Commit message (Collapse) | Author | Age | Files | Lines | |
---|---|---|---|---|---|
* | Fix json params parsing regression for non-object JSON content. | Dylan Smith | 2013-01-11 | 1 | -0/+7 |
| | | | | Fixes #8845. | ||||
* | Merge pull request #8821 from jamis/master | Rafael Mendonça França | 2013-01-10 | 1 | -2/+2 |
|\ | | | | | | | | | | | | | Evaluate view_cache_dependencies at the instance level Conflicts: actionpack/lib/action_controller/caching.rb | ||||
| * | evaluate the dependency blocks at the instance level, not class level | Jamis Buck | 2013-01-08 | 1 | -2/+2 |
| | | |||||
* | | Remove :yaml related tests and fix other related to parsing empty arrays | Carlos Antonio da Silva | 2013-01-08 | 2 | -45/+2 |
| | | | | | | | | All Action Pack tests are green. | ||||
* | | CVE-2013-0156: Safe XML params parsing. Doesn't allow symbols or yaml. | Jeremy Kemper | 2013-01-08 | 1 | -0/+13 |
| | | |||||
* | | * Strip nils from collections on JSON and XML posts. [CVE-2013-0155] * ↵ | Aaron Patterson | 2013-01-08 | 2 | -0/+32 |
| | | | | | | | | | | | | | | | | | | | | | | | | dealing with empty hashes. Thanks Damien Mathieu Conflicts: actionpack/CHANGELOG.md actionpack/lib/action_dispatch/http/request.rb actionpack/lib/action_dispatch/middleware/params_parser.rb activerecord/CHANGELOG.md activerecord/lib/active_record/relation/predicate_builder.rb activerecord/test/cases/relation/where_test.rb | ||||
* | | Revert "Merge branch 'master-sec'" | Jeremy Kemper | 2013-01-08 | 3 | -45/+0 |
| | | | | | | | | | | This reverts commit 88cc1688d0cb828c17706b41a8bd27870f2a2beb, reversing changes made to f049016cd348627bf8db0d72382d7580bf802a79. | ||||
* | | Merge branch 'master-sec' | Aaron Patterson | 2013-01-08 | 3 | -0/+45 |
|\ \ | |/ |/| | | | | | | | * master-sec: CVE-2013-0156: Safe XML params parsing. Doesn't allow symbols or yaml. * Strip nils from collections on JSON and XML posts. [CVE-2013-0155] * dealing with empty hashes. Thanks Damien Mathieu | ||||
| * | CVE-2013-0156: Safe XML params parsing. Doesn't allow symbols or yaml. | Jeremy Kemper | 2013-01-08 | 1 | -0/+13 |
| | | |||||
| * | * Strip nils from collections on JSON and XML posts. [CVE-2013-0155] * ↵ | Aaron Patterson | 2013-01-07 | 2 | -0/+32 |
| | | | | | | | | | | | | | | | | | | | | | | | | dealing with empty hashes. Thanks Damien Mathieu Conflicts: actionpack/CHANGELOG.md actionpack/lib/action_dispatch/http/request.rb actionpack/lib/action_dispatch/middleware/params_parser.rb activerecord/CHANGELOG.md activerecord/lib/active_record/relation/predicate_builder.rb activerecord/test/cases/relation/where_test.rb | ||||
* | | view_cache_dependency API | Jamis Buck | 2013-01-08 | 2 | -2/+34 |
| | | | | | | | | | | | | | | | | | | | | | | | | | | A declarative API for specifying dependencies that affect template cache digest computation. In your controller, specify any of said dependencies: view_cache_dependency { "phone" if using_phone? } When the block is evaluated, the resulting value is included in the cache digest calculation, allowing you to generate different digests for effectively the same template. (Mostly useful if you're mucking with template load paths.) | ||||
* | | Merge pull request #8810 from NARKOZ/image-submit-tag | Steve Klabnik | 2013-01-08 | 1 | -2/+2 |
|\ \ | | | | | | | set 'alt' attribute for image_submit_tag | ||||
