| Commit message (Collapse) | Author | Age | Files | Lines |
... | |
| | | | | | | | | |
| | | | | | | | | |
| | | | | | | | | |
| | | | | | | | | |
| | | | | | | | | |
| | | | | | | | | |
| | | | | | | | | |
| | | | | | | | | |
| | | | | | | | | |
| | | | | | | | | | |
Most of this section was written from the time that render file: was the
default, before CVE-2016-0752.
This updates the guide to the Rails 6 `render file:` behaviour, moves it
to a more appropriate part of the file.
[ci skip]
|
| |_|_|_|/ / / / /
|/| | | | | | | |
| | | | | | | | |
| | | | | | | | |
| | | | | | | | |
| | | | | | | | |
| | | | | | | | |
| | | | | | | | |
| | | | | | | | |
| | | | | | | | |
| | | | | | | | |
| | | | | | | | |
| | | | | | | | | |
Most of these examples no longer work. The ability to render an absolute
path was removed as part of CVE-2016-0752. In Rails 6 we changed `render
file:` to only take exact paths and always to render them as raw files.
Rendering a template with its extensions _is_ supported, but I don't
think should be recommended.
This also removes `render file:` from an example where it isn't
relevant.
[ci skip]
|
| | | | | | | | | |
|
| | | | | | | | | |
|
| |_|/ / / / / /
|/| | | | | | | |
|
| | | | | | | | |
|
| | | | | | | | |
|
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | | |
active_support/rails.rb
|
| | | | | | | | |
|
| | | | | | | | |
|
| | | | | | | | |
|
| | | | | | | | |
|
| | | | | | | | |
|
| | | | | | | | |
|
| | | | | | | | |
|
| | | | | | | | |
|
| | | | | | | | |
|
| | | | | | | | |
|
|/ / / / / / / |
|
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | | |
It doesn't work as indentation preperly.
https://github.com/rails/rails/blob/ba7634d304008a4e6170fd701a2b7e75e1d83aea/activesupport/CHANGELOG.md
|
|\ \ \ \ \ \ \
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | | |
giraffate/fix_exists_with_distinct_and_offset_and_order_in_postgresql
Fix `relation.exists?` with giving `distinct`, `offset` and `order` for joined table
|
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | | |
joined table
The error happens in PostgreSQL when using `relation.exists?` with
`distinct`, `offset` and `order` for joined table.
However, the error does not happen if either `distinct` or `offset` is
removed. This behavior is confusing.
Fixes #36632
|
|\ \ \ \ \ \ \ \
| | | | | | | | |
| | | | | | | | | |
MySQL: Check error number instead of a message
|
| |/ / / / / / /
| | | | | | | |
| | | | | | | |
| | | | | | | | |
To be able to check regardless of locale.
|
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | | |
A HTTP feature policy is Yet Another HTTP header for instructing the
browser about which features the application intends to make use of and
to lock down access to others. This is a new security mechanism that
ensures that should an application become compromised or a third party
attempts an unexpected action, the browser will override it and maintain
the intended UX.
WICG specification: https://wicg.github.io/feature-policy/
The end result is a HTTP header that looks like the following:
```
Feature-Policy: geolocation 'none'; autoplay https://example.com
```
This will prevent the browser from using geolocation and only allow
autoplay on `https://example.com`. Full feature list can be found over
in the WICG repository[1].
As of today Chrome and Safari have public support[2] for this
functionality with Firefox working on support[3] and Edge still pending
acceptance of the suggestion[4].
#### Examples
Using an initializer
```rb
# config/initializers/feature_policy.rb
Rails.application.config.feature_policy do |f|
f.geolocation :none
f.camera :none
f.payment "https://secure.example.com"
f.fullscreen :self
end
```
In a controller
```rb
class SampleController < ApplicationController
def index
feature_policy do |f|
f.geolocation "https://example.com"
end
end
end
```
Some of you might realise that the HTTP feature policy looks pretty
close to that of a Content Security Policy; and you're right. So much so
that I used the Content Security Policy DSL from #31162 as the starting
point for this change.
This change *doesn't* introduce support for defining a feature policy on
an iframe and this has been intentionally done to split the HTTP header
and the HTML element (`iframe`) support. If this is successful, I'll
look to add that on it's own.
Full documentation on HTTP feature policies can be found at
https://wicg.github.io/feature-policy/. Google have also published[5] a
great in-depth write up of this functionality.
