Commit message (Collapse) | Author | Age | Files | Lines | |
---|---|---|---|---|---|
* | feature detect for FNM_EXTGLOB for older Ruby. Fixes #15053 | Aaron Patterson | 2014-05-10 | 1 | -5/+21 |
| | |||||
* | use fnmatch to test for case insensitive file systems | Aaron Patterson | 2014-05-09 | 1 | -4/+2 |
| | | | | | | this is due to: https://bugs.ruby-lang.org/issues/5994 | ||||
* | Merge branch '3-2-sec' into 3-2-stable | Rafael Mendonça França | 2014-05-06 | 4 | -5/+54 |
|\ | | | | | | | | | Conflicts: actionpack/CHANGELOG.md | ||||
| * | Fix broken tests of the previous release | Rafael Mendonça França | 2014-05-06 | 1 | -5/+5 |
| | | |||||
| * | Preparing for 3.2.18 release | Rafael Mendonça França | 2014-05-06 | 2 | -1/+15 |
| | | |||||
| * | Only accept actions without File::SEPARATOR in the name. | Rafael Mendonça França | 2014-05-05 | 2 | -4/+41 |
| | | | | | | | | | | | | This will avoid directory traversal in implicit render. Fixes: CVE-2014-0130 | ||||
* | | Merge branch '3-2-17' into 3-2-stable | Rafael Mendonça França | 2014-02-18 | 6 | -4/+95 |
|\| | | | | | | | | | Conflicts: actionpack/CHANGELOG.md | ||||
| * | Preparing for 3.2.17 release | Rafael Mendonça França | 2014-02-18 | 2 | -1/+11 |
| | | |||||
| * | Use the reference for the mime type to get the format | Rafael Mendonça França | 2014-02-18 | 2 | -1/+18 |
| | | | | | | | | | | | | | | | | Before we were calling to_sym in the mime type, even when it is unknown what can cause denial of service since symbols are not removed by the garbage collector. Fixes: CVE-2014-0082 | ||||
| * | Escape format, negative_format and units options of number helpers | Rafael Mendonça França | 2014-02-18 | 2 | -1/+64 |
| | | | | | | | | | | | | | | Previously the values of these options were trusted leading to potential XSS vulnerabilities. Fixes: CVE-2014-0081 | ||||
* | | Fix force_ssl.rb documentation. Close tt tag. | Josef Šimánek | 2014-01-06 | 1 | -1/+1 |
| | | | | | | [ci skip] | ||||
* | | Merge pull request #13183 from sorah/never_ignore_i18n_translate_raise_option | Carlos Antonio da Silva | 2013-12-04 | 3 | -1/+24 |
| | | | | | | | | | | | | | | Escalate missing error when :raise is true in translate helper, fix regression introduced by security fix. Conflicts: actionpack/CHANGELOG.md | ||||
* | | Fix documentation of number_to_currency helper | Rafael Mendonça França | 2013-12-04 | 2 | -5/+5 |
| | | | | | | | | | | | | Now users have to explicit mark the unit as safe if they trust it. Closes #13161 | ||||
* | | repair a test broken by the number_to_currency XSS fix | Tobias Kraze | 2013-12-04 | 1 | -4/+4 |
|/ | |||||
* | updating the changelog | Aaron Patterson | 2013-12-02 | 2 | -1/+9 |
| | |||||
* | Deep Munge the parameters for GET and POST | Michael Koziarski | 2013-12-02 | 2 | -2/+17 |
| | | | | | | | | | | | The previous implementation of this functionality could be accidentally subverted by instantiating a raw Rack::Request before the first Rails::Request was constructed. Fixes CVE-2013-6417 Conflicts: actionpack/lib/action_dispatch/http/request.rb | ||||
* | Stop using i18n's built in HTML error handling. | Michael Koziarski | 2013-12-02 | 2 | -14/+9 |
| | | | | | | | | | | | | | | i18n doesn't depend on active support which means it can't use our html_safe code to do its escaping when generating the spans. Rather than try to sanitize the output from i18n, just revert to our old behaviour of rescuing the error and constructing the tag ourselves. Fixes: CVE-2013-4491 Conflicts: actionpack/lib/action_view/helpers/translation_helper.rb Backport: 50afd8eec9d088ad5a2d41f00a05520d5b78a6a0 | ||||
* | Escape the unit value provided to number_to_currency | Michael Koziarski | 2013-12-02 | 2 | -4/+5 |
| | | | | | | Fixes CVE-2013-6415 Previously the values were trusted blindly allowing for potential XSS attacks. | ||||
* | Only use valid mime type symbols as cache keys | Aaron Patterson | 2013-11-30 | 1 | -0/+7 |
| | | | | CVE-2013-6414 | ||||
* | updating changelogs | Aaron Patterson | 2013-10-16 | 1 | -1/+1 |
| | |||||
* | bumping to 3.2.15 | Aaron Patterson | 2013-10-15 | 1 | -1/+1 |
| | |||||
* | Merge branch '3-2-15' into 3-2-sec | Aaron Patterson | 2013-10-15 | 1 | -2/+2 |
|\ | | | | | | | | | | | | | | | | | | | | | * 3-2-15: bumping to rc3 Revert "Merge pull request #12413 from arthurnn/inverse_of_on_build" Revert "Merge pull request #12443 from arthurnn/add_inverse_of_add_target" bumping to rc2 Merge pull request #12443 from arthurnn/add_inverse_of_add_target bumping version to 3.2.15.rc1 Fix STI scopes using benolee's suggestion. Fixes #11939 | ||||
| * | bumping to rc3 | Aaron Patterson | 2013-10-11 | 1 | -1/+1 |
| | | |||||
| * | bumping to rc2 | Aaron Patterson | 2013-10-04 | 1 | -1/+1 |
