Commit message (Collapse) | Author | Age | Files | Lines | |
---|---|---|---|---|---|
* | Don't allow render(params) in view/controller | Arthur Neves | 2016-02-29 | 1 | -0/+27 |
| | | | | | | | | | | | | | | | `render(params)` is dangerous and could be a vector for attackers. Don't allow calls to render passing params on views or controllers. On a controller or view, we should not allow something like `render params[:id]` or `render params`. That could be problematic, because an attacker could pass input that could lead to a remote code execution attack. This patch is also compatible when using strong parameters. CVE-2016-2098 | ||||
* | allow :file to be outside rails root, but anything else must be inside the ↵ | Aaron Patterson | 2016-01-22 | 1 | -0/+7 |
| | | | | | | | | | | rails view directory Conflicts: actionpack/test/controller/render_test.rb actionview/lib/action_view/template/resolver.rb CVE-2016-0752 | ||||
* | fix issue #11605 | Kassio Borges | 2013-08-24 | 1 | -10/+7 |
| | |||||
* | Fix typo in view name | Carlos Antonio da Silva | 2013-04-03 | 1 | -1/+1 |
| | | | | Introduced in 2c22376fe04b89e8f34620139720b85a85ce3428 | ||||
* | Common behavior with adding formats to lookup_context for TemplateRenderer ↵ | Dmitry Vorotilin | 2013-04-02 | 1 | -0/+10 |
| | | | | and PartialRenderer | ||||
* | Merge pull request #8402 from ↵ | Rafael Mendonça França | 2012-12-02 | 1 | -1/+6 |
| | | | | | | | | | senny/8376_descriptive_error_message_for_partial_layout_true More descriptive error when rendering a partial with `:layout => true` Conflicts: actionpack/CHANGELOG.md actionpack/lib/action_view/renderer/partial_renderer.rb | ||||
* | Fix broken test from the earlier merge conflict | Prem Sichanugrist | 2012-04-23 | 1 | -9/+11 |
| | | | | Seriously people, please run the test before submitting pull request. | ||||
* | converting some tests to assert_raises, and DRY'ing retrieve_variable changes | Tieg Zaharia | 2012-04-16 | 1 | -46/+22 |
| | | | | | | Conflicts: actionpack/test/template/render_test.rb | ||||
* | catch nil.to_sym errors in partial_renderer, and raise ArgumentError instead | Tieg Zaharia | 2012-04-16 | 1 | -0/+9 |
| | |||||
* | format lookup for partials is derived from the format in which the template ↵ | Santiago Pastorino | 2012-02-22 | 1 | -2/+6 |
| | | | | | | is being rendered Closes #5025 part 2 | ||||
* | Restore lookup formats to the previous value after searching for the failing ↵ | Santiago Pastorino | 2012-02-21 | 1 | -1/+2 |
| | | | | view | ||||
* | Use the right format when a partial is missing. | Santiago Pastorino | 2012-02-20 | 1 | -0/+7 |
| | | | | Closes #5025 | ||||
* | Reset memoized hash keys when new entry added | Chris Kelly | 2012-02-20 | 1 | -0/+6 |
| | |||||
* | raises an ArgumentError if no valid options are given to ↵ | Lucas Mazza | 2011-12-21 | 1 | -4/+11 |
| | | | | | | TemplateRenderer#determine_template Signed-off-by: José Valim <jose.valim@gmail.com> | ||||
* | Meaningful errors for unexpected partial arguments. Fixes #3573 | Tobias Svensson | 2011-11-19 | 1 | -0/+7 |
| | |||||
* | Fix deprecation warnings in action pack test suite due to passing template ↵ | Matthew Daubert | 2011-10-25 | 1 | -4/+4 |
| | | | | formats in the template name. | ||||
* | Fix failing tests and add tests for :formats on partial. | José Valim | 2011-09-23 | 1 | -5/+10 |
| | |||||
* | Allow both sym and array for details options in #render. using ↵ | Nick Sutterer | 2011-09-23 | 1 | -0/+3 |
| | | | | LC#registered_details to extract options. | ||||
