| Commit message (Collapse) | Author | Age | Files | Lines |
... | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Because the UJS library creates a script tag to process responses it
normally requires the script-src attribute of the content security
policy to include 'unsafe-inline'.
To work around this we generate a per-request nonce value that is
embedded in a meta tag in a similar fashion to how CSRF protection
embeds its token in a meta tag. The UJS library can then read the
nonce value and set it on the dynamically generated script tag to
enable it to execute without needing 'unsafe-inline' enabled.
Nonce generation isn't 100% safe - if your script tag is including
user generated content in someway then it may be possible to exploit
an XSS vulnerability which can take advantage of the nonce. It is
however an improvement on a blanket permission for inline scripts.
It is also possible to use the nonce within your own script tags by
using `nonce: true` to set the nonce value on the tag, e.g
<%= javascript_tag nonce: true do %>
alert('Hello, World!');
<% end %>
Fixes #31689.
|
| |
| |
| |
| |
| |
| | |
Skipping over 2.4.0 to sidestep the `"symbol_from_string".to_sym.dup` bug.
References #32028
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
* Global ignores at toplevel .gitignore
* Component-specific ignores in each toplevel directory
* Remove `actionview/test/tmp/.keep` for JRuby
```
rm actionview/test/tmp/ -fr
cd actionview/
bundle exec jruby -Itest test/template/digestor_test.rb
```
Related to #11743, #30392.
Closes #29978.
|
| | |
|
|\ \
| | |
| | |
| | |
| | | |
Aquaj/feature/allow-callables-in-select-group-methods
Allow the use of callable objects as group methods for grouped selects.
|
| | |
| | |
| | |
| | |
| | |
| | | |
Replaced the uses of `group.send(...)` in `option_groups_from_collection_for_select`
by calls to `value_for_collection(group, ...)`, allowing the use of
procs, lambdas and other callable objects as parameters.
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
`BigDecimal.new` has been deprecated in BigDecimal 1.3.3
which will be a default for Ruby 2.5.
Refer
https://github.com/ruby/bigdecimal/commit/533737338db915b00dc7168c3602e4b462b23503
* This commit has been made as follows:
```
cd rails
git grep -l BigDecimal.new | grep -v guides/source/5_0_release_notes.md | grep -v activesupport/test/xml_mini_test.rb | xargs sed -i -e "s/BigDecimal.new/BigDecimal/g"
```
- `activesupport/test/xml_mini_test.rb`
Editmanually to remove `.new` and `::`
- guides/source/5_0_release_notes.md
This is a Rails 5.0 release notes.
|
| | |
| | |
| | |
| | | |
Follow up of #31432.
|
| | |
| | |
| | |
| | | |
Follow up of #31390.
|
|\ \ \
| |/ /
|/| | |
StreamingTemplateRenderer fails to forward I18n.locale in layouts
|
| | |
| | |
| | |
| | | |
stores the current locale in Thread.current[:local] (see: https://github.com/svenfuchs/i18n/blob/master/lib/i18n.rb#L23). StreamingTemplateRenderer is implemented with Fiber which have its own stack of locals and can not access Thread.current.locals(keys, see: https://ruby-doc.org/core-2.2.0/Thread.html#class-Thread-label-Fiber-local+vs.+Thread-local).
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
This helper creates a link tag with preload keyword that allows to
browser to initiate early fetch of resources. Additionally this send
Early Hints if supported.
See https://github.com/rails/rails/pull/30744/commits/59a02fb7bcbe68f26e1e7fdcec45c00c66e4a065
for more details about Early Hints.
Preload spec: https://w3c.github.io/preload/
|
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Action Mailer context for example responds to request but don't have a
a request object.
Fixes #31265
|
| | |
| | |
| | |
| | |
| | | |
This will keep the behavior of an application with the defaults of a 4.2
or 5.0 application behaving the same when upgrading to 5.2.
|
|/ /
| |
| |
| |
| |
| |
| | |
The def with blank `()` was newly added in #31176, but we have not used
the blank `()` style in most part of our code base.
So I've enabled `Style/DefWithParentheses` to prevent to newly added the
code.
|
| |
| |
| |
| | |
form_with_generates_ids
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
When `form_with` was introduced we disabled the automatic
generation of ids that was enabled in `form_for`. This usually
is not an good idea since labels don't work when the input
doesn't have an id and it made harder to test with Capybara.
You can still disable the automatic generation of ids setting
`config.action_view.form_with_generates_ids` to `false.`
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
### Summary
The [`:field_error_proc`](https://github.com/rails/rails/blob/master/actionview/lib/action_view/base.rb#L145) is responsible for decorating input tags that refer to attributes with errors. This default build-in rails feature wrap invalid form elements with additional markup: `<div class="field_with_errors">[…]</div>`.
* Fix for `field_error_proc` wraps form select `optgroup`
* Fix for `field_error_proc` wraps form select divider `option`
* Add tests for uncovered elements with errors
[Fixes #31088]
#### Test coverage
* `test_select_grouped_options_with_errors`
* `test_time_zone_select_with_priority_zones_and_errors`
#### Extend test coverage
* `test_collection_select_with_errors`
* `test_label_with_errors`
* `test_check_box_with_errors`
* `test_check_boxes_with_errors`
* `test_radio_button_with_errors`
* `test_radio_buttons_with_errors`
* `test_collection_check_boxes_with_errors`
* `test_collection_radio_buttons_with_errors`
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Currently, the following error is shows only when run the test using
`bin/test`.
