aboutsummaryrefslogtreecommitdiffstats
path: root/actionpack/test
Commit message (Collapse)AuthorAgeFilesLines
* Remove http_cache_forever's version parameterJean Boussier2016-03-051-9/+1
|
* Rename constrain_to to exclude.Kasper Timm Hansen2016-03-031-4/+4
| | | | | | | | | `ActionDispatch::SSL` redirects all HTTP requests to HTTPS, not just some. The `constrain_to` option inverts this, so it sounds like the middleware only handles a few requests, rather than the majority with a few routes to opt out of the redirect. Renaming to `exclude` matches this intent more closely.
* [ci skip] Use rails routes instead of rake routes in inspector test descriptionAbhishek Jain2016-03-021-9/+9
|
* Merge pull request #23932 from arthurnn/arthurnn/remove_load_pathsArthur Nogueira Neves2016-03-011-2/+0
|\ | | | | Remove load_paths file
| * Remove load_paths fileArthur Neves2016-02-271-2/+0
| |
* | Merge pull request #23980 from rails/deprecate-controller-action-segmentsAndrew White2016-03-0130-212/+468
|\ \ | | | | | | Deprecate :controller and :action path parameters
| * | Deprecate :controller and :action path parametersAndrew White2016-03-0130-212/+468
| | | | | | | | | | | | | | | | | | | | | | | | Allowing :controller and :action values to be specified via the path in config/routes.rb has been an underlying cause of a number of issues in Rails that have resulted in security releases. In light of this it's better that controllers and actions are explicitly whitelisted rather than trying to blacklist or sanitize 'bad' values.
* | | Publish AS::Executor and AS::Reloader APIsMatthew Draper2016-03-023-24/+191
|/ / | | | | | | | | | | These should allow external code to run blocks of user code to do "work", at a similar unit size to a web request, without needing to get intimate with ActionDipatch.
* / add `constraint_to` option to SSL middlewareGreg Molnar2016-02-281-0/+7
|/
* Merge pull request #23852 from prathamesh-sonpatki/hsts-subdomainsRafael França2016-02-251-7/+16
|\ | | | | Enable HSTS with IncludeSubdomains header by default for new apps
| * Added deprecation for older appsPrathamesh Sonpatki2016-02-251-7/+16
| | | | | | | | | | | | | | | | - For old apps which are not setting any value for hsts[:subdomains], a deprecation warning will be shown saying that hsts[:subdomains] will be turned on by default in Rails 5.1. Currently it will be set to false for backward compatibility. - Adjusted tests to reflect this change.
* | Revert "Merge pull request #20851 from tomprats/indifferent-sessions"Matthew Draper2016-02-261-10/+0
| | | | | | | | | | | | | | This reverts commit 22db455dbe9c26fe6d723cac0758705d9943ea4b, reversing changes made to 40be61dfda1e04c3f306022a40370862e3a2ce39. This finishes off what I meant to do in 6216a092ccfe6422f113db906a52fe8ffdafdbe6.
* | Revert "Update Session to utilize indiffernt access"Matthew Draper2016-02-266-118/+1
| | | | | | | | | | | | | | | | | | | | | | This reverts commit 45a75a3fcc96b22954caf69be2df4e302b134d7a. HWIAs are better than silently deeply-stringified hashes... but that's a reaction to a shortcoming of one particular session store: we should not break the basic behaviour of other, more featureful, session stores in the process. Fixes #23884
* | Additional review of 6b31761.Kasper Timm Hansen2016-02-251-1/+0
| | | | | | | | | | * Fixes typos in error message and release notes. * Removes unused template test file.
