aboutsummaryrefslogtreecommitdiffstats
path: root/actionpack/test/controller
Commit message (Collapse)AuthorAgeFilesLines
* Merge pull request #23342 from y-yagi/remove_unused_variableRafael França2016-01-301-1/+1
|\ | | | | remove unused variable from render test
| * remove unused variable from render testyuuji.yaginuma2016-01-301-1/+1
| | | | | | | | | | | | | | | | This removes the following warning. ``` rails/actionpack/test/controller/render_test.rb:278: warning: assigned but unused variable - response ```
* | Handle response_body= when body is nileileencodes2016-01-301-0/+16
|/ | | | | | | | | There are some cases when the `body` in `response_body=` can be set to nil. One of those cases is in `actionpack-action_caching` which I found while upgrading it for Rails 5. It's not possible to run `body.each` on a `nil` body so we have to return after we run `response.reset_body!`.
* Merge pull request #22800 from dgynn/pr_cache_helper_optionsRafael Mendonça França2016-01-291-0/+12
|\ | | | | | | Restore ability to pass extra options to cache stores
| * restore ability to pass extra options to cache storesDave Gynn2015-12-261-0/+12
| | | | | | | | | | | | | | | | | | The `cache` helper methods should pass any extra options to the cache store. For example :expires_in would be a valid option if memcache was the cache store. The change in commit da16745 broke the ability to pass any options other than :skip_digest and :virtual_path. This PR restores that functionality and adds a test for it.
* | Run `file.close` before unlinking for traviseileencodes2016-01-281-1/+2
| | | | | | | | | | | | | | | | | | | | | | This works on OSX but for some reason travis is throwing a ``` 1) Error: ExpiresInRenderTest#test_dynamic_render_with_absolute_path: NoMethodError: undefined method `unlink' for nil:NilClass ``` Looking at other tests in Railties the file has a name and we close it before unlinking, so I'm going to try that.
* | Regression test for rendering file from absolute patheileencodes2016-01-281-0/+11
| | | | | | | | | | | | Test that we are not allowing you to grab a file with an absolute path outside of your application directory. This is dangerous because it could be used to retrieve files from the server like `/etc/passwd`.
* | doc typoAkira Matsuda2016-01-271-2/+2
| | | | | | | | [ci skip]
* | add a skip for failing testAaron Patterson2016-01-261-1/+2
| |
* | fix permitted? conditional for `render` callsAaron Patterson2016-01-261-0/+11
| |
* | clear view path cache between testsAaron Patterson2016-01-261-0/+5
| | | | | | | | | | | | | | | | The cache for `render file:` seems to also be used in the case of `render(string)`. If one is supposed to be a hit and the other is supposed to be a miss, and they both reference the same file, then the cache could return incorrect values. This commit clears the cache between runs so that we get non-cached behavior.
* | Merge branch '5-0-beta-sec'Aaron Patterson2016-01-251-0/+31
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 5-0-beta-sec: bumping version fix version update task to deal with .beta1.1 Eliminate instance level writers for class accessors allow :file to be outside rails root, but anything else must be inside the rails view directory Don't short-circuit reject_if proc stop caching mime types globally use secure string comparisons for basic auth username / password
| * | allow :file to be outside rails root, but anything else must be inside the ↵Aaron Patterson2016-01-221-0/+31
| |/ | | | | | | | | | | rails view directory CVE-2016-0752
* | Merge pull request #23167 from maclover7/fix-21032Rafael França2016-01-211-0/+6
|\ \ | | | | | | Fix `ActionController::Parameters#==` bug
| * | Fix `ActionController::Parameters#==` bugJon Moss2016-01-211-0/+6
| | | | | | | | | | | | See bug #21032.
* | | - Fix warning introduced in ↵Vipul A M2016-01-221-1/+3
| | | | | | | | | | | | | | | | | | https://github.com/vipulnsward/rails/commit/77acc004efad07dfd4d4f83be14ef897968a3fd9 when fixing API responses. - render :text is deprecated, so added an assertion for it.
* | | Re-add ActionController::ApiRenderingJon Moss2016-01-201-0/+20
|/ / | | | | | | | | - Fixes bug #23142. - Bug was occurring only with ActionController::API, because `_process_options` wasn't being run for API requests, even though it was being run for normal app requests.
