From 43962d6ec50f918c9970bd3cd4b6ee5c7f7426ed Mon Sep 17 00:00:00 2001
From: Angelo capilleri <capilleri@yahoo.com>
Date: Fri, 29 Nov 2013 12:26:12 +0100
Subject: Fix header Content-Type: #<Mime::NullType:...> in localized template

This PR fixes #13064 regression bug introduced by the #8085

Now in _process_format when the format is a Mime::NullType nothing is written in self.content_type.
In this way the method Response#assign_default_content_type_and_charset can
write the the default mime_type.
---
 actionpack/test/controller/localized_templates_test.rb | 11 +++++++++++
 1 file changed, 11 insertions(+)

(limited to 'actionpack/test/controller')

diff --git a/actionpack/test/controller/localized_templates_test.rb b/actionpack/test/controller/localized_templates_test.rb
index 6b02eedaed..c95ef8a0c7 100644
--- a/actionpack/test/controller/localized_templates_test.rb
+++ b/actionpack/test/controller/localized_templates_test.rb
@@ -34,4 +34,15 @@ class LocalizedTemplatesTest < ActionController::TestCase
     get :hello_world
     assert_equal "Gutten Tag", @response.body
   end
+
+  def test_localized_template_has_correct_header_with_no_format_in_template_name
+    old_locale = I18n.locale
+    I18n.locale = :it
+
+    get :hello_world
+    assert_equal "Ciao Mondo", @response.body
+    assert_equal "text/html",  @response.content_type
+  ensure
+    I18n.locale = old_locale
+  end
 end
-- 
cgit v1.2.3


From b1b9a0aeca879b1c1bc2c8a74f2c9cabd143b9bb Mon Sep 17 00:00:00 2001
From: Lauro Caetano <laurocaetano1@gmail.com>
Date: Tue, 3 Dec 2013 12:04:25 -0200
Subject: Typos. return -> returns. [ci skip]

---
 actionpack/test/controller/http_digest_authentication_test.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'actionpack/test/controller')

diff --git a/actionpack/test/controller/http_digest_authentication_test.rb b/actionpack/test/controller/http_digest_authentication_test.rb
index 9f1c168209..52a0bc9aa3 100644
--- a/actionpack/test/controller/http_digest_authentication_test.rb
+++ b/actionpack/test/controller/http_digest_authentication_test.rb
@@ -21,7 +21,7 @@ class HttpDigestAuthenticationTest < ActionController::TestCase
 
     def authenticate
       authenticate_or_request_with_http_digest("SuperSecret") do |username|
-        # Return the password
+        # Returns the password
         USERS[username]
       end
     end
-- 
cgit v1.2.3


From 2d3a6a0cb8df0360dd588a4d2fb260dd07cc9bcf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C5=81ukasz=20Strza=C5=82kowski?=
 <lukasz.strzalkowski@gmail.com>
Date: Tue, 3 Dec 2013 11:17:01 +0100
Subject: Action Pack Variants

By default, variants in the templates will be picked up if a variant is set
and there's a match. The format will be:

  app/views/projects/show.html.erb
  app/views/projects/show.html+tablet.erb
  app/views/projects/show.html+phone.erb

If request.variant = :tablet is set, we'll automatically be rendering the
html+tablet template.

In the controller, we can also tailer to the variants with this syntax:

  class ProjectsController < ActionController::Base
    def show
      respond_to do |format|
        format.html do |html|
          @stars = @project.stars

          html.tablet { @notifications = @project.notifications }
          html.phone  { @chat_heads    = @project.chat_heads }
        end

        format.js
        format.atom
      end
    end
  end

The variant itself is nil by default, but can be set in before filters, like
so:

  class ApplicationController < ActionController::Base
    before_action do
      if request.user_agent =~ /iPad/
        request.variant = :tablet
      end
    end
  end

This is modeled loosely on custom mime types, but it's specifically not
intended to be used together. If you're going to make a custom mime type,
you don't need a variant. Variants are for variations on a single mime
types.
---
 actionpack/test/controller/mime/respond_to_test.rb | 54 ++++++++++++++++++++++
 1 file changed, 54 insertions(+)

(limited to 'actionpack/test/controller')

diff --git a/actionpack/test/controller/mime/respond_to_test.rb b/actionpack/test/controller/mime/respond_to_test.rb
index 774dabe105..2b6c8739af 100644
--- a/actionpack/test/controller/mime/respond_to_test.rb
+++ b/actionpack/test/controller/mime/respond_to_test.rb
@@ -146,6 +146,26 @@ class RespondToController < ActionController::Base
     end
   end
 
+  def variant_with_implicit_rendering
+  end
+
+  def variant_with_format_and_custom_render
+    request.variant = :mobile
+
+    respond_to do |type|
+      type.html { render text: "mobile" }
+    end
+  end
+
+  def multiple_variants_for_format
+    respond_to do |type|
+      type.html do |html|
+        html.tablet { render text: "tablet" }
+        html.phone  { render text: "phone" }
+      end
+    end
+  end
+
   protected
     def set_layout
       case action_name
@@ -490,4 +510,38 @@ class RespondToControllerTest < ActionController::TestCase
       get :using_defaults, :format => "invalidformat"
     end
   end
+
+  def test_invalid_variant
+    @request.variant = :invalid
+    assert_raises(ActionView::MissingTemplate) do
+      get :variant_with_implicit_rendering
+    end
+  end
+
+  def test_variant_not_set_regular_template_missing
+    assert_raises(ActionView::MissingTemplate) do
+      get :variant_with_implicit_rendering
+    end
+  end
+
+  def test_variant_with_implicit_rendering
+    @request.variant = :mobile
+    get :variant_with_implicit_rendering
+    assert_equal "text/html", @response.content_type
+    assert_equal "mobile", @response.body
+  end
+
+  def test_variant_with_format_and_custom_render
+    @request.variant = :phone
+    get :variant_with_format_and_custom_render
+    assert_equal "text/html", @response.content_type
+    assert_equal "mobile", @response.body
+  end
+
+  def test_multiple_variants_for_format
+    @request.variant = :tablet
+    get :multiple_variants_for_format
+    assert_equal "text/html", @response.content_type
+    assert_equal "tablet", @response.body
+  end
 end
-- 
cgit v1.2.3


