aboutsummaryrefslogtreecommitdiffstats
path: root/actionpack/lib/action_dispatch/http
Commit message (Collapse)AuthorAgeFilesLines
* stop caching mime types globallyAaron Patterson2016-01-221-2/+16
| | | | | | | Unknown mime types should not be cached globally. This global cache leads to a memory leak and a denial of service vulnerability. CVE-2016-0751
* Deep Munge the parameters for GET and POSTMichael Koziarski2013-12-021-2/+2
| | | | | | | | | | | The previous implementation of this functionality could be accidentally subverted by instantiating a raw Rack::Request before the first Rails::Request was constructed. Fixes CVE-2013-6417 Conflicts: actionpack/lib/action_dispatch/http/request.rb
* Backport fixes about #7774 to 3-2-stablemaximerety2013-03-051-2/+2
| | | | | Fix ActionDispatch::Request#formats when HTTP_ACCEPT header is an empty string.
* fixes #8631 local inflections from interfereing with HTTP_METHOD_LOOKUP ↵Aditya Sanghi2013-01-161-1/+6
| | | | dispatch logic
* Remove unnecessary caching of ParameterFilterAndrew White2013-01-121-3/+1
|
* Merge branch '3-2-sec' into 3-2-secmergeAaron Patterson2013-01-081-6/+4
|\ | | | | | | | | | | | | | | | | | | | | | | | | * 3-2-sec: bumping version CVE-2013-0156: Safe XML params parsing. Doesn't allow symbols or yaml. * Strip nils from collections on JSON and XML posts. [CVE-2013-0155] * dealing with empty hashes. Thanks Damien Mathieu Avoid Rack security warning no secret provided Conflicts: actionpack/CHANGELOG.md activerecord/CHANGELOG.md activesupport/CHANGELOG.md
| * * Strip nils from collections on JSON and XML posts. [CVE-2013-0155] * ↵Aaron Patterson2013-01-081-6/+4
| | | | | | | | dealing with empty hashes. Thanks Damien Mathieu
* | Backport #8701, do not append a second slash with `trailing_slash: true`Yves Senn2013-01-021-1/+5
| |
* | Merge pull request #8490 from mattv/fix_request_raw_postRafael Mendonça França2012-12-111-2/+3
|/ | | | | | Fix rewinding in ActionDispatch::Request#raw_post Conflicts: actionpack/CHANGELOG.md
* Since File instance doesn't respond to #open use a double to test theRafael Mendonça França2012-09-301-1/+1
| | | | behavior added at c53e5def08f7a289a92a8e5f79dcd7caa5c3a2fb
* Array parameters should not contain nil values.Aaron Patterson2012-06-111-2/+4
|
* Strip [nil] from parameters hash.Aaron Patterson2012-05-301-0/+22
| | | | | | Thanks to Ben Murphy for reporting this! CVE-2012-2660
* Reset the request parameters after a constraints checkAndrew White2012-05-031-0/+4
| | | | | | | | | | | | | | A callable object passed as a constraint for a route may access the request parameters as part of its check. This causes the combined parameters hash to be cached in the environment hash. If the constraint fails then any subsequent access of the request parameters will be against that stale hash. To fix this we delete the cache after every call to `matches?`. This may have a negative performance impact if the contraint wraps a large number of routes as the parameters hash is built by merging GET, POST and path parameters. Fixes #2510. (cherry picked from commit 56030506563352944fed12a6bb4793bb2462094b)
* backporting #4918 to 3.2 stable; adding extra test for accept header given ↵Aditya Sanghi2012-02-171-1/+3
| | | | by googlebot
* Add original_fullpath and original_url methods to RequestPiotr Sarnacki2012-01-101-0/+8
|
* Allow symbols to be passed for extension aliasesJustin Campbell2011-12-171-1/+1
|
* Fix url_for options[:subdomain] to allow objects as valueschoonkeat2011-12-141-1/+1
| | | | * e.g. blog_url(subdomain: current_user) instead of blog_url(subdomain: current_user.to_param)
* use Array#join so that file encoding doesn't impact returned string.Aaron Patterson2011-12-121-3/+3
| | | | Fixes #3957
* Remove dead broken code from AD::RequestJosé Valim2011-12-081-8/+0
|
* Use freezed string constant. Some string literals is used repeatedly.kennyj2011-12-083-24/+40
|
* Use default charset when we read content type without charset.kennyj2011-12-071-1/+1
|
* Fix ActionDispatch::Request method explanationsTravis Pew2011-11-281-5/+5
| | | | | | | | The methods, "post?", "put?", "head?", etc. contain an incorrect explanation. They state that they are equivalent to request_method == :type, but this is not accurate because the methods convert the string to a symbol. They are actually equivalent to: request_method_symbol == :type
* Merge pull request #3617 from indirect/remote_ipJosé Valim2011-11-131-18/+1
|\ | | | | refactor RemoteIp middleware
| * refactor RemoteIp middlewareAndre Arko2011-11-111-18/+1
| | | | | | | | | | | | | | | | | | | | | | - return the last forwarded IP before REMOTE_ADDR to handle proxies - remove completely superfluous RemoteIpGetter class - remove duplication of trusted proxies regexp - remove unused constant from Request - move comments from Request to where they are actually relevant - edit comments for clarity of purpose The original code (confusingly) tried to return REMOTE_ADDR both at the beginning and the end of the chain of options. Since REMOTE_ADDR is _always_ set, this is kind of silly. This change leaves REMOTE_ADDR as the last option, so that proxied requests will be assigned the correct remote IP address.
