aboutsummaryrefslogtreecommitdiffstats
path: root/actionpack/lib/action_dispatch
Commit message (Collapse)AuthorAgeFilesLines
...
* Call super to remove the verify methodKasper Timm Hansen2015-09-081-8/+2
| | | | | `SignedCookieJar`'s parse method already attempts to verify the message, so we can just call super and try the old verifier if it fails.
* Add parse method to share deserialization logic.Kasper Timm Hansen2015-09-081-19/+12
| | | | Cuts down on the duplicated reading parts.
* Add commit in the EncryptedCookieJarKasper Timm Hansen2015-09-081-17/+7
| | | | Gets rid of the option parsing and makes what the encryptor does stand out.
* Use commit in the SignedCookieJarKasper Timm Hansen2015-09-081-15/+6
| | | | Lets us avoid worrying about parsing the options and doing just what we need.
* Add commit method to share option normalizationKasper Timm Hansen2015-09-081-4/+12
| | | | Remove the clutter to make PermanentCookieJar's one change stand out.
* Add AbstractCookieJar class.Kasper Timm Hansen2015-09-081-1/+3
| | | | Eventually this will be the superclass of all the chained jars.
* Merge pull request #21502 from ↵Rafael Mendonça França2015-09-081-1/+2
|\ | | | | | | | | | | bernerdschaefer/bs-polymorphic-url_for-dups-arguments `url_for` does not modify polymorphic options
| * `url_for` does not modify polymorphic optionsBernerd Schaefer2015-09-041-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The `url_for` methods in `actionpack` and `actionview` now make a copy of the provided options before generating polymorphic paths or URLs. The bug in the previous behavior is most noticeable in a case like: url_options = [:new, :post, param: 'value'] if current_page?(url_options) css_class = "active" end link_to "New Post", url_options, class: css_class
* | Make `config.force_ssl` less dangerous to try and easier to disableJeremy Daer2015-09-071-36/+92
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | SSL redirect: * Move `:host` and `:port` options within `redirect: { … }`. Deprecate. * Introduce `:status` and `:body` to customize the redirect response. The 301 permanent default makes it difficult to test the redirect and back out of it since browsers remember the 301. Test with a 302 or 307 instead, then switch to 301 once you're confident that all is well. HTTP Strict Transport Security (HSTS): * Shorter max-age. Shorten the default max-age from 1 year to 180 days, the low end for https://www.ssllabs.com/ssltest/ grading and greater than the 18-week minimum to qualify for browser preload lists. * Disabling HSTS. Setting `hsts: false` now sets `hsts: { expires: 0 }` instead of omitting the header. Omitting does nothing to disable HSTS since browsers hang on to your previous settings until they expire. Sending `{ hsts: { expires: 0 }}` flushes out old browser settings and actually disables HSTS: http://tools.ietf.org/html/rfc6797#section-6.1.1 * HSTS Preload. Introduce `preload: true` to set the `preload` flag, indicating that your site may be included in browser preload lists, including Chrome, Firefox, Safari, IE11, and Edge. Submit your site: https://hstspreload.appspot.com
* | implement abstract store methodsAaron Patterson2015-09-042-5/+5
| | | | | | | | converts old ID methods to the new abstract store methods in Rack
* | stop using deprecated Abstract::ID classAaron Patterson2015-09-043-3/+3
| |
* | stop inheriting from Rack::RequestAaron Patterson2015-09-0410-17/+19
| | | | | | | | | | | | Just include the modules necessary in the Request object to implement the things we need. This should make it easier to build delegate request objects because the API is smaller
* | use `Rack::Utils.unescape_path` to unescape pathsAaron Patterson2015-09-041-3/+3
|/ | | | | | Escaping and unescaping paths is different than query parameters, and we need to respect that. This commit uses the new method in Rack to escape and unescape paths. Fixes #11816
* Merge pull request #21483 from justanshulsharma/add-ip6-addressEileen M. Uchitelle2015-09-031-1/+1
|\ | | | | [ci skip] Added localhost IPv6
| * [ci skip] Added localhost IPv6Anshul Sharma2015-09-031-1/+1
| |
* | Fix route creation when format is a blank stringeileencodes2015-09-021-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit bff61ba, while reducing allocations, caused a regression when an empty format is passed to a route. This can happen in cases where you're using an anchor tag, for example: `https://example.com/parent/575256966.#child_1032289285`. Because of this change `format` was getting sent in `parameterized_parts` when previously it was not included. This resulted in blank `format`'s being returned as `.` when if there was an extension included it would be `.extension`. Since there was no extension this caused incorrect URL's. The test shows this would result in `/posts/show/1.` instead of `/posts/show/1` which causes bad urls since the format is not present.
* | Remove not used requiresMarcin Olichwirowicz2015-09-015-10/+1
| |
* | Fix bug where cookies mutated by request were not persistedeileencodes2015-09-011-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | With changes made in 8363b8 and ae29142 cookies that are mutated on the request like `cookies.signed = x` were not retained in subsequent tests, breaking cookie authentiation in controller tests. The test added demonstrates the issue. The reason we need to select from non-deleted cookies is because without checking the `@delete_cookies` the `cookie_jar` `@cookies` will send the wrong cookies to be updated. The code must check for `@deleted_cookies` before sending an `#update` with the requests cookie_jar cookies. This follows how the cookie_jar cookies from the request were updated before these changes.
