aboutsummaryrefslogtreecommitdiffstats
path: root/actionpack/lib/action_controller
Commit message (Collapse)AuthorAgeFilesLines
* Merge branch 'master' of github.com:rails/docrailsVijay Dev2015-12-201-1/+1
|\
| * Add missing punctuation mark [ci skip]Gaurav Sharma2015-11-181-1/+1
| |
* | Merge pull request #20797 from byroot/prevent-url-for-ac-parametersRafael França2015-12-181-1/+0
|\ \ | | | | | | Prevent ActionController::Parameters in url_for
| * | Prevent ActionController::Parameters from being passed to url_for directlyJean Boussier2015-12-151-1/+0
| | |
* | | Document when fallback_location is used [ci-skip]Derek Prior2015-12-171-2/+8
| | | | | | | | | | | | | | | | | | | | | | | | If you're not familiar with how the `Referer` header works, you likely won't understand why you need to provide a fallback or under what circumstances it would be used. Hopefully this clarifies things a bit.
* | | Only dup Ruby's Hash and Array.Kasper Timm Hansen2015-12-171-2/+18
| | | | | | | | | | | | | | | | | | | | | | | | When calling `to_h` on an `ActionController::Parameters` instance it would `deep_dup` its internal parameters. This inadvertently called `dup` on a passed Active Record model which would create new models. Fix by only dupping Ruby's Arrays and Hashes.
* | | Deprecate `redirect_to :back`Derek Prior2015-12-161-10/+6
| | | | | | | | | | | | | | | | | | | | | Applications that use `redirect_to :back` can be forced to 500 by clients that do not send the HTTP `Referer` (sic) header. `redirect_back` requires the user to consider this possibility up front and avoids this trivially-caused application error.
* | | Add `redirect_back` for safer referrer redirectsDerek Prior2015-12-161-0/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `redirect_to :back` is a somewhat common pattern in Rails apps, but it is not completely safe. There are a number of circumstances where HTTP referrer information is not available on the request. This happens often with bot traffic and occasionally to user traffic depending on browser security settings. When there is no referrer available on the request, `redirect_to :back` will raise `ActionController::RedirectBackError`, usually resulting in an application error. `redirect_back` takes a required `fallback_location` keyword argument that specifies the redirect when the referrer information is not available. This prevents 500 errors caused by `ActionController::RedirectBackError`.
* | | Merge pull request #14212 from tylerhunt/fix-token-regexSean Griffin2015-12-151-1/+1
|\ \ \ | | | | | | | | | | | | Handle tab in token authentication header.
| * | | Handle tab in token authentication header.Tyler Hunt2014-02-261-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The HTTP spec allows for LWS to precede the header content, which could include multiple SP and HT characters. Update the regex used to match the Token authorization header to account for this, instead of matching on a single SP. See http://www.w3.org/Protocols/rfc2616/rfc2616-sec2.html and http://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html for the relevant parts of the specification.
* | | | Remove warning of shadowing variableRafael Mendonça França2015-12-151-1/+1
| | | |
* | | | Add fragment_cache_key macro for controller-wide fragment cache key prefixesSam Stephenson2015-12-141-3/+42
| | | |
* | | | Remove ActionView::Helpers::CacheHelper#fragment_cache_keySam Stephenson2015-12-141-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | Introduced in e56c63542780fe2fb804636a875f95cae08ab3f4, `CacheHelper#fragment_cache_key` is a duplicate of `ActionController::Caching::Fragments#fragment_cache_key`. We now require the view to provide this method on its own (as with `view_cache_dependencies`); `ActionController::Caching::Fragments` exports its version as a `helper_method`.
