| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
| |
since Ruby 2.5
https://bugs.ruby-lang.org/issues/14133
|
|
|
|
|
|
|
|
|
|
| |
`Hash#transform_keys!`
Since Rails 6 requires Ruby 2.5.
https://github.com/ruby/ruby/blob/ruby_2_5/NEWS
Follow up #34754.
|
|
|
|
|
|
|
|
|
|
| |
Generally followed the pattern for https://github.com/rails/rails/pull/32034
* Removes needless CI configs for 2.4
* Targets 2.5 in rubocop
* Updates existing CHANGELOG entries for fewer merge conflicts
* Removes Hash#slice extension as that's inlined on Ruby 2.5.
* Removes the need for send on define_method in MethodCallAssertions.
|
|
|
|
|
|
|
|
|
|
|
|
| |
This takes away the following log.
```
Error occurred while parsing request parameters.
Contents:
{:foo=>"heyo"}
```
Pass the correct value as JSON
|
| |
|
|\
| |
| | |
Allow nil params on controller HTTP test methods
|
| | |
|
|/
|
|
|
| |
Just testing that `after_action` is invoked before
`prepend_after_action`.
|
|\ |
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
… by switching the initialzation of an appropriate response parser
in `ActionDispatch::TestResponse` from eagerly to lazily.
By doing so, the response parser can be correctly set for
`ActionController::TestCase`, which doesn't include
the content type header in the constructor but only sets it at
a later time.
Fixes #34676.
|
|/
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The ActionDispatch::HostAuthorization is a new middleware that prevent
against DNS rebinding and other Host header attacks. By default it is
included only in the development environment with the following
configuration:
Rails.application.config.hosts = [
IPAddr.new("0.0.0.0/0"), # All IPv4 addresses.
IPAddr.new("::/0"), # All IPv6 addresses.
"localhost" # The localhost reserved domain.
]
In other environments, `Rails.application.config.hosts` is empty and no
Host header checks will be done. If you want to guard against header
attacks on production, you have to manually permit the allowed hosts
with:
Rails.application.config.hosts << "product.com"
The host of a request is checked against the hosts entries with the case
operator (#===), which lets hosts support entries of type RegExp,
Proc and IPAddr to name a few. Here is an example with a regexp.
# Allow requests from subdomains like `www.product.com` and
# `beta1.product.com`.
Rails.application.config.hosts << /.*\.product\.com/
A special case is supported that allows you to permit all sub-domains:
# Allow requests from subdomains like `www.product.com` and
# `beta1.product.com`.
Rails.application.config.hosts << ".product.com"
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This first started with moving type method inside
`ActionDispatch::Journey::Nodes::Symbol`.
`AD::Journey::Nodes::Symbol#type` was generated dynamically with an
`each` block. While this is OK for classes like `AD::Journey::Nodes::Slash`
or `AD::Journey::Nodes::Dot` which don't have further implementation, all
other classes containing more logic have this method defined in their class
body. This patch does the same in this case.
On code review process @kamipo suggested to fully expand over
metaprogramming for Slash and Dot classes, a topic on which I agree with him.
|
| |
|
|
|
|
|
| |
The variable `route` was only allocated to hold an object that was
immediately returned. This patch removes that variable.
|
|\
| |
| | |
Log exceptions atomically
|
| | |
|
| |
| |
| |
| |
| |
| | |
When distributed over multiple logger calls the lines can become
intermixed with other log statements. Combining them into a single
logger call makes sure they always get logged together.
|
| |
| |
| |
| |
| |
| |
| |
| |
| | |
The error can be reproduced with
require "bundler/setup"
require "action_controller"
AbstractController::ActionNotFound
|
|/
|
|
|
|
| |
Parallel execution of `ForkingExecutor` is the same approach as
`Testing::Parallelization`. So do not need to have own code inside
Action Pack. Let's use an already existing feature.
|
|
|
|
|
| |
We are dealing with the rack env so it is better to specify it in the
tests.
|
|
|
|
|
| |
Raises an ArgumentError when multiple root routes are defined in the
same context instead of assigning nil names to subsequent roots.
|
|\
| |
| |
| | |
:only and :except are now chained for routing resource(s)
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Allow chaining the :only and :except options for routing resource(s).
Previously, the following yielded routes for both show and destroy:
resource :account, :only => [:show, :destroy], :except => :destroy
This now yields only the show action. This chaining can be useful for
passing optional :except options to code that makes use of the :only
option (e.g. for a gem with its own routing methods).
|
| |
| |
| |
| | |
`Journey::Router::RoutingError` is no longer used since db06d128262b49c8b02e153cf95eb46f4eff364b.
|
| |
| |
| |
| | |
[Gannon McGibbon + Josh Cheek]
|
| |
| |
| |
| |
| | |
Reset Capybara sessions if `take_failed_screenshot` raise exception
in system test `after_teardown`.
|
| |
| |
| |
| | |
And remove trailing spaces.
|
| |
| |
| |
| |
| |
| |
| | |
Reword first sentence of dep management and CVE section of
security guide. Also, reword and move gemspec notes above deps.
