aboutsummaryrefslogtreecommitdiffstats
path: root/activesupport
Commit message (Collapse)AuthorAgeFilesLines
* Fix formatting of `Time.use_zone` [ci skip]yuuji.yaginuma2017-10-041-4/+4
|
* Cleanup CHANGELOGs [ci skip]Ryuta Kamizono2017-10-041-4/+4
| | | | | | | | | * Add missing credit * Add backticks * Fix indentation * Remove trailing spaces And some minor tweaks.
* Remove unused `new_credentials_configuration`yuuji.yaginuma2017-10-011-8/+0
| | | | `new_credentials_configuration` is no longer used since 081a6ac6f7fd929798481f9ee333fb92b441356c.
* Testing to ensure both bang and non-bang methods behaves consistentlyRyuta Kamizono2017-09-301-0/+23
| | | | Follow up of #30728.
* Deprecate secret_token, long since usurped by secret_key_base.Kasper Timm Hansen2017-09-281-0/+12
| | | | | | | | | | See the changelog entry. Remove `secrets.secret_token` from the bug report templates, since we don't accept bug reports for Rails versions that don't support a `secret_key_base`. [ claudiob & Kasper Timm Hansen ]
* Ensure `HashWithIndifferentAccess#transform_keys` to return ↵yuuji.yaginuma2017-09-273-0/+16
| | | | | | | | | | | `HashWithIndifferentAccess` Currently, `#transform_values`, `#select` and `#reject` return instance of `HashWithIndifferentAccess`. But `#transform_keys` returns instance of Hash. This behavior is a bit confusing. I think that `HashWithIndifferentAccess#transform_keys` should also return instance of `HashWithIndifferentAccess` as well as other methods.
* Merge pull request #30705 from frodsan/use-digest-thread-safeMatthew Draper2017-09-261-1/+1
|\ | | | | Preload digest/sha2 to avoid thread safe error.
| * Preload digest/sha2 to avoid thread safe error.Francesco Rodriguez2017-09-251-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I got this error in production using Puma in multi-threaded mode: ``` RuntimeError: Digest::Base cannot be directly inherited in Ruby from active_support/security_utils.rb:23:in `variable_size_secure_compare' from active_support/security_utils.rb:23:in `hexdigest' from active_support/security_utils.rb:23:in `digest' ``` Looks like Digest uses const_missing to load Digest::SHA256 (https://github.com/ruby/ruby/blob/trunk/ext/digest/lib/digest.rb#L8) - https://bugs.ruby-lang.org/issues/9494 - https://github.com/ruby/ruby/commit/c02fa39463a0c6bf698b01bc610135604aca2ff4
* | Fix minor CodeClimate issuedixpac2017-09-251-1/+1
|/
* Fix RotationConfiguration test and remove nil-kind rotates.Kasper Timm Hansen2017-09-242-29/+8
|
* [ci skip] Attempt a new explanation for rotations.Kasper Timm Hansen2017-09-242-49/+42
| | | | | | | | | | | It's become clear to me that the use case is still a bit muddy and the upgrade path is going to be tough for people to figure out. This attempts at understanding it better through documentation, but still needs follow up work. [ Michael Coyne & Kasper Timm Hansen ]
* Use new rotation signature in cookies.Kasper Timm Hansen2017-09-241-5/+5
| | | | [ Michael Coyne & Kasper Timm Hansen ]
* Remove advanced key generator rotations from verifier/encryptor.Kasper Timm Hansen2017-09-243-198/+66
| | | | | | | | Noticed that verifiers and encryptors never once mentioned key generators and salts but only concerned themselves with generated secrets. Clears up the confusing naming around raw_key and secret as well. And makes the rotation API follow the constructor signature to the letter.
* Infer options from the primary verifier.Kasper Timm Hansen2017-09-243-12/+27
| | | | | | Spares users from passing in non-changing values explicitly. [ Michael Coyne & Kasper Timm Hansen ]
* [ci skip] RotationConfiguration is an implementation detail, not public API.Kasper Timm Hansen2017-09-241-1/+1
|
* Add key rotation message Encryptor and VerifierMichael Coyne2017-09-238-4/+432
| | | | | | Both classes now have a rotate method where new instances are added for each call. When decryption or verification fails the next rotation instance is tried.