* | Merge pull request #17573 from zerothabhishek/masterGodfrey Chan2016-01-202-2/+2
|\ \ | | | | | | Response etags to always be weak: Prefixed 'W/' to value returned by Act...
| * | Response etags to always be weak: Prefixed W/ to value returned by ↵abhishek2016-01-202-2/+2
| | | | | | | | | | | | ActionDispatch::Http::Cache::Response#etag= such that etags set in fresh_when and stale? are weak. For #17556.
* | | Revert "Remove literal? check to fix issue with prefixed optionals"eileencodes2016-01-201-12/+0
|/ / | | | | | | | | | | | | | | | | This reverts commit 5d1b7c3b441654e8008dcd303f5367883ec660a6. The change here didn't actually fix the issue it was trying to fix, and this isn't the correct way to fix either issue. The problem is switching from the builder to grouping with find_all/regex is now very dependent on how you structure your path pattern.
* | Add methods to StrongParametersschneems2016-01-191-1/+8
| | | | | | It's reasonable to expose different value readers.
* | [close #23084] Deprecated StrongParametersschneems2016-01-191-0/+6
| | | | | | | | We can provide a more flexible upgrade experience by warning users they are using unsafe methods instead of forcing the safe API by deprecating before removal. This PR provides this functionality.
* | Remove literal? check to fix issue with prefixed optionalseileencodes2016-01-161-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In commit d993cb3 `build_path` was changed from using `grep` to `find_all` to save array allocations. This change was a little too aggressive in that when the dash comes before the symbol like `/omg-:song` the symbol is skipped. Removing the check for `n.right.left.literal?` fixes this issue, but does add back some allocations. The number of allocations are still well less than before. I've added a regression test to test this behavior for the future. Fixes #23069. Array allocations as of d993cb3: ``` {:T_SYMBOL=>11} {:T_REGEXP=>17} {:T_STRUCT=>6500} {:T_MATCH=>12004} {:T_OBJECT=>91009} {:T_DATA=>100088} {:T_HASH=>114013} {:T_STRING=>159637} {:T_ARRAY=>321056} {:T_IMEMO=>351133} ``` Array allocations after this change: ``` {:T_SYMBOL=>11} {:T_REGEXP=>1017} {:T_STRUCT=>6500} {:T_MATCH=>12004} {:T_DATA=>84092} {:T_OBJECT=>87009} {:T_HASH=>110015} {:T_STRING=>166152} {:T_ARRAY=>322056} {:T_NODE=>343558} ```
* | Merge pull request #22985 from akshay-vishnoi/fix-typoRafael França2016-01-161-1/+1
|\ \ | | | | | | test `include?`- fix typo
| * | test `include?`- fix typoAkshay Vishnoi2016-01-091-1/+1
| | |
* | | AC::Parameters#at_json: restore Rails 4.2’s valueclaudiob2016-01-121-0/+6
| | | | | | | | | | | | | | | | | | Fixes #23026 See discussion at #23026
* | | Merge pull request #21181 from denisenkom/mypatchKasper Timm Hansen2016-01-101-0/+19
|\ \ \ | |/ / |/| | Test basic auth with symbols in password
| * | Test basic auth with symbols in login and passwordMikhail Denisenko2015-10-241-0/+19
| | |
* | | Merge pull request #22275 from mastahyeti/per-form-csrfRafael França2016-01-061-0/+172
|\ \ \ | | | | | | | | Per-form CSRF tokens
| * | | add option for per-form CSRF tokensBen Toews2016-01-041-0/+172
| | | |
* | | | Merge pull request #22906 from bf4/rendering_exceptionsRafael França2016-01-042-24/+90
|\ \ \ \ | |/ / / |/| | | Add ActionController:Renderers test
| * | | Add ActionController:Renderers testBenjamin Fleischer2016-01-032-24/+90
| | | | | | | | | | | | | | | | To complement actionpack/test/controller/metal/renderers_test.rb
* | | | Fix typo in test desctiption [skip ci]Anton Davydov2016-01-041-1/+1
|/ / /
* | | Test ActionController::Renderers::use_renderersBenjamin Fleischer2015-12-311-0/+42
| | |
* | | Merge pull request #22850 from prathamesh-sonpatki/fix_ac_params_unsafe_h_2Kasper Timm Hansen2015-12-311-0/+8
|\ \ \ | | | | | | | | Fix AC::Parameters#to_unsafe_h to return all unfiltered values
