| Commit message (Collapse) | Author | Age | Files | Lines |
| |
|
| |
|
|\
| |
| | |
Change "parse_query" to "parse_nested_query"
|
| |
| |
| |
| | |
[ci skip]
|
|\ \
| | |
| | | |
Add more info on working with postgres ENUM type
|
| | | |
|
|\ \ \
| | | |
| | | | |
Update text on CSS Injection
|
| | | |
| | | |
| | | |
| | | | |
[skip ci]
|
|\ \ \ \ |
|
| | | | | |
|
| | | | | |
|
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
This reverts commit 37423e4ff883ad5584bab983aceb4b2b759a1fd8.
Jeremy is right that we shouldn't remove this. The fact is that many
engines are depending on this middleware to be in the default stack.
This ties our hands and forces us to keep the middleware in the stack so
that engines will work. To be extremely clear, I think this is another
smell of "the rack stack" that we have in place. When manipulating
middleware, we should have meaningful names for places in the req / res
lifecycle **not** have engines depend on a particular constant be in a
particular place in the stack. This is a weakness of the API that we
have to figure out a way to address before removing the constant.
As far as timing attacks are concerned, we can reduce the granularity
such that it isn't useful information for hackers, but is still useful
for developers.
|
| |/ / /
|/| | | |
|
|\ \ \ \
| | | | |
| | | | | |
use class to specify the middleware [ci skip]
|
| | | | |
| | | | |
| | | | |
| | | | | |
using string for middleware class names is deprecated in 83b767cef90abfc4c2ee9f4b451b0215501fae9a
|
|/ / / /
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
The runtime header is a potential target for timing attacks since it
returns the amount of time spent on the server (eliminating network
speed). Total time is also not accurate for streaming responses.
The middleware can be added back via:
```ruby
config.middleware.ues ::Rack::Runtime
```
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
Move from `AS::Callbacks::CallbackChain.halt_and_display_warning_on_return_false`
to `AS::Callbacks.halt_and_display_warning_on_return_false` base on
[this
discussion](https://github.com/rails/rails/pull/21218#discussion_r39354580)
Fix the documentation broken by 0a120a818d413c64ff9867125f0b03788fc306f8
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
* A `has_many` dependant association accepts `[:destroy, :delete_all, :nullify,
:restrict_with_error, :restrict_with_exception]` as options.
Currently the documentation references `delete` instead of `delete_all`
* Adds documentation for other options
|
| |_|/
|/| |
| | |
| | | |
[ci skip]
|
|\ \ \
| | | |
| | | | |
[Engines Guide] Remove to_s example, since it's outside the scope
|
| | | |
| | | |
| | | |
| | | |
| | | |
| | | | |
It's outside the scope of the Engines guide
[skip ci]
|
|\ \ \ \
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
[ci skip]
[Action View Overview Guide] Add note about Jbuilder
|
| |/ / /
| | | |
| | | |
| | | | |
[skip ci]
|
|/ / /
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
They're now consistent.
Also changes the quotes to be single, so we only have one type of quote per line
[skip ci]
|
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
The leading slash denotes an absolute path,
rather than a relative one (which is more popular)
[ci skip]
|
| | | |
|
| | | |
|
| | |
| | |
| | |
| | |
| | | |
https://github.com/rails/rails/commit/48583f8bf74d1cefefea3cd6591bd546a9eaff6c , to_time returns times formatted as YYYY-MM-DD HH:MM:SS UTC [ci skip]
`to_time` method returns in `YYYY-MM-DD HH:MM:SS UTC` format after this commit https://github.com/rails/rails/commit/48583f8bf74d1cefefea3cd6591bd546a9eaff6c .
|
| | |
| | |
| | | |
`smpt.gmail.com` should be `smtp.gmail.com`
|
| | |
| | |
| | |
| | | |
The option was deprecated in 6eae366d0d2e5d5211eeaf955f56bd1dc6836758
|
| | |
| | |
| | |
| | | |
@rafaelfranca suggested in https://github.com/rails/rails/commit/f7c7bcd9c2a8b0e8c2840295d001d2d4dfd4cfae that code examples should display
the result after `# =>` and not after `#=>`.
|
| | | |
|
| | |
| | |
| | |
| | |
| | | |
This can still be added to the middleware stack, but is really not
necessary. I'll follow up with a commit that deprecates the constant
|
|/ / |
|
|\ \ |
|
| | | |
|
| | |
| | |
| | |
| | |
| | |
| | | |
AbstractRequest has been deprecated, updating to refer to ActionDispatch::Request instead.
[ci skip]
|
| | |
| | |
| | |
| | |
| | |
| | |
| | |
| | | |
<script> tags.
Ref #21618
[ci skip]
|
|\ \ \
| | | |
| | | | |
Update documentation to remove 'desirable' suggestion for what is not a clear cut approach
|
| | | |
| | | |
| | | |
| | | | |
clear cut approach
|
|\ \ \ \
| |/ / /
|/| | | |
Improved explanation of the <script> tag CSRF behavior
|
| | | | |
|
|\ \ \ \
| |/ / /
|/| | | |
Update Validation guide for acceptance method
|
| | | | |
|
|\ \ \ \
| | | | |
| | | | | |
Updated MySQL documentation link to MySQL latest version 5.7 everywhe…
|
| | | | |
| | | | |
| | | | |
| | | | |
| | | | | |
skip]
Bumps from `5.6` to `5.7`
|
| | | | | |
|
|/ / / /
| | | |
| | | |
| | | | |
block support added in 8cc01e0b2bfa75a613720c535d34e451f5de769c
|
|\ \ \ \
| | | | |
| | | | | |
Improve the AR querying docs
|
| | | | |
| | | | |
| | | | |
| | | | | |
Bumps to 5.7
|