aboutsummaryrefslogtreecommitdiffstats
path: root/actionpack/test/dispatch/session/cache_store_test.rb
Commit message (Collapse)AuthorAgeFilesLines
* Deprecate :controller and :action path parametersAndrew White2016-03-011-1/+3
| | | | | | | | Allowing :controller and :action values to be specified via the path in config/routes.rb has been an underlying cause of a number of issues in Rails that have resulted in security releases. In light of this it's better that controllers and actions are explicitly whitelisted rather than trying to blacklist or sanitize 'bad' values.
* Revert "Update Session to utilize indiffernt access"Matthew Draper2016-02-261-29/+0
| | | | | | | | | | | This reverts commit 45a75a3fcc96b22954caf69be2df4e302b134d7a. HWIAs are better than silently deeply-stringified hashes... but that's a reaction to a shortcoming of one particular session store: we should not break the basic behaviour of other, more featureful, session stores in the process. Fixes #23884
* Update Session to utilize indiffernt accessTom Prats2016-01-301-0/+29
|
* finish deprecating handling strings and symbolsAaron Patterson2015-08-071-1/+1
| | | | | since we only work with instances of classes, it greatly simplifies the `Middleware` implementation.
* Stop using deprecated `render :text` in testPrem Sichanugrist2015-07-171-2/+2
| | | | | | | | | This will silence deprecation warnings. Most of the test can be changed from `render :text` to render `:plain` or `render :body` right away. However, there are some tests that needed to be fixed by hand as they actually assert the default Content-Type returned from `render :body`.
* Use request.session.id instead of request.session_options[:id]Brian John2015-03-121-1/+1
| | | | | | | | | As of the upgrade to Rack 1.5, request.session_options[:id] is no longer populated. Reflect this change in the tests by using request.session.id instead. Related change in Rack: https://github.com/rack/rack/commit/83a270d6
* Regenerate sid when sbdy tries to fixate the sessionSantiago Pastorino2014-08-041-9/+8
| | | | | | Fixed broken test. Thanks Stephen Richards for reporting.
* fix cache store testSteve Klabnik2012-09-301-0/+1
| | | | Pull #7800 broke the build, this should fix it.
* Remove default match without specified methodJose and Yehuda2012-04-241-1/+1
| | | | | | | | | | | | | | | | In the current router DSL, using the +match+ DSL method will match all verbs for the path to the specified endpoint. In the vast majority of cases, people are currently using +match+ when they actually mean +get+. This introduces security implications. This commit disallows calling +match+ without an HTTP verb constraint by default. To explicitly match all verbs, this commit also adds a :via => :all option to +match+. Closes #5964
* Remove rescue_action from compatibility module and testsCarlos Antonio da Silva2012-01-171-2/+0
|
* Add ActionDispatch::Session::CacheStore as a generic way of storing sessions ↵Brian Durand2011-10-211-0/+181
in a cache.
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-02 05:36:44 +0000