| Commit message (Collapse) | Author | Age | Files | Lines |
... | |
| | | |
|
|/ /
| |
| |
| |
| |
| | |
Most importantly, the original request thread must yield its share lock
while waiting for the live thread to commit -- otherwise a request's
base and live threads can deadlock against each other.
|
| |
| |
| |
| |
| |
| |
| |
| | |
Referencing Rails.env without checking if it's defined couples
us to Railties.
Fix by avoiding the line breaks if we don't have an env check
to rely on.
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Tests can (and do) access the database from the main thread. In this
case they were starting a transaction, then making a request. The
request would create a new thread, which would allocate a new database
connection. Since the main thread started a transaction that contains
data that the new thread wants to see, the new thread would not see it
due to data visibility from transactions. Spawning the new thread in
production is fine because middleware should not be doing database
manipulation similar to the test harness. Before 603fe20c it was
possible to set the database connection id based on a thread local, but
603fe20c changes the connection lookup code to never look at the
"connection id" but only at the thread object itself. Without that
indirection, we can't force threads to use the same connection pool as
another thread.
Fixes #23483
|
| |
| |
| |
| | |
- Fixes #23428.
|
|/
|
|
|
|
|
|
|
| |
There are some cases when the `body` in `response_body=` can be set to
nil. One of those cases is in `actionpack-action_caching` which I found
while upgrading it for Rails 5.
It's not possible to run `body.each` on a `nil` body so we have to
return after we run `response.reset_body!`.
|
|
|
| |
and remove unecessary spaces in string interpolation.
|
|\
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
* 5-0-beta-sec:
bumping version
fix version update task to deal with .beta1.1
Eliminate instance level writers for class accessors
allow :file to be outside rails root, but anything else must be inside the rails view directory
Don't short-circuit reject_if proc
stop caching mime types globally
use secure string comparisons for basic auth username / password
|
| |
| |
| |
| |
| |
| | |
this will avoid timing attacks against applications that use basic auth.
CVE-2015-7576
|
| |
| |
| |
| |
| |
| |
| | |
[ci skip]
Fixes #20808
[Vipul A M & Julio Lopez]
|
|\ \
| | |
| | | |
Fix `ActionController::Parameters#==` bug
|
| | |
| | |
| | |
| | | |
See bug #21032.
|
| | | |
|
| | | |
|
|/ /
| |
| |
| |
| | |
- Fixes bug #23142.
- Bug was occurring only with ActionController::API, because `_process_options` wasn't being run for API requests, even though it was being run for normal app requests.
|
| | |
|
| |
| |
| | |
It's reasonable to expose different value readers.
|
| |
| |
| |
| | |
We can provide a more flexible upgrade experience by warning users they are using unsafe methods instead of forcing the safe API by deprecating before removal. This PR provides this functionality.
|
| |
| |
| |
| |
| | |
Empty strings / data structures should be treated differently than nils.
We don't really need these calls here (don't pass in blank strings).
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Instead of checking whether the class has recycle! or not, we can just
always add the method to all controller classes when the test harness is
loaded. Technically this means that the controller test harness will
not work with controllers that do not inherit from AC::Metal, but then,
I'm not sure that is supported anyway.
Mixing in the module one will ensure that we don't break method caches,
and eliminates a runtime check so it should speed up tests (slightly).
|
| |
| |
| |
| |
| |
| | |
Fixes #23026
See discussion at #23026
|
| | |
|
| | |
|
|\ \
| | |
| | | |
Per-form CSRF tokens
|
| | | |
|
| | | |
|
|/ /
| |
| |
| | |
To complement actionpack/test/controller/metal/renderers_test.rb
|
| | |
|
|\ \
| | |
| | | |
Fix AC::Parameters#to_unsafe_h to return all unfiltered values
|
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
- AC::Parameters#convert_parameters_to_hashes should return filtered or
unfiltered values based on whether it is called from `to_h` or `to_unsafe_h`
instead of always defaulting to `to_h`.
- Fixes #22841
|
|/ /
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Benchmark.ips do |x|
x.report('Time.parse') { Time.parse('2011-01-01') }
x.report('Time.new') { Time.new(2011, 1, 1) }
end
Calculating -------------------------------------
Time.parse 6.640k i/100ms
Time.new 15.082k i/100ms
-------------------------------------------------
Time.parse 71.915k (± 3.1%) i/s - 365.200k
Time.new 167.645k (± 3.3%) i/s - 844.592k
|
| |
| |
| |
| | |
Fixes #22818
|
|\ \
| |/
|/| |
|
| | |
|
|\ \
| | |
| | | |
Prevent ActionController::Parameters in url_for
|
| | | |
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
If you're not familiar with how the `Referer` header works, you likely
won't understand why you need to provide a fallback or under what
circumstances it would be used.
