| Commit message (Collapse) | Author | Age | Files | Lines |
... | |
| | |
|
| | |
|
| |\
| | |
| | |
| | | |
3-2-stable: add ruby 2.2 compatibility
|
| | |
| | |
| | |
| | | |
https://github.com/ruby/ruby/commit/d781caaf313b8649948c107bba277e5ad7307314
|
| |/
|/| |
|
|/ |
|
| |
|
|
|
|
|
|
|
|
|
| |
Conflicts:
actionpack/lib/action_dispatch/middleware/static.rb
make sure that unreadable files are also not leaked
CVE-2014-7829
|
|\
| |
| |
| |
| |
| | |
* 3.2.20:
bumping version to 3.2.20
FileHandler should not be called for files outside the root
|
| | |
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
FileHandler#matches? should return false for files that are outside the
"root" path.
Conflicts:
actionpack/lib/action_dispatch/middleware/static.rb
Conflicts:
actionpack/lib/action_dispatch/middleware/static.rb
actionpack/test/dispatch/static_test.rb
|
| |
| |
| |
| |
| |
| | |
Fixed broken test.
Thanks Stephen Richards for reporting.
|
|\| |
|
| | |
|
| |
| |
| |
| | |
Fix CVE-2014-3482.
|
|/ |
|
|
|
|
|
|
|
| |
Before this patch configuration set using config.active_support
would not be set.
Closes #15364
|
|
|
|
|
|
|
| |
This reverts commit 6d800a909e24465ca6f3fa5206222fa7d78967f6, reversing
changes made to 6a051299f98ee43864326c6c0a4f7d169d22b3f8.
We don't apply non-security fixes to 3-2-stable branch!!!
|
|\
| |
| | |
File.exists? is a deprecated name, use File.exist?
|
|/
|
| |
File.exists? is a deprecated name, use File.exist?
|
|
|
|
|
|
|
| |
I didn't want to do this, FNM_EXTGLOB is defined on 2.1.x, but Dir.glob
returns the wrong value on Ruby less than 2.2.0. Checking for a
case-insensitive FS seems too hard, so just check Ruby version Checking
for a case-insensitive FS seems too hard, so just check Ruby version.
|
| |
|
|
|
|
|
|
| |
this is due to:
https://bugs.ruby-lang.org/issues/5994
|
|\
| |
| |
| |
| | |
Conflicts:
actionpack/CHANGELOG.md
|
| | |
|
| | |
|
| |
| |
| |
| |
| |
| | |
This will avoid directory traversal in implicit render.
Fixes: CVE-2014-0130
|
|\|
| |
| |
| |
| | |
Conflicts:
actionpack/CHANGELOG.md
|
| | |
|
| |
| |
| |
| |
| |
| |
| |
| | |
Before we were calling to_sym in the mime type, even when it is unknown
what can cause denial of service since symbols are not removed by the
garbage collector.
Fixes: CVE-2014-0082
|
| |
| |
| |
| |
| |
| |
| | |
Previously the values of these options were trusted leading to
potential XSS vulnerabilities.
Fixes: CVE-2014-0081
|
|\ \
| | |
| | | |
Fix force_ssl.rb documentation. Close tt tag.
|
|/ /
| |
| | |
[ci skip]
|
|\ \
| | |
| | | |
Update Session Store Documentation
|
|/ /
| |
| | |
session_id doesn't need to be a text column, just string (VARCHAR)
|
| |
| |
| |
| |
| |
| |
| | |
Escalate missing error when :raise is true in translate helper, fix regression introduced by security fix.
Conflicts:
actionpack/CHANGELOG.md
|
| |
| |
| |
| |
| |
| | |
Now users have to explicit mark the unit as safe if they trust it.
Closes #13161
|
|\ \
| |/
|/| |
Repair a test broken by the number_to_currency XSS fix
|
|/ |
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
The previous implementation of this functionality could be accidentally
subverted by instantiating a raw Rack::Request before the first Rails::Request
was constructed.
Fixes CVE-2013-6417
Conflicts:
actionpack/lib/action_dispatch/http/request.rb
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
i18n doesn't depend on active support which means it can't use our html_safe
code to do its escaping when generating the spans. Rather than try to sanitize
the output from i18n, just revert to our old behaviour of rescuing the error
and constructing the tag ourselves.
Fixes: CVE-2013-4491
Conflicts:
actionpack/lib/action_view/helpers/translation_helper.rb
Backport: 50afd8eec9d088ad5a2d41f00a05520d5b78a6a0
|
|
|
|
|
|
| |
Fixes CVE-2013-6415
Previously the values were trusted blindly allowing for potential XSS attacks.
|
|
|
|
| |
CVE-2013-6414
|
|\
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
* 3-2-sec:
updating changelogs
bumping to 3.2.15
bumping to rc3
Revert "Merge pull request #12413 from arthurnn/inverse_of_on_build"
Revert "Merge pull request #12443 from arthurnn/add_inverse_of_add_target"
bumping to rc2
Merge pull request #12443 from arthurnn/add_inverse_of_add_target
bumping version to 3.2.15.rc1
Remove the use of String#% when formatting durations in log messages
Conflicts:
activerecord/CHANGELOG.md
|
| | |
|
| | |
|
| |\
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
* 3-2-15:
bumping to rc3
Revert "Merge pull request #12413 from arthurnn/inverse_of_on_build"
Revert "Merge pull request #12443 from arthurnn/add_inverse_of_add_target"
bumping to rc2
Merge pull request #12443 from arthurnn/add_inverse_of_add_target
bumping version to 3.2.15.rc1
Fix STI scopes using benolee's suggestion. Fixes #11939
|
| | | |
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
This reverts commit ccd11d58910059f07b28cc518dbdad42cbc8ea0c, reversing
changes made to 54c05acdba138f3a7a3d44dfc922b0fe4e4cf554.
Reason: This caused a regression when the associated record is created
in a before_create callback. See
https://github.com/rails/rails/pull/12413#issuecomment-25848163
|