```
./bin/test -w test/template/log_subscriber_test.rb
Run options: --seed 17167
# Running:
/rails/actionview/test/template/log_subscriber_test.rb:34: warning: instance variable @defined_root not initialized
```
In `AVLogSubscriberTest`, if the `Rails.root` is not defined, define the
method and undef it in teardown.
https://github.com/rails/rails/blob/master/actionview/test/template/log_subscriber_test.rb#L21..L33
However, in `bin/test`, `Rails.root` is defined, which results in referring to
uninitialized variables and warnings.
|
|\ \
| | |
| | | |
Call Rails.ajax without beforeSend
|
| | | |
|
|/ /
| |
| |
| | |
Removed unnecessary semicolons
|
|\ \
| | |
| | | |
Does not include disabled element in params
|
| |/
| |
| |
| |
| |
| |
| | |
In the case of remote, it should be the same behavior as submitting
HTML form.
Fixes #30444
|
| | |
|
|\ \
| | |
| | | |
Fix callback in rails ujs
|
| | | |
|
| | |
| | |
| | |
| | | |
`FixtureTemplate` is no longer used since 3d7892d.
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
When puma/puma#1403 is merged Puma will support the Early Hints status
code for sending assets before a request has finished.
While the Early Hints spec is still in draft, this PR prepares Rails to
allowing this status code.
If the proxy server supports Early Hints, it will send H2 pushes to the
client.
This PR adds a method for setting Early Hints Link headers via Rails,
and also automatically sends Early Hints if supported from the
`stylesheet_link_tag` and the `javascript_include_tag`.
Once puma supports Early Hints the `--early-hints` argument can be
passed to the server to enable this or set in the puma config with
`early_hints(true)`. Note that for Early Hints to work
in the browser the requirements are 1) a proxy that can handle H2,
and 2) HTTPS.
To start the server with Early Hints enabled pass `--early-hints` to
`rails s`.
This has been verified to work with h2o, Puma, and Rails with Chrome.
The commit adds a new option to the rails server to enable early hints
for Puma.
Early Hints spec:
https://tools.ietf.org/html/draft-ietf-httpbis-early-hints-04
[Eileen M. Uchitelle, Aaron Patterson]
|
| | |
| | |
| | |
| | | |
Since test of `font_url` was not in Action View's test suite, so it added.
|
| | |
| | |
| | |
| | | |
These methods no longer used since a3da293.
|
| | |
| | |
| | |
| | | |
It is also used in `BlockTestCase`.
|
| | |
| | |
| | |
| | |
| | | |
`abstract_unit.rb` in actionview was copied from actionpack in the
commit eb23754e. But some part is never used for actionview's tests.
|
| |/
|/|
| |
| |
| |
| |
| |
| |
| | |
https://travis-ci.org/rails/rails/jobs/279300966#L2600
The result of `Loofah::HTML5::Scrub.scrub_css` was changed since
v2.1.0.rc1.
https://github.com/flavorjones/loofah/commit/ca56295ff9e802018ea18d23ed49be235a95ccad
|
|\ \
| | |
| | | |
Unify the internal source control .keep file name
|
| | | |
|
| | | |
|
| | | |
|
|\ \ \
| |/ /
|/| |
| | | |
Do not generate default alt text for images
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
- Auto-generating content from the filename of an image is not suitable
alternative text; alt text that isn't fully considered can be
distracting and fatiguing for screen readers users (blind, low vision,
dyslexic people).
- Setting a filename fallback short circuits screen reader default
behavior and configuration for blank descriptions.
- Setting poor defaults also creates false negatives for accessibility
linting and testing software, that makes it harder to improve
application accessibility.
***
- After this change, if authors leave images without alt text, screen
readers will fallback to default behavior for missing alt text.
- Also with this change, Automated linting and testing tools will
correctly generate warnings.
[Fixes #30096]
|
|/ / |
|
| |
| |
| |
| | |
And enable `context_dependent` of Style/BracesAroundHashParameters cop.
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
* Extend image_tag to accept ActiveStorage's Attachments and Variants
* Flip resolve_image_source around
* Add tests for the new use-cases of image_tag
* Remove the higher-level test
* Update image_tag documentation
* Add error states into the test suite
* Re-raise polymorhic_url's NoMethodError as ArgumentError
* delegate_missing_to will raise DelegationError instead of NoMethodError
|
|\ \
| | |
| | | |
Add Active Storage to Rails
|
| | |
| | |
| | |
| | | |
Also make sure file_field doesn't mutate the original options passed in.
|
| | |
| | |
| | |
| | |
| | | |
When Active Storage is not loaded and direct_upload is used on
file_field_tag we should not raise an exception.
|
|/ / |
|
|\ \
| | |
| | | |
Fix test directory to correct path
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
Together, fix to the following lint violation.
```
rails/actionview/test/ujs/public/test/data-confirm.js
303:11 error Strings must use singlequote quotes
rails/actionview/test/ujs/public/test/data-remote.js
414:32 error Extra semicolon semi
✖ 2 problems (2 errors, 0 warnings)
```
|
|/ / |
|