| Commit message (Collapse) | Author | Age | Files | Lines |
... | |
| |
|
|
|
|
|
|
| |
Many helpers mark content as HTML-safe without escaping double quotes -- including `sanitize`. Regardless of whether or not the attribute values are HTML-escaped, we want to be sure they don't include double quotes, as that can cause XSS issues. For example: `content_tag(:div, "foo", title: sanitize('" onmouseover="alert(1);//'))`
CVE-2016-6316
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Implement naive partial caching mechanism.
Add test for LogSubscriber
Use ActionView::Base#log_payload to store log_subscriber's payload, so we can pass cache result into it.
Fixed tests
Remove useless settings
Check if #log_payload exists before calling it. Because other classes also includes CacheHelper but don't have is attribute
Use @log_payload_for_partial_reder instead of #log_payload to carry ActionView's payload.
Update test's hash syntax
Add configuration to enable/disable fragment caching logging
Remove unless test and add new test to ensure cache info won't effect next rendering's log
Move :enable_fragment_cache_logging config from ActionView to ActionPack
Apply new config to tests
Update actionview's changelog
Update configuration guide
Improve actionview's changelog
Refactor PartialRenderer#render and log tests
Mute subscriber's log instead of disabling instrumentation.
Fix typo, remove useless comment and use new hash syntax
Improve actionpack's log_subscriber test
Fix rebase mistake
Apply new config to all caching intstrument actions
|
| |
|
| |
|
| |
|
|
|
|
|
| |
The current code base is not uniform. After some discussion,
we have chosen to go with double quotes by default.
|
|
|
|
|
| |
Where appropriate, prefer the more concise Regexp#match?,
String#include?, String#start_with?, or String#end_with?
|
|
|
|
|
|
| |
Code like `render(topics) => render("topics/topic")` adds confusion
for the readers. On first impression, that code feels like hash kind
of data, but it's not. So make it more clear and meaningful.
|
| |
|
|\
| |
| | |
Fix ActionView::Helpers#current_page? with trailing space issue.
|
| |
| |
| |
| | |
https://github.com/rails/rails/issues/19472
|
| |
| |
| |
| | |
[ci skip] Just some english and `<tt>` tags.
|
| |
| |
| |
| |
| |
| | |
Fix a link to use RDoc syntax and make sure that the titles' level
match the section we are in since we are both documenting the new
and the legacy syntax.
|
|\ \
| | |
| | | |
25543 docs cleanup
|
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
- Remove repetative docs
- Fix grammar on sentences
- Add escaping for literals
[ci skip]
|
| | | |
|
| | |
| | |
| | |
| | | |
Removes littering `freeze` calls with Ruby 2.3's magic comment.
|
|\ \ \
| | | |
| | | | |
Bring Boolean Attributes list for AV Tags helper upto speed with current spec
|
| |/ /
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
This is based on https://github.com/kangax/html-minifier/blob/6b2d4536d82819143b468b41a89c700b6c61631f/src/htmlminifier.js#L197 and
spec from https://www.w3.org/TR/html51/single-page.html.
Couple of other changes to tests due to support update:
- autobuffer has been dropped in favour of preload attribute, ref: https://msdn.microsoft.com/en-us/library/ff974743(v=vs.85).aspx
- pubdate attribute has been dropped from spec, ref: https://www.w3.org/html/wg/tracker/issues/185
|
|\ \ \
| | | |
| | | | |
Expand list of void elements to match spec
|
| |/ /
| | |
| | |
| | | |
https://html.spec.whatwg.org/multipage/syntax.html#void-elements
|
|/ /
| |
| |
| | |
create new content. This should also be inline with content being passed should not be mutable
|
| |
| |
| |
| |
| |
| |
| | |
`simple_format` handles `\r\n` and `\r` but previously did not document
this behavior. The handling is done with a `gsub` in `split_paragraphs`.
[ci skip]
|
| | |
|
| | |
|
|\ \
| |/
|/| |
Make select_year work with include_position: true option, fix #25267
|
| | |
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
A change was made in the helper that renders the `datetime`,
being now by default `datetime-local` and creating
an alias of `datetime-local` for `datetime`, `datetime` tag and
it passes to be an abstract class for all other tags that inherit from him.
