| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| ... | |
| | | | | | | |
|
| |/ / / / /
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
In Ruby 2.3 or later, `String#+@` is available and `+@` is faster than `dup`.
```ruby
# frozen_string_literal: true
require "bundler/inline"
gemfile(true) do
source "https://rubygems.org"
gem "benchmark-ips"
end
Benchmark.ips do |x|
x.report('+@') { +"" }
x.report('dup') { "".dup }
x.compare!
end
```
```
$ ruby -v benchmark.rb
ruby 2.5.1p57 (2018-03-29 revision 63029) [x86_64-linux]
Warming up --------------------------------------
+@ 282.289k i/100ms
dup 187.638k i/100ms
Calculating -------------------------------------
+@ 6.775M (± 3.6%) i/s - 33.875M in 5.006253s
dup 3.320M (± 2.2%) i/s - 16.700M in 5.032125s
Comparison:
+@: 6775299.3 i/s
dup: 3320400.7 i/s - 2.04x slower
```
|
| |\ \ \ \ \
| |_|/ / /
|/| | | | |
Add missing test case for `redirect_to` when request includes a port.
|
| | | | | | |
|
| |\ \ \ \ \
| |/ / / /
|/| | | | |
Add CSP nonce to `style-src` directive
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
For nonce, only `script-src` and` style-src` are meaningful in the
definition of Content Security Policy Level 2.
https://www.w3.org/TR/CSP2/#script-src-nonce-usage
https://www.w3.org/TR/CSP2/#style-src-nonce-usage
Therefore, I think that customization function not needs and it is enough
to enable both directives inside the framework.
Fixes #32920
|
| | | | | | |
|
| | | | | | |
|
| |\ \ \ \ \
| |_|/ / /
|/| | | | |
Conditionally use `helper_method` in Flash concern
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
I was attempting to use the `flash` functionality in a `Metal`
controller. When including the `flash` concern I received the following
error:
NoMethodError: undefined method `helper_method'....
Either:
- `AbstractController::Helpers` should be a dependency of
`ActionController::Flash`
- `ActionController::Flash` should not require the existence of
`AbstractController::Helpers`.
Since my use case (set a flash and redirect) has no need for the helper
method and that is a common use case, making the dependency conditional
seemed the better option.
NOTE: This is similar to issue #21067 only the error is within Rails
itself while that issue had the error within Devise.
|
| | | | | |
| | | | |
| | | | |
| | | | | |
Fixing code block rendering, indentation, backticks, etc.
|
| | | | | |
| | | | |
| | | | |
| | | | | |
Two implemented but undocumented features are to help indicate that cache is fresh for 3 hours, and it may continue to be served stale for up to an additional 60 seconds to parallel requests for the same resource or up to 5 minutes while errors are being returned back while the initial synchronous revalidation is attempted.
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
When running with code triage and derailed benchmarks and focusing on this file:
Before
16199 /Users/rschneeman/Documents/projects/rails/actionpack/lib/action_controller/metal/strong_parameters.r
After
2280 /Users/rschneeman/Documents/projects/rails/actionpack/lib/action_controller/metal/strong_parameters.rb
|
| | | | | | |
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
Remove the reference to the PR.
Usually, we write reference to solved issues in the changelog files.
Related to #33605.
Add missing dots.
Improve formatting.
|
| | | | | |
| | | | |
| | | | |
| | | | | |
Instead of using a splat on the head and tail we can mutate the array by flattening 1 level. We get further savings by not allocating another via `compact` but instead by using `compact!`
|
| |\ \ \ \ \
| | | | | |
| | | | | | |
Finish converting whitelist and blacklist references
|
| | | | | | | |
|
| | | | | | | |
|
| | | | | | | |
|
| | | | | | | |
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
* Call block to #redirect_to in controller context
The documentation for ActionController::Redirecting states that a Proc
argument "will be executed in the controller's context." However,
unless #instance_eval is used (removed in 6b3ad0ca), that statement is
false for procs defined outside of the controller instance.
This commit restores the documented behavior.
Fixes #33731.
* Move test proc into a constant in another class
Per @rafaelfranca's suggestion.
[Steven Peckins + Rafael Mendonça França]
|
| | | | | | |
| | | | | |
| | | | | | |
ActionDispatch::TestProcess::FixtureFile
|
| |/ / / / /
| | | | |
| | | | |
| | | | |
| | | | | |
This updates the `respond_to` method to be code formatted rather than
plain text (as it refers to the method)
|
| |\ \ \ \ \
| | | | | |
| | | | | | |
Use string lengths instead of regexp to extract path
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
The regexp was introduced in 186ac4cdaa911a9af659a29f2179a19b99dea13b,
and looks cosmetic. While they should be functionally identical in
theory, in practice, case insensitive (but preserving) filesystems can
give results that are differently-cased from the pattern we supplied.
