| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| ... | |
| |\ \ \ \ \ \ \ \ \
| | | | | | | | | |
| | | | | | | | | | |
Update sucker_punch adapter's description
|
| | | |_|_|_|_|/ / /
| |/| | | | | | |
| | | | | | | | |
| | | | | | | | | |
[ci skip]
|
| | | | | | | | | |
| | | | | | | | |
| | | | | | | | |
| | | | | | | | |
| | | | | | | | |
| | | | | | | | |
| | | | | | | | |
| | | | | | | | | |
Remove nonsense definition of == from `AcceptItem`. The definition only
compared names and not `q` values or even object identity. The only use
was in the `assort!` method that really just wanted the index of the
item given the item's name. Instead we just change the caller to use
`index` with the block form.
|
| | | | | | | | | |
| | | | | | | | |
| | | | | | | | |
| | | | | | | | |
| | | | | | | | | |
This commit refactors the private methods that were just aliases to []
to just directly use [] and cache the return values on the stack.
|
| | | | | | | | | |
| | | | | | | | |
| | | | | | | | |
| | | | | | | | |
| | | | | | | | | |
same strategy as `@text_xml_idx`: cache it on the stack to avoid ivar
lookups and the `||=` call.
|
| |/ / / / / / / /
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | | |
this eliminates the ivar lookup and also eliminates the `||=`
conditional that happens every time we called the `text_xml_idx` method.
|
| | | | | | | | | |
|
| |\ \ \ \ \ \ \ \
| | | | | | | | |
| | | | | | | | | |
Update ActiveJob adapter for sucker_punch 2.0
|
| | | |_|_|_|_|_|/
| |/| | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | | |
This PR includes two changes for 2.0.0:
- Breaking API change around `async.perform` --> `perform_async`
- New addition of `perform_in`, which now allows end users of the
adapter to use the `enqueued_at` public API method.
|
| | | | | | | | | |
|
| |\ \ \ \ \ \ \ \
| | | | | | | | |
| | | | | | | | | |
Fix img alt attribute generation when using Sprockets >= 3.0
|
| | | | | | | | | | |
|
| |\ \ \ \ \ \ \ \ \
| | | | | | | | | |
| | | | | | | | | | |
Fix typo in strong params hash deprecation message
|
| |/ / / / / / / / /
| | | | | | | | |
| | | | | | | | | |
and remove unecessary spaces in string interpolation.
|
| |/ / / / / / / /
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | | |
The commit which originally added this behavior did not consider that
doing `Subclass.new` does not actually populate the `type` field in the
attributes (though perhaps it should). We simply need to not use the
defaults for STI related things unless we are instantiating the base
class.
Fixes #23285.
|
| |\ \ \ \ \ \ \ \
| | | | | | | | |
| | | | | | | | | |
Fix small typos in asset_pipeline.md
|
| |/ / / / / / / / |
|
| |\ \ \ \ \ \ \ \
| | | | | | | | |
| | | | | | | | | |
Improvement in ActiveRecord::Persistence doc [ci skip]
|
| | | | | | | | | | |
|
| |\ \ \ \ \ \ \ \ \
| | | | | | | | | |
| | | | | | | | | | |
Fix doc
|
| |/ / / / / / / / / |
|
| |\ \ \ \ \ \ \ \ \
| | | | | | | | | |
| | | | | | | | | | |
Revert "Eliminate the EventMachine dependency"
|
| |/ / / / / / / / / |
|
| |\ \ \ \ \ \ \ \ \
| |_|_|/ / / / / /
|/| | | | | | | | |
remove duplication section [ci skip]
|
| | | |/ / / / / /
| |/| | | | | | |
|
| | | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | | |
[ci skip]
|
| |/ / / / / / /
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | | |
We found that inserting all 600 schema_migrations for our mid-sized app takes about a minute on a cloud based CI environment.
I assume that the original code did not use multi-row-insert because SQLite3 was not supporting the syntax back then,
but it's been supported since 3.7.11: http://www.sqlite.org/releaselog/3_7_11.html
|
| | | | | | | | |
|
| | | | | | | | |
|
| |\ \ \ \ \ \ \
| | | | | | | |
| | | | | | | | |
Fix undefined error for `ActionController::Parameters`
|
| | | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | | |
These tests were failing due to backwards incompatible changes, as apart
of the v1.0.3 release of rails-html-sanitizer.
|
| | | |_|/ / / /
| |/| | | | | |
|
| | | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | | |
The cache for `render file:` seems to also be used in the case of
`render(string)`. If one is supposed to be a hit and the other is
supposed to be a miss, and they both reference the same file, then the
cache could return incorrect values. This commit clears the cache
between runs so that we get non-cached behavior.
|
| |\ \ \ \ \ \ \
| | | | | | | |
| | | | | | | | |
documentation fix
|
| | | | | | | | | |
|
| |\ \ \ \ \ \ \ \
| | | | | | | | |
| | | | | | | | | |
[ci skip] Don’t explicitly mention EventMachine
|
| |/ / / / / / / /
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | | |
Since #23152 eliminated the EventMachine dependency, we don’t need to
explicitly mention EventMachine.
Nevertheless, I'm not 100% sure about saying "the websocket-driver loop"
driver… any suggestions, @matthewd or @pixeltrix ? :sweat_smile:
[ci skip]
|
| |\ \ \ \ \ \ \ \
| |_|/ / / / / /
|/| | | | | | | |
Update `Gemfile.lock`
|
| |/ / / / / / / |
|
| |\ \ \ \ \ \ \
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | | |
* 5-0-beta-sec:
bumping version
fix version update task to deal with .beta1.1
Eliminate instance level writers for class accessors
allow :file to be outside rails root, but anything else must be inside the rails view directory
Don't short-circuit reject_if proc
stop caching mime types globally
use secure string comparisons for basic auth username / password
|
| | | | | | | | | |
|
| | | | | | | | | |
|
| | | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | | |
Instance level writers can have an impact on how the Active Model /
Record objects are saved. Specifically, they can be used to bypass
validations. This is a problem if mass assignment protection is
disabled and specific attributes are passed to the constructor.
CVE-2016-0753
|
| | | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | | |
rails view directory
CVE-2016-0752
|
| | | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | | |
When updating an associated record via nested attribute hashes the
reject_if proc could be bypassed if the _destroy flag was set in the
attribute hash and allow_destroy was set to false.
The fix is to only short-circuit if the _destroy flag is set and the
option allow_destroy is set to true. It also fixes an issue where
a new record wasn't created if _destroy was set and the option
allow_destroy was set to false.
CVE-2015-7577
|
| | | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | | |
Unknown mime types should not be cached globally. This global cache
leads to a memory leak and a denial of service vulnerability.
CVE-2016-0751
|
| | | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | |
| | | | | | | | |
this will avoid timing attacks against applications that use basic auth.
CVE-2015-7576
|
| |\ \ \ \ \ \ \ \
| | | | | | | | |
| | | | | | | | | |
Fix nodoc to internal class error document some of them
|
| | | | | | | | | |
| | | | | | | | |
| | | | | | | | |
| | | | | | | | |
| | | | | | | | |
| | | | | | | | |
| | | | | | | | | |
[ci skip]
Fixes #20808
[Vipul A M & Julio Lopez]
|
| |\ \ \ \ \ \ \ \ \
| | | | | | | | | |
| | | | | | | | | | |
[close #23009] Limit key length
|