* | Lock down new `ImplicitRender` behavior for 5.0 RCGodfrey Chan2016-02-256-35/+86
|/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | 1. Conceptually revert #20276 The feature was implemented for the `responders` gem. In the end, they did not need that feature, and have found a better fix (see plataformatec/responders#131). `ImplicitRender` is the place where Rails specifies our default policies for the case where the user did not explicitly tell us what to render, essentially describing a set of heuristics. If the gem (or the user) knows exactly what they want, they could just perform the correct `render` to avoid falling through to here, as `responders` did (the user called `respond_with`). Reverting the patch allows us to avoid exploding the complexity and defining “the fallback for a fallback” policies. 2. `respond_to` and templates are considered exhaustive enumerations If the user specified a list of formats/variants in a `respond_to` block, anything that is not explicitly included should result in an `UnknownFormat` error (which is then caught upstream to mean “406 Not Acceptable” by default). This is already how it works before this commit. Same goes for templates – if the user defined a set of templates (usually in the file system), that set is now considered exhaustive, which means that “missing” templates are considered `UnknownFormat` errors (406). 3. To keep API endpoints simple, the implicit render behavior for actions with no templates defined at all (regardless of formats, locales, variants, etc) are defaulted to “204 No Content”. This is a strictly narrower version of the feature landed in #19036 and #19377. 4. To avoid confusion when interacting in the browser, these actions will raise an `UnknownFormat` error for “interactive” requests instead. (The precise definition of “interactive” requests might change – the spirit here is to give helpful messages and avoid confusions.) Closes #20666, #23062, #23077, #23564 [Godfrey Chan, Jon Moss, Kasper Timm Hansen, Mike Clark, Matthew Draper]
* Added a test for generating Strong ETagPrathamesh Sonpatki2016-02-241-0/+8
|
* Show permitted flag in the output of AC::Parameters#inspectPrathamesh Sonpatki2016-02-241-3/+13
| | | | - Fixes #23822.
* Merge pull request #20851 from tomprats/indifferent-sessionsRafael Mendonça França2016-02-246-0/+127
|\ | | | | | | Give Sessions Indifferent Access
| * Update Session to utilize indiffernt accessTom Prats2016-01-306-1/+118
| |
| * Update session to have indifferent accessTom Prats2016-01-291-0/+10
| |
* | Fix `request.ssl?` bug with Action CableJon Moss2016-02-231-0/+9
| | | | | | | | | | This bug affects `wss://` requests when running Action Cable in-app. Fixes #23620.
* | remove args from assert_nothing_raised in testsTara Scherner de la Fuente2016-02-221-1/+1
| |
* | Add `internal` attribute to routesJon Moss2016-02-221-0/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This is meant to provide a way for Action Cable, Sprockets, and possibly other Rack applications to mark themselves as internal, and to exclude themselves from the routing inspector, and thus `rails routes` / `rake routes`. I think this is the only way to have mounted Rack apps be marked as internal, within AD/Journey. Another option would be to create an array of regexes for internal apps, and then to iterate over that everytime a request comes through. Also, I only had the first `add_route` method set `internal`'s default to false, to avoid littering it all over the codebase.
* | Make sure we unregister the mime type before registeringRafael Mendonça França2016-02-221-10/+22
| | | | | | | | Also make sure we don't change the global state of our test suite.
* | Transform the mime object to symbol when registering the parsersRafael Mendonça França2016-02-221-1/+1
| | | | | | | | | | This will keep our current API working without having the users to change their codebases.
* | Use symbol of mime type instead of object to get correct parserMehmet Emin İNAÇ2016-02-222-2/+18
| | | | | | | | | | | | After registering new `:json` mime type `parsers.fetch` can't find the mime type because new mime type is not equal to old one. Using symbol of the mime type as key on parsers hash solves the problem. Closes #23766
* | Make per form token work when method is not providedRafael Mendonça França2016-02-221-2/+16
| | | | | | | | | | | | When `button_to 'Botton', url` form was being used the per form token was not correct because the method that is was being used to generate it was an empty string.
* | Merge pull request #23752 from vipulnsward/23524-fix-button_to_deleteRafael Mendonça França2016-02-221-48/+60
|\ \ | | | | | | | | | Fixed passing of delete method on button_to tag, creating wrong form csrf token
| * | Refactored Request Forgery CSRF PerFormTokensController tests and DRY'ed ↵Vipul A M2016-02-221-70/+38
| | | | | | | | | | | | them up.
| * | Fixed passing of delete method on button_to tag, creating wrong form csrf tokenVipul A M2016-02-211-0/+44
| | | | | | | | | | | | Fixes #23524
* | | Merge pull request #23695 from kaspth/remove-automatic-collection-cachingKasper Timm Hansen2016-02-202-17/+6
|\ \ \ | |/ / |/| | Make collection caching explicit.
| * | Make collection caching explicit.Kasper Timm Hansen2016-02-202-17/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Having collection caching that wraps templates and automatically tries to infer if they are cachable proved to be too much of a hassle. We'd rather have it be something you explicitly turn on. This removes much of the code and docs to explain the previous automatic behavior. This change also removes scoped cache keys and passing cache_options.