I don't know how to force the filesystem to do the surprising thing,
even when running in an environment that _could_, so no new test.
|
| |\ \ \ \ \ \
| | | | | | |
| | | | | | | |
Remove extra execution of `uniq!` on action_methods
|
| | | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | |
| | | | | | | |
Execution of `to_set` below should remove duplicated elements.
Follow up #33693
|
| |\ \ \ \ \ \ \
| |/ / / / / /
|/| | | | | | |
Update ParameterFilter to yield original parameters
|
| | |/ / / / / |
|
| |/ / / / /
| | | | |
| | | | |
| | | | | |
Instead of creating new arrays for `uniq` and `map` we can instead modify the array in place.
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
[ci skip]
It seems to need an escape for the showing `ENV`.
https://api.rubyonrails.org/classes/AbstractController/Caching/Fragments.html#method-i-combined_fragment_cache_key
|
| | |_|/ /
|/| | | |
|
| | | | | |
|
| | | | |
| | | |
| | | |
| | | | |
Fixes #33634.
|
| |\ \ \ \
| | | | |
| | | | | |
use BacktraceCleaner for ActiveRecord verbose logging
|
| | | | | | |
|
| |\ \ \ \ \
| | | | | |
| | | | | | |
Changelog and improved tests for purpose metadata added to cookies
|
| | |/ / / / |
|
| | | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
- Layout/TrailingWhitespace
```
actionpack/lib/action_controller/metal/request_forgery_protection.rb:49:4:
C: Layout/TrailingWhitespace: Trailing whitespace detected.
#
^
```
Related to c3787494eda
- Performance/StartWith
```
tasks/release.rb:108:44: C: Performance/StartWith:
Use String#start_with? instead of a regex match anchored to the beginning of the string.
header += "* No changes.\n\n\n" if current_contents =~ /\A##/
```
|
| |/ / / / |
|
| | | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Purpose metadata prevents cookie values from being
copy-pasted and ensures that the cookie is used only
for its originally intended purpose.
The Purpose and Expiry metadata are embedded inside signed/encrypted
cookies and will not be readable on previous versions of Rails.
We can switch off purpose and expiry metadata embedded in
signed and encrypted cookies using
config.action_dispatch.use_cookies_with_metadata = false
if you want your cookies to be readable on older versions of Rails.
|
| |\ \ \ \
| |/ / /
|/| | | |
fixes #27157 CSRF protection documentation
|
| | | | |
| | | |
| | | |
| | | |
| | | | |
* removed reference to GET requests where it applies also to other HTTP verbs
* updated documentation to try and better explain how CSRF protection
works with XHR, and the potential exposure with CORS
|
| |\ \ \ \
| | | | |
| | | | | |
Default content type for `head` is `text/html`
|
| | | | | |
| | | | |
| | | | |
| | | | | |
Otherwise Mime::NullType will be returned as the `Content-Type` header.
|
| | | | | |
| | | | |
| | | | |
| | | | | |
[ci skip]
|
| |\ \ \ \ \
| | | | | |
| | | | | | |
Raises exception when respond_to called multiple times in incompatible way
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
Nesting respond_to calls can lead to unexpected behavior, so it should be
avoided. Currently, the first respond_to format match sets the content-type
for the resulting response. But, if a nested respond_to occurs, it is possible
to match on a different format. For example:
respond_to do |outer_type|
outer_type.js do
respond_to do |inner_type|
inner_type.html { render body: "HTML" }
end
end
end
Browsers will often include */* in their Accept headers. In the above example,
such a request would result in the outer_type.js match setting the content-
type of the response to text/javascript, while the inner_type.html match will
cause the actual response to return "HTML".
This change tries to minimize potential breakage by only raising an exception
if the nested respond_to calls are in conflict with each other. So, something
like the following example would not raise an exception:
respond_to do |outer_type|
outer_type.js do
respond_to do |inner_type|
inner_type.js { render body: "JS" }
end
end
end
While the above is nested, it doesn't affect the content-type of the response.
|
| | | | | | |
| | | | | |
| | | | | |
| | | | | |
| | | | | | |
In cases where the MatchData object is not used, this provides a speed-up:
https://github.com/JuanitoFatas/fast-ruby/#stringmatch-vs-stringmatch-vs-stringstart_withstringend_with-code-start-code-end
|