* | Merge pull request #19788 from cmdrclueless/actionpack_http_url_ipv6Rafael Mendonça França2015-09-011-1/+1
|\ \ | | | | | | Fix broken IPv6 addresses handling
| * | Fix broken IPv6 addresses handlingBrian Weaver2015-04-161-1/+1
| | |
* | | add a method for getting the http auth saltAaron Patterson2015-08-291-0/+4
| | |
* | | Merge pull request #21396 from rodzyn/code-cleanupGuillermo Iguaran2015-08-282-13/+2
|\ \ \ | | | | | | | | Code cleanup
| * | | Code cleanupMarcin Olichwirowicz2015-08-272-13/+2
| | |/ | |/| | | | | | | | | | | | | | | | | | | Cleanup for `ActionDispatch::Http::Parameters` - no need for required libraries and remove not used private method. Apparently this method was used in `ActionDispatch::Http::Request` - fixed by calling `Request::Utils` explicitly (as was done in other parts of the codebase)
* | | remove dependency on `@cache_control` ivarAaron Patterson2015-08-271-6/+6
| | | | | | | | | | | | | | | eventually we'll remove this instance variable, but this is the first step
* | | remove `@etag` ivarAaron Patterson2015-08-271-5/+7
| | | | | | | | | | | | | | | we're storing the value in the headers hash, so lets just store the value in one place.
* | | use the abstract API in modulesAaron Patterson2015-08-272-14/+15
| | | | | | | | | | | | | | | Modules should be using the API that the abstract modules use so that we can move these modules between implementations
* | | remove useless conditionalAaron Patterson2015-08-271-2/+0
| | | | | | | | | | | | | | | cookies are always stored as a string in the header hash, so it will not need to be joined.
* | | implement the API required by the abstract Rack request.Aaron Patterson2015-08-271-16/+8
| | |
* | | use the non-hash dependent Rack utils APIAaron Patterson2015-08-271-2/+2
|/ / | | | | | | eventually we will refactor this to not know about header hashes
* | remove redefined methodAaron Patterson2015-08-261-3/+0
| | | | | | | | | | Rack::Response::Helpers implements this method, so we can safely remove it
* | provide a request and response to all controllersAaron Patterson2015-08-252-5/+8
| | | | | | | | | | | | | | | | | | | | Controllers should always have a request and response when responding. Since we make this The Rule(tm), then controllers don't need to be somewhere in limbo between "asking a response object for a rack response" or "I, myself contain a rack response". This duality leads to conditionals spread through the codebase that we can delete: * https://github.com/rails/rails/blob/85a78d9358aa728298cd020cdc842b55c16f9549/actionpack/lib/action_controller/metal.rb#L221-L223
* | adding a direct dispatch method to controller classesAaron Patterson2015-08-251-1/+1
| | | | | | | | This saves a lambda and request allocation on each request.
* | always dispatch to controllers the same wayAaron Patterson2015-08-252-7/+25
| | | | | | | | | | controllers should always go through the `action` class method so that their middleware is respected.
* | always return a controller class from the `controller_class` methodAaron Patterson2015-08-252-9/+14
| | | | | | | | | | now the caller can just treat it like a regular controller even though it will return a 404
* | Remove unused requiresMarcin Olichwirowicz2015-08-251-2/+0
| | | | | | | | They are already required in `actionpack/lib/action_dispatch.rb` (L25-L26)
* | Make `assert_index` privateMarcin Olichwirowicz2015-08-251-3/+1
| | | | | | | | | | This `protected` keyword looks like some leftover, since we are not using explicit receiver, this should go under `private`
* | Remove unused block argumentsAnshul Sharma2015-08-251-1/+1
| |
* | Remove unused block argumentsamitkumarsuroliya2015-08-251-1/+1
| |
* | remove another `@env` accessAaron Patterson2015-08-241-1/+1
| |
* | remove more direct access to `env`Aaron Patterson2015-08-242-3/+4
| |
* | fewer calls to `env`Aaron Patterson2015-08-241-2/+2
| | | | | | | | We don't want to directly access the env hash
* | stop using `@env` in the GET / POST methodsAaron Patterson2015-08-242-4/+11
| | | | | | | | | | I want to implement this with something besides `@env` in the future, so lets stop directly referencing it.
* | pull up dispatcher allocationAaron Patterson2015-08-242-5/+1
| | | | | | | | | | the dispatcher class isn't configurable anymore, so pull up allocation to the method that needs it.
* | directly ask the request for the controller classAaron Patterson2015-08-241-6/+1
| | | | | | | | | | | | Now that we don't have subclasses depending on this method (they augment the request class instead of the dispatch class) we can remove this method and directly ask the request object for the controller class
* | remove useless ivarAaron Patterson2015-08-241-2/+1
| |
* | remove setter for the dispatcher classAaron Patterson2015-08-241-2/+2
| | | | | | | | we don't need it anymore. We always use the same dispatcher in tests.
* | use a custom request class to determine the controller classAaron Patterson2015-08-241-2/+7
| | | | | | | | | | | | controller class resolution has been moved to the request object, so we should override that method instead of relying on the RouteSet to generate the controller class.
* | Merge pull request #21339 from deepj/unused-block-argumentsCarlos Antonio da Silva2015-08-241-2/+2
|\ \ | | | | | | Remove unused block arguments
| * | Remove unused block argumentsdeepj2015-08-231-2/+2
| | |
* | | use methods on the request object instead of accessing envAaron Patterson2015-08-231-7/+7
| | |
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-08 08:17:36 +0000