| * | | Fix AC::Parameters#to_unsafe_h to return all unfiltered valuesPrathamesh Sonpatki2015-12-311-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | - AC::Parameters#convert_parameters_to_hashes should return filtered or unfiltered values based on whether it is called from `to_h` or `to_unsafe_h` instead of always defaulting to `to_h`. - Fixes #22841
* | | | Fix test for AC::Parameters#to_unsafe_hPrathamesh Sonpatki2015-12-301-2/+2
|/ / / | | | | | | | | | - Test should call `to_unsafe_h` instead of `to_h`
* | / Add AC::Parameters#include?Justin Coyne2015-12-291-0/+6
| |/ |/| | | | | Fixes #22818
* | Merge pull request #20797 from byroot/prevent-url-for-ac-parametersRafael França2015-12-183-3/+10
|\ \ | | | | | | Prevent ActionController::Parameters in url_for
| * | Prevent ActionController::Parameters from being passed to url_for directlyJean Boussier2015-12-153-3/+10
| | |
* | | Only dup Ruby's Hash and Array.Kasper Timm Hansen2015-12-171-0/+28
| | | | | | | | | | | | | | | | | | | | | | | | When calling `to_h` on an `ActionController::Parameters` instance it would `deep_dup` its internal parameters. This inadvertently called `dup` on a passed Active Record model which would create new models. Fix by only dupping Ruby's Arrays and Hashes.
* | | Deprecate `redirect_to :back`Derek Prior2015-12-161-2/+15
| | | | | | | | | | | | | | | | | | | | | Applications that use `redirect_to :back` can be forced to 500 by clients that do not send the HTTP `Referer` (sic) header. `redirect_back` requires the user to consider this possibility up front and avoids this trivially-caused application error.
* | | Add `redirect_back` for safer referrer redirectsDerek Prior2015-12-161-0/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | `redirect_to :back` is a somewhat common pattern in Rails apps, but it is not completely safe. There are a number of circumstances where HTTP referrer information is not available on the request. This happens often with bot traffic and occasionally to user traffic depending on browser security settings. When there is no referrer available on the request, `redirect_to :back` will raise `ActionController::RedirectBackError`, usually resulting in an application error. `redirect_back` takes a required `fallback_location` keyword argument that specifies the redirect when the referrer information is not available. This prevents 500 errors caused by `ActionController::RedirectBackError`.
* | | deletes code commented out in 72160d9fTony Ta2015-12-151-10/+0
| | |
* | | Merge pull request #14212 from tylerhunt/fix-token-regexSean Griffin2015-12-151-0/+8
|\ \ \ | | | | | | | | | | | | Handle tab in token authentication header.
| * | | Handle tab in token authentication header.Tyler Hunt2014-02-261-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The HTTP spec allows for LWS to precede the header content, which could include multiple SP and HT characters. Update the regex used to match the Token authorization header to account for this, instead of matching on a single SP. See http://www.w3.org/Protocols/rfc2616/rfc2616-sec2.html and http://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html for the relevant parts of the specification.
* | | | Add fragment_cache_key macro for controller-wide fragment cache key prefixesSam Stephenson2015-12-141-0/+25
| | | |
* | | | Make Parameters#to_h and #to_unsafe_h return HWIAPrem Sichanugrist2015-12-141-4/+4
| |/ / |/| | | | | | | | | | | | | | | | | This makes these two methods to be more inline with the previous behavior of Parameters as Parameters used to be inherited from HWIA. Fixes #21391
* | | Merge pull request #20831 from jmbejar/rails-api-json-error-responseSantiago Pastorino2015-12-091-4/+6
|\ \ \ | | | | | | | | Rails API: Ability to return error responses in json format also in development
| * | | Response when error should be formatted properly in Rails API if local requestJorge Bejar2015-12-091-4/+6
| | | |
generated by cgit v1.2.3 (git 2.25.1) at 2024-10-31 16:08:49 +0000