diff options
Diffstat (limited to 'actionpack/lib')
7 files changed, 205 insertions, 54 deletions
diff --git a/actionpack/lib/action_controller/base.rb b/actionpack/lib/action_controller/base.rb index 092fe98588..4297d9bbf6 100644 --- a/actionpack/lib/action_controller/base.rb +++ b/actionpack/lib/action_controller/base.rb @@ -35,6 +35,7 @@ module ActionController RecordIdentifier, HttpAuthentication::Basic::ControllerMethods, HttpAuthentication::Digest::ControllerMethods, + HttpAuthentication::Token::ControllerMethods, # Add instrumentations hooks at the bottom, to ensure they instrument # all the methods properly. diff --git a/actionpack/lib/action_controller/caching/actions.rb b/actionpack/lib/action_controller/caching/actions.rb index 43ddf6435a..546f043c58 100644 --- a/actionpack/lib/action_controller/caching/actions.rb +++ b/actionpack/lib/action_controller/caching/actions.rb @@ -133,7 +133,7 @@ module ActionController #:nodoc: body = controller._save_fragment(cache_path.path, @store_options) end - body = controller.render_to_string(:text => cache, :layout => true) unless @cache_layout + body = controller.render_to_string(:text => body, :layout => true) unless @cache_layout controller.response_body = body controller.content_type = Mime[cache_path.extension || :html] diff --git a/actionpack/lib/action_controller/metal/http_authentication.rb b/actionpack/lib/action_controller/metal/http_authentication.rb index 6bd6c15990..be7448ce01 100644 --- a/actionpack/lib/action_controller/metal/http_authentication.rb +++ b/actionpack/lib/action_controller/metal/http_authentication.rb @@ -300,5 +300,163 @@ module ActionController end end + + # Makes it dead easy to do HTTP Token authentication. + # + # Simple Token example: + # + # class PostsController < ApplicationController + # TOKEN = "secret" + # + # before_filter :authenticate, :except => [ :index ] + # + # def index + # render :text => "Everyone can see me!" + # end + # + # def edit + # render :text => "I'm only accessible if you know the password" + # end + # + # private + # def authenticate + # authenticate_or_request_with_http_token do |token, options| + # token == TOKEN + # end + # end + # end + # + # + # Here is a more advanced Token example where only Atom feeds and the XML API is protected by HTTP token authentication, + # the regular HTML interface is protected by a session approach: + # + # class ApplicationController < ActionController::Base + # before_filter :set_account, :authenticate + # + # protected + # def set_account + # @account = Account.find_by_url_name(request.subdomains.first) + # end + # + # def authenticate + # case request.format + # when Mime::XML, Mime::ATOM + # if user = authenticate_with_http_token { |t, o| @account.users.authenticate(t, o) } + # @current_user = user + # else + # request_http_token_authentication + # end + # else + # if session_authenticated? + # @current_user = @account.users.find(session[:authenticated][:user_id]) + # else + # redirect_to(login_url) and return false + # end + # end + # end + # end + # + # + # In your integration tests, you can do something like this: + # + # def test_access_granted_from_xml + # get( + # "/notes/1.xml", nil, + # :authorization => ActionController::HttpAuthentication::Token.encode_credentials(users(:dhh).token) + # ) + # + # assert_equal 200, status + # end + # + # + # On shared hosts, Apache sometimes doesn't pass authentication headers to + # FCGI instances. If your environment matches this description and you cannot + # authenticate, try this rule in your Apache setup: + # + # RewriteRule ^(.*)$ dispatch.fcgi [E=X-HTTP_AUTHORIZATION:%{HTTP:Authorization},QSA,L] + module Token + + extend self + + module ControllerMethods + def authenticate_or_request_with_http_token(realm = "Application", &login_procedure) + authenticate_with_http_token(&login_procedure) || request_http_token_authentication(realm) + end + + def authenticate_with_http_token(&login_procedure) + Token.authenticate(self, &login_procedure) + end + + def request_http_token_authentication(realm = "Application") + Token.authentication_request(self, realm) + end + end + + # If token Authorization header is present, call the login procedure with + # the present token and options. + # + # controller - ActionController::Base instance for the current request. + # login_procedure - Proc to call if a token is present. The Proc should + # take 2 arguments: + # authenticate(controller) { |token, options| ... } + # + # Returns the return value of `&login_procedure` if a token is found. + # Returns nil if no token is found. + def authenticate(controller, &login_procedure) + token, options = token_and_options(controller.request) + if !token.blank? + login_procedure.call(token, options) + end + end + + # Parses the token and options out of the token authorization header. If + # the header looks like this: + # Authorization: Token token="abc", nonce="def" + # Then the returned token is "abc", and the options is {:nonce => "def"} + # + # request - ActionController::Request instance with the current headers. + # + # Returns an Array of [String, Hash] if a token is present. + # Returns nil if no token is found. + def token_and_options(request) + if header = request.authorization.to_s[/^Token (.