| Commit message (Collapse) | Author | Age | Files | Lines | |
|---|---|---|---|---|---|
| * | Add the `nonce: true` option for `javascript_include_tag` helper. | Yaroslav Markin | 2018-04-17 | 1 | -0/+6 |
| | | |||||
| * | Update security.md with latest underground market prices | szTheory | 2018-04-13 | 1 | -1/+1 |
| | | | | Updated underground market prices according to the 2017 Symantec ISTR (was previously citing the 2008 report) | ||||
| * | Fix MySpace Samy worm link [ci skip] | 284km | 2018-04-12 | 1 | -1/+1 |
| | | | | | The old link https://samy.pl/popular/tech.html is 404 not found. | ||||
| * | Put images into each page's dir in guides | Yoshiyuki Hirano | 2018-03-31 | 1 | -2/+2 |
| | | |||||
| * | Move CSP info from 5.2 release notes to guide [ci skip] | bogdanvlviv | 2018-03-18 | 1 | -0/+106 |
| | | | | | | | - Add mention about "nonce". Related to https://github.com/rails/rails/pull/32222#issuecomment-372268157 | ||||
| * | Fix note marks [ci skip] | Yauheni Dakuka | 2018-03-12 | 1 | -1/+1 |
| | | |||||
| * | Remove password anecdotes from guides [ci skip] | Daniel Colson | 2018-02-07 | 1 | -12/+0 |
| | | |||||
| * | Merge pull request #31817 from composerinteralia/mediocre-joke | Richard Schneeman | 2018-01-28 | 1 | -1/+1 |
| |\ | | | | | Remove joke in security guide [ci skip] | ||||
| | * | Remove joke in security guide [ci skip] | Daniel Colson | 2018-01-28 | 1 | -1/+1 |
| | | | | | | | | | | | | | I think this is a joke, although not a great one. It's mildly unprofessional, so I think we should get rid of it. | ||||
| * | | Update `action_dispatch.default_headers` default value [ci skip] | yuuji.yaginuma | 2018-01-28 | 1 | -1/+4 |
| |/ | | | | This was changed with 5d7b70f and 428939b. | ||||
| * | Fix typos [ci skip] | Yauheni Dakuka | 2018-01-11 | 1 | -1/+1 |
| | | |||||
| * | Merge pull request #30474 from yhirano55/make_it_same_title_in_index_and_page | Eileen M. Uchitelle | 2017-12-13 | 1 | -2/+2 |
| |\ | | | | | Make it same title in index and page [ci skip] | ||||
| | * | Make it same title in index and page [ci skip] | Yoshiyuki Hirano | 2017-08-31 | 1 | -2/+2 |
| | | | |||||
| * | | [ci skip] SecureRandom should mentioned Win32 CryptoAPI functions ins… ↵ | Atul Shimpi | 2017-11-25 | 1 | -1/+1 |
| | | | | | | | | | | | | | | | | | (#31225) * [ci skip] SecureRandom should mentioned Win32 CryptoAPI functions instead of Win32 * Remove functions word | ||||
| * | | Fix links [ci skip] | Yauheni Dakuka | 2017-11-16 | 1 | -2/+2 |
| | | | |||||
| * | | Update security guide for signed cookie rotations | Michael Coyne | 2017-10-09 | 1 | -2/+3 |
| | | | | | | | | | | | The example was slightly incorrect. This commit also adds a test case for this example to cookies middleware unit tests. | ||||
| * | | Fix broken link to recaptcha.net [ci skip] | Patrick Davey | 2017-10-01 | 1 | -1/+1 |
| | | | | | | | | | | | The link to recaptcha.net returns a 404. As far as I can tell, the new link ought to be to https://developers.google.com/recaptcha/ . | ||||
| * | | [ci skip] Don't mention unrotatable secret_key_base. | Kasper Timm Hansen | 2017-09-25 | 1 | -18/+20 |
| | | | |||||
| * | | [ci skip] Attempt a new explanation for rotations. | Kasper Timm Hansen | 2017-09-24 | 1 | -28/+16 |
| | | | | | | | | | | | | | | | | | | | | | | | It's become clear to me that the use case is still a bit muddy and the upgrade path is going to be tough for people to figure out. This attempts at understanding it better through documentation, but still needs follow up work. [ Michael Coyne & Kasper Timm Hansen ] | ||||
| * | | [ci skip] RotationConfiguration is an implementation detail, not public API. | Kasper Timm Hansen | 2017-09-24 | 1 | -7/+4 |
| | | | |||||
| * | | Add key rotation cookies middleware | Michael Coyne | 2017-09-24 | 1 | -19/+111 |
| | | | | | | | | | | | | | Using the action_dispatch.cookies_rotations interface, key rotation is now possible with cookies. Thus the secret_key_base as well as salts, ciphers, and digests, can be rotated without expiring sessions. | ||||
| * | | Merge pull request #30623 from manojmj92/manojmj92-oo-key-patch | Javan Makhmali | 2017-09-20 | 1 | -1/+1 |
| |\ \ | | | | | | | make documentation consistent with KeyError message | ||||
| | * | | Fix error message documentation | Manoj M J | 2017-09-20 | 1 | -1/+1 |
| | | | | |||||
| * | | | Remove "the" [ci skip] | Yauheni Dakuka | 2017-09-18 | 1 | -1/+1 |
| |/ / | |||||
| * | | Fix typo: `credentails` -> `credentials` [ci skip] | yuuji.yaginuma | 2017-09-16 | 1 | -3/+3 |
| | | | | | | | | | Follow up of ca18922ac23be2cde6963fae9b193c9111bec6f8 | ||||
| * | | [ci skip] Prefer credentials to secrets in docs. | Kasper Timm Hansen | 2017-09-13 | 1 | -24/+21 |