From d6eda3ef3c59e377670442cd7f36460dbdf389f5 Mon Sep 17 00:00:00 2001
From: Carlos Antonio da Silva <carlosantoniodasilva@gmail.com>
Date: Wed, 4 Dec 2013 23:13:04 -0200
Subject: Remove missing integration points of AV extraction

---
 actionpack/test/controller/render_test.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'actionpack/test/controller')

diff --git a/actionpack/test/controller/render_test.rb b/actionpack/test/controller/render_test.rb
index f41287381a..26806fb03f 100644
--- a/actionpack/test/controller/render_test.rb
+++ b/actionpack/test/controller/render_test.rb
@@ -529,4 +529,4 @@ class HeadRenderTest < ActionController::TestCase
     assert_equal "something", @response.headers["X-Custom-Header"]
     assert_response :forbidden
   end
-end
\ No newline at end of file
+end
-- 
cgit v1.2.3


From a16fa9abfd0b34026b04f4ceeb0b75e63609a74a Mon Sep 17 00:00:00 2001
From: David Heinemeier Hansson <david@loudthinking.com>
Date: Sat, 7 Dec 2013 15:00:35 -0800
Subject: Allow code execution in case no variant has been set with
 variant.none

---
 actionpack/test/controller/mime/respond_to_test.rb | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

(limited to 'actionpack/test/controller')

diff --git a/actionpack/test/controller/mime/respond_to_test.rb b/actionpack/test/controller/mime/respond_to_test.rb
index 2b6c8739af..cd93043360 100644
--- a/actionpack/test/controller/mime/respond_to_test.rb
+++ b/actionpack/test/controller/mime/respond_to_test.rb
@@ -166,6 +166,15 @@ class RespondToController < ActionController::Base
     end
   end
 
+  def variant_plus_none_for_format
+    respond_to do |format|
+      format.html do |variant|
+        variant.phone { render text: "phone" }
+        variant.none  { render text: "none" }
+      end
+    end
+  end
+
   protected
     def set_layout
       case action_name
@@ -544,4 +553,11 @@ class RespondToControllerTest < ActionController::TestCase
     assert_equal "text/html", @response.content_type
     assert_equal "tablet", @response.body
   end
+
+
+  def test_no_variant_in_variant_setup
+    get :variant_plus_none_for_format
+    assert_equal "text/html", @response.content_type
+    assert_equal "none", @response.body
+  end
 end
-- 
cgit v1.2.3


From 99975e742eb2636cd814f2c9de21f4bd3c3dbbc7 Mon Sep 17 00:00:00 2001
From: David Heinemeier Hansson <david@loudthinking.com>
Date: Sat, 7 Dec 2013 16:32:38 -0800
Subject: Variants can be declared without a block to signify their presence in
 the controller

---
 actionpack/test/controller/mime/respond_to_test.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'actionpack/test/controller')

diff --git a/actionpack/test/controller/mime/respond_to_test.rb b/actionpack/test/controller/mime/respond_to_test.rb
index cd93043360..c258bbec06 100644
--- a/actionpack/test/controller/mime/respond_to_test.rb
+++ b/actionpack/test/controller/mime/respond_to_test.rb
@@ -170,7 +170,7 @@ class RespondToController < ActionController::Base
     respond_to do |format|
       format.html do |variant|
         variant.phone { render text: "phone" }
-        variant.none  { render text: "none" }
+        variant.none
       end
     end
   end
-- 
cgit v1.2.3


From 2647d2f656ff203f45eecd7e19182018519d4064 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C5=81ukasz=20Strza=C5=82kowski?=
 <lukasz.strzalkowski@gmail.com>
Date: Sun, 8 Dec 2013 22:24:27 +0100
Subject: Inline variants syntax

In most cases, when setting variant specific code, you're not sharing any code
within format.