* | added tests for render :file/:template and the :formats/:handlers/:locale ↵ | Nick Sutterer | 2011-09-23 | 1 | -1/+17 |
| | | | | options. | ||||
* | Deprecate passing the template handler in the template name. | José Valim | 2011-09-22 | 1 | -20/+22 |
| | | | | | | For example, calling hello.erb is now deprecated. Since Rails 3.0 passing the handler had no effect whatsover. This commit simply deprecates such cases so we can clean up the code in later releases. | ||||
* | Get rid of update_details in favor of passing details to find_template. | José Valim | 2011-09-22 | 1 | -0/+5 |
| | |||||
* | it is now possible to pass details options (:formats, :details, :locales, ↵ | Nick Sutterer | 2011-09-22 | 1 | -0/+6 |
| | | | | ...) to #render, #find_template and friends. this doesn't change anything in global context. | ||||
* | deprecating process_view_paths | Aaron Patterson | 2011-08-09 | 1 | -1/+1 |
| | |||||
* | Rename new method to_path to to_partial_path to avoid conflicts with ↵ | José Valim | 2011-08-01 | 1 | -2/+2 |
| | | | | File#to_path and similar. | ||||
* | Let ActiveModel instances define partial paths. | Grant Hutchins & Peter Jaros | 2011-07-25 | 1 | -0/+30 |
| | | | | | | Deprecate ActiveModel::Name#partial_path. Now you should call #to_path directly on ActiveModel instances. | ||||
* | Added view template invalid name check, along with tests. No merges in commit. | huskins | 2011-07-13 | 1 | -0/+9 |
| | |||||
* | remove warning: assigned but unused variable | Santiago Pastorino | 2011-06-08 | 1 | -2/+2 |
| | |||||
* | Optimize the most common resolver case. | José Valim | 2011-05-09 | 1 | -1/+1 |
| | |||||
* | Buffer should be an option passed down to template rendering. | José Valim | 2011-04-16 | 1 | -9/+0 |
| | |||||
* | removes render :update from views | Xavier Noria | 2011-04-13 | 1 | -4/+0 |
| | |||||
* | SJIS is an alias to Windows-31J in ruby trunk. Use SHIFT_JIS for this test | Aaron Patterson | 2011-03-21 | 1 | -2/+2 |
| | |||||
* | Add a test for 'render :layout' | Anton Astashov | 2011-02-03 | 1 | -0/+5 |
| | | | | | | | | | To make sure it will show block contents if it is placed after 'render :partial' [#5557 state:resolved] Signed-off-by: Santiago Pastorino <santiago@wyeworks.com> | ||||
* | Accept String value for render_partial :as option | Akira Matsuda | 2011-02-01 | 1 | -1/+6 |
| | | | | | | [#6222 state:committed] Signed-off-by: Santiago Pastorino <santiago@wyeworks.com> | ||||
* | Properly check the arity for template handlers. | José Valim | 2010-12-09 | 1 | -0/+5 |
| | |||||
* | Pass the view object as parameter to the handler. Useful if you need to ↵ | José Valim | 2010-11-17 | 1 | -0/+9 |
| | | | | access the lookup context or other information when compiling the template. | ||||
* | Tests added for rendering partial with layout, when the partial contains ↵ | Santiago Pastorino | 2010-11-13 | 1 | -0/+15 |
| | | | | another render layout with block call | ||||
* | Fix render partial with layout and no block | Carlos Antonio da Silva | 2010-11-11 | 1 | -0/+10 |
| | | | | | | | | When using a render :partial with :layout call, without giving a block, if the given :partial had another render :partial call, the layout was not being rendered. This commit fixes this context by storing variables before rendering the partial, so they are not overrided in any successive call to render partials down the path. All ActionPack tests are ok. | ||||
* | Fix issue with rendering partials and then yielding inside a render layout call | Carlos Antonio da Silva | 2010-11-11 | 1 | -0/+20 |
