diff options
Diffstat (limited to 'guides/source')
| -rw-r--r-- | guides/source/action_view_overview.md | 69 | ||||
| -rw-r--r-- | guides/source/active_record_validations.md | 5 | ||||
| -rw-r--r-- | guides/source/association_basics.md | 5 | ||||
| -rw-r--r-- | guides/source/getting_started.md | 31 | ||||
| -rw-r--r-- | guides/source/i18n.md | 2 | ||||
| -rw-r--r-- | guides/source/migrations.md | 16 | ||||
| -rw-r--r-- | guides/source/security.md | 2 |
7 files changed, 39 insertions, 91 deletions
diff --git a/guides/source/action_view_overview.md b/guides/source/action_view_overview.md index 3542844f33..6fce5a1dc2 100644 --- a/guides/source/action_view_overview.md +++ b/guides/source/action_view_overview.md @@ -1542,72 +1542,3 @@ end Then you could create special views like `app/views/posts/show.expert.html.erb` that would only be displayed to expert users. You can read more about the Rails Internationalization (I18n) API [here](i18n.html). - -Using Action View outside of Rails ----------------------------------- - -Action View is a Rails component, but it can also be used without Rails. We can demonstrate this by creating a small [Rack](http://rack.rubyforge.org/) application that includes Action View functionality. This may be useful, for example, if you'd like access to Action View's helpers in a Rack application. - -Let's start by ensuring that you have the Action Pack and Rack gems installed: - -```bash -$ gem install actionpack -$ gem install rack -``` - -Now we'll create a simple "Hello World" application that uses the `titleize` method provided by Active Support. - -**hello_world.rb:** - -```ruby -require 'active_support/core_ext/string/inflections' -require 'rack' - -def hello_world(env) - [200, {"Content-Type" => "text/html"}, "hello world".titleize] -end - -Rack::Handler::Mongrel.run method(:hello_world), Port: 4567 -``` - -We can see this all come together by starting up the application and then visiting `http://localhost:4567/` - -```bash -$ ruby hello_world.rb -``` - -TODO needs a screenshot? I have one - not sure where to put it. - -Notice how 'hello world' has been converted into 'Hello World' by the `titleize` helper method. - -Action View can also be used with [Sinatra](http://www.sinatrarb.com/) in the same way. - -Let's start by ensuring that you have the Action Pack and Sinatra gems installed: - -```bash -$ gem install actionpack -$ gem install sinatra -``` - -Now we'll create the same "Hello World" application in Sinatra. - -**hello_world.rb:** - -```ruby -require 'action_view' -require 'sinatra' - -get '/' do - erb 'hello world'.titleize -end -``` - -Then, we can run the application: - -```bash -$ ruby hello_world.rb -``` - -Once the application is running, you can see Sinatra and Action View working together by visiting `http://localhost:4567/` - -TODO needs a screenshot? I have one - not sure where to put it. diff --git a/guides/source/active_record_validations.md b/guides/source/active_record_validations.md index d95b587e78..8154d4e1cc 100644 --- a/guides/source/active_record_validations.md +++ b/guides/source/active_record_validations.md @@ -243,7 +243,7 @@ line of code you can add the same kind of validation to several attributes. All of them accept the `:on` and `:message` options, which define when the validation should be run and what message should be added to the `errors` collection if it fails, respectively. The `:on` option takes one of the values -`:save` (the default), `:create` or `:update`. There is a default error +`:create` or `:update`. There is a default error message for each one of the validation helpers. These messages are used when the `:message` option isn't specified. Let's take a look at each one of the available helpers. @@ -765,10 +765,9 @@ class Person < ActiveRecord::Base validates :age, numericality: true, on: :update # the default (validates on both create and update) - validates :name, presence: true, on: :save + validates :name, presence: true end ``` -The last line is in review state and as of now, it is not running in any version of Rails 3.2.x as discussed in this [issue](https://github.com/rails/rails/issues/10248) Strict Validations ------------------ diff --git a/guides/source/association_basics.md b/guides/source/association_basics.md index e6a66f3fa1..9b80a65a44 100644 --- a/guides/source/association_basics.md +++ b/guides/source/association_basics.md @@ -1944,8 +1944,8 @@ While Rails uses intelligent defaults that will work well in most situations, th ```ruby class Parts < ActiveRecord::Base - has_and_belongs_to_many :assemblies, uniq: true, - read_only: true + has_and_belongs_to_many :assemblies, autosave: true, + readonly: true end ``` @@ -1957,6 +1957,7 @@ The `has_and_belongs_to_many` association