Hopefully this clarifies things a bit.
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
When calling `to_h` on an `ActionController::Parameters` instance it would
`deep_dup` its internal parameters.
This inadvertently called `dup` on a passed Active Record model which would
create new models. Fix by only dupping Ruby's Arrays and Hashes.
|
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Applications that use `redirect_to :back` can be forced to 500 by
clients that do not send the HTTP `Referer` (sic) header.
`redirect_back` requires the user to consider this possibility up front
and avoids this trivially-caused application error.
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
`redirect_to :back` is a somewhat common pattern in Rails apps, but it
is not completely safe. There are a number of circumstances where HTTP
referrer information is not available on the request. This happens often
with bot traffic and occasionally to user traffic depending on browser
security settings.
When there is no referrer available on the request, `redirect_to :back`
will raise `ActionController::RedirectBackError`, usually resulting in
an application error.
`redirect_back` takes a required `fallback_location` keyword argument
that specifies the redirect when the referrer information is not
available. This prevents 500 errors caused by
`ActionController::RedirectBackError`.
|
|\ \ \
| | | |
| | | |
| | | | |
Handle tab in token authentication header.
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
The HTTP spec allows for LWS to precede the header content, which
could include multiple SP and HT characters. Update the regex used to
match the Token authorization header to account for this, instead of
matching on a single SP.
See http://www.w3.org/Protocols/rfc2616/rfc2616-sec2.html and
http://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html for the relevant
parts of the specification.
|
| | | | |
|
| | | | |
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Introduced in e56c63542780fe2fb804636a875f95cae08ab3f4, `CacheHelper#fragment_cache_key` is a duplicate of `ActionController::Caching::Fragments#fragment_cache_key`.
We now require the view to provide this method on its own (as with `view_cache_dependencies`); `ActionController::Caching::Fragments` exports its version as a `helper_method`.
|
| |/ /
|/| |
| | |
| | |
| | |
| | |
| | | |
This makes these two methods to be more inline with the previous
behavior of Parameters as Parameters used to be inherited from HWIA.
Fixes #21391
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
In Rails 5.1 `ActionController::TestCase` will be moved out of Rails
into it's own gem.
Please use `ActionDispatch::IntegrationTest` going foward.
Because this will be moved to a gem I used `# :stopdoc:` instead of
deleting the documentation. This will remove it from the Rails
documentation but still leave the method documented for when we move it
to a gem.
Guides have been updated to use the routing structure used in Integration
and all test examples have been updated to inherit from
`ActionDispatch::IntegrationTest` instead of `ActionController::TestCase.
Fixes #22496
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
All of our tests were testing the `ActionController::Live` behavior in a
standalone environment, without going through the router or behaving
like a real application.
This resulted in `ActionController::Live` throwing the exception
`undefined method 'request' for #<ActionDispatch::Request:0x00000003ad1148>`
because `make_response!` was expecting a response instead of a request.
The expectation of a response came from `set_response!` in non-router
tests setting the response and passing it to `make_response!`. In the
case of an application we would hit `serve` in `RouteSet` first which
would send us to `make_response!` with a request sent instead of a
response.
The changes here remove `set_response!` so `make_response!` always
receives a request.
Thanks to KalabiYau for help with the investigation and solution.
Fixes #22524
[Eileen M. Uchitelle & KalabiYau]
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Per this comment
https://github.com/rails/rails/pull/18334#issuecomment-69234050 we want
`protect_from_forgery` to default to `prepend: false`.
`protect_from_forgery` will now be insterted into the callback chain at the
point it is called in your application. This is useful for cases where you
want to `protect_from_forgery` after you perform required authentication
callbacks or other callbacks that are required to run after forgery protection.
If you want `protect_from_forgery` callbacks to always run first, regardless of
position they are called in your application, then you can add `prepend: true`
to your `protect_from_forgery` call.
Example:
```ruby
protect_from_forgery prepend: true
```
|
|\ \ \
| | | |
| | | | |
Add missing require to strong_parameters.rb
|