| | | |||||
| * | bumping version to 3.2.15.rc1 | Aaron Patterson | 2013-10-03 | 1 | -2/+2 |
| | | |||||
* | | Merge branch '3-2-stable' into 3-2-sec | Aaron Patterson | 2013-10-03 | 2 | -1/+9 |
|\| | | | | | | | | | | | * 3-2-stable: make sure both headers are set before checking for ip spoofing Move set_inverse_instance to association.build_record | ||||
| * | make sure both headers are set before checking for ip spoofing | Tamir Duberstein | 2013-10-01 | 2 | -1/+9 |
| | | |||||
* | | Remove the use of String#% when formatting durations in log messages | Michael Koziarski | 2013-09-30 | 1 | -6/+5 |
|/ | | | | | This avoids potential format string vulnerabilities where user-provided data is interpolated into the log message before String#% is called. | ||||
* | Fix FinderMethods#last unscoped primary key | Eugene Kalenkovich | 2013-09-12 | 1 | -1/+0 |
| | | | | | | | | Fixes table.joins(:relation).last(N) breaking on sqlite Conflicts: activerecord/CHANGELOG.md activerecord/test/cases/finder_test.rb | ||||
* | pass the extra params to the rack test environment so that routes with block ↵ | Brian Hahn | 2013-09-06 | 4 | -4/+25 |
| | | | | constraints have access | ||||
* | fix issue #11605 | Kassio Borges | 2013-08-24 | 12 | -31/+16 |
| | |||||
* | Fix actionpack CHANGELOG entry | Rafael Mendonça França | 2013-07-22 | 1 | -1/+4 |
| | | | | It was included by git on the wrong release | ||||
* | Merge branch '3-2-14' into 3-2-stable | Rafael Mendonça França | 2013-07-22 | 2 | -2/+2 |
|\ | |||||
| * | Preparing for 3.2.14 release | Rafael Mendonça França | 2013-07-22 | 1 | -1/+1 |
| | | |||||
| * | Update CHANGELOG entry | Rafael Mendonça França | 2013-07-22 | 1 | -6/+1 |
| | | |||||
| * | Preparing for 3.2.14.rc2 release | Rafael Mendonça França | 2013-07-16 | 2 | -2/+7 |
| | | |||||
| * | Preparing for 3.2.14.rc1 release | Rafael Mendonça França | 2013-07-12 | 2 | -3/+3 |
| | | |||||
* | | Fix `assert_redirected_to` does not show user-supplied message. | Alexey Chernenkov | 2013-07-18 | 3 | -2/+11 |
| | | | | | | | | | | | | Issue: when `assert_redirected_to` fails due to the response redirect not matching the expected redirect the user-supplied message (second parameter) is not shown. This message is only shown if the response is not a redirect. | ||||
* | | Removed unused test file | Arun Agrawal | 2013-07-17 | 1 | -32/+0 |
|/ | | | | This test file is not be running from a long time This test is already covered in controller/caching_test.rb | ||||
* | Add license to the gemspec | Rafael Mendonça França | 2013-07-08 | 1 | -0/+3 |
| | |||||
* | Add missing require | Santiago Pastorino | 2013-07-02 | 1 | -0/+1 |
| | |||||
* | Use old style hash syntax for 3-2-stable | Andrew White | 2013-06-25 | 1 | -2/+2 |
| | |||||
* | Fix shorthand routes where controller and action are in the scope | Andrew White | 2013-06-25 | 3 | -0/+30 |
| | | | | | | | | | | | Merge `:action` from routing scope and assign endpoint if both `:controller` and `:action` are present. The endpoint assignment only occurs if there is no `:to` present in the options hash so should only affect routes using the shorthand syntax (i.e. endpoint is inferred from the the path). Fixes #9856 Backport of 37b4276 | ||||
* | Add CHANGELOG entry for #10971 | Rafael Mendonça França | 2013-06-24 | 1 | -0/+14 |
| | | | | [ci skip] | ||||
* | Merge pull request #10971 from dtaniwaki/escape_link_to_unless | Rafael Mendonça França | 2013-06-24 | 2 | -1/+6 |
| | | | | Always escape the result of link_to_unless method | ||||
* | Compare host scheme using case-insensitive regexp | Rafael Mendonça França | 2013-06-16 | 3 | -11/+52 |
| | | | | | | | | | | | | | | | | | | Before: image_tag("HTTP://google.com") # => "<img alt=\"Google\" src=\"/assets/HTTP://google.com\" />" image_tag("http://google.com") # => "<img alt=\"Google\" src=\"http://google.com\" />" After: image_tag("HTTP://google.com") # => "<img alt=\"Google\" src=\"HTTP://google.com\" />" image_tag("http://google.com") # => "<img alt=\"Google\" src=\"http://google.com\" />" Backport of #10969 | ||||
* | So not make Fixnum#/ private on Ruby verions less than 1.9.3 | Rafael Mendonça França | 2013-05-10 | 1 | -4/+3 |
| | | | | In those version to_date call Fixnum#/, what will cause a failure | ||||
* | Merge pull request #10478 from cainlevy/patch-1 | Rafael Mendonça França | 2013-05-06 | 1 | -1/+1 |
| | | | | | | use canonical #controller_path logic in controller test cases Conflicts: actionpack/lib/action_controller/test_case.rb | ||||
* | Merging in fix from #8222 | Ben Tucker | 2013-05-06 | 2 | -1/+6 |
| | |||||
* | just clear the caches on clear! rather than replacing. fixes #10251 | Aaron Patterson | 2013-04-17 | 1 | -8/+4 |
| |