* Make bang version work with `InheritableOptions`yuuji.yaginuma2017-09-232-1/+14
| | | | | | | | Currently, bang version does not work with `InheritableOptions`. `InheritableOptions` treats the argument Hash as the default value. However, `Hash#fetch` does not use the default value when key is not found, so can not get the default value. So in bang version, should use `Hash#[]` instead of `Hash#fetch`.
* Merge pull request #30624 from bogdanvlviv/deprecate_Module_reachableSean Griffin2017-09-204-13/+23
|\ | | | | Deprecate `Module#reachable?` method
| * Remove redundant require_relative "module/anonymous" and "module/reachable"bogdanvlviv2017-09-171-3/+0
| |
| * Deprecate `Module#reachable?` methodbogdanvlviv2017-09-173-10/+23
| |
* | Merge pull request #30623 from manojmj92/manojmj92-oo-key-patchJavan Makhmali2017-09-201-2/+2
|\ \ | | | | | | make documentation consistent with KeyError message
| * | Fix error message documentationManoj M J2017-09-201-2/+2
| |/
* / Remove unused `NumberToRoundedConverter#digits_and_rounded_number`yuuji.yaginuma2017-09-191-12/+0
|/ | | | `digits_and_rounded_number` is unused since #26628
* [ci skip] Prefer credentials to secrets in docs.Kasper Timm Hansen2017-09-131-1/+1
| | | | | | | Removes most mentions of secrets.secret_key_base and explains credentials instead. Also removes some very stale upgrade notices about Rails 3/4.
* Add credentials using a generic EncryptedConfiguration class (#30067)David Heinemeier Hansson2017-09-116-0/+288
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * WIP: Add credentials using a generic EncryptedConfiguration class This is sketch code so far. * Flesh out EncryptedConfiguration and test it * Better name * Add command and generator for credentials * Use the Pathnames * Extract EncryptedFile from EncryptedConfiguration and add serializers * Test EncryptedFile * Extract serializer validation * Stress the point about losing comments * Allow encrypted configuration to be read without parsing for display * Use credentials by default and base them on the master key * Derive secret_key_base in test/dev, source it from credentials in other envs And document the usage. * Document the new credentials setup * Stop generating the secrets.yml file now that we have credentials * Document what we should have instead Still need to make it happen, tho. * [ci skip] Keep wording to `key base`; prefer defaults. Usually we say we change defaults, not "spec" out a release. Can't use backticks in our sdoc generated documentation either. * Abstract away OpenSSL; prefer MessageEncryptor. * Spare needless new when raising. * Encrypted file test shouldn't depend on subclass. * [ci skip] Some woordings. * Ditch serializer future coding. * I said flip it. Flip it good. * [ci skip] Move require_master_key to the real production.rb. * Add require_master_key to abort the boot process. In case the master key is required in a certain environment we should inspect that the key is there and abort if it isn't. * Print missing key message and exit immediately. Spares us a lengthy backtrace and prevents further execution. I've verified the behavior in a test app, but couldn't figure the test out as loading the app just exits immediately with: ``` /Users/kasperhansen/Documents/code/rails/activesupport/lib/active_support/testing/isolation.rb:23:in `load': marshal data too short (ArgumentError) from /Users/kasperhansen/Documents/code/rails/activesupport/lib/active_support/testing/isolation.rb:23:in `run' from /Users/kasperhansen/.rbenv/versions/2.4.1/lib/ruby/gems/2.4.0/gems/minitest-5.10.2/lib/minitest.rb:830:in `run_one_method' from /Users/kasperhansen/.rbenv/versions/2.4.1/lib/ruby/gems/2.4.0/gems/minitest-5.10.2/lib/minitest/parallel.rb:32:in `block (2 levels) in start' ``` It's likely we need to capture and prevent the exit somehow. Kernel.stub(:exit) didn't work. Leaving it for tomorrow. * Fix require_master_key config test. Loading the app would trigger the `exit 1` per require_master_key's semantics, which then aborted the test. Fork and wait for the child process to finish, then inspect the exit status. Also check we aborted because of a missing master key, so something else didn't just abort the boot. Much <3 to @tenderlove for the tip. * Support reading/writing configs via methods. * Skip needless deep symbolizing. * Remove save; test config reader elsewhere. * Move secret_key_base check to when we're reading it. Otherwise we'll abort too soon since we don't assign the secret_key_base to secrets anymore. * Add missing string literal comments; require unneeded yaml require. * ya ya ya, rubocop. * Add master_key/credentials after bundle. Then we can reuse the existing message on `rails new bc4`. It'll look like: ``` Using web-console 3.5.1 from https://github.com/rails/web-console.git (at master@ce985eb) Using rails 5.2.0.alpha from source at `/Users/kasperhansen/Documents/code/rails` Using sass-rails 5.0.6 Bundle complete! 