From 79e086efc4532cee9216358611e28a83eafb2a11 Mon Sep 17 00:00:00 2001 From: Kyle Keesling Date: Tue, 23 Oct 2018 21:25:15 -0400 Subject: update activestorage attachment model documentation reflect recent behavior changes --- activestorage/app/models/active_storage/attachment.rb | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) (limited to 'activestorage') diff --git a/activestorage/app/models/active_storage/attachment.rb b/activestorage/app/models/active_storage/attachment.rb index 4bdd1c0224..13758d9179 100644 --- a/activestorage/app/models/active_storage/attachment.rb +++ b/activestorage/app/models/active_storage/attachment.rb @@ -3,9 +3,8 @@ require "active_support/core_ext/module/delegation" # Attachments associate records with blobs. Usually that's a one record-many blobs relationship, -# but it is possible to associate many different records with the same blob. If you're doing that, -# you'll want to declare with has_one/many_attached :thingy, dependent: false, so that destroying -# any one record won't destroy the blob as well. (Then you'll need to do your own garbage collecting, though). +# but it is possible to associate many different records with the same blob. A foreign-key constraint +# on the attachments table prevents blobs from being purged if they’re still attached to any records. class ActiveStorage::Attachment < ActiveRecord::Base self.table_name = "active_storage_attachments" -- cgit v1.2.3 From 1c11688b5624394c3792d1bb37599fd1e3452c9c Mon Sep 17 00:00:00 2001 From: Gannon McGibbon Date: Tue, 6 Nov 2018 14:17:23 -0500 Subject: Add CVE note to security guide and gemspecs [ci skip] --- activestorage/activestorage.gemspec | 3 +++ 1 file changed, 3 insertions(+) (limited to 'activestorage') diff --git a/activestorage/activestorage.gemspec b/activestorage/activestorage.gemspec index cb1bb00a25..0b879e270c 100644 --- a/activestorage/activestorage.gemspec +++ b/activestorage/activestorage.gemspec @@ -2,6 +2,9 @@ version = File.read(File.expand_path("../RAILS_VERSION", __dir__)).strip +# NOTE: There's no need to update dependencies for CVEs in minor +# releases when users can simply run `bundle update vulnerable_gem`. + Gem::Specification.new do |s| s.platform = Gem::Platform::RUBY s.name = "activestorage" -- cgit v1.2.3 From e74fdbe00cd0f403d34f2bc83eb09e7a5bc56109 Mon Sep 17 00:00:00 2001 From: Gannon McGibbon Date: Tue, 6 Nov 2018 18:05:40 -0500 Subject: Amend CVE note and security guide section wordings Reword first sentence of dep management and CVE section of security guide. Also, reword and move gemspec notes above deps. [ci skip] --- activestorage/activestorage.gemspec | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'activestorage') diff --git a/activestorage/activestorage.gemspec b/activestorage/activestorage.gemspec index 0b879e270c..2c8816df25 100644 --- a/activestorage/activestorage.gemspec +++ b/activestorage/activestorage.gemspec @@ -2,9 +2,6 @@ version = File.read(File.expand_path("../RAILS_VERSION", __dir__)).strip -# NOTE: There's no need to update dependencies for CVEs in minor -# releases when users can simply run `bundle update vulnerable_gem`. - Gem::Specification.new do |s| s.platform = Gem::Platform::RUBY s.name = "activestorage" @@ -28,6 +25,9 @@ Gem::Specification.new do |s| "changelog_uri" => "https://github.com/rails/rails/blob/v#{version}/activestorage/CHANGELOG.md" } + # NOTE: Please read our dependency guidelines before updating versions: + # https://edgeguides.rubyonrails.org/security.html#dependency-management-and-cves + s.add_dependency "actionpack", version s.add_dependency "activerecord", version -- cgit v1.2.3 From 455a122ef0135bd133b51014467211bc9a0a11f4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Maurice=20Ku=CC=88hlborn?= Date: Thu, 15 Nov 2018 12:11:36 +0100 Subject: Add progressive JPG to default variable content types --- activestorage/CHANGELOG.md | 4 ++++ activestorage/lib/active_storage/engine.rb | 1 + 2 files changed, 5 insertions(+) (limited to 'activestorage') diff --git a/activestorage/CHANGELOG.md b/activestorage/CHANGELOG.md index f4e2826dc6..ba57315301 100644 --- a/activestorage/CHANGELOG.md +++ b/activestorage/CHANGELOG.md @@ -1,3 +1,7 @@ +* Add progressive JPG to default list of variable content types + + *Maurice Kühlborn* + * Add `ActiveStorage.routes_prefix` for configuring generated routes. *Chris Bisnett* diff --git a/activestorage/lib/active_storage/engine.rb b/activestorage/lib/active_storage/engine.rb index 7eb93b5e16..d51e806220 100644 --- a/activestorage/lib/active_storage/engine.rb +++ b/activestorage/lib/active_storage/engine.rb @@ -26,6 +26,7 @@ module ActiveStorage image/gif image/jpg image/jpeg + image/pjpeg image/vnd.adobe.photoshop image/vnd.microsoft.icon ) -- cgit v1.2.3 From d6fcc419fe4f99d3f9414d39d081bd6355842018 Mon Sep 17 00:00:00 2001 From: Tasos Maschalidis Date: Sat, 24 Nov 2018 21:54:05 +0200 Subject: ASt direct uploads: account for