| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
| |
this also changes the constructor. We don't need to pass more options
than "defaults" (whatever defaults are, ugh. probably another hash of
stupid stuff).
|
| |
|
| |
|
| |
|
| |
|
| |
|
|
|
|
|
| |
stop hardcoding hash keys and use the accessors provided on the request
object.
|
|
|
|
| |
this decouples our code from the env hash a bit.
|
| |
|
|
|
|
| |
There are performance gains to be made by avoiding URI setter methods.
|
| |
|
| |
|
|\
| |
| | |
Check authentication scheme in Basic auth
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
`authenticate_with_http_basic` and its families should check the authentication
schema is "Basic".
Different schema, such as OAuth2 Bearer should be rejected by basic auth, but
it was passing as the test shows.
This fixes #10257.
|
|\ \
| | |
| | | |
Un-define :to_json for Customer class after stubbing.
|
| | | |
|
|\ \ \
| | | |
| | | | |
Deregister csv renderer after test to prevent leak.
|
| |/ / |
|
|/ /
| |
| |
| |
| |
| |
| |
| |
| |
| | |
This reverts commit 5c224de9e110763ec7a0f01f5b604bcf81f40bfb.
Conflicts:
actionpack/lib/action_dispatch/journey/visitors.rb
5c224de9e110763ec7a0f01f5b604bcf81f40bfb introduced a bug in the
formatter. This commit includes a regression test.
|
| | |
|
| |
| |
| |
| | |
'head :ok'
|
| | |
|
| | |
|
|\ \
| | |
| | |
| | |
| | |
| | |
| | | |
Add controller and action name to the fragment caching instrumentation payload
Conflicts:
actionpack/CHANGELOG.md
|
| | | |
|
|\ \ \
| | | |
| | | | |
Add multiple lines message support for SSE module
|
| | | | |
|
| | | |
| | | |
| | | |
| | | | |
Then we can avoid nil checks
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
`assert_redirected_to` would fail if there is no controller set on
a `ActionDispatch::IntegrationTest`, as _compute_redirect_to_location
would be called on the controller to build the url.
This regression was introduced after 1dacfbabf3bb1e0a9057dd2a016b1804e7fa38c0.
[fixes #14691]
|
|/ / / |
|
| | | |
|
| | |
| | |
| | |
| | |
| | | |
There may be situations where you need to tunnel SSL connections over
port 80 so we shouldn't remove it if it has been explicitly provided.
|
| | |
| | |
| | |
| | | |
relative URL.
|
| | |
| | |
| | |
| | | |
do not test internals
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Previously if you were looking for a given key, the header may incorrectly tell you that it did not exist even though it would return a valid value:
```ruby
env = { "CONTENT_TYPE" => "text/plain" }
headers = ActionDispatch::Http::Headers.new(env)
headers["Content-Type"]
# => "text/plain"
headers.key?("Content-Type")
# => false
```
This PR fixes that behavior by converting the key before checking for presence
|
|\ \ \
| | | |
| | | | |
Moved 'params[request_forgery_protection_token]' into its own method and...
|
| | | |
| | | |
| | | |
| | | | |
improved tests.
|
|/ / /
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
This will avoid directory traversal in implicit render.
Fixes: CVE-2014-0130
Conflicts:
actionpack/lib/abstract_controller/base.rb
|
| | | |
|
|\ \ \
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Callable route constraint verification
Conflicts:
actionpack/CHANGELOG.md
|
| | | |
| | | |
| | | |
| | | | |
silently failing to enforce the constraint
|
| |/ /
|/| | |
|
|\ \ \
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Make remote_ip detection properly handle private IPv6 addresses
Conflicts:
actionpack/CHANGELOG.md
|
| | | |
| | | |
| | | |
| | | | |
Fixes #12638.
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Previously, the `VerifyAndUpgradeLegacySignedMessage` assumes all incoming
cookies are marshal-encoded. This is not the case when `secret_token` is
used in conjunction with the `:json` or `:hybrid` serializer.
In those case, when upgrading to use `secret_key_base`, this would cause a
`TypeError: incompatible marshal file format` and a 500 error for the user.
Fixes #14774.
*Godfrey Chan*
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
1. Escape '%' characters in URLs - only unescaped data
should be passed to URL helpers
2. Add an `escape_segment` helper to `Router::Utils`
that escapes '/' characters
3. Use `escape_segment` rather than `escape_fragment`
in optimized URL generation
4. Use `escape_segment` rather than `escape_path`
in URL generation
For point 4 there are two exceptions. Firstly, when a route uses wildcard
segments (e.g. *foo) then we use `escape_path` as the value may contain '/'
characters. This means that wildcard routes can't be optimized. Secondly,
if a `:controller` segment is used in the path then this uses `escape_path`
as the controller may be namespaced.
Fixes #14629, #14636 and #14070.
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Makes it clear that anything passed with the helper must not be percent encoded.
Fixes previous behavior which tricks people into believing passing
non-percent-encoded will generate a proper percent-encoded path while in
reality it doesn't ('%' isn't escaped).
The intention is nice but the heuristic is broken.
|
| | | |
| | | |
| | | |
| | | | |
Related with cbb917455f306cf5818644b162f22be09f77d4b2
|
| | | |
| | | |
| | | |
| | | | |
This was changed at cbb917455f306cf5818644b162f22be09f77d4b2
|
| | | | |
|