| | | | | | | | The given block was never being executed when another render :partial call existed before the yield call, due to the block being overriden. This commit also adds some more tests to render with :layout option. | ||||
* | Do not allow templates coming from Fallback resolvers to store a virtual path. | José Valim | 2010-10-10 | 1 | -1/+12 |
| | |||||
* | fix rendering a partial with an array as its :object [#5746 state:resolved] | Michael Koziarski | 2010-10-08 | 1 | -0/+4 |
| | | | | | | | | Signed-off-by: Michael Koziarski <michael@koziarski.com> Conflicts: actionpack/lib/action_view/render/partials.rb | ||||
* | Silence warnings here, only setting Encoding.default_external for testing. | Emilio Tagua | 2010-09-28 | 1 | -2/+3 |
| | |||||
* | Removing unnecessary code from render_test | Thiago Pradi | 2010-09-02 | 1 | -2/+0 |
| | | | | Signed-off-by: José Valim <jose.valim@gmail.com> | ||||
* | Remove deprecated support to <% form_for %> and several ↵ | José Valim | 2010-08-29 | 1 | -9/+0 |
| | | | | ActionController::Base methods. | ||||
* | layout_for works again with objects as specified in the documentation and ↵ | José Valim & Carlos Antonio da Silva | 2010-08-11 | 1 | -0/+5 |
| | | | | Rails 2.3 [#5357 state:resolved] | ||||
* | render(:inline) in a layout before yield replaces original content | Neeraj Singh | 2010-06-13 | 1 | -0/+6 |
| | | | | | | [#4777 state:resolved] Signed-off-by: José Valim <jose.valim@gmail.com> | ||||
* | Revert "Moved encoding work in progress to a feature branch." | wycats | 2010-05-17 | 1 | -5/+5 |
| | | | | This reverts commit ade756fe42423033bae8e5aea8f58782f7a6c517. | ||||
* | Moved encoding work in progress to a feature branch. | Jeremy Kemper | 2010-05-16 | 1 | -5/+5 |
| | | | | This reverts commits af0d1a88157942c6e6398dbf73891cff1e152405 and 64d109e3539ad600f58536d3ecabd2f87b67fd1c. | ||||
* | Significantly improved internal encoding heuristics and support. | wycats | 2010-05-16 | 1 | -5/+5 |
| | | | | | | | | | | | | | | | | | | | | | | | | | * Default Encoding.default_internal to UTF-8 * Eliminated the use of file-wide magic comments to coerce code evaluated inside the file * Read templates as BINARY, use default_external or template-wide magic comments inside the Template to set the initial encoding * This means that template handlers in Ruby 1.9 will receive Strings encoded in default_internal (UTF-8 by default) * Create a better Exception for encoding issues, and use it when the template source has bytes that are not compatible with the specified encoding * Allow template handlers to opt-into handling BINARY. If they do so, they need to do some of their own manual encoding work * Added a "Configuration Gotchas" section to the intro Rails Guide instructing users to use UTF-8 for everything * Use config.encoding= in Ruby 1.8, and raise if a value that is an invalid $KCODE value is used Also: * Fixed a few tests that were assert() rather than assert_equal() and were caught by Minitest requiring a String for the message * Fixed a test where an assert_select was misformed, also caught by Minitest being more restrictive * Fixed a test where a Rack response was returning a String rather than an Enumerable | ||||
* | Use annoted source code in Template:Error to avoid special cases in the show ↵ | José Valim | 2010-05-09 | 1 | -0/+1 |
| | | | | exceptions middleware. | ||||
* | Expect an incompatible encoding exception when a template with a magic ↵ | Jeremy Kemper | 2010-04-08 | 1 | -2/+13 |
| | | | | comment renders a partial without one and its source encoding doesn't match the default external encoding |