aboutsummaryrefslogtreecommitdiffstats
path: root/actionpack
Commit message (Collapse)AuthorAgeFilesLines
...
| * fix protocol checking in sanitization [CVE-2013-1857]Aaron Patterson2013-03-152-2/+12
| | | | | | | | | | Conflicts: actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb
| * fix incorrect ^$ usage leading to XSS in sanitize_css [CVE-2013-1855]Charlie Somerville2013-03-152-3/+8
| |
| * Merge pull request #9616 from exviva/multiple_select_name_double_square_bracketsCarlos Antonio da Silva2013-03-123-1/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix incorrectly appended square brackets to a multiple select box Before: select(:category, [], {}, {:multiple => true, :name => "post[category][]"}) # => <select name="post[category][][]" ...> After: select(:category, [], {}, {:multiple => true, :name => "post[category][]"}) # => <select name="post[category][]" ...> Conflicts: actionpack/CHANGELOG.md actionpack/lib/action_view/helpers/tags/base.rb actionpack/test/template/form_options_helper_test.rb
| * bumping to rc2Aaron Patterson2013-03-061-1/+1
| |
| * Preparing for 3.2.13.rc1 releaseSteve Klabnik2013-02-271-2/+2
| |
| * Update CHANGELOGs for 3.2.13 release.Steve Klabnik2013-02-271-0/+5
| |
* | do not freeze NumberHelper defaults.Yves Senn2013-03-181-2/+2
| | | | | | | | Closes #9767.
* | Extract hardcoded lists to Redo::RestaurantsListJuan Barreneche2013-03-143-1/+21
| |
* | Merge pull request #9616 from exviva/multiple_select_name_double_square_bracketsCarlos Antonio da Silva2013-03-093-2/+27
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix incorrectly appended square brackets to a multiple select box Before: select(:category, [], {}, {:multiple => true, :name => "post[category][]"}) # => <select name="post[category][][]" ...> After: select(:category, [], {}, {:multiple => true, :name => "post[category][]"}) # => <select name="post[category][]" ...> Conflicts: actionpack/CHANGELOG.md actionpack/lib/action_view/helpers/tags/base.rb actionpack/test/template/form_options_helper_test.rb
* | Update CHANGELOGs for 3.2.13.rc1Steve Klabnik2013-03-051-0/+2
| |
* | Backport fixes about #7774 to 3-2-stablemaximerety2013-03-053-2/+16
| | | | | | | | | | Fix ActionDispatch::Request#formats when HTTP_ACCEPT header is an empty string.
* | Merge pull request #9531 from erik-escobedo/patch-1Guillermo Iguaran2013-03-031-1/+1
|\ \ | | | | | | Fix typo on ActionPack's ChangeLog
| * | Fix typo on CHANGELOG.mdÉrik Escobedo2013-03-031-1/+1
| |/
* / remove unused path_without_format variableKornelius Kalnbach2013-03-031-2/+0
|/ | | Was forgotten in a72dab0.
* Check for `method_missing` in public and protectedPrem Sichanugrist2013-02-241-1/+2
| | | | | | Ruby 2.0 changed the behavior of `respond_to?` without argument to return only search for public method. We actually want to perform the action only if `method_missing` is either in public or protected.
* There is already a Set of non-hidden action_names lying around.thedarkone2013-02-241-8/+2
|
* Ruby 2 compat. CGI.escapeHTML has changed the way it escapes apostrophes a ↵Jeremy Kemper2013-02-241-1/+1
| | | | few times, so fix up the test to work with however it chooses to escape.
* Ruby 2.0.0 defaults source encoding to utf-8 so we need to specifically tag ↵Aaron Patterson2013-02-241-0/+1
| | | | this file with us-ascii
* Use 1.8 hash styleCarlos Antonio da Silva2013-02-221-1/+1
|
* determine the match shorthand target early.Yves Senn2013-02-223-9/+54
| | | | | | | | | Backport #9361. Closes #7554. This patch determines the `controller#action` directly in the `match` method when the shorthand syntax is used. this prevents problems with namespaces and scopes.
* Change tabs to spaces in form options helper [ci skip]Carlos Antonio da Silva2013-02-211-2/+2
|
* Do not put the version in unreleased changes [ci skip]Rafael Mendonça França2013-02-141-1/+1
|
* Fix the CHANGELOG headers [ci skip]Rafael Mendonça França2013-02-141-0/+2
|
* Fixed changelog typos [ci skip]Jon McCartie2013-02-141-1/+1
|
* Update changelogs with version/release dates [ci skip]Carlos Antonio da Silva2013-02-111-3/+6
|
* Merge branch '3-2-sec' into 3-2-stableAaron Patterson2013-02-111-1/+1
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 3-2-sec: bumping version remove ruby-prof Fix issue with attr_protected where malformed input could circumvent protection fixing call to columns hash. run the damn tests when you backport! Bump rack dependency to 1.4.5 Merge pull request #9224 from dylanahsmith/bigdecimal-takes-string Merge pull request #9208 from dylanahsmith/3-2-mysql-quote-numeric Conflicts: Gemfile activerecord/CHANGELOG.md
| * bumping versionAaron Patterson2013-02-101-1/+1
| |
| * Bump rack dependency to 1.4.5Santiago Pastorino2013-02-091-1/+1
| | | | | | | | | | Conflicts: actionpack/actionpack.gemspec
* | Bump rack dependency to 1.4.5Santiago Pastorino2013-02-081-1/+1
| |
* | Fix markdown syntax in actionpack CHANGELOG.Steve Klabnik2013-02-011-1/+2
| | | | | | | | Starting a line with an octothorpe makes an <h1>
* | Add another NumberHelper missing dependencyRodrigo Rosenfeld Rosas2013-01-291-0/+1
| | | | | | | | | | Another missing dependency, now affecting #number_to_percentage. It depends on reverse_merge.