* | Unneeded require memoizableAkira Matsuda2011-11-121-2/+0
|/
* Fix trouble using :subdomain in development environment when using ↵Bradford Folkens2011-11-081-1/+1
| | | | | | | | | | | | | | | | numeric addresses. See-also pull request #3561 from 3-1-stable Otherwise the following occurs: TypeError: can't convert nil into String /Users/bfolkens/dev/bfolkens-rails-core/actionpack/lib/action_dispatch/http/url.rb:75:in host_or_subdomain_and_domain' /Users/bfolkens/dev/bfolkens-rails-core/actionpack/lib/action_dispatch/http/url.rb:37:in url_for' /Users/bfolkens/dev/bfolkens-rails-core/actionpack/lib/action_dispatch/routing/url_for.rb:147:in test_subdomain_may_be_accepted_with_numeric_host' /Users/bfolkens/dev/bfolkens-rails-core/activesupport/lib/active_support/testing/setup_and_teardown.rb:67:in run' /Users/bfolkens/dev/bfolkens-rails-core/activesupport/lib/active_support/callbacks.rb:426:in send' /Users/bfolkens/dev/bfolkens-rails-core/activesupport/lib/active_support/callbacks.rb:81:in run'
* Added X-Request-Id tracking and TaggedLogging to easily log that and other ↵David Heinemeier Hansson2011-10-191-0/+10
| | | | production concerns
* / is allowed in URI fragmentsJeremy Kemper2011-10-131-1/+1
|
* Clean up subdomain code a bit.José Valim2011-10-041-2/+2
|
* :subdomain can now be specified with a value of false in url_for, allowing ↵Kamil Sobieraj2011-10-041-3/+5
| | | | for subdomain(s) removal from the host during link generation. Closes #2025
* Implement Mime::Type#respond_to? (consistently with #method_missing)Evgeniy Dolzhenko2011-09-251-0/+4
|
* removing backwards compatibility moduleAaron Patterson2011-09-121-1/+1
|
* Refactor ActionDispatch::Http::UploadedFileDaniel Schierbeck2011-08-281-14/+3
|
* document meta methodVijay Dev2011-08-041-3/+3
|
* Check Accept and Content-Type headers before evaluating them in xhr ↵ogeidix2011-07-191-1/+2
| | | | | | requests. Closes #2119 An xhr request must have an "Accept" or "Content-type" header in order to be considered a request with valid_accept_header.
* TODO fix explicitly loading exceptations, autoload removedVishnu Atrai2011-07-111-0/+1
|
* Fix test to use Mime::ZipArun Agrawal2011-06-281-3/+3
|
* Register some commonly used mime types (png, jpeg, pdf, zip etc.) per defaultEsad Hajdarevic2011-06-281-0/+12
|
* Remove usage of memoizable from ActionPack.José Valim2011-06-161-3/+3
|
* all requests are utf-8. Don't use the external encoding.Damien Mathieu2011-06-141-3/+2
|
* encode the uploaded file's name in the default external encoding - Closes #869Damien Mathieu2011-06-141-1/+12
|
* Merge branch 'master' of git://github.com/lifo/docrailsXavier Noria2011-05-252-5/+5
|\ | | | | | | | | | | Conflicts: actionmailer/lib/action_mailer/base.rb activesupport/lib/active_support/core_ext/kernel/requires.rb
| * Remove extra white spaces on ActionPack docs.Sebastian Martinez2011-05-232-5/+5
| |
* | removed deprecated methods, and related tests, from ActionPackJosh Kalderimis2011-05-242-30/+1
| |
* | Make :status an attr_reader to avoid unnecessary warning when replacing status=wycats2011-05-221-1/+2
|/
* Dump and load rack-cache stuff.José Valim2011-05-171-2/+6
|
* Merge branch 'master' of git://github.com/lifo/docrailsXavier Noria2011-05-141-1/+1
|\ | | | | | | | | | | Conflicts: actionpack/lib/action_view/helpers/date_helper.rb railties/lib/rails/generators/rails/app/templates/config/initializers/wrap_parameters.rb.tt
| * minor correction to the ActionDispatch::Http::URL subdomain docsJosh Kalderimis2011-05-041-1/+1
| |
* | Fix previous commit by allowing a proc to be given as response_body. This is ↵José Valim2011-05-102-29/+53
| | | | | | | | deprecated and is going to be removed in future releases.
* | Only show dump of regular env methods on exception screen (not all the rack ↵David Heinemeier Hansson2011-05-041-4/+5
|/ | | | crap) [DHH]
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-08 05:24:14 +0000