supports these options: * `:foreign_key` * `:join_table` * `:validate` +* `:readonly` ##### `:association_foreign_key` diff --git a/guides/source/getting_started.md b/guides/source/getting_started.md index 27768952cc..dabdb391b3 100644 --- a/guides/source/getting_started.md +++ b/guides/source/getting_started.md @@ -155,7 +155,7 @@ To begin with, let's get some text up on screen quickly. To do this, you need to ### Starting up the Web Server -You actually have a functional Rails application already. To see it, you need to start a web server on your development machine. You can do this by running: +You actually have a functional Rails application already. To see it, you need to start a web server on your development machine. You can do this by running the following in the root directory of your rails application: ```bash $ rails server @@ -416,7 +416,7 @@ edit_post GET /posts/:id/edit(.:format) posts#edit The `posts_path` helper tells Rails to point the form to the URI Pattern associated with the `posts` prefix; and the form will (by default) send a `POST` request -to that route. This is associated with the +to that route. This is associated with the `create` action of the current controller, the `PostsController`. With the form and its associated route defined, you will be able to fill in the form and then click the submit button to begin the process of creating a new post, so go ahead and do that. When you submit the form, you should see a familiar error: @@ -553,7 +553,7 @@ and change the `create` action to look like this: ```ruby def create @post = Post.new(params[:post]) - + @post.save redirect_to @post end @@ -575,7 +575,7 @@ If you submit the form again now, Rails will complain about not finding the `show` action. That's not very useful though, so let's add the `show` action before proceeding. -First we need to add a new `route` in `config/routes.rb`. +As we have seen in the output of `rake routes`, the route for `show` action is as follows: ```ruby post GET /posts/:id(.:format) posts#show @@ -654,7 +654,7 @@ For more information, refer to ### Listing all posts We still need a way to list all our posts, so let's do that. -We'll use a specific route from `config/routes.rb`: +The route for this as per output of `rake routes` is: ```ruby posts GET /posts(.:format) posts#index @@ -888,7 +888,7 @@ it look as follows: ```html+erb <h1>Editing post</h1> -<%= form_for :post, url: post_path(@post.id), method: :patch do |f| %> +<%= form_for :post, url: post_path(@post), method: :patch do |f| %> <% if @post.errors.any? %> <div id="error_explanation"> <h2><%= pluralize(@post.errors.count, "error") %> prohibited @@ -1039,7 +1039,7 @@ content: ``` Everything except for the `form_for` declaration remained the same. -The reason we can use this shorter, simpler `form_for` declaration +The reason we can use this shorter, simpler `form_for` declaration to stand in for either of the other forms is that `@post` is a *resource* corresponding to a full set of RESTful routes, and Rails is able to infer which URI and method to use. @@ -1071,7 +1071,7 @@ Then do the same for the `app/views/posts/edit.html.erb` view: We're now ready to cover the "D" part of CRUD, deleting posts from the database. Following the REST convention, the route for -deleting posts in the `config/routes.rb` is: +deleting posts as per output of `rake routes` is: ```ruby DELETE /posts/:id(.:format) posts#destroy @@ -1616,6 +1616,8 @@ end Security -------- +### Basic Authentication + If you were to publish your blog online, anybody would be able to add, edit and delete posts or delete comments. @@ -1663,6 +1665,19 @@ Authentication challenge  +Other authentication methods are available for Rails applications. Two popular +authentication add-ons for Rails are the [Devise](https://github.com/plataformatec/devise) +rails engine and the [Authlogic](https://github.com/binarylogic/authlogic) gem, +along with a number of others. + + +### Other Security Considerations + +Security, especially in web applications, is a broad and detailed area. Security +in your Rails application is covered in more depth in +The [Ruby on Rails Security Guide](security.html) + + What's Next? ------------ diff --git a/guides/source/i18n.md b/guides/source/i18n.md index 046c7543f3..facfb96d98 100644 --- a/guides/source/i18n.md +++ b/guides/source/i18n.md @@ -97,7 +97,7 @@ en: hello: "Hello world" ``` -This means, that in the `:en` locale, the key _hello_ will map to the _Hello world_ string. Every string inside Rails is internationalized in this way, see for instance Active Record validation messages in the [`activerecord/lib/active_record/locale/en.yml`](https://github.com/rails/rails/blob/master/activerecord/lib/active_record/locale/en.yml) file