Inline syntax can vastly simplify defining variants in those sitiations:

  respond_to do |format|
    format.js { render "trash" }
    format.html do |variant|
      variant.phone { redirect_to progress_path }
      variant.none  { render "trash" }
    end
  end
`
Becomes:

  respond_to do |format|
    format.js         { render "trash" }
    format.html.phone { redirect_to progress_path }
    format.html.none  { render "trash" }
  end
---
 actionpack/test/controller/mime/respond_to_test.rb | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

(limited to 'actionpack/test/controller')

diff --git a/actionpack/test/controller/mime/respond_to_test.rb b/actionpack/test/controller/mime/respond_to_test.rb
index c258bbec06..0bac86977a 100644
--- a/actionpack/test/controller/mime/respond_to_test.rb
+++ b/actionpack/test/controller/mime/respond_to_test.rb
@@ -175,6 +175,12 @@ class RespondToController < ActionController::Base
     end
   end
 
+  def variant_inline_syntax
+    respond_to do |format|
+      format.html.phone { render text: "phone" }
+    end
+  end
+
   protected
     def set_layout
       case action_name
@@ -554,10 +560,16 @@ class RespondToControllerTest < ActionController::TestCase
     assert_equal "tablet", @response.body
   end
 
-
   def test_no_variant_in_variant_setup
     get :variant_plus_none_for_format
     assert_equal "text/html", @response.content_type
     assert_equal "none", @response.body
   end
+
+  def test_variant_inline_syntax
+    @request.variant = :phone
+    get :variant_inline_syntax
+    assert_equal "text/html", @response.content_type
+    assert_equal "phone", @response.body
+  end
 end
-- 
cgit v1.2.3


From 4aae538d9ffff3a00a81f3da52fa70f7fd79ac74 Mon Sep 17 00:00:00 2001
From: David Heinemeier Hansson <david@loudthinking.com>
Date: Sun, 8 Dec 2013 14:04:04 -0800
Subject: Revert "Merge pull request #13235 from strzalek/variants-inline" --
 needs a little more work!

This reverts commit 186161148a189839a1e0924043f068a8d155ce69, reversing
changes made to cad9eb178ea5eec0e27d74e93518f4ed34e2f997.
---
 actionpack/test/controller/mime/respond_to_test.rb | 14 +-------------
 1 file changed, 1 insertion(+), 13 deletions(-)

(limited to 'actionpack/test/controller')

diff --git a/actionpack/test/controller/mime/respond_to_test.rb b/actionpack/test/controller/mime/respond_to_test.rb
index 0bac86977a..c258bbec06 100644
--- a/actionpack/test/controller/mime/respond_to_test.rb
+++ b/actionpack/test/controller/mime/respond_to_test.rb
@@ -175,12 +175,6 @@ class RespondToController < ActionController::Base
     end
   end
 
-  def variant_inline_syntax
-    respond_to do |format|
-      format.html.phone { render text: "phone" }
-    end
-  end
-
   protected
     def set_layout
       case action_name
@@ -560,16 +554,10 @@ class RespondToControllerTest < ActionController::TestCase
     assert_equal "tablet", @response.body
   end
 
+
   def test_no_variant_in_variant_setup
     get :variant_plus_none_for_format
     assert_equal "text/html", @response.content_type
     assert_equal "none", @response.body
   end
-
-  def test_variant_inline_syntax
-    @request.variant = :phone
-    get :variant_inline_syntax
-    assert_equal "text/html", @response.content_type
-    assert_equal "phone", @response.body
-  end
 end
-- 
cgit v1.2.3


From edacdbfaf93ac1a81ec8654da4df03b80488e85c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C5=81ukasz=20Strza=C5=82kowski?=
 <lukasz.strzalkowski@gmail.com>
Date: Tue, 10 Dec 2013 00:36:18 +0100
Subject: Inline variants syntax

In most cases, when setting variant specific code, you're not sharing any code
within format.

Inline syntax can vastly simplify defining variants in those situations:

  respond_to do |format|
    format.js { render "trash" }
    format.html do |variant|
      variant.phone { redirect_to progress_path }
      variant.none  { render "trash" }
    end
  end

Becomes:

  respond_to do |format|
    format.js         { render "trash" }
    format.html.phone { redirect_to progress_path }
    format.html.none  { render "trash" }
  end
---
 actionpack/test/controller/mime/respond_to_test.rb | 39 +++++++++++++++++++++-
 1 file changed, 38 insertions(+), 1 deletion(-)

(limited to 'actionpack/test/controller')

diff --git a/actionpack/test/controller/mime/respond_to_test.rb b/actionpack/test/controller/mime/respond_to_test.rb
index c258bbec06..d84eb5790d 100644
--- a/actionpack/test/controller/mime/respond_to_test.rb
+++ b/actionpack/test/controller/mime/respond_to_test.rb
@@ -175,6 +175,22 @@ class RespondToController < ActionController::Base
     end
   end
 
+  def variant_inline_syntax
+    respond_to do |format|
+      format.js         { render text: "js"    }
+      format.html.none  { render text: "none"  }
+      format.html.phone { render text: "phone" }
+    end
+  end
+
+  def variant_inline_syntax_without_block
+    respond_to do |format|
+      format.js
+      format.html.none
+      format.html.phone
+    end
+  end
+
   protected
     def set_layout
       case action_name
@@ -554,10 +570,31 @@ class RespondToControllerTest < ActionController::TestCase
     assert_equal "tablet", @response.body
   end
 
-
   def test_no_variant_in_variant_setup
     get :variant_plus_none_for_format
     assert_equal "text/html", @response.content_type
     assert_equal "none", @response.body
   end
+
+  def test_variant_inline_syntax
+    get :variant_inline_syntax, format: :js
+    assert_equal "text/javascript", @response.content_type
+    assert_equal "js", @response.body
+
+    get :variant_inline_syntax
+    assert_equal "text/html", @response.content_type
+    assert_equal "none", @response.body
+
+    @request.variant = :phone
+    get :variant_inline_syntax
+    assert_equal "text/html", @response.content_type
+    assert_equal "phone", @response.body
+  end
+
+  def test_variant_inline_syntax_without_block
+    @request.variant = :phone
+    get :variant_inline_syntax_without_block
+    assert_equal "text/html", @response.content_type
+    assert_equal "phone", @response.body
+  end
 end
-- 
cgit v1.2.3