16 Gemfile dependencies, 72 gems now installed. Use `bundle info [gemname]` to see where a bundled gem is installed. Adding config/master.key to store the master encryption key: 97070158c44b4675b876373a6bc9d5a0 Save this in a password manager your team can access. If you lose the key, no one, including you, can access anything encrypted with it. create config/master.key ``` And that'll be executed even if `--skip-bundle` was passed. * Ensure test app has secret_key_base. * Assign secret_key_base to app or omit. * Merge noise * Split options for dynamic delegation into its own method and use deep symbols to make it work * Update error to point to credentials instead * Appease Rubocop * Validate secret_key_base when reading it. Instead of relying on the validation in key_generator move that into secret_key_base itself. * Fix generator and secrets test. Manually add config.read_encrypted_secrets since it's not there by default anymore. Move mentions of config/secrets.yml to config/credentials.yml.enc. * Remove files I have no idea how they got here. * [ci skip] swap secrets for credentials. * [ci skip] And now, changelogs are coming.
* Hash#transform_keys is in Ruby 2.5+Akira Matsuda2017-09-011-2/+2
| | | | since r59328
* Suppress "unused variable" in Ruby 2.5Akira Matsuda & yui-knk2017-09-011-3/+4
|
* Self-alias doesn't suppress the warning on Ruby 2.2Matthew Draper2017-09-011-8/+17
|
* Clarify intentions around method redefinitionsMatthew Draper2017-09-019-54/+69
| | | | | | | | | Don't use remove_method or remove_possible_method just before a new definition: at best the purpose is unclear, and at worst it creates a race condition. Instead, prefer redefine_method when practical, and silence_redefinition_of_method otherwise.
* Fix `can't modify frozen String` error in `XmlMini_JDOM`yuuji.yaginuma2017-09-011-1/+1
| | | | | | | | | | | | | | | | | | | | | | | Without this, `XmlMini_JDOM` raises an error as follwing: ``` RuntimeError: can't modify frozen String org/jruby/RubyString.java:2264:in `concat' activesupport/lib/active_support/xml_mini/jdom.rb:177:in `block in empty_content?' org/jruby/RubyRange.java:485:in `each' activesupport/lib/active_support/xml_mini/jdom.rb:174:in `empty_content?' activesupport/lib/active_support/xml_mini/jdom.rb:86:in `collapse' activesupport/lib/active_support/xml_mini/jdom.rb:66:in `merge_element!' activesupport/lib/active_support/xml_mini/jdom.rb:84:in `block in collapse' org/jruby/RubyRange.java:485:in `each' activesupport/lib/active_support/xml_mini/jdom.rb:82:in `collapse' activesupport/lib/active_support/xml_mini/jdom.rb:66:in `merge_element!' activesupport/lib/active_support/xml_mini/jdom.rb:51:in `parse' activesupport/lib/active_support/xml_mini.rb:101:in `parse' ``` We already have tests about `XmlMini_JDOM`. But it is not running in CI. https://github.com/rails/rails/blob/master/activesupport/test/xml_mini/jdom_engine_test.rb
* Use tt in doc for railties [skip ci]Yoshiyuki Hirano2017-08-271-1/+1
|
* Fix broken link for Java xml [ci skip]Yoshiyuki Hirano2017-08-241-1/+1
|
* Update links to use https instead of http [ci skip]Yoshiyuki Hirano2017-08-225-6/+6
|
* Update MIT licenses link [ci skip]Yoshiyuki Hirano2017-08-221-1/+1
|
* faster implementation of Hash#deep_mergeM. Simon Borg2017-08-161-12/+6
| | | | | | | | | | | | add missing newline call #deep_merge instead of #dup.deep_merge! make variable and parameter naming more consistent change `_key` to `key` faster implementation of Hash#deep_merge
* Pass missing name attribute to execute_hookAlberto Almagro2017-08-162-7/+12
| | | | Fixes commit 10bf93ef92a70ae511036134290bf0e2de184b5c created to solve issue #30025
* Fix RuboCop offensesKoichi ITO2017-08-161-2/+2
| | | | And enable `context_dependent` of Style/BracesAroundHashParameters cop.
