diff options
Diffstat (limited to 'guides')
| -rw-r--r-- | guides/rails_guides/helpers.rb | 2 | ||||
| -rw-r--r-- | guides/source/action_view_overview.md | 69 | ||||
| -rw-r--r-- | guides/source/active_record_validations.md | 5 | ||||
| -rw-r--r-- | guides/source/association_basics.md | 5 | ||||
| -rw-r--r-- | guides/source/getting_started.md | 27 | ||||
| -rw-r--r-- | guides/source/i18n.md | 2 | ||||
| -rw-r--r-- | guides/source/layouts_and_rendering.md | 6 | ||||
| -rw-r--r-- | guides/source/security.md | 2 |
8 files changed, 32 insertions, 86 deletions
diff --git a/guides/rails_guides/helpers.rb b/guides/rails_guides/helpers.rb index a288d0f0f4..760b196abd 100644 --- a/guides/rails_guides/helpers.rb +++ b/guides/rails_guides/helpers.rb @@ -17,7 +17,7 @@ module RailsGuides end def documents_flat - documents_by_section.map {|section| section['documents']}.flatten + documents_by_section.flat_map {|section| section['documents']} end def finished_documents(documents) diff --git a/guides/source/action_view_overview.md b/guides/source/action_view_overview.md index 3542844f33..6fce5a1dc2 100644 --- a/guides/source/action_view_overview.md +++ b/guides/source/action_view_overview.md @@ -1542,72 +1542,3 @@ end Then you could create special views like `app/views/posts/show.expert.html.erb` that would only be displayed to expert users. You can read more about the Rails Internationalization (I18n) API [here](i18n.html). - -Using Action View outside of Rails ----------------------------------- - -Action View is a Rails component, but it can also be used without Rails. We can demonstrate this by creating a small [Rack](http://rack.rubyforge.org/) application that includes Action View functionality. This may be useful, for example, if you'd like access to Action View's helpers in a Rack application. - -Let's start by ensuring that you have the Action Pack and Rack gems installed: - -```bash -$ gem install actionpack -$ gem install rack -``` - -Now we'll create a simple "Hello World" application that uses the `titleize` method provided by Active Support. - -**hello_world.rb:** - -```ruby -require 'active_support/core_ext/string/inflections' -require 'rack' - -def hello_world(env) - [200, {"Content-Type" => "text/html"}, "hello world".titleize] -end - -Rack::Handler::Mongrel.run method(:hello_world), Port: 4567 -``` - -We can see this all come together by starting up the application and then visiting `http://localhost:4567/` - -```bash -$ ruby hello_world.rb -``` - -TODO needs a screenshot? I have one - not sure where to put it. - -Notice how 'hello world' has been converted into 'Hello World' by the `titleize` helper method. - -Action View can also be used with [Sinatra](http://www.sinatrarb.com/) in the same way. - -Let's start by ensuring that you have the Action Pack and Sinatra gems installed: - -```bash -$ gem install actionpack -$ gem install sinatra -``` - -Now we'll create the same "Hello World" application in Sinatra. - -**hello_world.rb:** - -```ruby -require 'action_view' -require 'sinatra' - -get '/' do - erb 'hello world'.titleize -end -``` - -Then, we can run the application: - -```bash -$ ruby hello_world.rb -``` - -Once the application is running, you can see Sinatra and Action View working together by visiting `http://localhost:4567/` - -TODO needs a screenshot? I have one - not sure where to put it. diff --git a/guides/source/active_record_validations.md b/guides/source/active_record_validations.md index d95b587e78..8154d4e1cc 100644 --- a/guides/source/active_record_validations.md +++ b/guides/source/active_record_validations.md @@ -243,7 +243,7 @@ line of code you can add the same kind of validation to several attributes. All of them accept the `:on` and `:message` options, which define when the validation should be run and what message should be added to the `errors` collection if it fails, respectively. The `:on` option takes one of the values -`:save` (the default), `:create` or `:update`. There is a default error +`:create` or `:update`. There is a default error message for each one of the validation helpers. These messages are used when the `:message` option isn't specified. Let's take a look at each one of the available helpers. @@ -765,10 +765,9 @@ class Person < ActiveRecord::Base validates :age, numericality: true, on: :update # the default (validates on both create and update) - validates :name, presence: true, on: :save + validates :name, presence: true end ``` -The last line is in review state and as of now, it is not running in any version of Rails 3.2.x as discussed in this [issue](https://github.com/rails/rails/issues/10248) Strict Validations ------------------ diff --git a/guides/source/association_basics.md b/guides/source/association_basics.md index e6a66f3fa1..9b80a65a44 100644 --- a/guides/source/association_basics.md +++ b/guides/source/association_basics.md @@ -1944,8 +1944,8 @@ While Rails uses intelligent defaults that will work well in most situations, th ```ruby class Parts < ActiveRecord::Base - has_and_belongs_to_many :assemblies, uniq: true, - read_only: true + has_and_belongs_to_many :assemblies, autosave: true, + readonly: true end ``` @@ -1957,6 +1957,7 @@ The `has_and_belongs_to_many` association supports these options: * `:foreign_key` * `:join_table` * `:validate` +* `:readonly` ##### `:association_foreign_key` diff --git a/guides/source/getting_started.md b/guides/source/getting_started.md index 58bf8bbe90..12eb88f018 100644 --- a/guides/source/getting_started.md +++ b/guides/source/getting_started.md @@ -155,7 +155,7 @@ To begin with, let's get some text up on screen quickly. To do this, you need to ### Starting up the Web Server -You actually have a functional Rails application already. To see it, you need to start a web server on your development machine. You can do this by running: +You actually have a functional Rails application already. To see it, you need to start a web server on your development machine. You can do this by running the following in the root directory of your rails application: ```bash $ rails server @@ -416,7 +416,7 @@ edit_post GET /posts/:id/edit(.:format) posts#edit The `posts_path` helper tells Rails to point the form