From 1650bb3d56897cfef4c7e6b86a36eed4f1a41df5 Mon Sep 17 00:00:00 2001
From: Jeremy Kemper <jeremy@bitsweat.net>
Date: Thu, 12 Dec 2013 20:41:14 -0700
Subject: CSRF protection from cross-origin <script> tags

Thanks to @homakov for sounding the alarm about JSONP-style data leaking
---
 actionpack/test/controller/render_js_test.rb       |  2 +-
 actionpack/test/controller/render_json_test.rb     |  4 +-
 .../controller/request_forgery_protection_test.rb  | 78 +++++++++++++++++++---
 3 files changed, 72 insertions(+), 12 deletions(-)

(limited to 'actionpack/test/controller')

diff --git a/actionpack/test/controller/render_js_test.rb b/actionpack/test/controller/render_js_test.rb
index f070109b27..d550422a2f 100644
--- a/actionpack/test/controller/render_js_test.rb
+++ b/actionpack/test/controller/render_js_test.rb
@@ -22,7 +22,7 @@ class RenderJSTest < ActionController::TestCase
   tests TestController
 
   def test_render_vanilla_js
-    get :render_vanilla_js_hello
+    xhr :get, :render_vanilla_js_hello
     assert_equal "alert('hello')", @response.body
     assert_equal "text/javascript", @response.content_type
   end
diff --git a/actionpack/test/controller/render_json_test.rb b/actionpack/test/controller/render_json_test.rb
index 7c0a6bd67e..de8d1cbd9b 100644
--- a/actionpack/test/controller/render_json_test.rb
+++ b/actionpack/test/controller/render_json_test.rb
@@ -100,13 +100,13 @@ class RenderJsonTest < ActionController::TestCase
   end
 
   def test_render_json_with_callback
-    get :render_json_hello_world_with_callback
+    xhr :get, :render_json_hello_world_with_callback
     assert_equal 'alert({"hello":"world"})', @response.body
     assert_equal 'text/javascript', @response.content_type
   end
 
   def test_render_json_with_custom_content_type
-    get :render_json_with_custom_content_type
+    xhr :get, :render_json_with_custom_content_type
     assert_equal '{"hello":"world"}', @response.body
     assert_equal 'text/javascript', @response.content_type
   end
diff --git a/actionpack/test/controller/request_forgery_protection_test.rb b/actionpack/test/controller/request_forgery_protection_test.rb
index 727db79241..f1ed545205 100644
--- a/actionpack/test/controller/request_forgery_protection_test.rb
+++ b/actionpack/test/controller/request_forgery_protection_test.rb
@@ -52,18 +52,36 @@ module RequestForgeryProtectionActions
     render :inline => "<%= form_for(:some_resource, :remote => true, :authenticity_token => 'external_token') {} %>"
   end
 
+  def same_origin_js
+    render js: 'foo();'
+  end
+
+  def negotiate_same_origin
+    respond_to do |format|
+      format.js { same_origin_js }
+    end
+  end
+
+  def cross_origin_js
+    same_origin_js
+  end
+
+  def negotiate_cross_origin
+    negotiate_same_origin
+  end
+
   def rescue_action(e) raise e end
 end
 
 # sample controllers
 class RequestForgeryProtectionControllerUsingResetSession < ActionController::Base
   include RequestForgeryProtectionActions
-  protect_from_forgery :only => %w(index meta), :with => :reset_session
+  protect_from_forgery :only => %w(index meta same_origin_js negotiate_same_origin), :with => :reset_session
 end
 
 class RequestForgeryProtectionControllerUsingException < ActionController::Base
   include RequestForgeryProtectionActions
-  protect_from_forgery :only => %w(index meta), :with => :exception
+  protect_from_forgery :only => %w(index meta same_origin_js negotiate_same_origin), :with => :exception
 end
 
 class RequestForgeryProtectionControllerUsingNullSession < ActionController::Base
@@ -201,7 +219,7 @@ module RequestForgeryProtectionTests
   end
 
   def test_should_not_allow_post_without_token_irrespective_of_format
-    assert_blocked { post :index, :format=>'xml' }
+    assert_blocked { post :index, format: 'xml' }
   end
 
   def test_should_not_allow_patch_without_token
@@ -271,6 +289,38 @@ module RequestForgeryProtectionTests
     end
   end
 
+  def test_should_only_allow_same_origin_js_get_with_xhr_header
+    assert_cross_origin_blocked { get :same_origin_js }
+    assert_cross_origin_blocked { get :same_origin_js, format: 'js' }
+    assert_cross_origin_blocked do
+      @request.accept = 'text/javascript'
+      get :negotiate_same_origin
+    end
+
+    assert_cross_origin_not_blocked { xhr :get, :same_origin_js }
+    assert_cross_origin_not_blocked { xhr :get, :same_origin_js, format: 'js' }
+    assert_cross_origin_not_blocked do
+      @request.accept = 'text/javascript'
+      xhr :get, :negotiate_same_origin
+    end
+  end
+
+  def test_should_only_allow_cross_origin_js_get_without_xhr_header_if_protection_disabled
+    assert_cross_origin_not_blocked { get :cross_origin_js }
+    assert_cross_origin_not_blocked { get :cross_origin_js, format: 'js' }
+    assert_cross_origin_not_blocked do
+      @request.accept = 'text/javascript'
+      get :negotiate_cross_origin
+    end
+
+    assert_cross_origin_not_blocked { xhr :get, :cross_origin_js }
+    assert_cross_origin_not_blocked { xhr :get, :cross_origin_js, format: 'js' }
+    assert_cross_origin_not_blocked do
+      @request.accept = 'text/javascript'
+      xhr :get, :negotiate_cross_origin
+    end
+  end
+
   def assert_blocked
     session[:something_like_user_id] = 1
     yield
@@ -282,6 +332,16 @@ module RequestForgeryProtectionTests
     assert_nothing_raised { yield }
     assert_response :success
   end
+
+  def assert_cross_origin_blocked
+    assert_raises(ActionController::InvalidCrossOriginRequest) do
+      yield
+    end
+  end
+
+  def assert_cross_origin_not_blocked
+    assert_not_blocked { yield }
+  end
 end
 
