aboutsummaryrefslogtreecommitdiffstats
path: root/actionpack
Commit message (Collapse)AuthorAgeFilesLines
* Prep Rails 5 beta 4eileencodes2016-04-272-1/+3
|
* Add more info to insecure URL generation errorDerek Prior2016-04-264-4/+12
| | | | | | | | I always appreciate having a bit more information as to why something is now an error. We can use this error to tell people why what they were previously doing is insecure and give them hints on how to fix it. Signed-off-by: Kasper Timm Hansen <kaspth@gmail.com>
* Merge pull request #24641 from rafaelfranca/fix-per-form-token-with-full-urlJeremy Daer2016-04-252-1/+15
|\ | | | | | | Discart the schema and host information when building the per-form token
| * Discart the schema and host information when building the per-form tokenRafael Mendonça França2016-04-202-1/+15
| | | | | | | | | | | | | | | | | | | | | | When the token is generated by the form we were using the schema and host information while only using the path to compare if the action was the same. This was causing the token to be invalid. To fix this we use the same information to generate the token and check it. Fix #24257
* | Merge pull request #23103 from rails/refactor-handling-of-action-defaultJeremy Daer2016-04-248-33/+73
|\ \ | | | | | | | | | Refactor handling of :action default in routing
| * | Refactor handling of :action default in routingAndrew White2016-02-168-32/+74
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The longstanding convention in Rails is that if the :action parameter is missing or nil then it defaults to 'index'. Up until Rails 5.0.0.beta1 this was handled slightly differently than other routing defaults by deleting it from the route options and adding it to the recall parameters. With the recent focus of removing unnecessary duplications this has exposed a problem in this strategy - we are now mutating the request's path parameters and causing problems for later url generation. This will typically affect url_for rather a named url helper since the latter explicitly pass :controller, :action, etc. The fix is to add a default for :action in the route class if the path contains an :action segment and no default is passed. This change also revealed an issue with the parameterized part expiry in that it doesn't follow a right to left order - as soon as a dynamic segment is required then all other segments become required. Fixes #23019.
* | | Merge pull request #24701 from ↵Guillermo Iguaran2016-04-242-8/+11
|\ \ \ | | | | | | | | | | | | | | | | prathamesh-sonpatki/deprecate-request_via_redirect Deprecate `request_via_redirect` method.
| * | | Deprecate `request_via_redirect` method.Prathamesh Sonpatki2016-04-242-8/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Followup of https://github.com/rails/rails/issues/18693. - I think we missed deprecating `request_via_redirect` in that pull request. - Originally requested by DHH here https://github.com/rails/rails/issues/18333.
* | | | Merge pull request #24697 from tomkadwill/action_pack_typos_2Vipul A M2016-04-234-10/+10
|\ \ \ \ | |/ / / |/| | | Actionpack documentation typos [ci skip]
| * | | Actionpack documentation typos [ci skip]Tom Kadwill2016-04-234-10/+10
| | |/ | |/|
* | | Merge pull request #24669 from tomkadwill/action_pack_typosVipul A M2016-04-222-11/+10
|\ \ \ | | | | | | | | Actioncable and Actionpack documentation typos [ci skip]
| * | | Actioncable and Actionpack documentation typos [ci skip]Tom Kadwill2016-04-212-11/+10
| |/ /
* / / Fix ApplicationController.renderer.defaults.merge!Jon Moss2016-04-202-1/+9
|/ / | | | | | | | | | | | | Previously, users were trying to modify a frozen Hash. Includes a regression test :) Fixes #22975
* | Merge pull request #24031 from ↵Jeremy Daer2016-04-192-2/+14
|\ \ | | | | | | | | | | | | | | | samphilipd/sam/do_not_clobber_options_in_route_definitions Do not destructively mutate passed options hash in route definitions
| * | Do not destructively mutate passed options hash in route definitionsSam Davies2016-03-032-2/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Fixes #24030 An example scope might be specified as such: ```ruby HTML = { constraints: { format: :html } }.freeze scope HTML do get 'x' end ``` This currently raises an error because the mapper attempts to destructively modify the passed options hash. This is dangerous because this options hash might even be shared with other scopes. We should instead always instantiate a new object instead of modifying the passed options.
* | | Update send_data documentation [ci skip]Anton Rieder2016-04-191-1/+1
| | | | | | | | | Add missing period after sentence.