| * | | set 'alt' attribute for image_submit_tag | Nihad Abbasov | 2013-01-08 | 1 | -2/+2 |
| | | | |||||
* | | | Revert "unpermitted params" exception -- it's just not going to work. See ↵ | David Heinemeier Hansson | 2013-01-08 | 1 | -43/+0 |
| | | | | | | | | | | | | the discussion on https://github.com/rails/strong_parameters/pull/75. | ||||
* | | | Never treat action or controller as unpermitted params | David Heinemeier Hansson | 2013-01-08 | 1 | -0/+10 |
|/ / | |||||
* / | Do not generate local vars for partials without object or collection | Carlos Antonio da Silva | 2013-01-08 | 2 | -0/+8 |
|/ | | | | | | | | | Previously rendering a partial without giving :object or :collection would generate a local variable with the partial name by default. This was noticed due to warnings in Ruby 2.0 of not used variables, which turned out to be the generation of not used variables inside partials that do not contain objects related to them. | ||||
* | Namespace HashWithIndifferentAccess | Akira Matsuda | 2013-01-07 | 1 | -3/+2 |
| | |||||
* | Needless requires | Akira Matsuda | 2013-01-06 | 1 | -2/+0 |
| | |||||
* | Missing requires | Akira Matsuda | 2013-01-06 | 1 | -0/+1 |
| | |||||
* | Do not call fields_for from form_for, to avoid instantiating two builders | Carlos Antonio da Silva | 2013-01-06 | 1 | -1/+13 |
| | |||||
* | Remove unnecessary begin..rescue..end, use only rescue | Akira Matsuda | 2013-01-06 | 4 | -25/+17 |
| | |||||
* | deprecate `assert_blank` and `assert_present`. | Yves Senn | 2013-01-05 | 6 | -16/+16 |
| | | | | | They don't add any benefits over `assert object.blank?` and `assert object.present?` | ||||
* | display mountable engine routes on RoutingError. | Yves Senn | 2013-01-05 | 1 | -2/+20 |
| | |||||
* | split formatting concerns from RoutesInspector | Yves Senn | 2013-01-05 | 1 | -4/+21 |
| | |||||
* | Rename the last occurrence of UnexpectedParameters | Rafael Mendonça França | 2013-01-05 | 1 | -2/+2 |
| | |||||
* | Rename the configuration to raise_on_unpermitted_parameters | Rafael Mendonça França | 2013-01-05 | 1 | -4/+4 |
| | | | | Also changed the exception to UnpermittedParameters | ||||
* | Merge pull request #8752 from thomasfedb/master | Rafael Mendonça França | 2013-01-05 | 1 | -0/+33 |
|\ | | | | | Exception on unexpected params when enabled. | ||||
| * | Allow developers to enable raising of exception when unexpected params are ↵ | Thomas Drake-Brockman | 2013-01-05 | 1 | -0/+33 |
| | | | | | | | | provided. | ||||
* | | Allow use of durations for ActionDispatch::SSL configuration | Andrew White | 2013-01-04 | 1 | -0/+7 |
|/ | |||||
* | Restore original remote_ip algorithm. | Andre Arko | 2013-01-02 | 1 | -58/+44 |
| | | | | | | | | | | | Proxy servers add X-Forwarded-For headers, resulting in a list of IPs. We remove trusted IP values, and then take the last given value, assuming that it is the most likely to be the correct, unfaked value. See [1] for a very thorough discussion of why that is the best option we have at the moment. [1]: http://blog.gingerlime.com/2012/rails-ip-spoofing-vulnerabilities-and-protection/ Fixes #7979 | ||||
* | do not append a second slash when using | Yves Senn | 2013-01-02 | 1 | -6/+16 |
| | |||||
* | No need to pass a empty block to content_tag_for anymore | Rafael Mendonça França | 2013-01-02 | 1 | -11/+11 |
| | |||||
