| Commit message (Collapse) | Author | Age | Files | Lines |
|\
| |
| | |
Fix `ActionController::Parameters#==` bug
|
| |
| |
| |
| | |
See bug #21032.
|
| | |
|
| | |
|
|/
|
|
|
| |
- Fixes bug #23142.
- Bug was occurring only with ActionController::API, because `_process_options` wasn't being run for API requests, even though it was being run for normal app requests.
|
| |
|
|
|
| |
It's reasonable to expose different value readers.
|
|
|
|
| |
We can provide a more flexible upgrade experience by warning users they are using unsafe methods instead of forcing the safe API by deprecating before removal. This PR provides this functionality.
|
|
|
|
|
| |
Empty strings / data structures should be treated differently than nils.
We don't really need these calls here (don't pass in blank strings).
|
|
|
|
|
|
|
|
|
|
|
| |
Instead of checking whether the class has recycle! or not, we can just
always add the method to all controller classes when the test harness is
loaded. Technically this means that the controller test harness will
not work with controllers that do not inherit from AC::Metal, but then,
I'm not sure that is supported anyway.
Mixing in the module one will ensure that we don't break method caches,
and eliminates a runtime check so it should speed up tests (slightly).
|
|
|
|
|
|
| |
Fixes #23026
See discussion at #23026
|
| |
|
| |
|
|\
| |
| | |
Per-form CSRF tokens
|
| | |
|
| | |
|
|/
|
|
| |
To complement actionpack/test/controller/metal/renderers_test.rb
|
| |
|
|\
| |
| | |
Fix AC::Parameters#to_unsafe_h to return all unfiltered values
|
| |
| |
| |
| |
| |
| |
| | |
- AC::Parameters#convert_parameters_to_hashes should return filtered or
unfiltered values based on whether it is called from `to_h` or `to_unsafe_h`
instead of always defaulting to `to_h`.
- Fixes #22841
|
|/
|
|
|
|
|
|
|
|
|
|
|
|
| |
Benchmark.ips do |x|
x.report('Time.parse') { Time.parse('2011-01-01') }
x.report('Time.new') { Time.new(2011, 1, 1) }
end
Calculating -------------------------------------
Time.parse 6.640k i/100ms
Time.new 15.082k i/100ms
-------------------------------------------------
Time.parse 71.915k (± 3.1%) i/s - 365.200k
Time.new 167.645k (± 3.3%) i/s - 844.592k
|
|
|
|
| |
Fixes #22818
|
|\ |
|
| | |
|
|\ \
| | |
| | | |
Prevent ActionController::Parameters in url_for
|
| | | |
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
If you're not familiar with how the `Referer` header works, you likely
won't understand why you need to provide a fallback or under what
circumstances it would be used.
Hopefully this clarifies things a bit.
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
When calling `to_h` on an `ActionController::Parameters` instance it would
`deep_dup` its internal parameters.
This inadvertently called `dup` on a passed Active Record model which would
create new models. Fix by only dupping Ruby's Arrays and Hashes.
|
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Applications that use `redirect_to :back` can be forced to 500 by
clients that do not send the HTTP `Referer` (sic) header.
`redirect_back` requires the user to consider this possibility up front
and avoids this trivially-caused application error.
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
`redirect_to :back` is a somewhat common pattern in Rails apps, but it
is not completely safe. There are a number of circumstances where HTTP
referrer information is not available on the request. This happens often
with bot traffic and occasionally to user traffic depending on browser
security settings.
When there is no referrer available on the request, `redirect_to :back`
will raise `ActionController::RedirectBackError`, usually resulting in
an application error.
`redirect_back` takes a required `fallback_location` keyword argument
that specifies the redirect when the referrer information is not
available. This prevents 500 errors caused by
`ActionController::RedirectBackError`.
|
|\ \ \
| | | |
| | | |
| | | | |
Handle tab in token authentication header.
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
The HTTP spec allows for LWS to precede the header content, which
could include multiple SP and HT characters. Update the regex used to
match the Token authorization header to account for this, instead of
matching on a single SP.