*)/] + values = $1.split(','). + inject({}) do |memo, value| + value.strip! # remove any spaces between commas and values + key, value = value.split(/\=\"?/) # split key=value pairs + value.chomp!('"') # chomp trailing " in value + value.gsub!(/\\\"/, '"') # unescape remaining quotes + memo.update(key => value) + end + [values.delete("token"), values.with_indifferent_access] + end + end + + # Encodes the given token and options into an Authorization header value. + # + # token - String token. + # options - optional Hash of the options. + # + # Returns String. + def encode_credentials(token, options = {}) + values = ["token=#{token.to_s.inspect}"] + options.each do |key, value| + values << "#{key}=#{value.to_s.inspect}" + end + "Token #{values * ", "}" + end + + # Sets a WWW-Authenticate to let the client know a token is desired. + # + # controller - ActionController::Base instance for the outgoing response. + # realm - String realm to use in the header. + # + # Returns nothing. + def authentication_request(controller, realm) + controller.headers["WWW-Authenticate"] = %(Token realm="#{realm.gsub(/"/, "")}") + controller.__send__ :render, :text => "HTTP Token: Access denied.\n", :status => :unauthorized + end + end + end end diff --git a/actionpack/lib/action_dispatch/middleware/show_exceptions.rb b/actionpack/lib/action_dispatch/middleware/show_exceptions.rb index 43440e5f7c..12a93d6a24 100644 --- a/actionpack/lib/action_dispatch/middleware/show_exceptions.rb +++ b/actionpack/lib/action_dispatch/middleware/show_exceptions.rb @@ -45,7 +45,17 @@ module ActionDispatch end def call(env) - @app.call(env) + status, headers, body = @app.call(env) + + # Only this middleware cares about RoutingError. So, let's just raise + # it here. + # TODO: refactor this middleware to handle the X-Cascade scenario without + # having to raise an exception. + if headers['X-Cascade'] == 'pass' + raise ActionController::RoutingError, "No route matches #{env['PATH_INFO'].inspect}" + end + + [status, headers, body] rescue Exception => exception raise exception if env['action_dispatch.show_exceptions'] == false render_exception(env, exception) diff --git a/actionpack/lib/action_dispatch/routing/route_set.rb b/actionpack/lib/action_dispatch/routing/route_set.rb index fdbff74071..0d071dd7fe 100644 --- a/actionpack/lib/action_dispatch/routing/route_set.rb +++ b/actionpack/lib/action_dispatch/routing/route_set.rb @@ -6,10 +6,6 @@ require 'action_dispatch/routing/deprecated_mapper' module ActionDispatch module Routing class RouteSet #:nodoc: - NotFound = lambda { |env| - raise ActionController::RoutingError, "No route matches #{env['PATH_INFO'].inspect}" - } - PARAMETERS_KEY = 'action_dispatch.request.path_parameters' class Dispatcher #:nodoc: @@ -224,7 +220,6 @@ module ActionDispatch def finalize! return if @finalized @finalized = true - @set.add_route(NotFound) @set.freeze end diff --git a/actionpack/lib/action_view/helpers/date_helper.rb b/actionpack/lib/action_view/helpers/date_helper.rb index 42018ee261..7d846a01dd 100644 --- a/actionpack/lib/action_view/helpers/date_helper.rb +++ b/actionpack/lib/action_view/helpers/date_helper.rb @@ -589,56 +589,50 @@ module ActionView @options = options.dup @html_options = html_options.dup @datetime = datetime + @options[:datetime_separator] ||= ' — ' + @options[:time_separator] ||= ' : ' end def select_datetime - # TODO: Remove tag conditional - # Ideally we could just join select_date and select_date for the tag case + order = date_order.dup + order -= [:hour, :minute, :second] + @options[:discard_year] ||= true unless order.include?(:year) + @options[:discard_month] ||= true unless order.include?(:month) + @options[:discard_day] ||= true if @options[:discard_month] || !order.include?(:day) + @options[:discard_minute] ||= true if @options[:discard_hour] + @options[:discard_second] ||= true unless @options[:include_seconds] && !@options[:discard_minute] + + # If the day is hidden and the month is visible, the day should be set to the 1st so all month choices are + # valid (otherwise it could be 31 and february wouldn't be a valid date) + if @datetime && @options[:discard_day] && !