| Commit message (Collapse) | Author | Age | Files | Lines | |
|---|---|---|---|---|---|
| * | Filter sensitive query string parameters in the log [#6244 state:committed] | Prem Sichanugrist & Xavier Noria | 2011-03-11 | 1 | -4/+17 |
| | | | | | | | This provides more safety to applications that put secret information in the query string, such as API keys or SSO tokens. Signed-off-by: Xavier Noria <fxn@hashref.com> | ||||
| * | Filter params that return nil for to_param and allow through false values | Andrew White | 2011-03-09 | 2 | -2/+1 |
| | | |||||
| * | stop being clever and just call methods on the Route object | Aaron Patterson | 2011-03-08 | 2 | -1/+4 |
| | | |||||
| * | test/unit in ruby trunk adds a new instance variable. YAY! | Aaron Patterson | 2011-03-08 | 1 | -0/+1 |
| | | |||||
| * | more "SSL everywhere" for GitHub URLs | Akira Matsuda | 2011-03-07 | 1 | -1/+1 |
| | | | | | see: https://github.com/blog/738-sidejack-prevention-phase-2-ssl-everywhere | ||||
| * | fix typos | Akira Matsuda | 2011-03-07 | 1 | -2/+2 |
| | | |||||
| * | Improve testing of cookies in functional tests: | Andrew White | 2011-03-06 | 3 | -3/+17 |
| | | | | | | | | | | - cookies can be set using string or symbol keys - cookies are preserved across calls to get, post, etc. - cookie names and values are escaped - cookies can be cleared using @request.cookies.clear [#6272 state:resolved] | ||||
| * | Raise ArgumentError if route name is invalid [#6517 state:resolved] | Andrew White | 2011-03-06 | 1 | -0/+2 |
| | | |||||
| * | Allow model to be inherited from Hash [#6487 state:resolved] | Alexander Uvarov | 2011-03-06 | 1 | -3/+4 |
| | | | | | Signed-off-by: Andrew White <andyw@pixeltrix.co.uk> | ||||
| * | Action Pack typos. | R.T. Lechow | 2011-03-05 | 9 | -13/+13 |
| | | |||||
| * | Add an option to FormBuilder to omit hidden field with id | Alexander Uvarov | 2011-03-04 | 1 | -2/+22 |
| | | | | | | | [#4551 state:committed] Signed-off-by: Santiago Pastorino <santiago@wyeworks.com> | ||||
| * | make sure string keys are always looked up from the class cache | Aaron Patterson | 2011-03-02 | 1 | -2/+3 |
| | | |||||
| * | use newer class cache api | Aaron Patterson | 2011-03-02 | 1 | -1/+1 |
| | | |||||
| * | Fix Action caching bug where an action that has a non-cacheable response ↵ | Cheah Chu Yeow | 2011-03-02 | 1 | -3/+5 |
| | | | | | | | | | | | always renders a nil response body. It now correctly renders the response body. Note that only GET and HTTP 200 responses can be cached. [#6480 state:committed] Signed-off-by: Santiago Pastorino <santiago@wyeworks.com> | ||||
| * | yo dawg, directly use the class cache rather than the cache of the cache | Aaron Patterson | 2011-03-01 | 1 | -1/+2 |
| | | |||||
| * | refactor Reference to a ClassCache object, fix lazy lookup in Middleware so ↵ | Aaron Patterson | 2011-03-01 | 2 | -5/+13 |
| | | | | | that anonymous classes are supported | ||||
| * | initialize ivars | Aaron Patterson | 2011-03-01 | 1 | -1/+1 |
| | | |||||
| * | Enumerable gives us include?, so remove include? | Aaron Patterson | 2011-03-01 | 1 | -4/+0 |
| | | |||||
| * | prefer composition over inheritance with AD::MS | Aaron Patterson | 2011-03-01 | 2 | -9/+38 |
| | | |||||
| * | Revert "compute ext in initialize, and use an attr_reader" | Aaron Patterson | 2011-02-28 | 1 | -5/+7 |