[1]: https://github.com/WICG/feature-policy/blob/master/features.md
[2]: https://www.chromestatus.com/feature/5694225681219584
[3]: https://bugzilla.mozilla.org/show_bug.cgi?id=1390801
[4]: https://wpdev.uservoice.com/forums/257854-microsoft-edge-developer/suggestions/33507907-support-feature-policy
[5]: https://developers.google.com/web/updates/2018/06/feature-policy
|
|\ \ \ \ \ \ \ \
| | | | | | | | |
| | | | | | | | | |
Share the Arel dispatch cache between connections
|
| | | | | | | | | |
|
|\ \ \ \ \ \ \ \ \
| | | | | | | | | |
| | | | | | | | | | |
Share the column and table name quote cache between connections
|
| |/ / / / / / / / |
|
|\ \ \ \ \ \ \ \ \
| |_|_|_|_|_|_|/ /
|/| | | | | | | | |
Fix query cache when using shared connections
|
| | | | | | | | |
| | | | | | | | |
| | | | | | | | |
| | | | | | | | |
| | | | | | | | | |
Enables the query cache on the correct connection when
shared connections across threads are enabled
|
| | | | | | | | | |
|
| |_|/ / / / / /
|/| | | | | | | |
|
| | | | | | | | |
|
| | | | | | | | |
|
| |/ / / / / /
|/| | | | | |
| | | | | | |
| | | | | | | |
This is a first draft only, needs polishing for final.
|
|\ \ \ \ \ \ \
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | | |
y-yagi/make_setup_works_when_using_with_locales_other_than_en
Make "bin/setup" works when using PostgreSQL with locales other than en locale
|
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | | |
The PostgreSQL adapter uses an error message to determine if a database
exists or not.
https://github.com/rails/rails/blob/74ef67b16de67d2ae2f996e50a18a93aebf68fe6/activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb#L49
However, this message is properly converted according to the locale.
So this check does not work correctly for non-en locales.
As a result, `db:prepare` cannot correctly determine if a database exists, and
`bin/setup`, which depends on the task, does not work correctly if the database
does not exist.
It checks to exist if the "does not exist" exists, but that message is also
used in other error messages(e.g. "role does not exist"). So cannot check
correctly also in en locale.
https://github.com/postgres/postgres/blob/master/src/backend/po/ja.po#L10542
It would be fine could check the status, but in my understanding, when a connecting
fails, only the status `CONNECTION_BAD` be used, and it seems that details cannot
be checked.
https://www.postgresql.org/docs/11/libpq-status.html#LIBPQ-PQSTATUS
I fixed to check whether the error message contains a database
name. This is probably not accurate but can check it better now.
|
|\ \ \ \ \ \ \ \
| | | | | | | | |
| | | | | | | | |
| | | | | | | | |
| | | | | | | | | |
update example url for add_source
[ci skip]
|
| | |_|_|_|_|_|/
| |/| | | | | |
| | | | | | | | |
http://code.whytheluckystiff.net is now just a spam site. Use http://gems.github.com as an example instead.
|
|\ \ \ \ \ \ \ \
| |/ / / / / / /
|/| | | | | | |
| | | | | | | |
| | | | | | | | |
Fix indentation 💇♀️
[ci skip]
|
|/ / / / / / /
| | | | | | |
| | | | | | | |
Ref https://github.com/rails/rails/pull/36621#discussion_r301208961
|
|\ \ \ \ \ \ \
| |_|_|_|/ / /
|/| | | | | | |
Add database_exists? method to connection adapters
|
| |\ \ \ \ \ \
| |/ / / / / /
|/| | | | | | |
|
|\ \ \ \ \ \ \
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | | |
wjessop/fix_database_url_trampling_other_env_configs
When DATABASE_URL is specified don't trample envs that use a url: key
|
|/ / / / / / /
| | | | | | |
| | | | | | |
| | | | | | | |
fixes #36610
|
|\ \ \ \ \ \ \
| | | | | | | |
| | | | | | | | |
Do not use aliases in GROUP BY clause
|
| | |/ / / / /
| |/| | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | | |
It appears that Oracle does not allow using aliases in GROUP BY clause
unlike ORDER BY clause.
Fixes #36613.
|
| |_|/ / / /
|/| | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
Fixes that file attachments without captions would not be represented in plain text generated from rich-text content, causing ActionText::RichText#present? to return false.
Closes #36607.
|
|/ / / / /
| | | | |
| | | | |
| | | | |
| | | | | |
It is for agnostic test case, since quoted table name may include `.`
for all adapters, and `[` / `]` for sqlserver adapter.
|