* | | | Make Parameters#to_h and #to_unsafe_h return HWIAPrem Sichanugrist2015-12-141-5/+7
| |/ / |/| | | | | | | | | | | | | | | | | This makes these two methods to be more inline with the previous behavior of Parameters as Parameters used to be inherited from HWIA. Fixes #21391
* | | Remove ActionController::TestCase from documentationeileencodes2015-12-121-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In Rails 5.1 `ActionController::TestCase` will be moved out of Rails into it's own gem. Please use `ActionDispatch::IntegrationTest` going foward. Because this will be moved to a gem I used `# :stopdoc:` instead of deleting the documentation. This will remove it from the Rails documentation but still leave the method documented for when we move it to a gem. Guides have been updated to use the routing structure used in Integration and all test examples have been updated to inherit from `ActionDispatch::IntegrationTest` instead of `ActionController::TestCase. Fixes #22496
* | | Fix `make_response!` when called by `serve` in `RouteSet`eileencodes2015-12-091-6/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | All of our tests were testing the `ActionController::Live` behavior in a standalone environment, without going through the router or behaving like a real application. This resulted in `ActionController::Live` throwing the exception `undefined method 'request' for #<ActionDispatch::Request:0x00000003ad1148>` because `make_response!` was expecting a response instead of a request. The expectation of a response came from `set_response!` in non-router tests setting the response and passing it to `make_response!`. In the case of an application we would hit `serve` in `RouteSet` first which would send us to `make_response!` with a request sent instead of a response. The changes here remove `set_response!` so `make_response!` always receives a request. Thanks to KalabiYau for help with the investigation and solution. Fixes #22524 [Eileen M. Uchitelle & KalabiYau]
* | | Change the `protect_from_forgery` prepend default to `false`eileencodes2015-12-071-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Per this comment https://github.com/rails/rails/pull/18334#issuecomment-69234050 we want `protect_from_forgery` to default to `prepend: false`. `protect_from_forgery` will now be insterted into the callback chain at the point it is called in your application. This is useful for cases where you want to `protect_from_forgery` after you perform required authentication callbacks or other callbacks that are required to run after forgery protection. If you want `protect_from_forgery` callbacks to always run first, regardless of position they are called in your application, then you can add `prepend: true` to your `protect_from_forgery` call. Example: ```ruby protect_from_forgery prepend: true ```
* | | Merge pull request #22475 from claudiob/missing-requireMatthew Draper2015-12-081-0/+1
|\ \ \ | | | | | | | | Add missing require to strong_parameters.rb
| * | | Add missing require to strong_parameters.rbclaudiob2015-12-041-0/+1
| | | | | | | | | | | | | | | | | | | | The file [references Rack::Test here](https://github.com/rails/rails/blame/master/actionpack/lib/action_controller/metal/strong_parameters.rb#L671) so it's better off requiring 'rack/test' in the first place.
* | | | Push `before_sending` to super classeileencodes2015-12-061-6/+0
|/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We want to get rid of the `Live::Response` so we are consolidating methods from `Live::Response` and `Response` by merging them together. This adds an `#empty` method to the request so we don't need to hard-code the empty array each time we call an empty `ActionDispatch::Request`. The work here is a continuation on combining controller and integration test code bases into one.
* | | Merge pull request #22263 from mastahyeti/csrf-origin-checkRafael França2015-11-261-2/+28
|\ \ \ | |_|/ |/| | | | | | | | Add option to verify Origin header in CSRF checks [Jeremy Daer + Rafael Mendonça França]
| * | Add option to verify Origin header in CSRF checksBen Toews2015-11-251-2/+28
| | |
* | | [ci skip] Fix <tt> in docclaudiob2015-11-151-1/+1
|/ /
* | Deprecate exception#original_exception in favor of exception#causeYuki Nishijima2015-11-032-8/+13
| |
* | Merge branch 'master' of github.com:rails/docrailsVijay Dev2015-10-311-2/+2
|\ \
| * | Improved readability of Assertion docs, replaced ‘Assert’ -> ↵amitkumarsuroliya2015-10-091-2/+2
| | | | | | | | | | | | | | | ‘Asserts’ at all places [ci skip] Following commit https://github.com/rails/docrails/commit/495722a95687e25114ae75608dd3107ac5d6611b
* | | use `dispatch` instead of `process` to run requests thougheileencodes2015-10-292-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | `dispatch` sets the request and response on the controller for us automatically, so the test harness doesn't need to know the internals of how request / response is set. Conflicts: actionpack/lib/action_controller/test_case.rb
* | | Remove unnecessary methodeileencodes2015-10-291-3/+0
| | |
* | | Write the cookie jar it was not committed in TestCaseRafael Mendonça França2015-10-281-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | For ActionController::Base we write the cookies in a middleware if it was not yet committed no matter if the response was committed or not. [1] For ActionController::Live we write the cookies before the response is committed. [2] We already mimic ActionController::Live in ActionController::TestCase but we don't mimic the ActionController::Base behavior because we were checking if the response was committed before writing the cookies. Now we are matching the behavior of the middleware and writing the cookies if it was not written before. [1]: https://github.com/rails/rails/blob/80c6b901d4d87cee610ab0a438ff6e3c6bf118d1/actionpack/lib/action_dispatch/middleware/cookies.rb#L599-L604 [2]: https://github.com/rails/rails/blob/80c6b901d4d87cee610ab0a438ff6e3c6bf118d1/actionpack/lib/action_controller/metal/live.rb#L218-L223
* | | fix rdoc markup [ci skip]yuuji.yaginuma2015-10-251-4/+4
| | |
* | | Merge pull request #22003 from yui-knk/remove_needless_require_asYves Senn2015-10-202-2/+0
|\ \ \ | | | | | | | | Delete needless `require 'active_support/deprecation'`
| * | | Delete needless `require 'active_support/deprecation'`yui-knk2015-10-202-2/+0
| | | | | | | | | | | | | | | | | | | | When `require 'active_support/rails'`, 'active_support/deprecation' is automatically loaded.
