| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
|
|
|
| |
This works on OSX but for some reason travis is throwing a
```
1) Error:
ExpiresInRenderTest#test_dynamic_render_with_absolute_path:
NoMethodError: undefined method `unlink' for nil:NilClass
```
Looking at other tests in Railties the file has a name and we close
it before unlinking, so I'm going to try that.
|
|
|
|
|
|
| |
Test that we are not allowing you to grab a file with an absolute path
outside of your application directory. This is dangerous because it
could be used to retrieve files from the server like `/etc/passwd`.
|
|
|
|
| |
[ci skip]
|
| |
|
| |
|
|
|
|
|
|
|
|
| |
The cache for `render file:` seems to also be used in the case of
`render(string)`. If one is supposed to be a hit and the other is
supposed to be a miss, and they both reference the same file, then the
cache could return incorrect values. This commit clears the cache
between runs so that we get non-cached behavior.
|
|\
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
* 5-0-beta-sec:
bumping version
fix version update task to deal with .beta1.1
Eliminate instance level writers for class accessors
allow :file to be outside rails root, but anything else must be inside the rails view directory
Don't short-circuit reject_if proc
stop caching mime types globally
use secure string comparisons for basic auth username / password
|
| |
| |
| |
| |
| |
| | |
rails view directory
CVE-2016-0752
|
|\ \
| | |
| | | |
Fix `ActionController::Parameters#==` bug
|
| | |
| | |
| | |
| | | |
See bug #21032.
|
| | |
| | |
| | |
| | |
| | |
| | | |
https://github.com/vipulnsward/rails/commit/77acc004efad07dfd4d4f83be14ef897968a3fd9 when fixing API responses.
- render :text is deprecated, so added an assertion for it.
|
|/ /
| |
| |
| |
| | |
- Fixes bug #23142.
- Bug was occurring only with ActionController::API, because `_process_options` wasn't being run for API requests, even though it was being run for normal app requests.
|
|\ \
| | |
| | | |
Response etags to always be weak: Prefixed 'W/' to value returned by Act...
|
| | |
| | |
| | |
| | | |
ActionDispatch::Http::Cache::Response#etag= such that etags set in fresh_when and stale? are weak. For #17556.
|
|/ /
| |
| |
| |
| |
| |
| |
| |
| | |
This reverts commit 5d1b7c3b441654e8008dcd303f5367883ec660a6.
The change here didn't actually fix the issue it was trying to fix, and
this isn't the correct way to fix either issue. The problem is switching
from the builder to grouping with find_all/regex is now very dependent
on how you structure your path pattern.
|
| |
| |
| | |
It's reasonable to expose different value readers.
|
| |
| |
| |
| | |
We can provide a more flexible upgrade experience by warning users they are using unsafe methods instead of forcing the safe API by deprecating before removal. This PR provides this functionality.
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
In commit d993cb3 `build_path` was changed from using `grep` to
`find_all` to save array allocations.
This change was a little too aggressive in that when the dash comes
before the symbol like `/omg-:song` the symbol is skipped.
Removing the check for `n.right.left.literal?` fixes this issue, but
does add back some allocations. The number of allocations are still well
less than before.
I've added a regression test to test this behavior for the future.
Fixes #23069.
Array allocations as of d993cb3:
```
{:T_SYMBOL=>11}
{:T_REGEXP=>17}
{:T_STRUCT=>6500}
{:T_MATCH=>12004}
{:T_OBJECT=>91009}
{:T_DATA=>100088}
{:T_HASH=>114013}
{:T_STRING=>159637}
{:T_ARRAY=>321056}
{:T_IMEMO=>351133}
```
Array allocations after this change:
```
{:T_SYMBOL=>11}
{:T_REGEXP=>1017}
{:T_STRUCT=>6500}
{:T_MATCH=>12004}
{:T_DATA=>84092}
{:T_OBJECT=>87009}
{:T_HASH=>110015}
{:T_STRING=>166152}
{:T_ARRAY=>322056}
{:T_NODE=>343558}
```
|
|\ \
| | |
| | | |
test `include?`- fix typo
|
| | | |
|
| | |
| | |
| | |
| | |
| | |
| | | |
Fixes #23026
See discussion at #23026
|
|\ \ \
| |/ /
|/| | |
Test basic auth with symbols in password
|
| | | |
|
|\ \ \
| | | |
| | | | |
Per-form CSRF tokens
|
| | | | |
|
|\ \ \ \
| |/ / /
|/| | | |
Add ActionController:Renderers test
|
| | | |
| | | |
| | | |
| | | | |
To complement actionpack/test/controller/metal/renderers_test.rb
|
|/ / / |
|
| | | |
|
|\ \ \
| | | |
| | | | |
Fix AC::Parameters#to_unsafe_h to return all unfiltered values
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
- AC::Parameters#convert_parameters_to_hashes should return filtered or
unfiltered values based on whether it is called from `to_h` or `to_unsafe_h`
instead of always defaulting to `to_h`.
