aboutsummaryrefslogtreecommitdiffstats
path: root/actionpack/test/controller/redirect_test.rb
Commit message (Collapse)AuthorAgeFilesLines
* Ensure that `redirect_back` with `fallback_location` to another host is allowedbogdanvlviv2019-01-251-0/+29
| | | | I would like to add those tests to prevent regression.
* Revert ensure external redirects are explicitly allowedGannon McGibbon2019-01-221-37/+7
|
* Ensure external redirects are explicitly allowedGannon McGibbon2019-01-171-7/+37
| | | | Add `fallback_location` and `allow_other_host` options to `redirect_to`.
* Add missing test case for `redirect_to` when request includes a port.Guo Xiang Tan2018-09-211-0/+7
|
* Call block to #redirect_to in controller context (#33735)speckins2018-08-271-0/+16
| | | | | | | | | | | | | | | | | | * Call block to #redirect_to in controller context The documentation for ActionController::Redirecting states that a Proc argument "will be executed in the controller's context." However, unless #instance_eval is used (removed in 6b3ad0ca), that statement is false for procs defined outside of the controller instance. This commit restores the documented behavior. Fixes #33731. * Move test proc into a constant in another class Per @rafaelfranca's suggestion. [Steven Peckins + Rafael Mendonça França]
* Add allow_other_host option to redirect_back methodTim Masliuchenko2017-10-101-0/+21
|
* Fix RuboCop offensesKoichi ITO2017-08-161-1/+1
| | | | And enable `context_dependent` of Style/BracesAroundHashParameters cop.
* Use frozen string literal in actionpack/Kir Shatrov2017-07-291-0/+2
|
* Revert "Merge pull request #29540 from kirs/rubocop-frozen-string"Matthew Draper2017-07-021-1/+0
| | | | | This reverts commit 3420a14590c0e6915d8b6c242887f74adb4120f9, reversing changes made to afb66a5a598ce4ac74ad84b125a5abf046dcf5aa.
* Enforce frozen string in RubocopKir Shatrov2017-07-011-0/+1
|
* Reuse the Parameters#to_h check in the routing helpersRafael Mendonça França2017-04-181-2/+2
| | | | | Since this protection is now in Parameters we can use it instead of reimplementing again.
* Use `response#location` instead of `#location` in redirect.Mehmet Emin INAC2017-02-201-2/+2
| | | | Closes #28033
* Privatize unneededly protected methods in Action Pack testsAkira Matsuda2016-12-231-1/+1
|
* Remove deprecated support to `:back` in `redirect_to`Rafael Mendonça França2016-10-091-42/+0
|
* Add three new rubocop rulesRafael Mendonça França2016-08-161-2/+2
| | | | | | | | Style/SpaceBeforeBlockBraces Style/SpaceInsideBlockBraces Style/SpaceInsideHashLiteralBraces Fix all violations in the repository.
* remove redundant curlies from hash argumentsXavier Noria2016-08-061-4/+4
|
* modernizes hash syntax in actionpackXavier Noria2016-08-061-18/+18
|
* applies new string literal convention in actionpack/testXavier Noria2016-08-061-13/+13
| | | | | The current code base is not uniform. After some discussion, we have chosen to go with double quotes by default.
* Move `Workshop` class definitionJon Moss2016-05-301-0/+18
| | | | | We should define it only where we need it, not in the global abstract unit :grimacing:
* Add more info to insecure URL generation errorDerek Prior2016-04-261-2/+1
| | | | | | | | I always appreciate having a bit more information as to why something is now an error. We can use this error to tell people why what they were previously doing is insecure and give them hints on how to fix it. Signed-off-by: Kasper Timm Hansen <kaspth@gmail.com>
* Deprecate :controller and :action path parametersAndrew White2016-03-011-2/+7
| | | | | | | | Allowing :controller and :action values to be specified via the path in config/routes.rb has been an underlying cause of a number of issues in Rails that have resulted in security releases. In light of this it's better that controllers and actions are explicitly whitelisted rather than trying to blacklist or sanitize 'bad' values.
* Use a URL instead of an URL everywhereAbhishek Jain2016-02-151-1/+1
|
* Merge pull request #20797 from byroot/prevent-url-for-ac-parametersRafael França2015-12-181-2/+2
|\ | | | | Prevent ActionController::Parameters in url_for
| * Prevent ActionController::Parameters from being passed to url_for directlyJean Boussier2015-12-151-2/+2
| |
* | Deprecate `redirect_to :back`Derek Prior2015-12-161-2/+15
| | | | | | | | | | | | | | Applications that use `redirect_to :back` can be forced to 500 by clients that do not send the HTTP `Referer` (sic) header. `redirect_back` requires the user to consider this possibility up front and avoids this trivially-caused application error.