* | | Deprecate AC::Parameters#== with a HashBenjamin Quorning2016-02-191-2/+4
| | |
* | | Fix AC::Parameters#== with other AC::ParametersBenjamin Quorning2016-02-191-0/+33
| | | | | | | | | | | | Creating a protected getter method for `@parameters`.
* | | Tests for AC::Parameters#==Benjamin Quorning2016-02-191-0/+6
| | |
* | | Fix master buildJon Moss2016-02-181-1/+1
|/ /
* | fields_for_style needs to test for AC::ParametersAaron Patterson2016-02-171-0/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | While iterating an AC::Parameters object, the object will mutate itself and stick AC::Parameters objects where there used to be hashes: https://github.com/rails/rails/blob/f57092ad728fa1de06c4f5fd9d09dcc2c4738fd9/actionpack/lib/action_controller/metal/strong_parameters.rb#L632 If you use `permit` after this iteration, the `fields_for_style` method wouldn't return true because the child objects are now AC::Parameters objects rather than Hashes. fixes #23701
* | Implement ActionController::Parameters#inspectBenjamin Quorning2016-02-171-0/+9
| | | | | | | | Now that AC::Parameters is no longer a Hash, it shouldn't look like a hash.
* | Fix typoRafael Mendonça França2016-02-171-1/+1
| |
* | Merge pull request #23712 from ↵Rafael França2016-02-171-9/+2
|\ \ | | | | | | | | | | | | bf4/incorrect_to_accept_json_api_and_not_render_spec The JSON API media type should only work wih a JSON API handler
| * | The JSON API media type should only work wih a JSON API handlerBenjamin Fleischer2016-02-161-9/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since the media type 'application/vnd.api+json' is a spec, it is inappropriate to handle it with the JSON renderer. This PR removes support for a JSON API media type. I would recommend the media type be registered on its own as `jsonapi` when a jsonapi Renderer and deserializer (Http::Parameters::DEFAULT_PARSERS) are added. Is related to work in https://github.com/rails/rails/pull/21496
* | | Merge pull request #23661 from meinac/add_gzip_mime_typeRichard Schneeman2016-02-161-1/+1
|\ \ \ | |/ / |/| | application/gzip added as default mime type into mime type list
| * | application/gzip added as default mime type into mime type listMehmet Emin İNAÇ2016-02-131-1/+1
| | |
* | | Merge pull request #23692 from abhishekjain16/docsYves Senn2016-02-161-1/+1
|\ \ \ | | | | | | | | Use a URL instead of an URL everywhere
| * | | Use a URL instead of an URL everywhereAbhishek Jain2016-02-151-1/+1
| | | |
* | | | Remove unused test controller actionAndrew White2016-02-161-5/+0
| | | |
* | | | Move test for #22828 into it's own testAndrew White2016-02-161-2/+10
| | | | | | | | | | | | | | | | | | | | | | | | The `cookies` hash isn't updated with the value generated by the output from `to_header` so it wasn't testing anything. Rendering the cookie value in the controller makes sure that the escaping is actually working.
* | | | Merge branch 'should-escape-cookie' of https://github.com/ma2gedev/rails ↵Andrew White2016-02-161-0/+7
|\ \ \ \ | | | | | | | | | | | | | | | into ma2gedev-should-escape-cookie
| * | | | Escape cookie's key and value in ActionController::TestCaseTakayuki Matsubara2015-12-301-0/+7
| | | | | | | | | | | | | | | | | | | | | | | | | Get an incorrect cookie value in controller action method if cookie value contains an escapable string.
* | | | | Remove `const_missing` which fallback to deprecated `NEVER_UNPERMITTED_PARAMS`Ryuta Kamizono2016-02-151-6/+0
| |_|/ / |/| | | | | | | | | | | `NEVER_UNPERMITTED_PARAMS` is deprecated in Rails 4.2. See #15933.
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-02 02:08:52 +0000