aboutsummaryrefslogtreecommitdiffstats
path: root/actionpack/CHANGELOG.md
Commit message (Collapse)AuthorAgeFilesLines
* Revert "Merge pull request #36785 from shes50103/fix_typo_actionpack_changelog"Ryuta Kamizono2019-07-281-1/+1
| | | | | This reverts commit ac6f3c9299209ea4b2fa7c368ea1ff406735ca93, reversing changes made to 5b0ea95a1a8acc5054f9a58d324070303cbd19b9.
* fix typo in actionpack CHANGELOG.mdshes501032019-07-281-1/+1
|
* Merge pull request #36545 from tomfakes/screenshot-updatesRafael Mendonça França2019-07-271-0/+9
|\ | | | | | | HTML page save during screenshot and multiple shots per test
| * Add code to save the HTML of the page being screenshotted during the ↵Tom Fakes2019-06-251-0/+9
| | | | | | | | | | | | | | | | | | | | | | `take_screenshot` method that is enabled by a new environment variable - RAILS_SYSTEM_TESTING_SCREENSHOT_HTML=1 Add the ability to call `take_screenshot` more than once in a single test by prefixing the name of the image file with a counter that is incremented on every `take_screenshot` call. This allows a developer to see their pages in sequence when trying to debug test errors. This does not affect the failure case where the prefix remains 'failures'
* | Add `Vary: Accept` header when renderingst00122019-07-261-0/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Problem description (quoted from @rafaelfranca's excellent explanation in https://github.com/rails/jquery-ujs/issues/318#issuecomment-88129005): > Let say that we requested /tasks/1 using Ajax, and the previous page has the same url. When we click the back button the browser tries to get the response from its cache and it gets the javascript response. With vary we "fix" this behavior because we are telling the browser that the url is the same but it is not from the same type what will skip the cache. And there's a Rails issue discussing about this problem as well https://github.com/rails/rails/issues/25842 Also, according to [RFC 7231 7.1.4](https://tools.ietf.org/html/rfc7231#section-7.1.4) > An origin server SHOULD send a Vary header field when its algorithm > for selecting a representation varies based on aspects of the request > message other than the method and request target we should add `Vary: Accept` header when determining content based on the `Accept` header. Although adding such header by default could cause unnecessary cache invalidation. But this PR only adds the header if: - The format param is not provided - The request is a `xhr` request - The request has accept headers and the headers are valid So if the user - sends request with explicit format, like `/users/1.json` - or sends a normal request (non xhr) - or doesn't specify accept headers then the header won't be added. See the discussion in https://github.com/rails/rails/issues/25842 and https://github.com/rails/rails/pull/36213 for more details.
* | fix `follow_redirect!` not using the same HTTP verb on 307 redirection:Edouard CHIN2019-07-251-0/+5
| | | | | | | | | | | | | | | | | | | | - According to the HTTP 1.1 spec, the 307 redirection guarantees that the method and the body will not be changed during redirection. This PR fixes that since follow_redirect! would always follow the redirection my making a GET request. Ref https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/307
* | Stop setting a default Capybara app hostGeorge Claghorn2019-07-241-0/+4
| | | | | | It's intended not to be set if Capybara starts the app server itself. Base Rails-generated URLs off of Capybara.current_session.server_url instead.
* | Merge pull request #31634 from afcapel/reduce-routing-error-log-noiseRafael Mendonça França2019-07-161-0/+4
|\ \ | | | | | | | | | Reduce log noise handling ActionController::RoutingErrors
| * | Reduce log noise handling ActionController::RoutingErrorsAlberto Fernández Capel2019-05-281-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | Each time a missing route is hit 32 lines of internal rails traces are written to the log. This is overly verbose and doesn't offer any actionable information to the user. With this change we'll still write an error message showing the route error but the trace will be omitted.