 # OK let's get our test on
@@ -305,13 +365,13 @@ class RequestForgeryProtectionControllerUsingResetSessionTest < ActionController
   end
 end
 
-class NullSessionDummyKeyGenerator
-  def generate_key(secret)
-    '03312270731a2ed0d11ed091c2338a06'
+class RequestForgeryProtectionControllerUsingNullSessionTest < ActionController::TestCase
+  class NullSessionDummyKeyGenerator
+    def generate_key(secret)
+      '03312270731a2ed0d11ed091c2338a06'
+    end
   end
-end
 
-class RequestForgeryProtectionControllerUsingNullSessionTest < ActionController::TestCase  
   def setup
     @request.env[ActionDispatch::Cookies::GENERATOR_KEY] = NullSessionDummyKeyGenerator.new
   end
@@ -375,8 +435,8 @@ end
 
 class CustomAuthenticityParamControllerTest < ActionController::TestCase
   def setup
-    ActionController::Base.request_forgery_protection_token = :custom_token_name
     super
+    ActionController::Base.request_forgery_protection_token = :custom_token_name
   end
 
   def teardown
-- 
cgit v1.2.3


From 4f4fdd643f9d19fbbeeec3ac77674f791c9beffa Mon Sep 17 00:00:00 2001
From: Jeremy Kemper <jeremy@bitsweat.net>
Date: Tue, 17 Dec 2013 16:02:04 -0700
Subject: Clearly limit new CSRF protection to GET requests

---
 actionpack/test/controller/request_forgery_protection_test.rb | 10 ++++++++++
 1 file changed, 10 insertions(+)

(limited to 'actionpack/test/controller')

diff --git a/actionpack/test/controller/request_forgery_protection_test.rb b/actionpack/test/controller/request_forgery_protection_test.rb
index f1ed545205..1f5fc06410 100644
--- a/actionpack/test/controller/request_forgery_protection_test.rb
+++ b/actionpack/test/controller/request_forgery_protection_test.rb
@@ -305,6 +305,16 @@ module RequestForgeryProtectionTests
     end
   end
 
+  # Allow non-GET requests since GET is all a remote <script> tag can muster.
+  def test_should_allow_non_get_js_without_xhr_header
+    assert_cross_origin_not_blocked { post :same_origin_js, custom_authenticity_token: @token }
+    assert_cross_origin_not_blocked { post :same_origin_js, format: 'js', custom_authenticity_token: @token }
+    assert_cross_origin_not_blocked do
+      @request.accept = 'text/javascript'
+      post :negotiate_same_origin, custom_authenticity_token: @token
+    end
+  end
+
   def test_should_only_allow_cross_origin_js_get_without_xhr_header_if_protection_disabled
     assert_cross_origin_not_blocked { get :cross_origin_js }
     assert_cross_origin_not_blocked { get :cross_origin_js, format: 'js' }
-- 
cgit v1.2.3


From c5b76b5362e4ba28ff3a5649156c50dff9a86de7 Mon Sep 17 00:00:00 2001
From: Carlos Antonio da Silva <carlosantoniodasilva@gmail.com>
Date: Thu, 19 Dec 2013 09:03:39 -0200
Subject: Prefer assert_raise instead of flunk + rescue to test for exceptions

Change most tests to make use of assert_raise returning the raised
exception rather than relying on a combination of flunk + rescue to
check for exception types/messages.
---
 .../test/controller/action_pack_assertions_test.rb       | 16 ++++++----------
 actionpack/test/controller/routing_test.rb               | 13 +++----------
 2 files changed, 9 insertions(+), 20 deletions(-)

(limited to 'actionpack/test/controller')

diff --git a/actionpack/test/controller/action_pack_assertions_test.rb b/actionpack/test/controller/action_pack_assertions_test.rb
index ba4cffcd3e..b6b5a218cc 100644
--- a/actionpack/test/controller/action_pack_assertions_test.rb
+++ b/actionpack/test/controller/action_pack_assertions_test.rb
@@ -444,22 +444,18 @@ class ActionPackAssertionsControllerTest < ActionController::TestCase
 
   def test_assert_response_uses_exception_message
     @controller = AssertResponseWithUnexpectedErrorController.new
-    get :index
+    e = assert_raise RuntimeError, 'Expected non-success response' do
+      get :index
+    end
     assert_response :success
-    flunk 'Expected non-success response'
-  rescue RuntimeError => e
-    assert e.message.include?('FAIL')
+    assert_includes 'FAIL', e.message
   end
 
