize_encode_params(super || {})
     rescue Rack::Utils::ParameterTypeError, Rack::Utils::InvalidParameterError => e
       raise ActionController::BadRequest.new(:request, e)
     end
@@ -307,10 +340,10 @@ module ActionDispatch
     # Returns the authorization header regardless of whether it was specified directly or through one of the
     # proxy alternatives.
     def authorization
-      @env['HTTP_AUTHORIZATION']   ||
-      @env['X-HTTP_AUTHORIZATION'] ||
-      @env['X_HTTP_AUTHORIZATION'] ||
-      @env['REDIRECT_X_HTTP_AUTHORIZATION']
+      get_header('HTTP_AUTHORIZATION')   ||
+      get_header('X-HTTP_AUTHORIZATION') ||
+      get_header('X_HTTP_AUTHORIZATION') ||
+      get_header('REDIRECT_X_HTTP_AUTHORIZATION')
     end
 
     # True if the request came from localhost, 127.0.0.1.
@@ -318,10 +351,13 @@ module ActionDispatch
       LOCALHOST =~ remote_addr && LOCALHOST =~ remote_ip
     end
 
-    protected
-      def parse_query(*)
-        Utils.deep_munge(super)
-      end
+    def request_parameters=(params)
+      set_header("action_dispatch.request.request_parameters".freeze, params)
+    end
+
+    def logger
+      get_header("action_dispatch.logger".freeze)
+    end
 
     private
       def check_method(name)