| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
- `secrets.secret_token` is now used in all places `config.secret_token` was
- `secrets.secret_token`, when not present in `config/secrets.yml`,
now falls back to the value of `config.secret_token`
- when `secrets.secret_token` is set, it over-writes
`config.secret_token` so they are the same (for backwards-compatibility)
- Update docs to reference app.secrets in all places
- Remove references to `config.secret_token`, `config.secret_key_base`
- Warn that missing secret_key_base is deprecated
- Add tests for secret_token, key_generator, and message_verifier
- the legacy key generator is used with the message verifier when
secrets.secret_key_base is blank and secret_token is set
- app.key_generator raises when neither secrets.secret_key_base nor
secret_token are set
- app.env_config raises when neither secrets.secret_key_base nor
secret_token are set
- Add changelog
Run focused tests via
ruby -w -Itest test/application/configuration_test.rb -n '/secret_|key_/'
|
|\
| |
| | |
Remove redundant `to_s` in interpolation
|
| | |
|
|\ \
| |/
|/|
| |
| | |
* master-sec:
FileHandler should not be called for files outside the root
|
| |
| |
| |
| |
| | |
FileHandler#matches? should return false for files that are outside the
"root" path.
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
This patch uniformizes warning messages. I used the most common style
already present in the code base:
* Capitalize the first word.
* End the message with a full stop.
* "Rails 5" instead of "Rails 5.0".
* Backticks for method names and inline code.
Also, converted a few long strings into the new heredoc convention.
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
The current style for warning messages without newlines uses
concatenation of string literals with manual trailing spaces
where needed.
Heredocs have better readability, and with `squish` we can still
produce a single line.
This is a similar use case to the one that motivated defining
`strip_heredoc`, heredocs are super clean.
|
| | |
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
In cases where this option is set to `true`, the option is redundant and can
be safely removed; otherwise, the corresponding `*_url` helper should be
used instead.
Fixes #17294.
See also #17363.
[Dan Olson, Godfrey Chan]
|
| |
| |
| |
| | |
trace list, closes #17312
|
|\ \
| | |
| | | |
Fix url generation error message
|
| | | |
|
| | | |
|
|/ /
| |
| |
| |
| | |
- Also one minor change for documenting url_for method in ActionController::Metal.
[ci skip]
|
| | |
|
|\ \
| | |
| | | |
ActionController::InvalidCrossOriginRequest fails with 422 instead of 500
|
| | |
| | |
| | |
| | | |
Fixes #15967
|
| | |
| | |
| | |
| | |
| | | |
`#tr` is more efficient than `#gsub` and can be used as a drop in
replacement in this context.
|
|/ /
| |
| |
| |
| |
| |
| |
| |
| |
| | |
The scanner in Journey fails to recognize routes that use literals
from the sub-delims section of RFC 3986.
This commit enhance the compatibility of Journey with the RFC by
adding support of authorized delimiters to the scanner.
Fix #17212
|
|/ |
|
|
|
|
|
|
|
|
| |
Request#check_method would use to_sentence(locale: :en), which breaks when
I18n.available_locales does not include :en and
I18n.enforce_available_locales is true (default).
Inlined to_sentence functionality to solve this.
|
|
|
|
| |
This is to match the changes in Rails Dom Testing rails/rails-dom-testing#20.
|
|
|
|
|
|
| |
Hash#keys.each allocates an array of keys; Hash#each_key iterates through the
keys without allocating a new array. This is the reason why Hash#each_key
exists.
|
|
|
|
|
|
|
|
| |
This reverts commit 9d05d6de52871e57bfbf54a60de005e8a5f5b0e4, reversing
changes made to 0863c9248fd47a15e88e05ce4fcd80966684c0e3.
The change in the behaviour reported at #16958 doesn't exist since 4.0
and 4.1 works in the same way
|
| |
|
| |
|
|
|
|
| |
Fixes #17057
|
|
|
|
|
|
|
|
| |
As of rack/rack@167b6480235ff00ed5f355698bf00ec2f250f72e, Rack raises
Rack::Utils::ParameterTypeError which inherits TypeError.
