| Commit message (Collapse) | Author | Age | Files | Lines |
| |
|
|
|
|
| |
Follow up of #32605.
|
|
|
|
|
|
|
| |
If a POST request is followed by a GET request in a controller test, the
`rack.input` and `RAW_POST_DATA` headers from the first request will be
reset but the `CONTENT_LENGTH` header will leak, leading the request
object in the second request to incorrectly believe it has a body.
|
|
|
|
|
|
| |
`RAW_POST_DATA` is derived from the `rack.input` header, which changes
with each test request. It needs to be cleared in `scrub_env!`, or all
requests within the same test will see the value from the first request.
|
|\
| |
| |
| | |
Create MissingExactTemplate exception with separate template
|
| | |
|
| |
| |
| |
| | |
operator
|
|\ \
| | |
| | |
| | | |
Fixes StrongParameters `permit!` to work with nested arrays
|
| | |
| | |
| | |
| | |
| | | |
`permit!` is intended to mark all instances of `ActionController::Parameters` as permitted, however nested arrays of params were not being marked permitted because the method did shallow iteration.
This fixes that by flattening the array before calling `permit!` on all each item.
|
|/ /
| |
| |
| |
| | |
This autocorrects the violations after adding a custom cop in
3305c78dcd.
|
| | |
|
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Initially, the test was added to 5-0-stable in #32492
and a bit modified in #32506. This test ensures that request(in tests)
doesn't mutate params. It was fixed since v5.1.0.beta1 by
98b8309569a326910a723f521911e54994b112fb and then on 5-0-stable by #32492.
This commit adds this test to master branch in order to prevent any
regressions.
|
|\ \
| | |
| | | |
Add custom RuboCop for `assert_not` over `refute`
|
| | |
| | |
| | |
| | |
| | |
| | | |
73e7aab behaved as expected on codeship, failing the build with
exactly these RuboCop violations. Hopefully `rubocop -a` will
have been enough to get a passing build!
|
|\ \ \
| |/ /
|/| | |
Make mutating params#dig return value mutate underlying params
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
When #dig was called on a params object and return either a Hash or an
Array, and that value was subsquently mutated, it would not modify the
containing params object. That means that the behavior of
`params.dig(:a, :b)[:c] = 1` did not match either `params[:a][:b][:c] =
1` nor `hash.dig(:a, :b)[:c] = 1`. Similarly to
`ActionController::Parameters#[]`, use `#convert_hashes_to_parameters`
to pre-convert values and insert them in the receiving params object
prior to returning them.
|
|/ /
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Today there are two common ways for Rails developers to force their
applications to communicate over HTTPS:
* `config.force_ssl` is a setting in environment configurations that
enables the `ActionDispatch::SSL` middleware. With this middleware
enabled, all HTTP communication to your application will be redirected
to HTTPS. The middleware also takes care of other best practices by
setting HSTS headers, upgrading all cookies to secure only, etc.
* The `force_ssl` controller method redirects HTTP requests to certain
controllers to HTTPS.
As a consultant, I've seen many applications with misconfigured HTTPS
setups due to developers adding `force_ssl` to `ApplicationController`
and not enabling `config.force_ssl`. With this configuration, many
application requests can be served over HTTP such as assets, requests
that hit mounted engines, etc. In addition, because cookies are not
upgraded to secure only in this configuration and HSTS headers are not
set, it's possible for cookies that are meant to be secure to be sent
over HTTP.
The confusion between these two methods of forcing HTTPS is compounded
by the fact that they share an identical name. This makes finding
documentation on the "right" method confusing.
HTTPS throughout is quickly becomming table stakes for all web sites.
Sites are expected to operate over HTTPS for all communication,
sensitive or otherwise. Let's encourage use of the broader-reaching
`ActionDispatch::SSL` middleware and elminate this source of user
confusion. If, for some reason, applications need to expose certain
endpoints over HTTP they can do so by properly configuring
`config.ssl_options`.
|
| |
| |
| |
| |
| | |
https://bugs.ruby-lang.org/issues/12752
https://ruby-doc.org/core-2.4.0/String.html#method-i-unpack1
|
| |
| |
| |
| |
| |
| | |
Found several instances.
Follow up on 63d530c5e68a8cf53603744789f53ccbc7ac1a0e
|
| |
| |
| |
| |
| |
| | |
Skipping over 2.4.0 to sidestep the `"symbol_from_string".to_sym.dup` bug.
References #32028
|
| | |
|
|/
|
|
|
| |
Some places we can't remove because Ruby still don't have a method
equivalent to strip_heredoc to be called in an already existent string.
|
| |
|
| |
|
| |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
`BigDecimal.new` has been deprecated in BigDecimal 1.3.3
which will be a default for Ruby 2.5.
Refer
https://github.com/ruby/bigdecimal/commit/533737338db915b00dc7168c3602e4b462b23503
* This commit has been made as follows:
```
cd rails
git grep -l BigDecimal.new | grep -v guides/source/5_0_release_notes.md | grep -v activesupport/test/xml_mini_test.rb | xargs sed -i -e "s/BigDecimal.new/BigDecimal/g"
```
- `activesupport/test/xml_mini_test.rb`
Editmanually to remove `.new` and `::`
- guides/source/5_0_release_notes.md
This is a Rails 5.0 release notes.
|
|\
| |
| | |
Initial support for running Rails on FIPS-certified systems
|
| |
| |
| |
| |
| |
| |
| |
| | |
implementation
and defaults to `Digest::MD5`.
Replaced calls to `::Digest::MD5.hexdigest` with calls to `ActiveSupport::Digest.hexdigest`.
|
| |
| |
| |
| | |
Follow up of #31432.
|
| |
| |
| |
| | |
Follow up of #31390.
|
| |
| |
| |
| | |
default headers set.
|
|\ \
| | |
| | |
| | |
| | | |
JackMc/fix-chrome-referrer-invalidauthenticitytoken
Fix issue #30658 by checking explicitly for 'null' referrer
|
| | | |
|
| | | |
|
| |/
|/|
| |
| | |
Matches Hash#each behaviour as used in Rails 4.
|
| | |
|
|\ \
| |/
|/|
| | |
Use `Tempfile.create`
|
| |
| |
| |
| | |
As `@cache_path` is expected to be a directory name, use `Dir.mktmpdir`.
And omit unnecessary `Dir.tmpdir`.
|
|/
|
| |
Instead of `Dir::Tmpname.make_tmpname`, an internal method which does not guarantee uniqueness, use `Tempfile.create`.
|
|\
| |
| | |
Remove redundant return statements
|
| | |
|
|\ \
| |/
|/|
| | |
Removed unnecessary semicolons
|
|/ |
|
|
|
|
| |
as well
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
Currently `:api:` tag has leaked on the doc directly since RDoc doesn't
support `:api:` tag directive.
http://api.rubyonrails.org/v5.1/classes/AbstractController/Rendering.html
So `:api: private` doesn't work as expected. We are using `:nodoc:` for
the purpose.
Related #13989.
|
|
|
|
|
|
| |
Using the action_dispatch.cookies_rotations interface, key rotation is
now possible with cookies. Thus the secret_key_base as well as salts,
ciphers, and digests, can be rotated without expiring sessions.
|
| |
|
|\
| |
| | |
Normalize/process Cache-Control headers consistently
|