aboutsummaryrefslogtreecommitdiffstats
path: root/actionpack/lib
Commit message (Collapse)AuthorAgeFilesLines
* Merge branch '5-0-beta-sec'Aaron Patterson2016-01-254-5/+30
|\ | | | | | | | | | | | | | | | | | | | | * 5-0-beta-sec: bumping version fix version update task to deal with .beta1.1 Eliminate instance level writers for class accessors allow :file to be outside rails root, but anything else must be inside the rails view directory Don't short-circuit reject_if proc stop caching mime types globally use secure string comparisons for basic auth username / password
| * bumping versionAaron Patterson2016-01-251-1/+1
| |
| * allow :file to be outside rails root, but anything else must be inside the ↵Aaron Patterson2016-01-221-1/+7
| | | | | | | | | | | | rails view directory CVE-2016-0752
| * stop caching mime types globallyAaron Patterson2016-01-221-2/+16
| | | | | | | | | | | | | | Unknown mime types should not be cached globally. This global cache leads to a memory leak and a denial of service vulnerability. CVE-2016-0751
| * use secure string comparisons for basic auth username / passwordAaron Patterson2016-01-221-1/+6
| | | | | | | | | | | | this will avoid timing attacks against applications that use basic auth. CVE-2015-7576
* | Fix nodoc to internal class error document some of themVipul A M2016-01-251-1/+0
| | | | | | | | | | | | | | [ci skip] Fixes #20808 [Vipul A M & Julio Lopez]
* | Merge pull request #23167 from maclover7/fix-21032Rafael França2016-01-211-1/+5
|\ \ | | | | | | Fix `ActionController::Parameters#==` bug
| * | Fix `ActionController::Parameters#==` bugJon Moss2016-01-211-1/+5
| | | | | | | | | | | | See bug #21032.
* | | remove doc reference to ActionController::MimeResponds#respond_tosealocal2016-01-201-3/+0
| | |
* | | document simple example of ActionController::MimeResponds#respond_tosealocal2016-01-201-1/+9
| | |
* | | Re-add ActionController::ApiRenderingJon Moss2016-01-203-1/+19
|/ / | | | | | | | | - Fixes bug #23142. - Bug was occurring only with ActionController::API, because `_process_options` wasn't being run for API requests, even though it was being run for normal app requests.
* | Merge pull request #23140 from rails/fix-search-for-custom-routesAaron Patterson2016-01-201-14/+20
|\ \ | | | | | | Fix marking of custom routes for Journey
| * | Fix marking of custom routes for JourneyAndrew White2016-01-201-14/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Mapper build_path method marks routes where path parameters are part of a path segment as custom routes by altering the regular expression, e.g: get '/foo-:bar', to: 'foo#bar' There were some edge cases where certain constructs weren't being picked up and this commit fixes those. Fixes #23069.
* | | Merge pull request #17573 from zerothabhishek/masterGodfrey Chan2016-01-201-1/+1
|\ \ \ | |/ / |/| | Response etags to always be weak: Prefixed 'W/' to value returned by Act...
| * | Response etags to always be weak: Prefixed W/ to value returned by ↵abhishek2016-01-201-1/+1
| | | | | | | | | | | | ActionDispatch::Http::Cache::Response#etag= such that etags set in fresh_when and stale? are weak. For #17556.
* | | Revert "Remove literal? check to fix issue with prefixed optionals"eileencodes2016-01-201-1/+1
|/ / | | | | | | | | | | | | | | | | This reverts commit 5d1b7c3b441654e8008dcd303f5367883ec660a6. The change here didn't actually fix the issue it was trying to fix, and this isn't the correct way to fix either issue. The problem is switching from the builder to grouping with find_all/regex is now very dependent on how you structure your path pattern.
* | Revert "Its ideal to set Vary: Accept-Encoding, irrespective of whether ↵schneems2016-01-191-1/+1
| | | | | | | | | | | | | | | | gzipped version exists or not. This is helpful for CDN's to later distinguish assets, based on previous, current copies and introduced gzip version if any." This reverts commit 067c52f608568e35181830a5c1016e382650e655. Conversation: https://github.com/rails/rails/pull/23120#issuecomment-173007011
* | Merge pull request #23120 from vipulnsward/always-set-vary-for-static-assetsRichard Schneeman2016-01-191-1/+1
|\ \ | | | | | | Its ideal to set Vary: Accept-Encoding, irrespective of whether gzipped or not
| * | Its ideal to set Vary: Accept-Encoding, irrespective of whether gzipped ↵Vipul A M2016-01-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | version exists or not. This is helpful for CDN's to later distinguish assets, based on previous, current copies and introduced gzip version if any. For ref: https://www.fastly.com/blog/best-practices-for-using-the-vary-header This change sets `Vary` header always, to be on safer side
* | | Link to docs instead of listing methodsschneems2016-01-191-5/+7
| | |
* | | Add methods to StrongParametersschneems2016-01-191-1/+1
| | | | | | | | | It's reasonable to expose different value readers.