* | Add `redirect_back` for safer referrer redirectsDerek Prior2015-12-161-0/+21
|/ | | | | | | | | | | | | | | | | `redirect_to :back` is a somewhat common pattern in Rails apps, but it is not completely safe. There are a number of circumstances where HTTP referrer information is not available on the request. This happens often with bot traffic and occasionally to user traffic depending on browser security settings. When there is no referrer available on the request, `redirect_to :back` will raise `ActionController::RedirectBackError`, usually resulting in an application error. `redirect_back` takes a required `fallback_location` keyword argument that specifies the redirect when the referrer information is not available. This prevents 500 errors caused by `ActionController::RedirectBackError`.
* Added assertion for error messages for redirection to nil and params Ronak Jangir2015-09-211-2/+4
| | | As both `redirect_to_nil` and `redirect_to_params` are raising same `ActionController::ActionControllerError` so it’s good to assert error messages as well
* Stop using deprecated `render :text` in testPrem Sichanugrist2015-07-171-2/+2
| | | | | | | | | This will silence deprecation warnings. Most of the test can be changed from `render :text` to render `:plain` or `render :body` right away. However, there are some tests that needed to be fixed by hand as they actually assert the default Content-Type returned from `render :body`.
* Remove `assigns` and `assert_template`.Guo Xiang Tan2015-05-301-11/+0
|
* Remove unused WorkshopsController class in redirect_test.Bryce Boe2015-04-231-3/+0
|
* remove old unavailable link with relevant fixGaurav Sharma2015-03-231-2/+2
|
* Don't accept parameters as argument for redirect to [via @homakov]Santiago Pastorino2014-07-161-0/+10
| | | | Closes #16170
* Remove default match without specified methodJose and Yehuda2012-04-241-2/+2
| | | | | | | | | | | | | | | | In the current router DSL, using the +match+ DSL method will match all verbs for the path to the specified endpoint. In the vast majority of cases, people are currently using +match+ when they actually mean +get+. This introduces security implications. This commit disallows calling +match+ without an HTTP verb constraint by default. To explicitly match all verbs, this commit also adds a :via => :all option to +match+. Closes #5964
* fix typo in redirect testBrian Lopez2012-03-151-1/+1
|
* strip null bytes from Location header as wellBrian Lopez2012-03-151-0/+20
| | | | add tests for stripping \r\n chars since that's already happening
* Remove rescue_action from compatibility module and testsCarlos Antonio da Silva2012-01-171-2/+0
|
* Fix for redirect_to to respect urls with a network path reference like ↵Overbryd2011-12-051-0/+10
| | | | "//asset.host.com/resources/1235" see issue #3856
* Methods like status and location are interfering with redirect_to [Closes #2511]Franck Verrot2011-08-141-0/+5
|
* delete repeated codeAaron Patterson2010-10-011-18/+0
|
* Make redirect_to accept blocks [#5643 state:resolved]Nando Vieira2010-09-241-0/+38
| | | | Signed-off-by: José Valim <jose.valim@gmail.com>
* Removed deprecated RouteSet API, still many tests failPiotr Sarnacki2010-09-051-1/+1
|
* Revert "Setup explicit requires for files with exceptions. Removed them from ↵José Valim2010-09-021-1/+0
| | | | | | | | autoloading." Booting a new Rails application does not work after this commit [#5359 state:open] This reverts commit 38a421b34d0b414564e919f67d339fac067a56e6.
* Setup explicit requires for files with exceptions. Removed them from ↵Łukasz Strzałkowski2010-09-021-0/+1
| | | | | | autoloading. Signed-off-by: José Valim <jose.valim@gmail.com>
* Require persisted? in ActiveModel::Lint and remove new_record? and ↵José Valim2010-02-211-9/+9
| | | | destroyed? methods. ActionPack does not care if the resource is new or if it was destroyed, it cares only if it's persisted somewhere or not.
* Use new routing dsl in testsJoshua Peek2009-12-081-2/+2
|
* Cleanup route reloading in tests. Prefer with_routing over using ↵Joshua Peek2009-08-161-11/+13
| | | | ActionController::Routing::Routes directly
* Add test ensuring redirect_to uses the given protocol [#2886]Dan Croak2009-08-081-0/+10
| | | | Signed-off-by: Pratik Naik <pratiknaik@gmail.com>
* AMo conversion helperJoshua Peek2009-07-211-1/+2
|
* Define ActiveModel API ComplianceYehuda Katz2009-07-201-1/+1
| | | | | | - Define to_model on AR - Define to_model on ActiveModel::APICompliant - Update test fixtures to be API Compliant - Start using to_model in AP
* Move model naming into ActiveModelJoshua Peek2009-06-171-0/+1
|
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-01 16:48:29 +0000