## Rails 3.2.19 (Jul 2, 2014) ##
* Fix regression when using `ActionView::Helpers::TranslationHelper#translate` with
`options[:raise]`.
This regression was introduced at ec16ba75a5493b9da972eea08bae630eba35b62f.
*Shota Fukumori (sora_h)*
## Rails 3.2.18 (May 6, 2014) ##
* Only accept actions without File::SEPARATOR in the name.
This will avoid directory traversal in implicit render.
Fixes: CVE-2014-0130
*Rafael Mendonça França*
## Rails 3.2.17 (Feb 18, 2014) ##
* Use the reference for the mime type to get the format
Fixes: CVE-2014-0082
* Escape format, negative_format and units options of number helpers
Fixes: CVE-2014-0081
## Rails 3.2.16 (Dec 12, 2013) ##
* Deep Munge the parameters for GET and POST Fixes CVE-2013-6417
* Stop using i18n's built in HTML error handling. Fixes: CVE-2013-4491
* Escape the unit value provided to number_to_currency Fixes CVE-2013-6415
* Only use valid mime type symbols as cache keys CVE-2013-6414
## Rails 3.2.15 (Oct 16, 2013) ##
* Fix `ActionDispatch::RemoteIp::GetIp#calculate_ip` to only check for spoofing
attacks if both `HTTP_CLIENT_IP` and `HTTP_X_FORWARDED_FOR` are set.
Fixes #12410
Backports #10844
*Tamir Duberstein*
* Fix the assert_recognizes test method so that it works when there are
constraints on the querystring.
Issue/Pull Request #9368
Backport #5219
*Brian Hahn*
* Fix to render partial by context(#11605).
*Kassio Borges*
* Fix `ActionDispatch::Assertions::ResponseAssertions#assert_redirected_to`
does not show user-supplied message.
Issue: when `assert_redirected_to` fails due to the response redirect not
matching the expected redirect the user-supplied message (second parameter)
is not shown. This message is only shown if the response is not a redirect.
*Alexey Chernenkov*
## Rails 3.2.14 (Jul 22, 2013) ##
* Merge `:action` from routing scope and assign endpoint if both `:controller`
and `:action` are present. The endpoint assignment only occurs if there is
no `:to` present in the options hash so should only affect routes using the
shorthand syntax (i.e. endpoint is inferred from the the path).
Fixes #9856
*Yves Senn*, *Andrew White*
* Always escape the result of `link_to_unless` method.
Before:
link_to_unless(true, 'Showing ', 'github.com')
# => "Showing "
After:
link_to_unless(true, 'Showing ', 'github.com')
# => "<b>Showing</b>"
*dtaniwaki*
* Use a case insensitive URI Regexp for #asset_path.
This fix a problem where the same asset path using different case are generating
different URIs.
Before:
image_tag("HTTP://google.com")
# => "
After:
select(:category, [], {}, multiple: true, name: "post[category][]")
# =>
Backport #9616.
*Olek Janiszewski*
* Determine the controller#action from only the matched path when using the
shorthand syntax. Previously the complete path was used, which led
to problems with nesting (scopes and namespaces).
Fixes #7554.
Backport #9361.
Example:
# this will route to questions#new
scope ':locale' do
get 'questions/new'
end
*Yves Senn*
* Fix `assert_template` with `render :stream => true`.
Fix #1743.
Backport #5288.
*Sergey Nartimov*
* Eagerly populate the http method lookup cache so local project inflections do
not interfere with use of underscore method ( and we don't need locks )
*Aditya Sanghi*
* `BestStandardsSupport` no longer duplicates `X-UA-Compatible` values on
each request to prevent header size from blowing up.
*Edward Anderson*
* Fixed JSON params parsing regression for non-object JSON content.
*Dylan Smith*
* Prevent unnecessary asset compilation when using `javascript_include_tag` on
files with non-standard extensions.
*Noah Silas*
* Fixes issue where duplicate assets can be required with sprockets.
*Jeremy Jackson*
* Bump `rack` dependency to 1.4.3, eliminate `Rack::File` headers deprecation warning.
*Sam Ruby + Carlos Antonio da Silva*
* Do not append second slash to `root_url` when using `trailing_slash: true`
Fix #8700.
Backport #8701.
Example:
# before
root_url # => http://test.host//
# after
root_url # => http://test.host/
*Yves Senn*
* Fix a bug in `content_tag_for` that prevents it for work without a block.
*Jasl*
* Clear url helper methods when routes are reloaded by removing the methods
explicitly rather than just clearing the module because it didn't work
properly and could be the source of a memory leak.
*Andrew White*
* Fix a bug in `ActionDispatch::Request#raw_post` that caused `env['rack.input']`
to be read but not rewound.
*Matt Venables*
* More descriptive error messages when calling `render :partial` with
an invalid `:layout` argument.