* | | [close #23084] Deprecated StrongParametersschneems2016-01-191-0/+16
|/ / | | | | | | We can provide a more flexible upgrade experience by warning users they are using unsafe methods instead of forcing the safe API by deprecating before removal. This PR provides this functionality.
* | Remove literal? check to fix issue with prefixed optionalseileencodes2016-01-161-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In commit d993cb3 `build_path` was changed from using `grep` to `find_all` to save array allocations. This change was a little too aggressive in that when the dash comes before the symbol like `/omg-:song` the symbol is skipped. Removing the check for `n.right.left.literal?` fixes this issue, but does add back some allocations. The number of allocations are still well less than before. I've added a regression test to test this behavior for the future. Fixes #23069. Array allocations as of d993cb3: ``` {:T_SYMBOL=>11} {:T_REGEXP=>17} {:T_STRUCT=>6500} {:T_MATCH=>12004} {:T_OBJECT=>91009} {:T_DATA=>100088} {:T_HASH=>114013} {:T_STRING=>159637} {:T_ARRAY=>321056} {:T_IMEMO=>351133} ``` Array allocations after this change: ``` {:T_SYMBOL=>11} {:T_REGEXP=>1017} {:T_STRUCT=>6500} {:T_MATCH=>12004} {:T_DATA=>84092} {:T_OBJECT=>87009} {:T_HASH=>110015} {:T_STRING=>166152} {:T_ARRAY=>322056} {:T_NODE=>343558} ```
* | Fix typo in docs [ci skip]Rebecca Skinner2016-01-141-2/+2
| |
* | Space OddityAkira Matsuda2016-01-143-4/+4
| | | | | | | | | | Converting nbsp(\u{00A0}) to the normal ASCII space(\u{0020}) [ci skip]
* | remove `present?` callsAaron Patterson2016-01-121-4/+4
| | | | | | | | | | Empty strings / data structures should be treated differently than nils. We don't really need these calls here (don't pass in blank strings).
* | monkey patch `recycle!` on to controllers onceAaron Patterson2016-01-121-4/+4
| | | | | | | | | | | | | | | | | | | | | | Instead of checking whether the class has recycle! or not, we can just always add the method to all controller classes when the test harness is loaded. Technically this means that the controller test harness will not work with controllers that do not inherit from AC::Metal, but then, I'm not sure that is supported anyway. Mixing in the module one will ensure that we don't break method caches, and eliminates a runtime check so it should speed up tests (slightly).
* | Merge pull request #22935 from cllns/add-status-name-to-outputRafael França2016-01-123-14/+64
|\ \ | | | | | | Add HTTP status name to output of tests
| * | Add both HTTP Response Code and Type to assertion messagesSean Collins2016-01-123-14/+64
| | | | | | | | | | | | | | | Also, refactor logic to convert between symbol and response code, via the AssertionResponse class
* | | Merge pull request #23035 from jkowens/fix-null-byteRafael França2016-01-121-1/+5
|\ \ \ | | | | | | | | Prevent static middleware from attempting to serve a request with a null byte
| * | | Prevent attempt to serve a request with a null byteJordan Owens2016-01-121-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | File paths cannot contain null byte characters and methods that do path operations such as Rack::Utils#clean_path_info will raise unwanted errors.
* | | | AC::Parameters#at_json: restore Rails 4.2’s valueclaudiob2016-01-121-1/+2
| |/ / |/| | | | | | | | | | | | | | Fixes #23026 See discussion at #23026
* | | Commit before freezing the headersMatthew Draper2016-01-122-1/+8
| | | | | | | | | | | | | | | This shouldn't generally come up: under a standard flow, we don't start sending until after the commit. But application code always finds a way.