As a new specification of the HTML 5 the text field type `datetime`
will no longer exist and will pass a `datetime-local`.
Ref: https://html.spec.whatwg.org/multipage/forms.html#local-date-and-time-state-(type=datetime-local)
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
The reason we are reverting this commit is because it created breaking
changes for file upload gems. For more information see discussion here:
https://github.com/rails/rails/issues/17947#issuecomment-225154294
This reverts commit c455817804e4df64c46c17a0cdec0e5a1ca5ba2e, reversing
changes made to 8b3cd74b8a09ef85a43d7631bb062a9ec7f57227.
Conflicts:
actionview/CHANGELOG.md
actionview/lib/action_view/helpers/form_helper.rb
|
| |
| |
| |
| |
| |
| | |
This method is used in `distance_of_time_in_words`
Fixes #25357
|
| |
| |
| |
| | |
The option was deprecated in #21191.
|
|/ |
|
|
|
|
|
|
|
|
|
|
|
|
| |
`include_blank: true` option.
We now generate option with empty label, example:
`<select id="places" name="places"><option value="" label=" "></option></select>`
for include_blank: true. This is only done, if content is missing on the option, and we providing the value from this option.
Fixes #24816
|
|
|
|
|
| |
Sorry, I missed a few places in my last PR. This should be the last of
'em :grimacing:
|
| |
|
| |
|
|\
| |
| |
| | |
Add ActiveSupport::TimeZone.country_zones helper
|
|\ \
| | |
| | |
| | |
| | |
| | | |
neumayr/date_select_helper_with_css_classes_accept_hash
date_select helper with_css_classes option also accept a hash
|
| |/
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
`date_select` helper `:with_css_classes` option now accepts a hash of strings
for `:year`, `:month`, `:day`, `:hour`, `:minute`, `:second` that will extend
the select type with the given css class value.
```erb
<%= f.date_select :birthday, with_css_classes: { month: "my-month", year: "my-year" } %>
```
```html
<select id="user_birthday_3i" name="user[birthday(3i)]">…</select>
<select id="user_birthday_2i" name="user[birthday(2i)]" class="my-month">…</select>
<select id="user_birthday_1i" name="user[birthday(1i)]" class="my-year">…</select>
```
Optional, add global `html_options` to modify every select tag in the set.
```erb
<%= f.date_select :birthday, with_css_classes: { month: "my-month", year: "my-year" }, { class: "my-date optional" } %>
```
Supported DateHelper methods: `select_day`, `select_month`, `select_year`,
`select_hour`, `select_minute`, `select_second`, `select_datetime`, `select_time`,
`time_select`, `date_select` and `datetime_select`.
`:with_css_classes` option was added to the `date_select` with #7975.
|
|\ \
| |/
|/| |
Add html_safe support to ActionView Array#OutputSafetyHelper
|
| | |
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
By default, this method formats US number. This commit extends its
functionality to format number for other countries with a custom regular
expression.
number_to_phone(18812345678, pattern: /(\d{3})(\d{4})(\d{4})/)
# => 188-1234-5678
The output phone number is divided into three groups, so the regexp
should also match three groups of numbers.
|
|\ \
| | |
| | | |
sanitiser helper may be remove in 5.1, update doc [ci skip]
|
| | |
| | |
| | | |
using `rails-html-sanitizer` gem still Rails providing strip_tags, strip_links features. May be remove in 5.1
|
|/ /
| |
| |
| |
| | |
Datetime input type was removed from HTML specification.
One can use `datetime_local_field` and `datetime_local_field_tag` instead.
|
| | |
|
| |
| |
| |
| |
| | |
reduce string allocation.
- Use freezed empty string instead of create one every time we need to return it
|
|/
|
|
|
|
|
|
|
|
| |
stevenspiel/titleize_model_name_for_default_submit_button_value"
This reverts commit 4158974c60d817c9bc1e2aecb342161295f2ac0d, reversing
changes made to 3d590add45b7ff1de972d99b076cb504d5208935.
Reason: This break i18n in some languages. See
https://github.com/rails/rails/issues/791#issuecomment-192724640
|