| Commit message (Collapse) | Author | Age | Files | Lines |
| ... | |
| | | | |
|
| | | |
| | |
| | |
| | | |
options aren't modified inside send_file_headers!
|
| | | | |
|
| | | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
IE since version 6 and recently Chrome and Firefox have started following
302 redirects from XHR requests other than GET/POST using the original request
method. This can lead to DELETE requests being redirected amongst other things.
Although it doesn't directly affect the Rails framework since it doesn't return
a 302 redirect to any non-GET/POST request a note has been added to raise
awareness of the issue. Some references:
Original article from @technoweenie:
http://techno-weenie.net/2011/8/19/ie9-deletes-stuff/
Hacker News discussion of the article:
http://news.ycombinator.com/item?id=2903493
WebKit bug report:
https://bugs.webkit.org/show_bug.cgi?id=46183
Firefox bug report and changeset:
https://bugzilla.mozilla.org/show_bug.cgi?id=598304
https://hg.mozilla.org/mozilla-central/rev/9525d7e2d20d
Chrome bug report:
http://code.google.com/p/chromium/issues/detail?id=56373
HTTPbis bug report and changeset:
http://trac.tools.ietf.org/wg/httpbis/trac/ticket/160
http://trac.tools.ietf.org/wg/httpbis/trac/changeset/1428
Roy T. Fielding's history of the issue:
http://ftp.ics.uci.edu/pub/ietf/http/hypermail/1997q3/0611.html
Automated browser tests for the issue:
http://www.mnot.net/javascript/xmlhttprequest/
Fixes #4144
|
| | | | |
|
| |\ \ \
| |/ /
|/| | |
JSONP should use mimetype application/javascript
|
| | |\ \ |
|
| | | | | |
|
| | | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
The latter doesn't render as code in HTML output.
Regex used in Rubymine to locate the latter form:
(\+)(:*\w+:(?::|\w)+)(\+)
|
| | | | |
| | | |
| | | |
| | | | |
opening the file to set the response body is wasteful. Set a FileBody wrapper instead that responds to to_path and streams the file if needed.
|
| | | | | |
|
| |\ \ \ \
| | | | |
| | | | | |
Updated/changed unneeded tr/gsubs
|
| | | | | | |
|
| | | | | | |
|
| |/ / / / |
|
| |\ \ \ \ |
|
| | | | | |
| | | | |
| | | | |
| | | | | |
InvalidAuthenticityToken is not raised
|
| | | | | | |
|
| |/ / / / |
|
| | | | | |
|
| | | | | |
|
| |\ \ \ \ |
|
| | | | | |
| | | | |
| | | | |
| | | | | |
add tests for stripping \r\n chars since that's already happening
|
| | | | | | |
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
More info http://edgeguides.rubyonrails.org/api_app.html
[Carlos Antonio da Silva & Santiago Pastorino]
|
| | |\ \ \ \ |
|
| | | | | | | |
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
can be configured using `:with` option in `protect_from_forgery` method
or `request_forgery_protection_method` config option
possible values:
- :reset_session (default)
- :exception
new applications are generated with:
protect_from_forgery :with => :exception
|
| | |/ / / /
|/| | | | |
|
| |/ / / / |
|
| | | | | |
|
| | | | | |
|
| | | | | |
|
| | | | |
| | | |
| | | |
| | | | |
Removed some useless docstrings and no-doc'ed some.
|
| | | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
We should let the responder to decide what to do with the given
overridden response block, and not short circuit it.
Fixes #5280
|
| | | | | |
|
| |\ \ \ \ |
|
| | | | | |
| | | | |
| | | | |
| | | | | |
max-stale is a cache request header.
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
It fails if routes from to railties are called in one context,
for example: blog.posts_path and main_app.users_path
|
| | | | | | |
|
| |/ / / / |
|
| | | | | |
|
| | | | | |
|
| | | | | |
|
| |\ \ \ \
| | | | |
| | | | | |
Add config.default_method_for_update to support PATCH
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
PATCH is the correct HTML verb to map to the #update action. The
semantics for PATCH allows for partial updates, whereas PUT requires a
complete replacement.
Changes:
* adds config.default_method_for_update you can set to :patch
* optionally use PATCH instead of PUT in resource routes and forms
* adds the #patch verb to routes to detect PATCH requests
* adds #patch? to Request
* changes documentation and comments to indicate support for PATCH
This change maintains complete backwards compatibility by keeping :put
as the default for config.default_method_for_update.
|
| |/ / / /
| | | |
| | | |
| | | |
| | | |
| | | | |
is being rendered
Closes #5025 part 2
|
| | | | | |
|
| |\ \ \ \
| | | | |
| | | | | |
Ensure Date header on expires_in
|
| | | | | |
| | | | |
| | | | |
| | | | | |
#expires_in
|