* | | Unneeded &block parametersAkira Matsuda2016-01-121-2/+2
| | |
* | | [ci skip] Fix typo Renderering --> RenderingAkshay Vishnoi2016-01-091-1/+1
| | |
* | | Better error message when running `rake routes` with CONTROLLER arg:Edouard CHIN2016-01-071-7/+18
| | | | | | | | | | | | | | | | | | | | | - `CONTROLLER` argument can now be supplied in different ways (Rails::WelcomeController, Rails::Welcome, rails/welcome) - If `CONTROLLER` argument was supplied but it does not exist, will warn the user that this controller does not exist - If `CONTROLLER` argument was supplied and no routes could be found matching this filter, will warn the user that no routes were found matching the supplied filter - If no routes were defined in the config/routes.rb file, will warn the user with the original message
* | | Merge pull request #20109 from prathamesh-sonpatki/keep-only-one-rootKasper Timm Hansen2016-01-071-21/+21
|\ \ \ | | | | | | | | Remove original root method from Base module and kept overridden implementation in Resources module.
| * | | Kept overridden root method and removed original methodPrathamesh Sonpatki2016-01-071-21/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - The root method is defined and documented in Base module and decorated in Resources module. - The documentation in Base module actually talks about method signature of decorated method from Resources module. - Argument handling was moved to decorated method in https://github.com/rails/rails/commit/977455cc2efb94f40b4c0d46d1842be198ed7c4c to handle options such as :as with directly passed path parameter. - To avoid the confusion, removed original root method from Base module and only kept overridden version in Resources module. - References - https://github.com/rails/rails/pull/12208 & https://github.com/rails/rails/pull/12208#issuecomment-24350897.
* | | | Allow AC::Parameters as an argument to url_helpersPrathamesh Sonpatki2016-01-071-2/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Earlier only Hash was allowed as params argument to url_helpers. - Now ActionController::Parameters instances will also be allowed. - If the params are not secured then it will raise an ArgumentError to indicate that constructing URLs with non-secure params is not recommended. - Fixes #22832.
* | | | Merge pull request #22275 from mastahyeti/per-form-csrfRafael França2016-01-061-11/+54
|\ \ \ \ | | | | | | | | | | Per-form CSRF tokens
| * | | | add option for per-form CSRF tokensBen Toews2016-01-041-11/+54
| | | | |
* | | | | Merge pull request #22906 from bf4/rendering_exceptionsRafael França2016-01-041-64/+73
|\ \ \ \ \ | |/ / / / |/| | | | Add ActionController:Renderers test
| * | | | Group related methods togetherBenjamin Fleischer2016-01-031-67/+67
| | | | |
| * | | | Add ActionController:Renderers testBenjamin Fleischer2016-01-031-0/+9
| | | | | | | | | | | | | | | | | | | | To complement actionpack/test/controller/metal/renderers_test.rb
* | | | | Replace x.times.map{} with Array.new(x){}Viktar Basharymau2016-01-021-1/+1
|/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The former is slightly more readable, performant and has fewer method calls. ```ruby Benchmark.ips do |x| x.report('times.map') { 5.times.map{} } x.report('Array.new') { Array.new(5){} } x.compare! end __END__ Calculating ------------------------------------- times.map 21.188k i/100ms Array.new 30.449k i/100ms ------------------------------------------------- times.map 311.613k (± 3.5%) i/s - 1.568M Array.new 590.374k (± 1.2%) i/s - 2.954M Comparison: Array.new: 590373.6 i/s times.map: 311612.8 i/s - 1.89x slower ```
* | | | Merge pull request #22519 from bf4/test_use_renderersRafael França2015-12-311-0/+34
|\ \ \ \ | |_|/ / |/| | | Add tests for ActionController::Renderers::use_renderers
| * | | Test ActionController::Renderers::use_renderersBenjamin Fleischer2015-12-311-0/+34
| | | |
* | | | Update copyright notices to 2016 [ci skip]Rashmi Yadav2015-12-312-2/+2
|/ / /
* | | Merge pull request #22850 from prathamesh-sonpatki/fix_ac_params_unsafe_h_2Kasper Timm Hansen2015-12-311-6/+6
|\ \ \ | | | | | | | | Fix AC::Parameters#to_unsafe_h to return all unfiltered values
| * | | Fix AC::Parameters#to_unsafe_h to return all unfiltered valuesPrathamesh Sonpatki2015-12-311-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | - AC::Parameters#convert_parameters_to_hashes should return filtered or unfiltered values based on whether it is called from `to_h` or `to_unsafe_h` instead of always defaulting to `to_h`. - Fixes #22841
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-08 08:45:00 +0000