aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Merge branch '3-2-17' into 3-2-stableRafael Mendonça França2014-02-1814-12/+103
|\ | | | | | | | | Conflicts: actionpack/CHANGELOG.md
| * Preparing for 3.2.17 releaseRafael Mendonça França2014-02-1810-9/+19
| |
| * Use the reference for the mime type to get the formatRafael Mendonça França2014-02-182-1/+18
| | | | | | | | | | | | | | | | Before we were calling to_sym in the mime type, even when it is unknown what can cause denial of service since symbols are not removed by the garbage collector. Fixes: CVE-2014-0082
| * Escape format, negative_format and units options of number helpersRafael Mendonça França2014-02-182-1/+64
| | | | | | | | | | | | | | Previously the values of these options were trusted leading to potential XSS vulnerabilities. Fixes: CVE-2014-0081
* | Merge pull request #13613 from simi/patch-1Damien Mathieu2014-01-061-1/+1
|\ \ | | | | | | Fix force_ssl.rb documentation. Close tt tag.
| * | Fix force_ssl.rb documentation. Close tt tag.Josef Šimánek2014-01-061-1/+1
|/ / | | | | [ci skip]
* | Merge pull request #13315 from tyre/patch-1Rafael Mendonça França2013-12-131-1/+1
|\ \ | | | | | | Update Session Store Documentation
| * | Update Session Store DocumentationChris Maddox2013-12-131-1/+1
|/ / | | | | session_id doesn't need to be a text column, just string (VARCHAR)
* | Merge pull request #13183 from sorah/never_ignore_i18n_translate_raise_optionCarlos Antonio da Silva2013-12-043-1/+24
| | | | | | | | | | | | | | Escalate missing error when :raise is true in translate helper, fix regression introduced by security fix. Conflicts: actionpack/CHANGELOG.md
* | Fix documentation of number_to_currency helperRafael Mendonça França2013-12-042-5/+5
| | | | | | | | | | | | Now users have to explicit mark the unit as safe if they trust it. Closes #13161
* | Merge pull request #13162 from makandra/3-2-stableRafael Mendonça França2013-12-041-4/+4
|\ \ | |/ |/| Repair a test broken by the number_to_currency XSS fix
| * repair a test broken by the number_to_currency XSS fixTobias Kraze2013-12-041-4/+4
|/
* updating the changelogAaron Patterson2013-12-0210-9/+17
|
* Deep Munge the parameters for GET and POSTMichael Koziarski2013-12-022-2/+17
| | | | | | | | | | | The previous implementation of this functionality could be accidentally subverted by instantiating a raw Rack::Request before the first Rails::Request was constructed. Fixes CVE-2013-6417 Conflicts: actionpack/lib/action_dispatch/http/request.rb
* Stop using i18n's built in HTML error handling.Michael Koziarski2013-12-022-14/+9
| | | | | | | | | | | | | | i18n doesn't depend on active support which means it can't use our html_safe code to do its escaping when generating the spans. Rather than try to sanitize the output from i18n, just revert to our old behaviour of rescuing the error and constructing the tag ourselves. Fixes: CVE-2013-4491 Conflicts: actionpack/lib/action_view/helpers/translation_helper.rb Backport: 50afd8eec9d088ad5a2d41f00a05520d5b78a6a0
* Escape the unit value provided to number_to_currencyMichael Koziarski2013-12-022-4/+5
| | | | | | Fixes CVE-2013-6415 Previously the values were trusted blindly allowing for potential XSS attacks.
* Only use valid mime type symbols as cache keysAaron Patterson2013-11-301-0/+7
| | | | CVE-2013-6414
* Merge branch '3-2-sec' into 3-2-stableAaron Patterson2013-10-1619-21/+40
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 3-2-sec: updating changelogs bumping to 3.2.15 bumping to rc3 Revert "Merge pull request #12413 from arthurnn/inverse_of_on_build" Revert "Merge pull request #12443 from arthurnn/add_inverse_of_add_target" bumping to rc2 Merge pull request #12443 from arthurnn/add_inverse_of_add_target bumping version to 3.2.15.rc1 Remove the use of String#% when formatting durations in log messages Conflicts: activerecord/CHANGELOG.md
| * updating changelogsAaron Patterson2013-10-167-3/+19
| |
| * bumping to 3.2.15Aaron Patterson2013-10-159-9/+9
| |
| * Merge branch '3-2-15' into 3-2-secAaron Patterson2013-10-1516-28/+30
| |\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 3-2-15: bumping to rc3 Revert "Merge pull request #12413 from arthurnn/inverse_of_on_build" Revert "Merge pull request #12443 from arthurnn/add_inverse_of_add_target" bumping to rc2 Merge pull request #12443 from arthurnn/add_inverse_of_add_target bumping version to 3.2.15.rc1 Fix STI scopes using benolee's suggestion. Fixes #11939
| | * bumping to rc3Aaron Patterson2013-10-119-9/+9
| | |
| | * Revert "Merge pull request #12413 from arthurnn/inverse_of_on_build"Rafael Mendonça França2013-10-104-10/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit ccd11d58910059f07b28cc518dbdad42cbc8ea0c, reversing changes made to 54c05acdba138f3a7a3d44dfc922b0fe4e4cf554. Reason: This caused a regression when the associated record is created in a before_create callback. See https://github.com/rails/rails/pull/12413#issuecomment-25848163
| | * Revert "Merge pull request #12443 from arthurnn/add_inverse_of_add_target"Rafael Mendonça França2013-10-102-14/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 7ed5bdc834479c39e3b0ad5a38bcffe27983c10d, reversing changes made to 31c79e291f42b1d862df06c552fe002864aae705. Reason: this caused a regression when the associated record is creted in a before_create callback. See https://github.com/rails/rails/pull/12413#issuecomment-25848163
| | * bumping to rc2Aaron Patterson2013-10-049-9/+9
| | |
| | * Merge pull request #12443 from arthurnn/add_inverse_of_add_targetRafael Mendonça França2013-10-042-0/+14
| | | | | | | | | | | | Add inverse of add target
| | * bumping version to 3.2.15.rc1Aaron Patterson2013-10-039-17/+17
| | |
| * | Merge branch '3-2-stable' into 3-2-secAaron Patterson2013-10-037-3/+29
| |\ \ | | | | | | | | | | | | | | | | | | | | * 3-2-stable: make sure both headers are set before checking for ip spoofing Move set_inverse_instance to association.build_record
| * | | Remove the use of String#% when formatting durations in log messagesMichael Koziarski2013-09-303-9/+12
| | | | | | | | | | | | | | | | | | | | This avoids potential format string vulnerabilities where user-provided data is interpolated into the log message before String#% is called.