* Allow lazy load hooks to be executed only onceAlberto Almagro2017-08-142-8/+63
| | | | Provide run_once: true option to on_load in case you want a hook only to be executed once. This may be useful in cases where executing a hook several times may have undesired side effects
* Merge pull request #30171 from ↵Kasper Timm Hansen2017-08-145-56/+92
|\ | | | | | | | | kaspth/verifier-encryptor-null-serializer-metadata Perform self-serialization once metadata is involved.
| * Perform self-serialization once metadata is involved.Kasper Timm Hansen2017-08-135-56/+92
| | | | | | | | Adds support for metadata even when using ActiveSupport::MessageEncryptor::NullSerializer.
* | Test for the new exception of delegate_missing_to (#30191)Anton Khamets2017-08-123-3/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Add test for the new exception of delegate_missing_to * Add a changelog entry * Only check for nil if NoMethodError was raised * Make method private * Have to pass both target name and value * Inline the re-raise [Rafael Mendonça França + Anton Khamets]
* | [ci skip] Prefer cookies.encrypted over signed (#30129)Claudio B2017-08-071-1/+1
|/ | | | | | | | | | | | | | | | In some examples and guides we are recommending to use code like: ```ruby verified_user = User.find_by(id: cookies.signed[:user_id]) ``` My suggestion is to use instead: ```ruby verified_user = User.find_by(id: cookies.encrypted[:user_id]) ``` which invites users to prefer the "newer" encrypted cookies over the "legacy" signed cookies.
* Extend image_tag to accept ActiveStorage Attachments and Variants (#30084)Anton Khamets2017-08-071-0/+2
| | | | | | | | | | | | | | | | | | * Extend image_tag to accept ActiveStorage's Attachments and Variants * Flip resolve_image_source around * Add tests for the new use-cases of image_tag * Remove the higher-level test * Update image_tag documentation * Add error states into the test suite * Re-raise polymorhic_url's NoMethodError as ArgumentError * delegate_missing_to will raise DelegationError instead of NoMethodError
* Lint activesupport/CHANGELOG.mdJon Moss2017-08-061-7/+7
| | | | | | Light grammar edits. [ci skip]
* Revert "Merge pull request #15446 from akshay-vishnoi/doc_changes"Matthew Draper2017-08-051-1/+1
| | | | It was right as originally written in #15440.
* Merge pull request #30052 from y-yagi/deprecate_load_error_regexpsSean Griffin2017-08-031-7/+0
|\ | | | | Deprecate `LoadError::REGEXPS` constant
| * Remove unused `LoadError::REGEXPS` constantyuuji.yaginuma2017-08-041-7/+0
| | | | | | | | since 4ad1a52, `LoadError::REGEXPS` is no longer needed.
* | Fix all rubocop violationsRafael Mendonça França2017-08-031-0/+1
|/
* Add backticks around String#camelizeRyuta Kamizono2017-08-041-2/+2
| | | | [ci skip]
* Merge pull request #30039 from ricardotk002/fix-string-camelize-invalid-optionSean Griffin2017-08-033-0/+26
|\ | | | | Update String#camelize to provide feedback when a wrong option is sent
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-04 15:23:16 +0000