* | | Use reserved domain for example configurationJacob Bednarz2019-07-151-1/+1
| | | | | | | | | | | | | | | | | | | | | Updates the generator output to use a reserved domain[1] instead of a potentially real world domain. [1]: https://tools.ietf.org/html/rfc2606#section-3
* | | Adds support for configuring HTTP Feature Policy (#33439)Jacob Bednarz2019-07-101-0/+33
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A HTTP feature policy is Yet Another HTTP header for instructing the browser about which features the application intends to make use of and to lock down access to others. This is a new security mechanism that ensures that should an application become compromised or a third party attempts an unexpected action, the browser will override it and maintain the intended UX. WICG specification: https://wicg.github.io/feature-policy/ The end result is a HTTP header that looks like the following: ``` Feature-Policy: geolocation 'none'; autoplay https://example.com ``` This will prevent the browser from using geolocation and only allow autoplay on `https://example.com`. Full feature list can be found over in the WICG repository[1]. As of today Chrome and Safari have public support[2] for this functionality with Firefox working on support[3] and Edge still pending acceptance of the suggestion[4]. #### Examples Using an initializer ```rb # config/initializers/feature_policy.rb Rails.application.config.feature_policy do |f| f.geolocation :none f.camera :none f.payment "https://secure.example.com" f.fullscreen :self end ``` In a controller ```rb class SampleController < ApplicationController def index feature_policy do |f| f.geolocation "https://example.com" end end end ``` Some of you might realise that the HTTP feature policy looks pretty close to that of a Content Security Policy; and you're right. So much so that I used the Content Security Policy DSL from #31162 as the starting point for this change. This change *doesn't* introduce support for defining a feature policy on an iframe and this has been intentionally done to split the HTTP header and the HTML element (`iframe`) support. If this is successful, I'll look to add that on it's own. Full documentation on HTTP feature policies can be found at https://wicg.github.io/feature-policy/. Google have also published[5] a great in-depth write up of this functionality. [1]: https://github.com/WICG/feature-policy/blob/master/features.md [2]: https://www.chromestatus.com/feature/5694225681219584 [3]: https://bugzilla.mozilla.org/show_bug.cgi?id=1390801 [4]: https://wpdev.uservoice.com/forums/257854-microsoft-edge-developer/suggestions/33507907-support-feature-policy [5]: https://developers.google.com/web/updates/2018/06/feature-policy
* | | Add the ability to set the CSP nonce only to the specified directivesyuuji.yaginuma2019-06-221-0/+6
| |/ |/| | | | | | | | | | | | | | | | | | | I changed to set CSP nonce to `style-src` directive in #32932. But this causes an issue when `unsafe-inline` is specified to `style-src` (If a nonce is present, a nonce takes precedence over `unsafe-inline`). So, I fixed to nonce directives configurable. By configure this, users can make CSP as before. Fixes #35137.
* | Unify to use 4 spaces indentation in CHANGELOGs [ci skip]Ryuta Kamizono2019-06-051-3/+5
|/ | | | | Especially, somehow `CHANGELOG.md` in actiontext and activestorage in master branch had used 3 spaces indentation.
* Keep part when scope option has valueAlberto Almagro2019-05-221-0/+11
| | | | | | | | | When a route was defined within an optional scope, if that route didn't take parameters the scope was lost when using path helpers. This patch ensures scope is kept both when the route takes parameters or when it doesn't. Fixes #33219
* Implemented deep_transform_keys/! for ActionController::ParametersGustavo Gutierrez2019-05-221-0/+4
|
* Return parameters enumerator from transform_keys/!Eugene Kenny2019-05-181-0/+5
| | | | | | | | | | | | | | | | | Previously calling `ActionController::Parameters#transform_keys/!` without passing a block would return an enumerator for the underlying hash, which was inconsistent with the behaviour when a block was passed: ActionController::Parameters.new(foo: "bar").transform_keys { |k| k } => <ActionController::Parameters {"foo"=>"bar"} permitted: false> ActionController::Parameters.new(foo: "bar").transform_keys.each { |k| k } => {"foo"=>"bar"} An enumerator for the parameters is now returned instead, ensuring that evaluating it produces another parameters object instead of a hash: ActionController::Parameters.new(foo: "bar").transform_keys.each { |k| k } => <ActionController::Parameters {"foo"=>"bar"} permitted: false>
* fixed usage of Parameters when a non-numeric key existsL.Fexon2019-05-131-0/+2
| | | | | | | | | | test for non-numeric key in nested attributes test: extra blank line between tests removed test for non-numeric key fixed (by Daniel) Update according to feedback
* Remove forward ported CHANGELOG [ci skip]Ryuta Kamizono2019-05-081-4/+0
|
* Merge pull request #36196 from st0012/fix-29947Eileen M. Uchitelle2019-05-071-0/+4
| | | | | | | Hide malformed parameters from error page Accidentally merged this to 6-0-stable so forward porting it to master here instead.