* | | | Revert "Merge pull request #12413 from arthurnn/inverse_of_on_build"Rafael Mendonça França2013-10-104-10/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit ccd11d58910059f07b28cc518dbdad42cbc8ea0c, reversing changes made to 54c05acdba138f3a7a3d44dfc922b0fe4e4cf554. Reason: This caused a regression when the associated record is created in a before_create callback. See https://github.com/rails/rails/pull/12413#issuecomment-25848163
* | | | Revert "Merge pull request #12443 from arthurnn/add_inverse_of_add_target"Rafael Mendonça França2013-10-102-14/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 7ed5bdc834479c39e3b0ad5a38bcffe27983c10d, reversing changes made to 31c79e291f42b1d862df06c552fe002864aae705. Reason: this caused a regression when the associated record is creted in a before_create callback. See https://github.com/rails/rails/pull/12413#issuecomment-25848163
* | | | Merge pull request #12443 from arthurnn/add_inverse_of_add_targetRafael Mendonça França2013-10-042-0/+14
|\ \ \ \ | |_|_|/ |/| | | Add inverse of add target
| * | | add regression test for set_inverse_instance on add_to_targetArthur Neves2013-10-041-0/+13
| | | |
| * | | Add back set_inverse_instance on .add_to_targetArthur Neves2013-10-041-0/+1
|/ / / | | | | | | | | | | | | We must have it in there too, so when an existent record is being concat to another, we will have the inverse relation.
* | | Merge pull request #12084 from Ben-M/3-2-stableAaron Patterson2013-10-033-1/+11
|\ \ \ | |_|/ |/| | Fix STI scopes using benolee's suggestion. Fixes #11939
| * | Fix STI scopes using benolee's suggestion. Fixes #11939Ben Maraney2013-08-303-1/+11
| | |
* | | Merge pull request #12410 from tamird/fix-ip-spoof-errorsAndrew White2013-10-013-1/+19
|\ \ \ | | | | | | | | Fix ip spoof errors
| * | | make sure both headers are set before checking for ip spoofingTamir Duberstein2013-10-013-1/+19
|/ / /
* | | Merge pull request #12413 from arthurnn/inverse_of_on_buildRafael Mendonça França2013-09-304-2/+10
|\ \ \ | |_|/ |/| | Inverse of on build
| * | Move set_inverse_instance to association.build_recordArthur Neves2013-09-304-2/+10
|/ / | | | | | | [fixes #10371]
* | Merge pull request #12375 from arthurnn/inverse_after_find_or_initializeRafael Mendonça França2013-09-283-4/+22
|\ \ | | | | | | Inverse after find or initialize
| * | fix inverse_of when find_or_initialize_by_*Arthur Neves2013-09-263-4/+22
| | | | | | | | | | | | | | | inverse_of relation was not being set when calling find_or_initialize_by_ and the entry was found on the db.
* | | Use Ruby 1.8 hash syntaxRafael Mendonça França2013-09-281-2/+2
|/ /
* | Merge pull request #12364 from arthurnn/test_fix_validateRafael Mendonça França2013-09-252-2/+5
|\ \ | | | | | | Fix query counters when testing with IdentityMap on 3.2
| * | on tests: dont always touch firm on validateArthur Neves2013-09-252-2/+5
|/ /
* | Merge pull request #12359 from arthurnn/inverse_on_callbacksRafael Mendonça França2013-09-254-1/+18
| | | | | | | | | | | | | | Make sure inverse_of is visible on the has_many callbacks Conflicts: activerecord/CHANGELOG.md activerecord/test/models/company.rb
* | Merge pull request #12196 from h-lame/fix-activesupport-cache-filestore-cleanupRafael Mendonça França2013-09-123-1/+18
| | | | | | | | | | | | | | Fix FileStore#cleanup to no longer rely on missing each_key method Conflicts: activesupport/CHANGELOG.md activesupport/test/caching_test.rb
* | Fix FinderMethods#last unscoped primary keyEugene Kalenkovich2013-09-124-3/+21
| | | | | | | | | | | | | | | | Fixes table.joins(:relation).last(N) breaking on sqlite Conflicts: activerecord/CHANGELOG.md activerecord/test/cases/finder_test.rb
* | Merge pull request #9368 from CrowdFlower/3-2-stableSteve Klabnik2013-09-104-4/+25
|\ \ | | | | | | PR #5219 backported to 3-2
| * | pass the extra params to the rack test environment so that routes with block ↵Brian Hahn2013-09-064-4/+25
| |/ | | | | | | constraints have access
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-07 22:50:06 +0000