aboutsummaryrefslogtreecommitdiffstats
path: root/guides
diff options
context:
space:
mode:
Diffstat (limited to 'guides')
-rw-r--r--guides/source/4_2_release_notes.md6
-rw-r--r--guides/source/caching_with_rails.md7
-rw-r--r--guides/source/contributing_to_ruby_on_rails.md2
-rw-r--r--guides/source/generators.md15
-rw-r--r--guides/source/layouts_and_rendering.md2
-rw-r--r--guides/source/security.md8
6 files changed, 33 insertions, 7 deletions
diff --git a/guides/source/4_2_release_notes.md b/guides/source/4_2_release_notes.md
index a39dd9ace0..e8d1dc361a 100644
--- a/guides/source/4_2_release_notes.md
+++ b/guides/source/4_2_release_notes.md
@@ -94,6 +94,12 @@ Action Pack
Please refer to the [Changelog][action-pack] for detailed changes.
+### Removals
+
+* Removed deprecated `AbstractController::Helpers::ClassMethods::MissingHelperError`
+ in favor of `AbstractController::Helpers::MissingHelperError`.
+ ([Commit](https://github.com/rails/rails/commit/a1ddde15ae0d612ff2973de9cf768ed701b594e8))
+
### Deprecations
* Deprecated support for setting the `:to` option of a router to a symbol or a
diff --git a/guides/source/caching_with_rails.md b/guides/source/caching_with_rails.md
index 0902e347e2..d0f3a596fe 100644
--- a/guides/source/caching_with_rails.md
+++ b/guides/source/caching_with_rails.md
@@ -353,7 +353,12 @@ Instead of an options hash, you can also simply pass in a model, Rails will use
class ProductsController < ApplicationController
def show
@product = Product.find(params[:id])
- respond_with(@product) if stale?(@product)
+
+ if stale?(@product)
+ respond_to do |wants|
+ # ... normal response processing
+ end
+ end
end
end
```
diff --git a/guides/source/contributing_to_ruby_on_rails.md b/guides/source/contributing_to_ruby_on_rails.md
index 0b05725623..8bc4b10591 100644
--- a/guides/source/contributing_to_ruby_on_rails.md
+++ b/guides/source/contributing_to_ruby_on_rails.md
@@ -397,7 +397,7 @@ inside, just indent it with 4 spaces:
class ArticlesController
def index
- respond_with Article.limit(10)
+ render json: Article.limit(10)
end
end
diff --git a/guides/source/generators.md b/guides/source/generators.md
index 5e88fa0c70..2349908979 100644
--- a/guides/source/generators.md
+++ b/guides/source/generators.md
@@ -8,6 +8,7 @@ After reading this guide, you will know:
* How to see which generators are available in your application.
* How to create a generator using templates.
* How Rails searches for generators before invoking them.
+* How Rails internally generates Rails code from the templates.
* How to customize your scaffold by creating new generators.
* How to customize your scaffold by changing generator templates.
* How to use fallbacks to avoid overwriting a huge set of generators.
@@ -340,6 +341,20 @@ end
If you generate another resource, you can see that we get exactly the same result! This is useful if you want to customize your scaffold templates and/or layout by just creating `edit.html.erb`, `index.html.erb` and so on inside `lib/templates/erb/scaffold`.
+Many scaffold templates in Rails are written in ERB tags which needs to be escaped, so that the output is a valid ERB code, that can be used correctly in Rails app.
+
+The following code in one of the generator file,
+
+```ruby
+<%%= stylesheet_include_tag :application %>
+```
+
+when passed through the generator, would generate the following output.
+
+```ruby
+<%= stylesheet_include_tag :application %>
+```
+
Adding Generators Fallbacks
---------------------------
diff --git a/guides/source/layouts_and_rendering.md b/guides/source/layouts_and_rendering.md
index f00f7bca1b..8b37b92139 100644
--- a/guides/source/layouts_and_rendering.md
+++ b/guides/source/layouts_and_rendering.md
@@ -903,7 +903,7 @@ You can also specify multiple videos to play by passing an array of videos to th
This will produce:
```erb
-<video><source src="trailer.ogg" /><source src="movie.ogg" /></video>
+<video><source src="/videos/trailer.ogg" /><source src="/videos/trailer.flv" /></video>
```
#### Linking to Audio Files with the `audio_tag`
diff --git a/guides/source/security.md b/guides/source/security.md
index ebfcc5bdd0..125dd82666 100644
--- a/guides/source/security.md
+++ b/guides/source/security.md
@@ -118,9 +118,9 @@ It works like this:
* A user receives credits, the amount is stored in a session (which is a bad idea anyway, but we'll do this for demonstration purposes).
* The user buys something.
-* Their new, lower credit will be stored in the session.
-* The dark side of the user forces them to take the cookie from the first step (which they copied) and replace the current cookie in the browser.
-* The user has their credit back.
+* The new adjusted credit value is stored in the session.
+* The user takes the cookie from the first step (which they previously copied) and replaces the current cookie in the browser.
+* The user has their original credit back.
Including a nonce (a random value) in the session solves replay attacks. A nonce is valid only once, and the server has to keep track of all the valid nonces. It gets even more complicated if you have several application servers (mongrels). Storing nonces in a database table would defeat the entire purpose of CookieStore (avoiding accessing the database).
@@ -847,7 +847,7 @@ It is recommended to _use RedCloth in combination with a whitelist input filter_
NOTE: _The same security precautions have to be taken for Ajax actions as for "normal" ones. There is at least one exception, however: The output has to be escaped in the controller already, if the action doesn't render a view._
-If you use the [in_place_editor plugin](http://dev.rubyonrails.org/browser/plugins/in_place_editing), or actions that return a string, rather than rendering a view, _you have to escape the return value in the action_. Otherwise, if the return value contains a XSS string, the malicious code will be executed upon return to the browser. Escape any input value using the h() method.
+If you use the [in_place_editor plugin](https://rubygems.org/gems/in_place_editing), or actions that return a string, rather than rendering a view, _you have to escape the return value in the action_. Otherwise, if the return value contains a XSS string, the malicious code will be executed upon return to the browser. Escape any input value using the h() method.
### Command Line Injection