   def test_assert_response_failure_response_with_no_exception
     @controller = AssertResponseWithUnexpectedErrorController.new
     get :show
-    assert_response :success
-    flunk 'Expected non-success response'
-  rescue ActiveSupport::TestCase::Assertion
-    # success
-  rescue
-    flunk "assert_response failed to handle failure response with missing, but optional, exception."
+    assert_response 500
+    assert_equal 'Boom', response.body
   end
 end
 
diff --git a/actionpack/test/controller/routing_test.rb b/actionpack/test/controller/routing_test.rb
index 2c84e95c6e..df453a0251 100644
--- a/actionpack/test/controller/routing_test.rb
+++ b/actionpack/test/controller/routing_test.rb
@@ -1833,11 +1833,11 @@ class RackMountIntegrationTests < ActiveSupport::TestCase
     assert_equal({:controller => 'foo', :action => 'id_default', :id => 1 }, @routes.recognize_path('/id_default'))
     assert_equal({:controller => 'foo', :action => 'get_or_post'}, @routes.recognize_path('/get_or_post', :method => :get))
     assert_equal({:controller => 'foo', :action => 'get_or_post'}, @routes.recognize_path('/get_or_post', :method => :post))
-    assert_raise(ActionController::ActionControllerError) { @routes.recognize_path('/get_or_post', :method => :put) }
-    assert_raise(ActionController::ActionControllerError) { @routes.recognize_path('/get_or_post', :method => :delete) }
+    assert_raise(ActionController::RoutingError) { @routes.recognize_path('/get_or_post', :method => :put) }
+    assert_raise(ActionController::RoutingError) { @routes.recognize_path('/get_or_post', :method => :delete) }
 
     assert_equal({:controller => 'posts', :action => 'index', :optional => 'bar'}, @routes.recognize_path('/optional/bar'))
-    assert_raise(ActionController::ActionControllerError) { @routes.recognize_path('/optional') }
+    assert_raise(ActionController::RoutingError) { @routes.recognize_path('/optional') }
 
     assert_equal({:controller => 'posts', :action => 'show', :id => '1', :ws => true}, @routes.recognize_path('/ws/posts/show/1', :method => :get))
     assert_equal({:controller => 'posts', :action => 'list', :ws => true}, @routes.recognize_path('/ws/posts/list', :method => :get))
@@ -1916,11 +1916,4 @@ class RackMountIntegrationTests < ActiveSupport::TestCase
       end
       extras
     end
-
-    def assert_raise(e)
-      result = yield
-      flunk "Did not raise #{e}, but returned #{result.inspect}"
-    rescue e
-      assert true
-    end
 end
-- 
cgit v1.2.3


From 92f9ff8cc325d72d74cbf839ac9ac0acd474a768 Mon Sep 17 00:00:00 2001
From: Xavier Noria <fxn@hashref.com>
Date: Sat, 21 Dec 2013 01:11:47 +0100
Subject: converts hashes in arrays of unfiltered params to unpermitted params
 [fixes #13382]

---
 actionpack/test/controller/parameters/parameters_permit_test.rb | 7 +++++++
 1 file changed, 7 insertions(+)

(limited to 'actionpack/test/controller')

diff --git a/actionpack/test/controller/parameters/parameters_permit_test.rb b/actionpack/test/controller/parameters/parameters_permit_test.rb
index b60c5f058d..ba191a7227 100644
--- a/actionpack/test/controller/parameters/parameters_permit_test.rb
+++ b/actionpack/test/controller/parameters/parameters_permit_test.rb
@@ -153,6 +153,13 @@ class ParametersPermitTest < ActiveSupport::TestCase
     assert_equal nil, params[:foo]
   end
 
+  test 'hashes in array values get wrapped' do
+    params = ActionController::Parameters.new(foo: [{}, {}])
+    params[:foo].each do |hash|
+      assert !hash.permitted?
+    end
+  end
+
   test "fetch doesnt raise ParameterMissing exception if there is a default" do
     assert_equal "monkey", @params.fetch(:foo, "monkey")
     assert_equal "monkey", @params.fetch(:foo) { "monkey" }
-- 
cgit v1.2.3


From 273045d6d5c5f68e38f917e8ab4b1ad533d23aac Mon Sep 17 00:00:00 2001
From: Xavier Noria <fxn@hashref.com>
Date: Sat, 21 Dec 2013 14:22:08 +0100
Subject: optimizes array conversion in AC::Parameters

---
 actionpack/test/controller/parameters/parameters_permit_test.rb | 5 +++++
 1 file changed, 5 insertions(+)

(limited to 'actionpack/test/controller')

diff --git a/actionpack/test/controller/parameters/parameters_permit_test.rb b/actionpack/test/controller/parameters/parameters_permit_test.rb
index ba191a7227..9c1828e9aa 100644
--- a/actionpack/test/controller/parameters/parameters_permit_test.rb
+++ b/actionpack/test/controller/parameters/parameters_permit_test.rb
@@ -160,6 +160,11 @@ class ParametersPermitTest < ActiveSupport::TestCase
     end
   end
 
+  test 'arrays are converted at most once' do
+    params = ActionController::Parameters.new(foo: [{}])
+    assert params[:foo].equal?(params[:foo])
+  end
+
   test "fetch doesnt raise ParameterMissing exception if there is a default" do
     assert_equal "monkey", @params.fetch(:foo, "monkey")
     assert_equal "monkey", @params.fetch(:foo) { "monkey" }
-- 
cgit v1.2.3


From 618d5317d3ce3d40a22293149f79ff9843bbdb35 Mon Sep 17 00:00:00 2001
From: Carlos Antonio da Silva <carlosantoniodasilva@gmail.com>
Date: Thu, 19 Dec 2013 16:30:48 -0200
Subject: Move the null mime type to request.format

TLDR: always return an object that responds to the query methods from
request.format, and do not touch Mime::Type[] lookup to avoid bugs.