| | | | | | | | | | | | | | | | Removes most mentions of secrets.secret_key_base and explains credentials instead. Also removes some very stale upgrade notices about Rails 3/4. | ||||
| * | | Fix created_at [ci skip] | Yauheni Dakuka | 2017-09-13 | 1 | -1/+1 |
| |/ | |||||
| * | Grammar fix | Jordan Sitkin | 2017-08-22 | 1 | -1/+1 |
| | | | | | Changed the phrase '... and many more high targets' to '... and many more high _profile_ targets' | ||||
| * | Use ssl in guide and comment [ci skip] | Yoshiyuki Hirano | 2017-08-19 | 1 | -3/+3 |
| | | |||||
| * | Remove period from within links | Jon Moss | 2017-08-16 | 1 | -3/+3 |
| | | | | | | | Periods should be outside of the <a> tags [ci skip] | ||||
| * | Update security.md | Yauheni Dakuka | 2017-06-26 | 1 | -1/+1 |
| | | |||||
| * | Add brakeman to guides/additional resources. Fixes #29383 [ci skip] (#29427) | Vipul A M | 2017-06-12 | 1 | -3/+4 |
| | | |||||
| * | Merge pull request #28132 from mikeycgto/aead-encrypted-cookies | Kasper Timm Hansen | 2017-05-28 | 1 | -8/+15 |
| |\ | | | | | AEAD encrypted cookies and sessions | ||||
| | * | AEAD encrypted cookies and sessions | Michael Coyne | 2017-05-22 | 1 | -8/+15 |
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit changes encrypted cookies from AES in CBC HMAC mode to Authenticated Encryption using AES-GCM. It also provides a cookie jar to transparently upgrade encrypted cookies to this new scheme. Some other notable changes include: - There is a new application configuration value: +use_authenticated_cookie_encryption+. When enabled, AEAD encrypted cookies will be used. - +cookies.signed+ does not raise a +TypeError+ now if the name of an encrypted cookie is used. Encrypted cookies using the same key as signed cookies would be verified and serialization would then fail due the message still be encrypted. | ||||
| * | | Define path with __dir__ | bogdanvlviv | 2017-05-23 | 1 | -1/+1 |
| | | | | | | | | | | | | | ".. with __dir__ we can restore order in the Universe." - by @fxn Related to 5b8738c2df003a96f0e490c43559747618d10f5f | ||||
| * | | Fix broken external link in security guide. | Mike Gunderloy | 2017-05-21 | 1 | -1/+1 |
| |/ | |||||
| * | Fix link to rails-ujs | Ryunosuke Sato | 2017-03-30 | 1 | -1/+1 |
| | | | | | | https://github.com/rails/rails-ujs is merged into actionview in favor of https://github.com/rails/rails/pull/28098. [skip ci] | ||||
| * | update guide to reflect browser compatibility for HTTP verbs [ci skip] | Rachel Carvalho | 2017-03-23 | 1 | -2/+2 |
| | | |||||
| * | Update some jquery-ujs references to rails-ujs | Jon Moss | 2017-03-18 | 1 | -7/+6 |
| | | | | | [ci skip] | ||||
| * | Fix typo in the security guide | bogdanvlviv | 2017-03-12 | 1 | -2/+2 |
| | | | | | [ci skip] | ||||
| * | Merge branch 'master' of github.com:rails/docrails | Vijay Dev | 2016-12-16 | 1 | -1/+1 |
| |\ | |||||
| | * | Remove mention of SafeErb gem [ci skip] | Prathamesh Sonpatki | 2016-11-19 | 1 | -1/+1 |
| | | | | | | | | | Followup of https://github.com/rails/rails/pull/27086 | ||||
| * | | Remove mention of deprecated SafeERB gem from security docs for now, prior ↵ | Vipul A M | 2016-11-18 | 1 | -1/+1 |
| |/ | | | | | section already speaks about sanitization as a safety measure. [ci skip] (#27086) Fixes #27085 | ||||
| * | Remove the word "mongrel" from documents | Ryunosuke Sato | 2016-09-07 | 1 | -1/+1 |
| | | | | | | | | | | Currently mongrel is not maintained. And it couldn't be built with any Ruby versions that supported by Rails. It is reasonable to remove the word "mongrel" in order to avoid confusion from newcomer. | ||||
| * | [ci skip] Broken links in documentation fix | Rasmus Kjellberg | 2016-08-30 | 1 | -1/+1 |
| | | |||||
| * | When referring to Rails, be consistent in usage of capitalized form, unless ↵ | Vipul A M | 2016-08-19 | 1 | -1/+1 |
| | | | | | it is used in context of a command like bin/rails or the rails directory [ci skip] | ||||
| * | rails -> Rails [ci skip] | Santosh Wadghule | 2016-07-12 | 1 | -1/+1 |
| | | |||||
| * | cometic updates to security guide - fixes #25058 [ci skip] | Mateusz Konieczny | 2016-05-27 | 1 | -1/+1 |
| | | |||||
| * | Merge pull request #25052 from matkoniecz/2008_is_not_recent | Jon Moss | 2016-05-17 | 1 | -3/+1 |
| |\ | | | | | update to make it less obvious that this guide is from 2008/2009 | ||||
| | * | update to make it less obvious that this guide is from 2008/2009 | Mateusz Konieczny | 2016-05-17 | 1 | -3/+1 |
| | | | | | | | | | | | malicious ads are neither new nor unusual live HTTP headers project is dead - see https://www.mozdev.org/bugs/show_bug.cgi?id=25944 | ||||
 |
index : rails.git | |
| Mirror of official rails repo with custom fixes. | Harald Eilertsen |
| aboutsummaryrefslogtreecommitdiffstats |