- Fixes #22841
|
|/ / /
| | |
| | |
| | | |
- Test should call `to_unsafe_h` instead of `to_h`
|
| |/
|/|
| |
| | |
Fixes #22818
|
|\ \
| | |
| | | |
Prevent ActionController::Parameters in url_for
|
| | | |
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
When calling `to_h` on an `ActionController::Parameters` instance it would
`deep_dup` its internal parameters.
This inadvertently called `dup` on a passed Active Record model which would
create new models. Fix by only dupping Ruby's Arrays and Hashes.
|
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Applications that use `redirect_to :back` can be forced to 500 by
clients that do not send the HTTP `Referer` (sic) header.
`redirect_back` requires the user to consider this possibility up front
and avoids this trivially-caused application error.
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
`redirect_to :back` is a somewhat common pattern in Rails apps, but it
is not completely safe. There are a number of circumstances where HTTP
referrer information is not available on the request. This happens often
with bot traffic and occasionally to user traffic depending on browser
security settings.
When there is no referrer available on the request, `redirect_to :back`
will raise `ActionController::RedirectBackError`, usually resulting in
an application error.
`redirect_back` takes a required `fallback_location` keyword argument
that specifies the redirect when the referrer information is not
available. This prevents 500 errors caused by
`ActionController::RedirectBackError`.
|
| | | |
|
|\ \ \
| | | |
| | | |
| | | | |
Handle tab in token authentication header.
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
The HTTP spec allows for LWS to precede the header content, which
could include multiple SP and HT characters. Update the regex used to
match the Token authorization header to account for this, instead of
matching on a single SP.
See http://www.w3.org/Protocols/rfc2616/rfc2616-sec2.html and
http://www.w3.org/Protocols/rfc2616/rfc2616-sec4.html for the relevant
parts of the specification.
|
| | | | |
|
| |/ /
|/| |
| | |
| | |
| | |
| | |
| | | |
This makes these two methods to be more inline with the previous
behavior of Parameters as Parameters used to be inherited from HWIA.
Fixes #21391
|
|\ \ \
| | | |
| | | | |
Rails API: Ability to return error responses in json format also in development
|
| | | | |
|
|/ / /
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
All of our tests were testing the `ActionController::Live` behavior in a
standalone environment, without going through the router or behaving
like a real application.
This resulted in `ActionController::Live` throwing the exception
`undefined method 'request' for #<ActionDispatch::Request:0x00000003ad1148>`
because `make_response!` was expecting a response instead of a request.
The expectation of a response came from `set_response!` in non-router
tests setting the response and passing it to `make_response!`. In the
case of an application we would hit `serve` in `RouteSet` first which
would send us to `make_response!` with a request sent instead of a
response.
The changes here remove `set_response!` so `make_response!` always
receives a request.
Thanks to KalabiYau for help with the investigation and solution.
Fixes #22524
[Eileen M. Uchitelle & KalabiYau]
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Per this comment
https://github.com/rails/rails/pull/18334#issuecomment-69234050 we want
`protect_from_forgery` to default to `prepend: false`.
`protect_from_forgery` will now be insterted into the callback chain at the
point it is called in your application. This is useful for cases where you
want to `protect_from_forgery` after you perform required authentication
callbacks or other callbacks that are required to run after forgery protection.
If you want `protect_from_forgery` callbacks to always run first, regardless of
position they are called in your application, then you can add `prepend: true`
to your `protect_from_forgery` call.
Example:
```ruby
protect_from_forgery prepend: true
```
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
We want to get rid of the `Live::Response` so we are consolidating methods
from `Live::Response` and `Response` by merging them together.
This adds an `#empty` method to the request so we don't need to
hard-code the empty array each time we call an empty
`ActionDispatch::Request`.
The work here is a continuation on combining controller and integration
test code bases into one.
|
|\ \ \
| | | |
| | | |
| | | |
| | | | |
Add option to verify Origin header in CSRF checks
[Jeremy Daer + Rafael Mendonça França]
|
| | | | |
|