See http://www.w3.org/Protocols/rfc2616/rfc2616-sec2.html and
http://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html for the relevant
parts of the specification.
|
| | | | |
|
| | | | |
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Introduced in e56c63542780fe2fb804636a875f95cae08ab3f4, `CacheHelper#fragment_cache_key` is a duplicate of `ActionController::Caching::Fragments#fragment_cache_key`.
We now require the view to provide this method on its own (as with `view_cache_dependencies`); `ActionController::Caching::Fragments` exports its version as a `helper_method`.
|
| |/ /
|/| |
| | |
| | |
| | |
| | |
| | | |
This makes these two methods to be more inline with the previous
behavior of Parameters as Parameters used to be inherited from HWIA.
Fixes #21391
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
In Rails 5.1 `ActionController::TestCase` will be moved out of Rails
into it's own gem.
Please use `ActionDispatch::IntegrationTest` going foward.
Because this will be moved to a gem I used `# :stopdoc:` instead of
deleting the documentation. This will remove it from the Rails
documentation but still leave the method documented for when we move it
to a gem.
Guides have been updated to use the routing structure used in Integration
and all test examples have been updated to inherit from
`ActionDispatch::IntegrationTest` instead of `ActionController::TestCase.
Fixes #22496
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
All of our tests were testing the `ActionController::Live` behavior in a
standalone environment, without going through the router or behaving
like a real application.
This resulted in `ActionController::Live` throwing the exception
`undefined method 'request' for #<ActionDispatch::Request:0x00000003ad1148>`
because `make_response!` was expecting a response instead of a request.
The expectation of a response came from `set_response!` in non-router
tests setting the response and passing it to `make_response!`. In the
case of an application we would hit `serve` in `RouteSet` first which
would send us to `make_response!` with a request sent instead of a
response.
The changes here remove `set_response!` so `make_response!` always
receives a request.
Thanks to KalabiYau for help with the investigation and solution.
Fixes #22524
[Eileen M. Uchitelle & KalabiYau]
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Per this comment
https://github.com/rails/rails/pull/18334#issuecomment-69234050 we want
`protect_from_forgery` to default to `prepend: false`.
`protect_from_forgery` will now be insterted into the callback chain at the
point it is called in your application. This is useful for cases where you
want to `protect_from_forgery` after you perform required authentication
callbacks or other callbacks that are required to run after forgery protection.
If you want `protect_from_forgery` callbacks to always run first, regardless of
position they are called in your application, then you can add `prepend: true`
to your `protect_from_forgery` call.
Example:
```ruby
protect_from_forgery prepend: true
```
|
|\ \ \
| | | |
| | | | |
Add missing require to strong_parameters.rb
|
| | | |
| | | |
| | | |
| | | |
| | | | |
The file [references Rack::Test here](https://github.com/rails/rails/blame/master/actionpack/lib/action_controller/metal/strong_parameters.rb#L671)
so it's better off requiring 'rack/test' in the first place.
|
|/ / /
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
We want to get rid of the `Live::Response` so we are consolidating methods
from `Live::Response` and `Response` by merging them together.
This adds an `#empty` method to the request so we don't need to
hard-code the empty array each time we call an empty
`ActionDispatch::Request`.
The work here is a continuation on combining controller and integration
test code bases into one.
|
|\ \ \
| |_|/
|/| |
| | |
| | | |
Add option to verify Origin header in CSRF checks
[Jeremy Daer + Rafael Mendonça França]
|
| | | |
|
|/ / |
|
| | |
|
|\ \ |
|
| | |
| | |
| | |
| | |
| | | |
‘Asserts’ at all places [ci skip]
Following commit https://github.com/rails/docrails/commit/495722a95687e25114ae75608dd3107ac5d6611b
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
`dispatch` sets the request and response on the controller for us
automatically, so the test harness doesn't need to know the internals of
how request / response is set.
Conflicts:
actionpack/lib/action_controller/test_case.rb
|
| | | |
|