@options[:discard_month] + @datetime = @datetime.change(:day => 1) + end + if @options[:tag] && @options[:ignore_date] select_time - elsif @options[:tag] - order = date_order.dup - order -= [:hour, :minute, :second] - - @options[:discard_year] ||= true unless order.include?(:year) - @options[:discard_month] ||= true unless order.include?(:month) - @options[:discard_day] ||= true if @options[:discard_month] || !order.include?(:day) - @options[:discard_minute] ||= true if @options[:discard_hour] - @options[:discard_second] ||= true unless @options[:include_seconds] && !@options[:discard_minute] - - # If the day is hidden and the month is visible, the day should be set to the 1st so all month choices are - # valid (otherwise it could be 31 and february wouldn't be a valid date) - if @datetime && @options[:discard_day] && !@options[:discard_month] - @datetime = @datetime.change(:day => 1) - end - + else [:day, :month, :year].each { |o| order.unshift(o) unless order.include?(o) } order += [:hour, :minute, :second] unless @options[:discard_hour] build_selects_from_types(order) - else - "#{select_date}#{@options[:datetime_separator]}#{select_time}".html_safe end end def select_date order = date_order.dup - # TODO: Remove tag conditional - if @options[:tag] - @options[:discard_hour] = true - @options[:discard_minute] = true - @options[:discard_second] = true + @options[:discard_hour] = true + @options[:discard_minute] = true + @options[:discard_second] = true - @options[:discard_year] ||= true unless order.include?(:year) - @options[:discard_month] ||= true unless order.include?(:month) - @options[:discard_day] ||= true if @options[:discard_month] || !order.include?(:day) + @options[:discard_year] ||= true unless order.include?(:year) + @options[:discard_month] ||= true unless order.include?(:month) + @options[:discard_day] ||= true if @options[:discard_month] || !order.include?(:day) - # If the day is hidden and the month is visible, the day should be set to the 1st so all month choices are - # valid (otherwise it could be 31 and february wouldn't be a valid date) - if @datetime && @options[:discard_day] && !@options[:discard_month] - @datetime = @datetime.change(:day => 1) - end + # If the day is hidden and the month is visible, the day should be set to the 1st so all month choices are + # valid (otherwise it could be 31 and february wouldn't be a valid date) + if @datetime && @options[:discard_day] && !@options[:discard_month] + @datetime = @datetime.change(:day => 1) end [:day, :month, :year].each { |o| order.unshift(o) unless order.include?(o) } @@ -649,15 +643,12 @@ module ActionView def select_time order = [] - # TODO: Remove tag conditional - if @options[:tag] - @options[:discard_month] = true - @options[:discard_year] = true - @options[:discard_day] = true - @options[:discard_second] ||= true unless @options[:include_seconds] + @options[:discard_month] = true + @options[:discard_year] = true + @options[:discard_day] = true + @options[:discard_second] ||= true unless @options[:include_seconds] - order += [:year, :month, :day] unless @options[:ignore_date] - end + order += [:year, :month, :day] unless @options[:ignore_date] order += [:hour, :minute] order << :second if @options[:include_seconds] @@ -937,10 +928,8 @@ module ActionView options[:include_position] = true options[:prefix] ||= @object_name options[:index] = @auto_index if @auto_index && !options.has_key?(:index) - options[:datetime_separator] ||= ' — ' - options[:time_separator] ||= ' : ' - DateTimeSelector.new(datetime, options.merge(:tag => true), html_options) + DateTimeSelector.new(datetime, options, html_options) end def default_datetime(options) diff --git a/actionpack/lib/action_view/helpers/url_helper.rb b/actionpack/lib/action_view/helpers/url_helper.rb index 4ffc5ea127..210f148c02 100644 --- a/actionpack/lib/action_view/helpers/url_helper.rb +++ b/actionpack/lib/action_view/helpers/url_helper.rb @@ -596,10 +596,8 @@ module ActionView html_options = {} if html_options.nil? html_options = html_options.stringify_keys - if (options.is_a?(Hash) && options.key?('remote')) || (html_options.is_a?(Hash) && html_options.key?('remote')) + if (options.is_a?(Hash) && options.key?('remote') && options.delete('remote')) || (html_options.is_a?(Hash) && html_options.key?('remote') && html_options.delete('remote')) html_options['data-remote'] = 'true' - options.delete('remote') if options.is_a?(Hash) - html_options.delete('remote') if html_options.is_a?(Hash) end confirm = html_options.delete("confirm") |