* | | | Show helpful messages on invalid param. encodingsAgis Anastasopoulos2015-10-191-5/+3
|/ / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Prior to this change, given a route: # config/routes.rb get ':a' => "foo#bar" If one pointed to http://example.com/%BE (param `a` has invalid encoding), a `BadRequest` would be raised with the following non-informative message: ActionController::BadRequest From now on the message displayed is: Invalid parameter encoding: hi => "\xBE" Fixes #21923.
* | | Use `Mime[:foo]` instead of `Mime::Type[:FOO]` for back compatJeremy Daer2015-10-065-16/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Rails 4.x and earlier didn't support `Mime::Type[:FOO]`, so libraries that support multiple Rails versions would've had to feature-detect whether to use `Mime::Type[:FOO]` or `Mime::FOO`. `Mime[:foo]` has been around for ages to look up registered MIME types by symbol / extension, though, so libraries and plugins can safely switch to that without breaking backward- or forward-compatibility. Note: `Mime::ALL` isn't a real MIME type and isn't registered for lookup by type or extension, so it's not available as `Mime[:all]`. We use it internally as a wildcard for `respond_to` negotiation. If you use this internal constant, continue to reference it with `Mime::ALL`. Ref. efc6dd550ee49e7e443f9d72785caa0f240def53
* | | move file sending to the response objectAaron Patterson2015-10-052-26/+6
|/ / | | | | | | | | | | | | Just a slight refactor that delegates file sending to the response object. This gives us the advantage that if a webserver (in the future) provides a response object that knows how to do accelerated file serving, it can implement this method.
* | Merge branch 'master' of github.com:rails/docrailsVijay Dev2015-10-042-1/+3
|\ \
| * | Renamed ‘Return’ to ‘Returns’ [ci skip]Ronak Jangir2015-09-281-1/+1
| | |
| * | [ci skip] Fix document of `ActionController::RequestForgeryProtection`yui-knk2015-09-281-0/+2
| | | | | | | | | | | | | | | * add `end` to end of class definition * add a blank line between explanation and example code
* | | remove useless methodAaron Patterson2015-09-281-4/+0
| | | | | | | | | | | | | | | the caller of `handle_conditional_get!` checks the committed state of the response, so we don't need to in the subclass.
* | | commit the flash after the controller finishes being servicedAaron Patterson2015-09-251-0/+1
| | | | | | | | | | | | | | | Committing the flash needs to happen in order for the session to be written correctly, so lets guarantee that it actually does happen.
* | | move the Header hash to the super classAaron Patterson2015-09-241-27/+0
| | | | | | | | | | | | | | | | | | | | | I want to move the header hash to the super request object in order to consolidate behavior. We should be switching out buffering strategies rather than header strategies since things like "mutating headers after send" is an error in both cases (buffering vs streaming).
* | | stop directly setting headers on the controllerAaron Patterson2015-09-231-5/+0
| | | | | | | | | | | | | | | again, since we are going through the test harness, all this is done for us.
* | | stop constructing a request object in this setterAaron Patterson2015-09-231-1/+0
| | | | | | | | | | | | | | | Since we just go through the normal test harness that sets up a request for us, we don't need to do this anymore.
* | | stop applying default headers in ActionDispatch::ResponseAaron Patterson2015-09-233-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I'm making this change so that I can construct response objects that *don't* have the default headers applied. For example, I would like to construct a response object from the return value of a controller. If you need to construct a response object with the default headers, then please use the alternate constructor: `ActionDispatch::Response.create`
* | | Document Bearer prefix for Authorization header [ci skip]Eliot Sykes2015-09-231-5/+7
| | |
* | | Updated Mime Negotiations docs [ci skip]amitkumarsuroliya2015-09-231-2/+2
| | | | | | | | | As we all know that Accessing mime types via constants is deprecated. Now, we are using `Mime::Type[:JSON]` instead of `Mime::JSON`
* | | don't deal with `nil` valuesAaron Patterson2015-09-221-1/+3
| | | | | | | | | | | | | | | We can know whether or not there is a content type object, and just exit early. There is no need to `try` so hard.
* | | swap upcase and to_symAaron Patterson2015-09-211-1/+1
| | |
* | | stop calling deprecated methodsAaron Patterson2015-09-214-14/+14
| | | | | | | | | | | | | | | We should be asking the mime type method for the mime objects rather than via const lookup
* | | remove outdated commentAaron Patterson2015-09-181-4/+0
| | | | | | | | | | | | | | | all parameter parsing is done on the request object now, so we don't need to worry about at ParamParser middleware
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-08 15:38:08 +0000