[ci skip]
|
| |
| |
| |
| | |
[ci skip]
|
|\ \
| | |
| | | |
ActionController::API *does* support cookies, sessions
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
ActionController::Metal provides session support by delegating `session to the request (`"@_request"`)
https://github.com/rails/rails/blob/a3dcba42e2422eb9c2e77011a39ce72dc934b420/actionpack/lib/action_controller/metal.rb#L149
Though the ActionController::Cookies modules isn't included, it's really a convenience for providing a first class `cookies` object.
*all* ActionController::Metal subclasses support setting cookies via the `session` object.
|
|/ /
| |
| |
| | |
or they would be listed in `action_methods`
|
| |
| |
| |
| |
| |
| |
| |
| | |
There is no controller instance when using a redirect route or a
mounted rack application so pass the request object as the context
when resolving dynamic CSP sources in this scenario.
Fixes #34200.
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Previously if a dynamic source returned a symbol such as :self it
would be converted to a string implicity, e.g:
policy.default_src -> { :self }
would generate the header:
Content-Security-Policy: default-src self
and now it generates:
Content-Security-Policy: default-src 'self'
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
this method (#34210)
* Fix `ActionController::Parameters#each_value`
`each_value` should yield with "value" of the params instead of "value" as an array.
Related to #33979
* Add changelog entry about `ActionController::Parameters#each_value`.
Follow up #33979
|
| | |
|
|\ \
| | |
| | | |
Follow up #34064
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
The removed code was added in 7f870a5ba2aa9177aa4a0e03a9d027928ba60e49,
then 7f870a5ba2aa9177aa4a0e03a9d027928ba60e49 was reverted by #34064.
But I found that that commit wasn't completely reverted, I guess it was
caused by resolving some conflicts during reverting.
@schneems could you please confirm that those changes weren't reverted
unintentionally, or reject this commit otherwise?
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
This PR adds the allocations to the instrumentation for template and
partial rendering.
Before:
```
Rendering posts/new.html.erb within layouts/application
Rendered posts/_form.html.erb (9.7ms)
Rendered posts/new.html.erb within layouts/application (10.9ms)
Completed 200 OK in 902ms (Views: 890.8ms | ActiveRecord: 0.8ms)
```
After:
```
Rendering posts/new.html.erb within layouts/application
Rendered posts/_form.html.erb (Duration: 7.1ms | Allocations: 6004)
Rendered posts/new.html.erb within layouts/application (Duration: 8.3ms | Allocations: 6654)
Completed 200 OK in 858ms (Views: 848.4ms | ActiveRecord: 0.4ms | Allocations: 1539564)
```
|
|/ /
| |
| |
| | |
ActiveSupport::ParameterFilter
|
| | |
|
| |
| |
| |
| |
| |
| |
| | |
Until #34050 can be resolved
This reverts commit 7f870a5ba2aa9177aa4a0e03a9d027928ba60e49, reversing
changes made to 6556898884d636c59baae008e42783b8d3e16440.
|
| | |
|
|\ \
| | |
| | |
| | | |
Don't handle params option in a special way in url_for helper
|
| | | |
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Since Rails 6.0 will support Ruby 2.4.1 or higher
`# frozen_string_literal: true` magic comment is enough to make string object frozen.
This magic comment is enabled by `Style/FrozenStringLiteralComment` cop.
* Exclude these files not to auto correct false positive `Regexp#freeze`
- 'actionpack/lib/action_dispatch/journey/router/utils.rb'
- 'activerecord/lib/active_record/connection_adapters/sqlite3_adapter.rb'
It has been fixed by https://github.com/rubocop-hq/rubocop/pull/6333
Once the newer version of RuboCop released and available at Code Climate these exclude entries should be removed.
* Replace `String#freeze` with `String#-@` manually if explicit frozen string objects are required
- 'actionpack/test/controller/test_case_test.rb'
- 'activemodel/test/cases/type/string_test.rb'
- 'activesupport/lib/active_support/core_ext/string/strip.rb'
- 'activesupport/test/core_ext/string_ext_test.rb'
- 'railties/test/generators/actions_test.rb'
|
|\ \ \
| | | |
| | | | |
Fix optionally scoped root route unscoped access
|
| | | | |
|
|/ / /
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
This PR fixes an issue when the following situation occurs.
If you define a class like this
class MyConstraint
def call(*args)
# for some reason this is defined
end
def matches?(*args)
# checking the args
end
end
and try to use it as a constraint
get "/", to: "home#show", constraints: MyConstraint.new
if its `matches?` method returns `false` there will be an error for the
mapper will ask for the constraint arity, thinking it is a proc, lambda
or method.
This PR checks for the presence of the `arity` method on the constraint
calling it only if present, preventing the error while keeping the basic
behavior.
|