In terms of the behavior, Rescuing TypeError still works but this
method shouldn't rescue if TypeError is raised for other reasons.
|
| |
|
|
|
|
| |
[ci skip]
|
|
|
|
| |
- [ci skip]
|
| |
|
| |
|
| |
|
| |
|
|\
| |
| |
| | |
Propagate test messages through assert_routing helper, Fixes #14908
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
assert_routing was not raising the message passed into the assertion
violation that it raised. This change propagates messages through
the on_fail error.
This fixes this error:
https://github.com/rails/rails/issues/14908
A test case for this issue is located here.
https://github.com/estsauver/test14908
To see that test case fail in the example app, just run
ruby -Itest test/controllers/guests_controller_test.rb
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Suppose you have two resources routed in the following manner:
```ruby
resources :blogs do
resources :posts
end
resources :posts
```
When using polymorphic resource routing like `url_for([@blog, @post])`, and `@blog` is `nil` Rails should still try to match the route to the top-level posts resource.
Fixes #16754
|
| |
| |
| |
| |
| |
| |
| |
| | |
IPAddr::InvalidAddressError does not exist in Ruby 1.9.3
and fails for JRuby in 1.9 mode.
As IPAddr::InvalidAddressError is a subclass of ArgumentError
(via IPAddr::Error) just rescuing ArgumentError is fine.
|
|\ \
| | |
| | | |
Fix the router ignoring constraints when used together with a redirect route
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
https://github.com/rails/rails/commit/402c2af55053c2f29319091ad21fd6fa6b90ee89
introduced a regression that caused any constraints added to redirect routes
to be ignored.
Fixes #16605
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Dir.glob can be a security concern. The original use was to provide logic of fallback files. Example a request to `/` should render the file from `/public/index.html`. We can replace the dir glob with the specific logic it represents. The glob {,index,index.html} will look for the current path, then in the directory of the path with index file and then in the directory of the path with index.html. This PR replaces the glob logic by manually checking each potential match. Best case scenario this results in one less file API request, worst case, this has one more file API request.
Related to #16464
Update: added a test for when a file of a given name (`public/bar.html` and a directory `public/bar` both exist in the same root directory. Changed logic to accommodate this scenario.
|
|/ /
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
- don't mutate PATH_INFO in env, test
- test fallback content type matches Rack::File
- change assertion style
- make HTTP_ACCEPT_ENCODING comparison case insensitive
- return gzip path from method instead of true/false so we don't have to assume later
- don't allocate un-needed hash.
Original comments:
https://github.com/rails/rails/commit/
cfaaacd9763642e91761de54c90669a88d772e5a#commitcomment-7468728
cc @jeremy
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Refactored IP address checking in ActionDispatch::RemoteIp to rely on
the IPAddr class instead of the unwieldly regular expression to match
IP addresses. This commit keeps the same api but allows users to pass
IPAddr objects to config.action_dispatch.trusted_proxies in addition
to passing strings and regular expressions.
Example:
# config/environments/production.rb
config.action_dispatch.trusted_proxies = IPAddr.new('4.8.15.0/16')
|
| |
| |
| |
| |
| |
| |
| |
| | |
Follow up to rails#15321
Instead of duplicating the routes, we will first match the HEAD request to
HEAD routes. If no match is found, we will then map the HEAD request to
GET routes.
|
| |
| |
| |
| |
| |
| | |
If someone is using ActionDispatch::Static to serve assets and makes it past the `match?` then the file exists on disk and it will be served. This PR adds in logic that checks to see if the file being served is already compressed (via gzip) and on disk, if it is it will be served as long as the client can handle gzip encoding. If not, then a non gzip file will be served.
This additional logic slows down an individual asset request but should speed up the consumer experience as compressed files are served and production applications should be delivered with a CDN. This PR allows a CDN to cache a gzip file by setting the `Vary` header appropriately. In net this should speed up a production application that are using Rails as an origin for a CDN. Non-asset request speed is not affected in this PR.
|
| |
| |
| |
| | |
Related with #11795.
|
|\ \
| | |
| | |
| | |
| | |
| | |
| | | |
Conflicts:
actionpack/lib/action_controller/metal/mime_responds.rb
actionview/lib/action_view/vendor/html-scanner/html/sanitizer.rb
activerecord/lib/active_record/type/value.rb
|
| | |
| | |
| | |
| | | |
[skip ci]
|
| | | |
|