* Start Rails 6.1 developmentRafael Mendonça França2019-04-241-258/+1
|
* Make system tests take failed screenshots in `before_teardown` hookRichard Macklin2019-04-201-0/+9
| | | | | | | | | | | | Previously we were calling the `take_failed_screenshot` method in an `after_teardown` hook. However, this means that other teardown hooks have to be executed before we take the screenshot. Since there can be dynamic updates to the page after the assertion fails and before we take a screenshot, it seems desirable to minimize that gap as much as possible. Taking the screenshot in a `before_teardown` rather than an `after_teardown` helps with that, and has a side benefit of allowing us to remove the nested `ensure` commented on here: https://github.com/rails/rails/pull/34411#discussion_r232819478
* Introduce Actionable ErrorsGenadi Samokovarov2019-04-191-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Actionable errors let's you dispatch actions from Rails' error pages. This can help you save time if you have a clear action for the resolution of common development errors. The de-facto example are pending migrations. Every time pending migrations are found, a middleware raises an error. With actionable errors, you can run the migrations right from the error page. Other examples include Rails plugins that need to run a rake task to setup themselves. They can now raise actionable errors to run the setup straight from the error pages. Here is how to define an actionable error: ```ruby class PendingMigrationError < MigrationError #:nodoc: include ActiveSupport::ActionableError action "Run pending migrations" do ActiveRecord::Tasks::DatabaseTasks.migrate end end ``` To make an error actionable, include the `ActiveSupport::ActionableError` module and invoke the `action` class macro to define the action. An action needs a name and a procedure to execute. The name is shown as the name of a button on the error pages. Once clicked, it will invoke the given procedure.
* Follow up tweaks b89a3e7e638a50c648a17d09c48b49b707e1d90d [ci skip]Ryuta Kamizono2019-03-311-2/+2
| | | | | | * use backticks instead of `+` * and more (e.g. missed replacing `Array#excluding` and `Enumerable#excluding` in b89a3e7e638a50c648a17d09c48b49b707e1d90d)
* Raise if resource custom params contain colonsJosua Schmid2019-03-261-0/+15
| | | | | | | | | | | After this change it's not possible anymore to configure routes like this: routes.draw do resources :users, param: "name/:sneaky" end Fixes #30467.
* Prep releaseeileencodes2019-03-111-0/+5
| | | | | | | * Update RAILS_VERSION * Bundle * rake update_versions * rake changelog:header
* Preparing for 6.0.0.beta2 releaseRafael Mendonça França2019-02-251-0/+2
|
* Merge pull request #35139 from 7coAim/fix_debug_exceptionsGeorge Claghorn2019-02-051-0/+4
|\ | | | | Fix NameError : Make debug exceptions works in an environment where ActiveStorage is not loaded.
| * fix NameErrorkurosawat2019-02-051-0/+4
| | | | | | | | NameError: uninitialized constant ActionView::CompiledTemplates::ActiveStorage
* | Merge pull request #35086 from gsamokovarov/cleanup-whitelisting-refsGannon McGibbon2019-02-041-1/+1
|\ \ | |/ |/| Cleanup the whitelisting references after #33145
| * Cleanup the whitelisting references after #33145Genadi Samokovarov2019-02-031-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | During the development of #33145, I have named a few concepts in the code as `whitelisted`. We decided to stay away from the term and I adjusted most of the code afterwards, but here are the cases I forgot to change. I also found a case in the API guide that we could have cleaned up as well. [ci skip]
* | driver_option -> driver_optionsEdouard CHIN2019-01-291-1/+2
| |
* | Implement a way to add browser capabilities:Edouard CHIN2019-01-291-1/+6
|/ | | | | | | | | | | | | | | | | | * There is currently no way to define specific browser capabilities since our SystemTest driver override the `option` key [Ref](https://github.com/rails/rails/blob/a07d0680787ced3c04b362fa7a238c918211ac70/actionpack/lib/action_dispatch/system_testing/driver.rb#L35) This option key is used internally by selenium to add custom capabilities on the browser. Depending on the Browser, some option are allowed to be passed inside a hash, the driver takes care of setting whatever you passed on the driver option. An example [here](https://github.com/rails/rails/blob/a07d0680787ced3c04b362fa7a238c918211ac70/actionpack/lib/action_dispatch/system_testing/driver.rb#L35) where you are allowed to pass args such as `--no-sandbox` etc However this behavior was only meant for backward compatibility and as you can see it's deprecated. The non-deprecated behavior is to create a `<Driver>::Option` object containing all the capabilities we want. This is what we [currently do](https://github.com/rails/rails/blob/a07d0680787ced3c04b362fa7a238c918211ac70/actionpack/lib/action_dispatch/system_testing/browser.rb#L34-L36) when chrome or firefox are in headless mode. This PR allows to pass a block when calling `driven_by`, the block will be pased a `<Driver>::Option` instance. You can modify this object the way you want by adding any capabilities. The option object will be then passed to selenium. ```ruby driven_by :selenium, using: :chrome do |driver_option| driver_option.add_argument('--no-sandbox') driver_option.add_emulation(device: 'iphone 4') end ```
* Merge pull request #35018 from gmcgibbon/revert_redirect_to_allow_other_hostRafael França2019-01-221-6/+0
|\ | | | | Revert ensure external redirects are explicitly allowed
| * Revert ensure external redirects are explicitly allowedGannon McGibbon2019-01-221-6/+0
| |
* | 1. Replaced unused variables by `_`.alkesh262019-01-221-2/+2
|/ | | | 2. Typo fixes.