| | | | | | | | | | This reverts commit 2dbb73bdda3b81947fd112486ac4285fb1a6e3a9. Conflicts: actionpack/lib/action_dispatch/middleware/static.rb | ||||
| * | no need to pass a regex to Regexp.compile | Aaron Patterson | 2011-02-28 | 1 | -4/+4 |
| | | |||||
| * | compute ext in initialize, and use an attr_reader | Aaron Patterson | 2011-02-28 | 1 | -7/+5 |
| | | |||||
| * | javascript_include_tag shouldn't raise if you register an expansion key with ↵ | Santiago Pastorino | 2011-02-28 | 2 | -2/+2 |
| | | | | | nil value | ||||
| * | We're in 2011, let's update our license | Prem Sichanugrist | 2011-02-22 | 3 | -3/+3 |
| | | | | | Signed-off-by: Santiago Pastorino <santiago@wyeworks.com> | ||||
| * | Prepend the CSRF filter to make it much more difficult to execute ↵ | Michael Koziarski | 2011-02-23 | 1 | -1/+1 |
| | | | | | application code before it fires. | ||||
| * | merges docrails | Xavier Noria | 2011-02-18 | 3 | -1/+45 |
| |\ | |||||
| | * | Fix Typos: remove several occurences of the the | Nicholas Rowe | 2011-02-17 | 1 | -1/+1 |
| | | | |||||
| | * | Added RDoc info for accepted options for simple_format in TextHelper. | Steve Schwartz | 2011-02-15 | 1 | -0/+7 |
| | | | |||||
| | * | add some docs for ActionController::Renderers | Gabriel Horner | 2011-02-10 | 1 | -0/+37 |
| | | | |||||
| * | | Fix named route helper for routes nested inside deeply nested resources | Andrew White | 2011-02-14 | 1 | -1/+1 |
| | | | | | | | | | [#6416 state:resolved] | ||||
| * | | Add notes on how to override the default :id constraint [#5994 state:resolved] | Andrew White | 2011-02-14 | 1 | -1/+8 |
| | | | |||||
| * | | Remove incorrect assert_recognizes example | Andrew White | 2011-02-13 | 1 | -3/+0 |
| | | | |||||
| * | | Fix assert_recognizes with block constraints [#5805 state:resolved] | Andrew White | 2011-02-13 | 3 | -6/+13 |
| | | | |||||
| * | | Add Date#rfc3339 and Date#iso8601 to AS | Santiago Pastorino | 2011-02-13 | 1 | -0/+1 |
| | | | |||||
| * | | Allow for the format of time_tag in AP to be changed via an option argument. | Josh Kalderimis | 2011-02-12 | 1 | -3/+5 |
| | | | | | | | | | Signed-off-by: Santiago Pastorino <santiago@wyeworks.com> | ||||
| * | | Added time_tag helper to AP for HTML5 time tag [#5919 state:resolved] | Sjoerd Andringa | 2011-02-12 | 2 | -1/+20 |
| | | | | | | | | | Signed-off-by: Santiago Pastorino <santiago@wyeworks.com> | ||||
| * | | Applied changes to stylesheet_link_tag from javascript_include_tag which ↵ | Josh Kalderimis | 2011-02-13 | 2 | -14/+15 |
| | | | | | | | | | corrects issues with ordering and duplicates. | ||||
| * | | This corrects two issues with javascript_include_tag, the order at which ↵ | Josh Kalderimis | 2011-02-13 | 1 | -4/+23 |
| | | | | | | | | | | | | | | | | | they are expanded, and removing duplicates. When individual js assets are specified, they will override the order of the same asset specified in an expansion. [#5938 state:resolved] | ||||
| * | | Add block support to button_tag helper | Tom Stuart | 2011-02-12 | 1 | -4/+9 |