* | | Properly verify that cache accepts and user `expires` value.Vipul A M2016-04-172-2/+5
| | |
* | | Filter scalar values when params permit hashes or arraysSean Griffin2016-04-152-1/+14
| | | | | | | | | | | | | | | | | | This brings the behavior more inline with other similar cases, such as receiving a hash when an array of scalars was expected. Prior to this commit, the key would be present, but the value would be `nil`
* | | [ci skip] Remove extra `so` from the Action Pack CHANGELOGPrathamesh Sonpatki2016-04-141-2/+2
| | |
* | | Merge pull request #24318 from bogdanvlviv/patch-1Rafael Mendonça França2016-04-122-1/+5
|\ \ \ | | | | | | | | | | | | extension synonyms yml and yaml
| * | | extension synonyms yml and yamlBogdan2016-03-272-1/+5
| | | |
* | | | Merge pull request #24504 from nickmalcolm/masterVipul A M2016-04-121-1/+6
|\ \ \ \ | | | | | | | | | | Encourage best practice in the HTTP Token authentication example code
| * | | | [ci skip] This modifies the HTTP Token authentication example's ↵Nick Malcolm2016-04-121-1/+6
| | | | | | | | | | | | | | | | | | | | `authenticate` method, to use the `secure_compare` method with two constant-length strings. This defends against timing attacks, and is best practice. Using `==` for sensitive actions is not recommended, and this was the source of a CVE fixed in October 2015: https://github.com/rails/rails/commit/17e6f1507b7f2c2a883c180f4f9548445d6dfbda
* | | | | Pass over all Rails 5 warnings, to make sure:Vipul A M2016-04-125-6/+6
|/ / / / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - we are ending sentences properly - fixing of space issues - fixed continuity issues in some sentences. Reverts https://github.com/rails/rails/commit/8fc97d198ef31c1d7a4b9b849b96fc08a667fb02 . This change reverts making sure we add '.' at end of deprecation sentences. This is to keep sentences within Rails itself consistent and with a '.' at the end.
* | | | quick edits on the AC::API RDoc [ci skip]Xavier Noria2016-04-051-19/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In particular, the fact that ApplicationController is the only one inheriting from AC::API is not a default. You could say at most that generators generate them that way, but the creation of controllers is something which is out of our control because programmers write controllers by hand. Instead, we can say that normally, conventionally, as in the majority of Rails apps, that is the actually the case.
* | | | it's => its typoRyan McCuaig2016-04-041-1/+1
| | | |
* | | | Fixes #24239Ryan T. Hosford2016-04-043-1/+31
| | | | | | | | | | | | | | | | | | | | - skip calling helper_method if it's not there: if we don't have helpers, we needn't define one. - tests that an api controller can include and use ActionController::Cookies
* | | | Merge branch 'master' of github.com:rails/docrailsVijay Dev2016-04-031-0/+7
|\ \ \ \
| * | | | [ci skip] Fix example of ActionController::Parameters#to_unsafe_hPrathamesh Sonpatki2016-03-241-1/+1
| | | | | | | | | | | | | | | | | | | | - Added missing `"`.
| * | | | Add example for ActionController::Parameters#to_unsafe_hGaurish Sharma2016-03-121-0/+7
| | | | | | | | | | | | | | | | | | | | [ci-skip]
* | | | | Grammar fixes based on pass over ETag doc changesVipul A M2016-04-031-2/+2
| | | | | | | | | | | | | | | | | | | | [ci skip]
* | | | | Grammer fix in comment: capitalize first word in sentence [ci skip].utilum2016-04-021-1/+1
| | | | |
* | | | | Strong ETag validatorsJeremy Daer2016-03-316-63/+210
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Introduce `Response#strong_etag=` and `#weak_etag=` and analogous options for `fresh_when` and `stale?`. `Response#etag=` sets a weak ETag. Strong ETags are desirable when you're serving byte-for-byte identical responses that support Range requests, like PDFs or videos (typically done by reproxying the response from a backend storage service). Also desirable when fronted by some CDNs that support strong ETags only, like Akamai. * No longer strips quotes (`"`) from ETag values before comparing them. Quotes are significant, part of the ETag. A quoted ETag and an unquoted one are not the same entity. * Support `If-None-Match: *`. Rarely useful for GET requests; meant to provide some optimistic concurrency control for PUT requests.