* Preparing for 6.0.0.beta1 releaseRafael Mendonça França2019-01-181-0/+2
|
* Remove deprecated `fragment_cache_key` helper in favor of ↵Rafael Mendonça França2019-01-171-0/+4
| | | | `combined_fragment_cache_key`
* Remove deprecated methods in ActionDispatch::TestResponseRafael Mendonça França2019-01-171-0/+7
| | | | | `#success?`, `missing?` and `error?` were deprecated in Rails 5.2 in favor of `#successful?`, `not_found?` and `server_error?`.
* Ensure external redirects are explicitly allowedGannon McGibbon2019-01-171-0/+6
| | | | Add `fallback_location` and `allow_other_host` options to `redirect_to`.
* Revert "Don't handle params option in a special way in url_for helper"Rafael Mendonça França2019-01-161-4/+0
| | | | | | | | | | | This reverts commit e385e4678fc64be6e176c3bdac6641db9fe48d85. While this option was undocumented it exists to make possible to pass parameters to the route helpers that are reserved like `:domain`. While `url_for(domain: 'foo.com')` would generate a URL in the `foo.com` domain `url_for(params: { domain: 'foo.com' })` would generate a URL with `?domain=foo.com`.
* Require Ruby 2.5 for Rails 6.Kasper Timm Hansen2018-12-191-2/+2
| | | | | | | | | | Generally followed the pattern for https://github.com/rails/rails/pull/32034 * Removes needless CI configs for 2.4 * Targets 2.5 in rubocop * Updates existing CHANGELOG entries for fewer merge conflicts * Removes Hash#slice extension as that's inlined on Ruby 2.5. * Removes the need for send on define_method in MethodCallAssertions.
* [ci skip] Remove needless changelog entry, as bug fix was backported to 5.2.Kasper Timm Hansen2018-12-181-4/+0
|
* Allow nil params on controller HTTP test methodsr7kamura2018-12-181-0/+4
|
* Merge branch 'master' into host-authorizationEileen M. Uchitelle2018-12-171-0/+18
|\
| * Allow using parsed_body in ActionController::TestCaseTobias Bühlmann2018-12-161-0/+18
| | | | | | | | | | | | | | | | | | | | | | | | … by switching the initialzation of an appropriate response parser in `ActionDispatch::TestResponse` from eagerly to lazily. By doing so, the response parser can be correctly set for `ActionController::TestCase`, which doesn't include the content type header in the constructor but only sets it at a later time. Fixes #34676.
* | Introduce a guard against DNS rebinding attacksGenadi Samokovarov2018-12-151-0/+10
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The ActionDispatch::HostAuthorization is a new middleware that prevent against DNS rebinding and other Host header attacks. By default it is included only in the development environment with the following configuration: Rails.application.config.hosts = [ IPAddr.new("0.0.0.0/0"), # All IPv4 addresses. IPAddr.new("::/0"), # All IPv6 addresses. "localhost" # The localhost reserved domain. ] In other environments, `Rails.application.config.hosts` is empty and no Host header checks will be done. If you want to guard against header attacks on production, you have to manually permit the allowed hosts with: Rails.application.config.hosts << "product.com" The host of a request is checked against the hosts entries with the case operator (#===), which lets hosts support entries of type RegExp, Proc and IPAddr to name a few. Here is an example with a regexp. # Allow requests from subdomains like `www.product.com` and # `beta1.product.com`. Rails.application.config.hosts << /.*\.product\.com/ A special case is supported that allows you to permit all sub-domains: # Allow requests from subdomains like `www.product.com` and # `beta1.product.com`. Rails.application.config.hosts << ".product.com"
* Raise an error on root route naming conflicts.Gannon McGibbon2018-11-201-0/+7
| | | | | Raises an ArgumentError when multiple root routes are defined in the same context instead of assigning nil names to subsequent roots.
* Allow rescue from parameter parse errorsGannon McGibbon2018-11-131-0/+10
| | | | [Gannon McGibbon + Josh Cheek]
* Reset sessions on failed system test screenshotMaxim Perepelitsa2018-11-131-0/+7
| | | | | Reset Capybara sessions if `take_failed_screenshot` raise exception in system test `after_teardown`.
* Fix broken CHANGELOG markup [ci skip]Ryuta Kamizono2018-11-081-3/+3
| | | | And remove trailing spaces.
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-16 09:27:21 +0000