1 files changed, 130 insertions, 4 deletions
diff --git a/actionpack/CHANGELOG.md b/actionpack/CHANGELOG.md
index ae109852a6..f5527450c7 100644
--- a/actionpack/CHANGELOG.md
+++ b/actionpack/CHANGELOG.md
@@ -1,3 +1,129 @@
+*   Don't let strong parameters mutate the given hash via `fetch`
+
+    Create a new instance if the given parameter is a `Hash` instead of
+    passing it to the `convert_hashes_to_parameters` method since it is
+    overriding its default value.
+
+    *Brendon Murphy*, *Doug Cole*
+
+*   Add `params` option to `button_to` form helper, which renders the given hash
+    as hidden form fields.
+
+    *Andy Waite*
+
+*   Make assets helpers work in the controllers like it works in the views.
+
+    Example:
+
+        # config/application.rb
+        config.asset_host = 'http://mycdn.com'
+
+        ActionController::Base.helpers.asset_path('fallback.png')
+        # => http://mycdn.com/assets/fallback.png
+
+    Fixes #10051.
+
+    *Tima Maslyuchenko*
+
+*   Respect `SCRIPT_NAME` when using `redirect` with a relative path
+
+    Example:
+
+        # application routes.rb
+        mount BlogEngine => '/blog'
+
+        # engine routes.rb
+        get '/admin' => redirect('admin/dashboard')
+
+    This now redirects to the path `/blog/admin/dashboard`, whereas before it would've
+    generated an invalid url because there would be no slash between the host name and
+    the path. It also allows redirects to work where the application is deployed to a
+    subdirectory of a website.
+
+    Fixes #7977.
+
+    *Andrew White*
+
+*   Fixing repond_with working directly on the options hash
+    This fixes an issue where the respond_with worked directly with the given
+    options hash, so that if a user relied on it after calling respond_with,
+    the hash wouldn't be the same.
+
+    Fixes #12029.
+
+    *bluehotdog*
+
+*   Fix `ActionDispatch::RemoteIp::GetIp#calculate_ip` to only check for spoofing
+    attacks if both `HTTP_CLIENT_IP` and `HTTP_X_FORWARDED_FOR` are set.
+
+    Fixes #10844.
+
+    *Tamir Duberstein*
+
+*   Strong parameters should permit nested number as key.
+
+    Fixes #12293.
+
+    *kennyj*
+
+*   Fix regex used to detect URI schemes in `redirect_to` to be consistent with
+    RFC 3986.
+
+    *Derek Prior*
+
+*   Fix incorrect `assert_redirected_to` failure message for protocol-relative
+    URLs.
+
+    *Derek Prior*
+
+*   Fix an issue where router can't recognize downcased url encoding path.
+
+    Fixes #12269.
+
+    *kennyj*
+
+*   Fix custom flash type definition. Misusage of the `_flash_types` class variable
+    caused an error when reloading controllers with custom flash types.
+
+    Fixes #12057.
+
+    *Ricardo de Cillo*
+
+*   Do not break params filtering on `nil` values.
+
+    Fixes #12149.
+
+    *Vasiliy Ermolovich*
+
+*   Separate Action View completely from Action Pack.
+
+    *Łukasz Strzałkowski*
+
+*   Development mode exceptions are rendered in text format in case of XHR request.
+
+    *Kir Shatrov*
+
+*   Fix an issue where :if and :unless controller action procs were being run
+    before checking for the correct action in the :only and :unless options.
+
+    Fixes #11799.
+
+    *Nicholas Jakobsen*
+
+*   Fix an issue where `assert_dom_equal` and `assert_dom_not_equal` were
+    ignoring the passed failure message argument.
+
+    Fixes #11751.
+
+    *Ryan McGeary*
+
+*   Allow REMOTE_ADDR, HTTP_HOST and HTTP_USER_AGENT to be overridden from
+    the environment passed into `ActionDispatch::TestRequest.new`.
+
+    Fixes #11590.
+
+    *Andrew White*
+
 *   Fix an issue where Journey was failing to clear the named routes hash when the
     routes were reloaded and since it doesn't overwrite existing routes then if a
     route changed but wasn't renamed it kept the old definition. This was being
@@ -9,7 +135,7 @@
 *   Skip routes pointing to a redirect or mounted application when generating urls
     using an options hash as they aren't relevant and generate incorrect urls.
 
-    Fixes #8018
+    Fixes #8018.
 
     *Andrew White*
 
@@ -27,7 +153,7 @@
 *   Fix `ActionDispatch::ParamsParser#parse_formatted_parameters` to rewind body input stream on
     parsing json params.
 
-    Fixes #11345
+    Fixes #11345.
 
     *Yuri Bol*, *Paul Nikitochkin*
 
@@ -60,7 +186,7 @@
     was setting `request.formats` with an array containing a `nil` value, which
     raised an error when setting the controller formats.
 
-    Fixes #10965
+    Fixes #10965.
 
     *Becker*
 
@@ -69,7 +195,7 @@
     no `:to` present in the options hash so should only affect routes using the
     shorthand syntax (i.e. endpoint is inferred from the path).
 
-    Fixes #9856
+    Fixes #9856.
 
     *Yves Senn*, *Andrew White*