* | Make content_tag_for work without block | Rafael Mendonça França | 2013-01-02 | 1 | -0/+8 |
| | | | | This is version of #8640 for master | ||||
* | Fix test for DebugExceptions due to template change | Guillermo Iguaran | 2012-12-31 | 1 | -1/+1 |
| | |||||
* | Use ActiveSupport::TestCase in the journey tests | Rafael Mendonça França | 2012-12-31 | 13 | -13/+13 |
| | |||||
* | Alias refute methods to assert_not and perfer assert_not on tests | Rafael Mendonça França | 2012-12-31 | 12 | -22/+22 |
| | |||||
* | Do not use the same tests description | Rafael Mendonça França | 2012-12-31 | 1 | -3/+3 |
| | |||||
* | Remove unneeded tests | Rafael Mendonça França | 2012-12-31 | 5 | -381/+0 |
| | | | | These tests are needed only if we are using MiniTest::Spec | ||||
* | Add active_support/testing/autorun | Rafael Mendonça França | 2012-12-31 | 3 | -3/+3 |
| | | | | | minitest/autorun load minitest/spec polluting the global namespace with the DSL that we don't want on Rails | ||||
* | Merge pull request #8662 from ↵ | Santiago Pastorino | 2012-12-31 | 1 | -1/+12 |
|\ | | | | | | | | | senny/8661_should_not_append_charset_if_already_present Charset should not be appended to image/* type | ||||
| * | charset should not be appended for `head` responses | Yves Senn | 2012-12-31 | 1 | -1/+12 |
| | | | | | | | | | | | | | | 1) Failure: test_head_created_with_image_png_content_type(RenderTest) [test/controller/render_test.rb:1238]: Expected: "image/png" Actual: "image/png; charset=utf-8" | ||||
* | | Merge pull request #8546 from hsbt/fix-testcase-strict-warning | Santiago Pastorino | 2012-12-30 | 1 | -1/+2 |
|\ \ | |/ |/| | fix testcase: ruby-2.0.0 warned unused variables | ||||
| * | change spy of after invoked controller action. because ruby-2.0.0 waned ↵ | SHIBATA Hiroshi | 2012-12-20 | 1 | -1/+2 |
| | | | | | | | | unused variables | ||||
* | | Fix collection_radio_buttons with the option `:checked` with value of | Rafael Mendonça França | 2012-12-26 | 1 | -0/+6 |
| | | | | | | | | `false` | ||||
* | | we're not supporting SQLite 2 | Akira Matsuda | 2012-12-24 | 1 | -13/+5 |
| | | |||||
* | | Merge pull request #8085 from acapilleri/format_never_nil | Guillermo Iguaran | 2012-12-22 | 2 | -2/+11 |
|\ \ | | | | | | | if format is unknown NullMimeTypeObject is returned | ||||
| * | | return Mime::NullType if format is unknown | Angelo Capilleri | 2012-12-22 | 2 | -2/+11 |
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If a request has an unknown format, the methods html?, xml?, json? ...etc not raise an Exception. This patch add a class Mime::NullType, that is returned when request.format is unknown and it responds false to the methods that ends with '?' and true to 'nil?'. It refers to #7837, this issue is considered a improvement not a bug. | ||||
* | | | Merge pull request #8586 from balexand/cache_digests_regex | Rafael Mendonça França | 2012-12-21 | 2 | -1/+11 |
|\ \ \ | |/ / |/| | | Digestor explicit dependency should not contain trailing whitespace | ||||
| * | | Digestor explicit dependency should not contain trailing whitespace | Brian Alexander | 2012-12-21 | 2 | -1/+11 |
| | | | | | | | | | | | | test for rails/rails#8586 | ||||
* | | | Move background jobs to the 'jobs' branch until fully baked. Not shipping ↵ | Jeremy Kemper | 2012-12-21 | 1 | -10/+0 |
| | | | | | | | | | | | | with Rails 4.0. |