---

Long version:

The initial issue was about being able to do checks like
request.format.html? for request with an unknown format, where
request.format would be nil.

This is where the issue came from at first in #7837 and #8085
(merged in cba05887dc3b56a46a9fe2779b6b228880b49622), but the
implementation went down the path of adding this to the mime type
lookup logic.

This unfortunately introduced subtle bugs, for instance in the merged
commit a test related to send_file had to be changed to accomodate the
introduction of the NullType.

Later another bug was found in #13064, related to the content-type being
shown as #<Mime::NullType:...> for templates with localized extensions
but no format included. This one was fixed in #13133, merged in
43962d6ec50f918c9970bd3cd4b6ee5c7f7426ed.

Besides that, custom handlers were not receiving the proper template
formats anymore when passing through the rendering process, because of
the NullType addition. That was found while migrating an application
from 3.2 to 4.0 that uses the Markerb gem (a custom handler that
generates both text and html emails from a markdown template).

---

This changes the implementation moving away from returning this null
object from the mime lookup, and still fixes the initial issue where
request.format.zomg? would raise an exception for unknown formats due to
request.format being nil.
---
 actionpack/test/controller/send_file_test.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'actionpack/test/controller')

diff --git a/actionpack/test/controller/send_file_test.rb b/actionpack/test/controller/send_file_test.rb
index 8ecc1c7d73..a4c84c29d7 100644
--- a/actionpack/test/controller/send_file_test.rb
+++ b/actionpack/test/controller/send_file_test.rb
@@ -144,7 +144,7 @@ class SendFileTest < ActionController::TestCase
     }
 
     @controller.headers = {}
-    assert !@controller.send(:send_file_headers!, options)
+    assert_raise(ArgumentError) { @controller.send(:send_file_headers!, options) }
   end
 
   def test_send_file_headers_guess_type_from_extension
-- 
cgit v1.2.3


From fa0380cb4a7f08909e961a8e355c70ba3a676253 Mon Sep 17 00:00:00 2001
From: Xavier Noria <fxn@hashref.com>
Date: Mon, 23 Dec 2013 22:55:03 +0100
Subject: AC::Parameters#permit! permits hashes in array values

---
 .../test/controller/parameters/parameters_permit_test.rb   | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

(limited to 'actionpack/test/controller')

diff --git a/actionpack/test/controller/parameters/parameters_permit_test.rb b/actionpack/test/controller/parameters/parameters_permit_test.rb
index 9c1828e9aa..33a91d72d9 100644
--- a/actionpack/test/controller/parameters/parameters_permit_test.rb
+++ b/actionpack/test/controller/parameters/parameters_permit_test.rb
@@ -8,9 +8,16 @@ class ParametersPermitTest < ActiveSupport::TestCase
   end
 
   setup do
-    @params = ActionController::Parameters.new({ person: {
-      age: "32", name: { first: "David", last: "Heinemeier Hansson" }
-    }})
+    @params = ActionController::Parameters.new(
+      person: {
+        age: '32',
+        name: {
+          first: 'David',
+          last: 'Heinemeier Hansson'
+        },
+        addresses: [{city: 'Chicago', state: 'Illinois'}]
+      }
+    )
 
     @struct_fields = []
     %w(0 1 12).each do |number|
@@ -233,6 +240,7 @@ class ParametersPermitTest < ActiveSupport::TestCase
     assert @params.permitted?
     assert @params[:person].permitted?
     assert @params[:person][:name].permitted?
+    assert @params[:person][:addresses][0].permitted?
   end
 
   test "permitted takes a default value when Parameters.permit_all_parameters is set" do
-- 
cgit v1.2.3


From ccc1a7b7b0b2915799c60aeb6ee94b2e70994b6c Mon Sep 17 00:00:00 2001
From: Akira Matsuda <ronnie@dio.jp>
Date: Wed, 25 Dec 2013 16:29:04 +0900
Subject: Unused classes in AP tests

---
 actionpack/test/controller/filters_test.rb | 11 -----------
 1 file changed, 11 deletions(-)

(limited to 'actionpack/test/controller')

diff --git a/actionpack/test/controller/filters_test.rb b/actionpack/test/controller/filters_test.rb
index 3b5d7ef446..d3efca5b6f 100644
--- a/actionpack/test/controller/filters_test.rb
+++ b/actionpack/test/controller/filters_test.rb
@@ -893,17 +893,6 @@ class ControllerWithFilterInstance < PostsController
   around_filter YieldingFilter.new, :only => :raises_after
 end
 
-class ControllerWithFilterMethod < PostsController
-  class YieldingFilter < DefaultFilter
-    def around(controller)
-      yield
-      raise After
-    end
-  end
-
-  around_filter YieldingFilter.new.method(:around), :only => :raises_after
-end
-
 class ControllerWithProcFilter < PostsController
   around_filter(:only => :no_raise) do |c,b|
     c.instance_variable_set(:"@before", true)
-- 
cgit v1.2.3


From a288cc1e011cf25508d1b56f393023bb40ab441e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C5=81ukasz=20Strza=C5=82kowski?=
 <lukasz.strzalkowski@gmail.com>
Date: Tue, 24 Dec 2013 16:53:10 +0100
Subject: Add any/all support for variants

Like `format.any`, you can do the same with variants.

