| Commit message (Collapse) | Author | Age | Files | Lines |
|\
| |
| |
| |
| | |
Conflicts:
actionpack/CHANGELOG.md
|
| |
| |
| |
| |
| |
| |
| | |
Previously the values of these options were trusted leading to
potential XSS vulnerabilities.
Fixes: CVE-2014-0081
|
| |
| |
| |
| |
| |
| |
| | |
Escalate missing error when :raise is true in translate helper, fix regression introduced by security fix.
Conflicts:
actionpack/CHANGELOG.md
|
|/
|
|
|
|
| |
Now users have to explicit mark the unit as safe if they trust it.
Closes #13161
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
i18n doesn't depend on active support which means it can't use our html_safe
code to do its escaping when generating the spans. Rather than try to sanitize
the output from i18n, just revert to our old behaviour of rescuing the error
and constructing the tag ourselves.
Fixes: CVE-2013-4491
Conflicts:
actionpack/lib/action_view/helpers/translation_helper.rb
Backport: 50afd8eec9d088ad5a2d41f00a05520d5b78a6a0
|
|
|
|
|
|
| |
Fixes CVE-2013-6415
Previously the values were trusted blindly allowing for potential XSS attacks.
|
|
|
|
| |
Always escape the result of link_to_unless method
|
| |
|
|
|
|
|
|
|
|
| |
If a file field tag is passed the multiple option, it is turned into an
array field (appending "[]"), but if the file field is passed an
explicit name as an option, leave the name alone (do not append "[]").
Fixes #9830
|
| |
|
|
|
|
| |
Closes #9767.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Fix incorrectly appended square brackets to a multiple select box
Before:
select(:category, [], {}, {:multiple => true, :name => "post[category][]"})
# => <select name="post[category][][]" ...>
After:
select(:category, [], {}, {:multiple => true, :name => "post[category][]"})
# => <select name="post[category][]" ...>
Conflicts:
actionpack/CHANGELOG.md
actionpack/lib/action_view/helpers/tags/base.rb
actionpack/test/template/form_options_helper_test.rb
|
| |
|
|
|
|
|
| |
Another missing dependency, now affecting #number_to_percentage.
It depends on reverse_merge.
|
|
|
| |
symbolize_keys depends on hash/keys AS core extension
|
|
|
|
|
|
| |
Conflicts:
actionpack/lib/action_view/helpers/form_helper.rb
actionpack/test/template/form_helper_test.rb
|
|
|
|
| |
Fix typo on form_tag_helper.rb [ci skip]
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Because DateTime#to_time returns self when it has a non-zero offset
and subtracting two DateTime instances returns a Rational then the
distance_of_time_in_words methods outputs an incorrect value.
This is fixed in master because we can rely on Ruby 1.9.3's
implementation of to_time but it can't be fixed on Ruby 1.8.7 as
there is no way to map the DateTime to a Time with a non-zero offset.
We can workaround the problem by casting to Float before doing
the subtraction in the distance_of_time_in_words method.
Closes #8390
|
|
|
|
|
|
|
|
|
|
| |
This commit fixes the output of distance_of_time_in_words when
using integer or duration arguments. Previously a distance of
more than 30 seconds would be output as 'Less than 1 minute'
when using integer arguments and '1 minute' when using two
Time instances more than 30 seconds apart.
Cherry picked from 5fdd4cd9e47be972f146a8a17a74c8f4700e2ac0
|
|
|
|
| |
This is a backport of rails/rails#7997.
|
| |
|
|
|
|
|
|
|
| |
Support :multiple option on input tags that also have :index
Conflicts:
actionpack/lib/action_view/helpers/tags/base.rb
actionpack/lib/action_view/helpers/tags/collection_check_boxes.rb
|
|
|
|
|
| |
Accept either :remote or 'remote' in both the html_options and
(url_)options hash arguments to link_to.
|
|
|
|
|
|
|
|
|
|
|
|
| |
we should take disabled option not only from `html_options` hash but from
`options` hash too like `build_select` method does it. So
datetime_select("post", "updated_at", { :discard_minute => true }, { :disabled => true })
datetime_select("post", "updated_at", :discard_minute => true , :disabled => true)
both these variants work now
closes #7431
|
|
|
|
|
|
| |
option_tags coerced to "" instead of nil
Closes #7404
|
|\ |
|
| |
| |
| |
| |
| |
| | |
Thanks to Marek Labos & Nethemba
CVE-2012-3465
|
| |
| |
| |
| | |
CVE-2012-3463
|
| | |
|
|/
|
|
|
|
| |
Rails were including 'application.js' to the pack when using
`javascript_include_tag :all` even there's no application.js in the
public directory.
|
|
|
|
| |
This reverts commit 9dc57fe9c4807fc0ad4b1590a931891d9faa3164.
|
|
|
|
|
|
|
| |
This reverts commit 1aff7725c7a04cde202cca906208560a55409e6a.
Conflicts:
actionpack/CHANGELOG.md
|
|
|
|
|
|
|
|
|
|
|
| |
option"
Revert "Deprecate `:disable_with` in favor of `'data-disable-with'` option for `button_to` and `submit_tag` helpers."
This reverts commit fc092a9cba5fceec38358072e50e09250cf58840.
This reverts commit e9051e20aeb2c666db06b6217954737665878db7.
This reverts commit d47d6e7eda3aa3e6aa28d0c17ac6801234bb97d1.
This reverts commit 21141e777bdce8534e3755c8de7268324b3d8714.
|
|
|
|
|
|
|
|
|
| |
When a select tag is created for a field with errors, and that select
tag has :prompt or :include_blank options, then the inserted first
option will errantly have a <div class="field_with_errors"> wrapping
it.
See https://github.com/rails/rails/issues/7017
|
|
|
|
|
|
|
|
|
|
| |
instead of line continuations. While I'm at it, wrap long comment lines consistently.
Conflicts:
actionpack/lib/action_view/helpers/number_helper.rb
There was just one conflict related to the addition of the :format
option to number_to_percentage.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
This deprecation applies to:
`button_to`
`button_tag`
`image_submit_tag`
`link_to`
`submit_tag`
As :confirm is an UI specific option is better to use the data attributes,
teaching users about unobtrusive JavaScript and how Rails works with it.
|
| |
|
|
|
|
|
|
|
| |
`excerpt` text helper uses `:radius`, not `line_width` (that is used by
`word_wrap` helper).
Also cleanup some whitespaces.
|
|
|
|
| |
Render img tag with empty src if empty string is passed to image_tag.
|
| |
|
| |
|
| |
|
|
|
|
| |
`button_to` and `submit_tag` helpers.
|
| |
|
|
|
|
| |
Support data: url scheme
|
| |
|
| |
|
|
|
|
| |
closes #3341
|