to the URI Pattern associated with the `posts` prefix; and the form will (by default) send a `POST` request -to that route. This is associated with the +to that route. This is associated with the `create` action of the current controller, the `PostsController`. With the form and its associated route defined, you will be able to fill in the form and then click the submit button to begin the process of creating a new post, so go ahead and do that. When you submit the form, you should see a familiar error: @@ -553,7 +553,7 @@ and change the `create` action to look like this: ```ruby def create @post = Post.new(params[:post]) - + @post.save redirect_to @post end @@ -621,9 +621,9 @@ it! You should get an error that looks like this: Rails has several security features that help you write secure applications, and you're running into one of them now. This one is called -'strong_parameters,' which requires us to tell Rails exactly which parameters +`strong_parameters`, which requires us to tell Rails exactly which parameters we want to accept in our controllers. In this case, we want to allow the -'title' and 'text' parameters, so change your `create` controller action to +`title` and `text` parameters, so change your `create` controller action to look like this: ``` @@ -1039,7 +1039,7 @@ content: ``` Everything except for the `form_for` declaration remained the same. -The reason we can use this shorter, simpler `form_for` declaration +The reason we can use this shorter, simpler `form_for` declaration to stand in for either of the other forms is that `@post` is a *resource* corresponding to a full set of RESTful routes, and Rails is able to infer which URI and method to use. @@ -1616,6 +1616,8 @@ end Security -------- +### Basic Authentication + If you were to publish your blog online, anybody would be able to add, edit and delete posts or delete comments. @@ -1663,6 +1665,19 @@ Authentication challenge  +Other authentication methods are available for Rails applications. Two popular +authentication add-ons for Rails are the [Devise](https://github.com/plataformatec/devise) +rails engine and the [Authlogic](https://github.com/binarylogic/authlogic) gem, +along with a number of others. + + +### Other Security Considerations + +Security, especially in web applications, is a broad and detailed area. Security +in your Rails application is covered in more depth in +The [Ruby on Rails Security Guide](security.html) + + What's Next? ------------ diff --git a/guides/source/i18n.md b/guides/source/i18n.md index a20e82931d..facfb96d98 100644 --- a/guides/source/i18n.md +++ b/guides/source/i18n.md @@ -97,7 +97,7 @@ en: hello: "Hello world" ``` -This means, that in the `:en` locale, the key _hello_ will map to the _Hello world_ string. Every string inside Rails is internationalized in this way, see for instance Active Record validation messages in the [`activerecord/lib/active_record/locale/en.yml`](https://github.com/rails/rails/blob/master/activerecord/lib/active_record/locale/en.yml file or time and date formats in the [`activesupport/lib/active_support/locale/en.yml`](https://github.com/rails/rails/blob/master/activesupport/lib/active_support/locale/en.yml) file. You can use YAML or standard Ruby Hashes to store translations in the default (Simple) backend. +This means, that in the `:en` locale, the key _hello_ will map to the _Hello world_ string. Every string inside Rails is internationalized in this way, see for instance Active Model validation messages in the [`activemodel/lib/active_model/locale/en.yml`](https://github.com/rails/rails/blob/master/activemodel/lib/active_model/locale/en.yml) file or time and date formats in the [`activesupport/lib/active_support/locale/en.yml`](https://github.com/rails/rails/blob/master/activesupport/lib/active_support/locale/en.yml) file. You can use YAML or standard Ruby Hashes to store translations in the default (Simple) backend. The I18n library will use **English** as a **default locale**, i.e. if you don't set a different locale, `:en` will be used for looking up translations. diff --git a/guides/source/layouts_and_rendering.md b/guides/source/layouts_and_rendering.md index 5b6e5387ff..b5d66d08ba 100644 --- a/guides/source/layouts_and_rendering.md +++ b/guides/source/layouts_and_rendering.md @@ -375,9 +375,9 @@ Rails understands both numeric status codes and the corresponding symbols shown | | 423 | :locked | | | 424 | :failed_dependency | | | 426 | :upgrade_required | -| | 423 | :precondition_required | -| | 424 | :too_many_requests | -| | 426 | :request_header_fields_too_large | +| | 428 | :precondition_required | +| | 429 | :too_many_requests | +| | 431 | :request_header_fields_too_large | | **Server Error** | 500 | :internal_server_error | | | 501 | :not_implemented | | | 502 | :bad_gateway | diff --git a/guides/source/security.md b/guides/source/security.md index ad0546810d..e4db26c64e 100644 --- a/guides/source/security.md +++ b/guides/source/security.md @@ -93,7 +93,7 @@ Rails 2 introduced a new default session storage, CookieStore. CookieStore saves * The client can see everything you store in a session, because it is stored in clear-text (actually Base64-encoded, so not encrypted). So, of course, _you don't want to store any secrets here_. To prevent session hash tampering, a digest is calculated from the session with a server-side secret and inserted into the end of the cookie. -That means the security of this storage depends on this secret (and on the digest algorithm, which defaults to SHA512, which has not been compromised, yet). So _don't use a trivial secret, i.e. a word from a dictionary, or one which is shorter than 30 characters_. +That means the security of this storage depends on this secret (and on the digest algorithm, which defaults to SHA1, for compatibility). So _don't use a trivial secret, i.e. a word from a dictionary, or one which is shorter than 30 characters_. `config.secret_key_base` is used for specifying a key which allows sessions for the application to be verified against a known secure key to prevent tampering. Applications get `config.secret_key_base` initialized to a random key in `config/initializers/secret_token.rb`, e.g.: |