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | As per the HTML 4.01 spec: Buttons created with the BUTTON element function just like buttons created with the INPUT element, but they offer richer rendering possibilities: the BUTTON element may have content. For example, a BUTTON element that contains an image functions like and may resemble an INPUT element whose type is set to "image", but the BUTTON element type allows content. Since rich content is the main purpose of the <button> element, it makes sense for the button_tag helper to accept a block. http://www.w3.org/TR/html401/interact/forms.html#edef-BUTTON http://dev.w3.org/html5/spec/the-button-element.html#the-button-element Signed-off-by: Santiago Pastorino and Emilio Tagua <santiago+emilioe@wyeworks.com> | ||||
| * | | Make type="submit" the default for button_tag helper | Tom Stuart | 2011-02-12 | 1 | -6/+4 |
| | | | | | | | | | | | | | | | | | | | | | | | | | "submit" is the default value of the <button> element's type attribute according to the HTML 4.01 and the HTML5 draft specs, so if button_tag is going to have a default, type="submit" is a more sensible choice than type="button". http://www.w3.org/TR/html401/interact/forms.html#adef-type-BUTTON http://dev.w3.org/html5/spec/the-button-element.html#attr-button-type Signed-off-by: Santiago Pastorino and Emilio Tagua <santiago+emilioe@wyeworks.com> | ||||
| * | | Add missing deprecation require | Carlos Antonio da Silva | 2011-02-11 | 1 | -0/+1 |
| | | | | | | | | | Signed-off-by: Santiago Pastorino <santiago@wyeworks.com> | ||||
| * | | Remove misleading reference to polymorphic_url. | José Valim | 2011-02-11 | 1 | -2/+0 |
| | | | |||||
| * | | Removed Array#safe_join in AS core_ext and moved it to a view helper with ↵ | Josh Kalderimis | 2011-02-10 | 3 | -20/+40 |
| | | | | | | | | | | | | | the same same. This also changes how safe_join works, if items or the separator are not html_safe they are html_escape'd, a html_safe string is always returned. Signed-off-by: José Valim <jose.valim@gmail.com> | ||||
| * | | Revert "Removed Array#safe_join in AS core_ext and moved it to a view helper ↵ | José Valim | 2011-02-10 | 3 | -42/+20 |
| | | | | | | | | | | | | | | | | | with the same same." Applied the wrong version. This reverts commit 98c0c5db50a7679b3d58769ac22cb0a27a62c930. | ||||
| * | | Removed Array#safe_join in AS core_ext and moved it to a view helper with ↵ | Josh Kalderimis | 2011-02-10 | 3 | -20/+42 |
| | | | | | | | | | the same same. | ||||
| * | | reduce string append funcalls | Aaron Patterson | 2011-02-08 | 1 | -3/+3 |
| | | | |||||
| * | | Change the CSRF whitelisting to only apply to get requests | Michael Koziarski | 2011-02-08 | 2 | -11/+11 |
| | | | | | | | | | | | | | | | | | Unfortunately the previous method of browser detection and XHR whitelisting is unable to prevent requests issued from some Flash animations and Java applets. To ease the work required to include the CSRF token in ajax requests rails now supports providing the token in a custom http header: X-CSRF-Token: ... This fixes CVE-2011-0447 | ||||
| * | | Use Mime::Type references. | José Valim | 2011-02-08 | 4 | -5/+9 |
| | | | |||||
| * | | Ensure render is case sensitive even on systems with case-insensitive ↵ | José Valim | 2011-02-08 | 1 | -3/+12 |
| | | | | | | | | | | | | | filesystems. This fixes CVE-2011-0449 | ||||
| * | | Be sure to javascript_escape the email address to prevent apostrophes ↵ | Michael Koziarski | 2011-02-08 | 1 | -5/+6 |
| | | | | | | | | | | | | | inadvertently causing javascript errors. This fixes CVE-2011-0446 | ||||
 |
index : rails.git | |
| Mirror of official rails repo with custom fixes. | Harald Eilertsen |
| aboutsummaryrefslogtreecommitdiffstats |