* | Add NumberHelper missing dependencyRodrigo Rosenfeld Rosas2013-01-291-0/+1
| | | | | | symbolize_keys depends on hash/keys AS core extension
* | Duplicate possible frozen string from routeAndrew White2013-01-212-2/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | Ruby 1.9 freezes Hash string keys by default so where a route is defined like this: get 'search' => 'search' then the Mapper will derive the action from the key. This blows up later when the action is added to the parameters hash and the encoding is forced. Closes #3429
* | Remove warning of not used variableCarlos Antonio da Silva2013-01-171-1/+1
| |
* | Do not run this streaming test in Ruby 1.8, fix syntax errorCarlos Antonio da Silva2013-01-171-5/+8
| |
* | Merge pull request #5288 from lest/patch-2José Valim2013-01-173-0/+21
| | | | | | | | | | | | force response body to be read in assert_template Conflicts: actionpack/lib/action_controller/test_case.rb
* | fixes #8631 local inflections from interfereing with HTTP_METHOD_LOOKUP ↵Aditya Sanghi2013-01-163-1/+32
| | | | | | | | dispatch logic
* | Merge pull request #8914 from nilbus/fix-header-bloatRafael Mendonça França2013-01-153-2/+10
| | | | | | | | | | | | Remove header bloat introduced by BestStandardsSupport middleware Conflicts: actionpack/CHANGELOG.md
* | Merge pull request #8907 from rubys/masterRafael Mendonça França2013-01-121-1/+2
| | | | | | | | Fix regression introduced in pull 8812
* | Remove unnecessary caching of ParameterFilterAndrew White2013-01-121-3/+1
| |
* | Fix JSON params parsing regression for non-object JSON content.Dylan Smith2013-01-113-2/+13
| | | | | | | | Backports #8855.
* | Reorder AP changelog and remove duplicated entry [ci skip]Carlos Antonio da Silva2013-01-101-11/+9
| | | | | | | | Duplicated entry added in 002dfba66490d289bac897d1ba886310a672e779.
* | Merge pull request #8756 from causes/js_include_tag_fixGuillermo Iguaran2013-01-103-9/+28
|\ \ | | | | | | Fix javascript_include_tag when no js runtime is available
| * | Fix javascript_include_tag when no js runtime is availableNoah Silas2013-01-073-9/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In a production environment where the assets have been precompiled, we don't want an assets compile step to happen on the application server at all. To ensure this, a js runtime may not be available on the app servers. In this environment, pages using javascript_include_tag for assets with non-standard or chained extensions were throwing 500 errors. For instance, `javascript_include_tag('jquery.min')` would blow up. Sprockets was attempting to build the assets being included during the rewrite_extension step (responsible for appending a '.js' extension to assets being included by the basename rather than a fully qualified name). This was happening as a step to resolve #6310, which required checking for the presence of an asset with a non-standard extension before appending the extension. We can check for the presence of an asset without invoking the asset build step by using Sprockets' resolve method, which will search for the base file without building it (and is the method that find_asset uses internally to get the path to the asset before attempting to build it). When rewriting the extension on an asset, these are the steps: - If the source does not have an extension, assume that the default extension is desired and append it. - If there is an extension and it doesn't match the default extension, check to see if a file with the precise name specified exists amongst the assets; if it is present, do not append the default extension. (This is the step that resolves #6310).
* | | Fixes issue where duplicate assets can be required with sprockets.jejacks0n2013-01-105-2/+16
| | | | | | | | | | | | | | | - addresses the problem by calling flatten on asset array before calling uniq. - adds note to CHANGELOG.
* | | Update changelogs with release date [ci skip]Carlos Antonio da Silva2013-01-091-2/+4
| | |
* | | Merge branch '3-2-sec' into 3-2-secmergeAaron Patterson2013-01-087-11/+57
|\ \ \ | | |/ | |/| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * 3-2-sec: bumping version CVE-2013-0156: Safe XML params parsing. Doesn't allow symbols or yaml. * Strip nils from collections on JSON and XML posts. [CVE-2013-0155] * dealing with empty hashes. Thanks Damien Mathieu Avoid Rack security warning no secret provided Conflicts: actionpack/CHANGELOG.md activerecord/CHANGELOG.md activesupport/CHANGELOG.md
| * | bumping versionAaron Patterson2013-01-081-1/+1
| | |
| * | CVE-2013-0156: Safe XML params parsing. Doesn't allow symbols or yaml.Jeremy Kemper2013-01-081-0/+13
| | |
| * | * Strip nils from collections on JSON and XML posts. [CVE-2013-0155] * ↵Aaron Patterson2013-01-085-8/+42
| | | | | | | | | | | | dealing with empty hashes. Thanks Damien Mathieu
generated by cgit v1.2.3 (git 2.25.1) at 2024-10-30 09:18:58 +0000