or time and date formats in the [`activesupport/lib/active_support/locale/en.yml`](https://github.com/rails/rails/blob/master/activesupport/lib/active_support/locale/en.yml) file. You can use YAML or standard Ruby Hashes to store translations in the default (Simple) backend. +This means, that in the `:en` locale, the key _hello_ will map to the _Hello world_ string. Every string inside Rails is internationalized in this way, see for instance Active Model validation messages in the [`activemodel/lib/active_model/locale/en.yml`](https://github.com/rails/rails/blob/master/activemodel/lib/active_model/locale/en.yml) file or time and date formats in the [`activesupport/lib/active_support/locale/en.yml`](https://github.com/rails/rails/blob/master/activesupport/lib/active_support/locale/en.yml) file. You can use YAML or standard Ruby Hashes to store translations in the default (Simple) backend. The I18n library will use **English** as a **default locale**, i.e. if you don't set a different locale, `:en` will be used for looking up translations. diff --git a/guides/source/migrations.md b/guides/source/migrations.md index e6d1e71f5e..6100fc89c8 100644 --- a/guides/source/migrations.md +++ b/guides/source/migrations.md @@ -829,8 +829,7 @@ which contains a `Product` model: Bob goes on vacation. Alice creates a migration for the `products` table which adds a new column and -initializes it. She also adds a validation to the `Product` model for the new -column. +initializes it: ```ruby # db/migrate/20100513121110_add_flag_to_product.rb @@ -845,6 +844,8 @@ class AddFlagToProduct < ActiveRecord::Migration end ``` +She also adds a validation to the `Product` model for the new column: + ```ruby # app/models/product.rb @@ -853,9 +854,8 @@ class Product < ActiveRecord::Base end ``` -Alice adds a second migration which adds and initializes another column to the -`products` table and also adds a validation to the `Product` model for the new -column. +Alice adds a second migration which adds another column to the `products` +table and initializes it: ```ruby # db/migrate/20100515121110_add_fuzz_to_product.rb @@ -870,6 +870,8 @@ class AddFuzzToProduct < ActiveRecord::Migration end ``` +She also adds a validation to the `Product` model for the new column: + ```ruby # app/models/product.rb @@ -903,7 +905,7 @@ A fix for this is to create a local model within the migration. This keeps Rails from running the validations, so that the migrations run to completion. When using a local model, it's a good idea to call -`Product.reset_column_information` to refresh the `ActiveRecord` cache for the +`Product.reset_column_information` to refresh the Active Record cache for the `Product` model prior to updating data in the database. If Alice had done this instead, there would have been no problem: @@ -956,7 +958,7 @@ other product attributes. These migrations run just fine, but when Bob comes back from his vacation and calls `rake db:migrate` to run all the outstanding migrations, he gets a subtle bug: The descriptions have defaults, and the `fuzz` column is present, -but `fuzz` is nil on all products. +but `fuzz` is `nil` on all products. The solution is again to use `Product.reset_column_information` before referencing the Product model in a migration, ensuring the Active Record's diff --git a/guides/source/security.md b/guides/source/security.md index ad0546810d..e4db26c64e 100644 --- a/guides/source/security.md +++ b/guides/source/security.md @@ -93,7 +93,7 @@ Rails 2 introduced a new default session storage, CookieStore. CookieStore saves * The client can see everything you store in a session, because it is stored in clear-text (actually Base64-encoded, so not encrypted). So, of course, _you don't want to store any secrets here_. To prevent session hash tampering, a digest is calculated from the session with a server-side secret and inserted into the end of the cookie. -That means the security of this storage depends on this secret (and on the digest algorithm, which defaults to SHA512, which has not been compromised, yet). So _don't use a trivial secret, i.e. a word from a dictionary, or one which is shorter than 30 characters_. +That means the security of this storage depends on this secret (and on the digest algorithm, which defaults to SHA1, for compatibility). So _don't use a trivial secret, i.e. a word from a dictionary, or one which is shorter than 30 characters_. `config.secret_key_base` is used for specifying a key which allows sessions for the application to be verified against a known secure key to prevent tampering. Applications get `config.secret_key_base` initialized to a random key in `config/initializers/secret_token.rb`, e.g.: |