It works for both inline:

    respond_to do |format|
      format.html.any   { render text: "any"   }
      format.html.phone { render text: "phone" }
    end

and block syntax:

    respond_to do |format|
      format.html do |variant|
        variant.any(:tablet, :phablet){ render text: "any" }
        variant.phone { render text: "phone" }
      end
    end
---
 actionpack/test/controller/mime/respond_to_test.rb | 143 +++++++++++++++++++++
 1 file changed, 143 insertions(+)

(limited to 'actionpack/test/controller')

diff --git a/actionpack/test/controller/mime/respond_to_test.rb b/actionpack/test/controller/mime/respond_to_test.rb
index d84eb5790d..84e4936f31 100644
--- a/actionpack/test/controller/mime/respond_to_test.rb
+++ b/actionpack/test/controller/mime/respond_to_test.rb
@@ -191,6 +191,61 @@ class RespondToController < ActionController::Base
     end
   end
 
+  def variant_any
+    respond_to do |format|
+      format.html do |variant|
+        variant.any(:tablet, :phablet){ render text: "any" }
+        variant.phone { render text: "phone" }
+      end
+    end
+  end
+
+  def variant_any_any
+    respond_to do |format|
+      format.html do |variant|
+        variant.any   { render text: "any"   }
+        variant.phone { render text: "phone" }
+      end
+    end
+  end
+
+  def variant_inline_any
+    respond_to do |format|
+      format.html.any(:tablet, :phablet){ render text: "any" }
+      format.html.phone { render text: "phone" }
+    end
+  end
+
+  def variant_inline_any_any
+    respond_to do |format|
+      format.html.phone { render text: "phone" }
+      format.html.any   { render text: "any"   }
+    end
+  end
+
+  def variant_any_implicit_render
+    respond_to do |format|
+      format.html.phone
+      format.html.any(:tablet, :phablet)
+    end
+  end
+
+  def variant_any_with_none
+    respond_to do |format|
+      format.html.any(:none, :phone){ render text: "none or phone" }
+    end
+  end
+
+  def format_any_variant_any
+    respond_to do |format|
+      format.html { render text: "HTML" }
+      format.any(:js, :xml) do |variant|
+        variant.phone{ render text: "phone" }
+        variant.any(:tablet, :phablet){ render text: "tablet" }
+      end
+    end
+  end
+
   protected
     def set_layout
       case action_name
@@ -597,4 +652,92 @@ class RespondToControllerTest < ActionController::TestCase
     assert_equal "text/html", @response.content_type
     assert_equal "phone", @response.body
   end
+
+  def test_variant_any
+    @request.variant = :phone
+    get :variant_any
+    assert_equal "text/html", @response.content_type
+    assert_equal "phone", @response.body
+
+    @request.variant = :tablet
+    get :variant_any
+    assert_equal "text/html", @response.content_type
+    assert_equal "any", @response.body
+
+    @request.variant = :phablet
+    get :variant_any
+    assert_equal "text/html", @response.content_type
+    assert_equal "any", @response.body
+  end
+
+  def test_variant_any_any
+    @request.variant = :phone
+    get :variant_any_any
+    assert_equal "text/html", @response.content_type
+    assert_equal "phone", @response.body
+
+    @request.variant = :yolo
+    get :variant_any_any
+    assert_equal "text/html", @response.content_type
+    assert_equal "any", @response.body
+  end
+
+  def test_variant_inline_any
+    @request.variant = :phone
+    get :variant_any
+    assert_equal "text/html", @response.content_type
+    assert_equal "phone", @response.body
+
+    @request.variant = :tablet
+    get :variant_inline_any
+    assert_equal "text/html", @response.content_type
+    assert_equal "any", @response.body
+
+    @request.variant = :phablet
+    get :variant_inline_any
+    assert_equal "text/html", @response.content_type
+    assert_equal "any", @response.body
+  end
+
+  def test_variant_inline_any_any
+    @request.variant = :phone
+    get :variant_inline_any_any
+    assert_equal "text/html", @response.content_type
+    assert_equal "phone", @response.body
+
+    @request.variant = :yolo
+    get :variant_inline_any_any
+    assert_equal "text/html", @response.content_type
+    assert_equal "any", @response.body
+  end
+
+  def test_variant_any_implicit_render
+    @request.variant = :tablet
+    get :variant_any_implicit_render
+    assert_equal "text/html", @response.content_type
+    assert_equal "tablet", @response.body
+
+    @request.variant = :phablet
+    get :variant_any_implicit_render
+    assert_equal "text/html", @response.content_type
+    assert_equal "phablet", @response.body
+  end
+
+  def test_variant_any_with_none
+    get :variant_any_with_none
+    assert_equal "text/html", @response.content_type
+    assert_equal "none or phone", @response.body
+
+    @request.variant = :phone
+    get :variant_any_with_none
+    assert_equal "text/html", @response.content_type
+    assert_equal "none or phone", @response.body
+  end
+
+  def test_format_any_variant_any
+    @request.variant = :tablet
+    get :format_any_variant_any, format: :js
+    assert_equal "text/javascript", @response.content_type
+    assert_equal "tablet", @response.body
+  end
 end
-- 
cgit v1.2.3