* | | | | Fix deprecation warning for ParamsParser instance :smile:Prathamesh Sonpatki2016-03-301-1/+1
| | | | |
* | | | | Deprecate ActionDispatch::ParamsParser instance.Rafael Mendonça França2016-03-302-0/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Related with 38d2bf5fd1f3e014f2397898d371c339baa627b1. cc @tenderlove
* | | | | Fix typo in headers commentGrey Baker2016-03-291-1/+1
| |/ / / |/| | |
* | | | Fix typo in Action Pack changelog [ci skip]Prathamesh Sonpatki2016-03-251-1/+1
| | | |
* | | | Merge pull request #24037 from ↵Jeremy Daer2016-03-231-53/+34
|\ \ \ \ | | | | | | | | | | | | | | | | | | | | jeremy/implicit-render-raises-on-browser-GET-requests-only Are you missing that template or did you omit it on purpose?
| * | | | Refinement of our "are you missing a template or did you omit it on ↵Jeremy Daer2016-03-031-53/+34
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | purpose?" heuristics Narrows the "are you in a browser, viewing the page?" check to exclude non-GET requests. Allows content-less APIs to use implicit responses without having to set a fake request format. This will need further attention. If you forget to redirect from a POST to a GET, you'll get a 204 No Content response that browsers will typically treat as… do nothing. It'll seem like the form just didn't work and knowing where to start debugging is non-obvious. On the flip side, redirecting from POST and others is the default, done everywhere, so it's less likely to be removed or otherwise missed. Alternatives are to do more explicit browser sniffing. Ref #23827.
* | | | | Fix typo for redirect_backArkadiusz Fal2016-03-221-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | indetical -> identical [skip ci]
* | | | | guides, sync railties and AP changelogs with 5.0 release notes.Yves Senn2016-03-221-12/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | [ci skip] This updates the 5.0 release notes guide to reflect changes that happened after beta1 has been released. I'll sync the other changelogs later today but I'll push this batch to prevent against cumbersome merge conflicts.
* | | | | Fix request.reset_session for API controllersJon Moss2016-03-192-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Due to that `ActionDispatch::Flash` (the flash API's middleware) is not included for API controllers, the `request.reset_session` method, which relies on there being a `flash=` method which is in fact defined by the middleware, was previously breaking. Similarly to how add46482a540b33184f3011c5c307f4b8e90c9cc created a method to be overridden by the flash middleware in order to ensure non-breakage, this is how flashes are now reset. Fixes #24222
* | | | | Add explanation about accepts_nested_attributes_for keys in the strong ↵Bart de Water2016-03-121-2/+3
| | | | | | | | | | | | | | | | | | | | parameters documentation [skip ci]
* | | | | Break up a circular require between AP/AVSean Griffin2016-03-113-3/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Right now referencing the constant `AbstractController::Rendering` causes `ActionView::Base` to be loaded, and thus the load hooks for action_view are run. If that load hook references any part of action view that then references action controller (such as `ActionView::TestCase`), the constant `AbstractController::Rendering` will attempt to be autoloaded and blow up. With this change, `ActionView::LoadPaths` no longer requires `ActionView::Base` (which it had no reason to require). There was a needed class from `AbstractController::Base` in the Rendering module, which I've moved into its own file so we don't need to load all of `AbstractController::Base` there. This commit fixes https://github.com/rails/rails-controller-testing/issues/21
* | | | | Use the most highest priority exception handler when cause is setSean Griffin2016-03-112-2/+39
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There was some subtle breakage caused by #18774, when we removed `#original_exception` in favor of `#cause`. However, `#cause` is automatically set by Ruby when raising an exception from a rescue block. With this change, we will use whichever handler has the highest priority (whichever call to `rescue_from` came last). In cases where the outer has lower precidence than the cause, but the outer is what should be handled, cause will need to be explicitly unset. Fixes #23925
* | | | | Merge pull request #22854 from jcoyne/missing_templateSean Griffin2016-03-113-1/+23
|\ \ \ \ \ | | | | | | | | | | | | | | | | | | Default rendering behavior if respond_to collector doesn't have a block.
| * | | | | Render default template if block doesn't renderJustin Coyne2016-02-253-1/+23
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When a `respond_to` collector doesn't have a response, then a `:no_content` response should be rendered. This brings the default rendering behavior introduced by https://github.com/rails/rails/issues/19036 to controller methods employing `respond_to`
* | | | | | [skip ci] Reorder paragraphsDamir2016-03-101-3/+3
| | | | | | | | | | | | | | | | | | The previous order made sense [when `match` was used twice to point to two different actions](https://github.com/rails/rails/commit/7305ef842b675bf965f063de681a96294577fb84). In this case the note was misleading as posting to `/posts/:id` would still route to `show` action.
* | | | | | revises the homepage URL in the gemspecs [ci skip]Xavier Noria2016-03-101-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | References https://github.com/rails/homepage/issues/46.
* | | | | | add return values to example [ci skip]yuuji.yaginuma2016-03-101-1/+1
| | | | | |
generated by cgit v1.2.3 (git 2.25.1) at 2024-06-26 01:16:46 +0000