Fixes #8376.
render :partial => 'partial', :layout => true
# results in ActionView::MissingTemplate: Missing partial /true
*Yves Senn*
* Accept symbols as `#send_data` :disposition value. [Backport #8329] *Elia Schito*
* Add i18n scope to `distance_of_time_in_words`. [Backport #7997] *Steve Klabnik*
* Fix side effect of `url_for` changing the `:controller` string option. [Backport #6003]
Before:
controller = '/projects'
url_for :controller => controller, :action => 'status'
puts controller #=> 'projects'
After
puts controller #=> '/projects'
*Nikita Beloglazov + Andrew White*
* Introduce `ActionView::Template::Handlers::ERB.escape_whitelist`. This is a list
of mime types where template text is not html escaped by default. It prevents `Jack & Joe`
from rendering as `Jack & Joe` for the whitelisted mime types. The default whitelist
contains text/plain. Fix #7976 [Backport #8235]
*Joost Baaij*
* `BestStandardsSupport` middleware now appends it's `X-UA-Compatible` value to app's
returned value if any. Fix #8086 [Backport #8093]
*Nikita Afanasenko*
* prevent double slashes in engine urls when `Rails.application.default_url_options[:trailing_slash] = true` is set
Fix #7842
*Yves Senn*
* Fix input name when `:multiple => true` and `:index` are set.
Before:
check_box("post", "comment_ids", { :multiple => true, :index => "foo" }, 1)
#=> .css and aliases phone/index.css to phone.css.
config.assets.precompile = [ 'phone.css' ]
# Precompiles phone/index-.css and aliases phone.css to phone/index.css.
config.assets.precompile = [ 'phone/index.css' ]
# Both of these work with either precompile thanks to their aliases.
<%= stylesheet_link_tag 'phone', media: 'all' %>
<%= stylesheet_link_tag 'phone/index', media: 'all' %>
*Jeremy Kemper*
* `assert_template` is no more passing with what ever string that matches
with the template name.
Before when we have a template `/layout/hello.html.erb`, `assert_template`
was passing with any string that matches. This behavior allowed false
positive like:
assert_template "layout"
assert_template "out/hello"
Now it only passes with:
assert_template "layout/hello"
assert_template "hello"
Fixes #3849.
*Hugolnx*
* Handle `ActionDispatch::Http::UploadedFile` like `Rack::Test::UploadedFile`, don't call to_param on it. Since
`Rack::Test::UploadedFile` isn't API compatible this is needed to test file uploads that rely on `tempfile`
being available.
*Tim Vandecasteele*
* Respect `config.digest = false` for `asset_path`
Previously, the `asset_path` internals only respected the `:digest`
option, but ignored the global config setting. This meant that
`config.digest = false` could not be used in conjunction with
`config.compile = false` this corrects the behavior.
*Peter Wagenet*
* Fix #7646, the log now displays the correct status code when an exception is raised.
*Yves Senn*
* Fix handling of date selects when using both disabled and discard options.
Fixes #7431.
*Vasiliy Ermolovich*
* Fix select_tag when option_tags is nil.
Fixes #7404.
*Sandeep Ravichandran*
* `javascript_include_tag :all` will now not include `application.js` if the file does not exists. *Prem Sichanugrist*
* Support cookie jar options (e.g., domain :all) for all session stores.
Fixes GH#3047, GH#2483.
*Ravil Bayramgalin*
* Performance Improvement to send_file: Avoid having to pass an open file handle as the response body. Rack::Sendfile
will usually intercept the response and just uses the path directly, so no reason to open the file. This performance
improvement also resolves an issue with jRuby encodings, and is the reason for the backport, see issue #6844.
*Jeremy Kemper & Erich Menge*
## Rails 3.2.8 (Aug 9, 2012) ##
* There is an XSS vulnerability in the strip_tags helper in Ruby on Rails, the
helper doesn't correctly handle malformed html. As a result an attacker can
execute arbitrary javascript through the use of specially crafted malformed
html.
*Marek from Nethemba (www.nethemba.com) & Santiago Pastorino*
* When a "prompt" value is supplied to the `select_tag` helper, the "prompt" value is not escaped.
If untrusted data is not escaped, and is supplied as the prompt value, there is a potential for XSS attacks.
Vulnerable code will look something like this:
select_tag("name", options, :prompt => UNTRUSTED_INPUT)
*Santiago Pastorino*
* Reverted the deprecation of `:confirm`. *Rafael Mendonça França*
* Reverted the deprecation of `:disable_with`. *Rafael Mendonça França*
* Reverted the deprecation of `:mouseover` option to `image_tag`. *Rafael Mendonça França*
* Reverted the deprecation of `button_to_function` and `link_to_function` helpers.
*Rafael Mendonça França*
## Rails 3.2.7 (Jul 26, 2012) ##
* Do not convert digest auth strings to symbols. CVE-2012-3424
* Bump Journey requirements to 1.0.4
* Add support for optional root segments containing slashes
* Fixed bug creating invalid HTML in select options
* Show in log correct wrapped keys
* Fix NumberHelper options wrapping to prevent verbatim blocks being rendered instead of line continuations.
* ActionController::Metal doesn't have logger method, check it and then delegate
* ActionController::Caching depends on RackDelegation and AbstractController::Callbacks
## Rails 3.2.6 (Jun 12, 2012) ##
* nil is removed from array parameter values
CVE-2012-2694
* Deprecate `:confirm` in favor of `':data => { :confirm => "Text" }'` option for `button_to`, `button_tag`, `image_submit_tag`, `link_to` and `submit_tag` helpers.
*Carlos Galdino*
* Allow to use mounted_helpers (helpers for accessing mounted engines) in ActionView::TestCase. *Piotr Sarnacki*
* Include mounted_helpers (helpers for accessing mounted engines) in ActionDispatch::IntegrationTest by default. *Piotr Sarnacki*
## Rails 3.2.5 (Jun 1, 2012) ##
* No changes.
## Rails 3.2.4 (May 31, 2012) ##
* Deprecate old APIs for highlight, excerpt and word_wrap *Jeremy Walker*
* Deprecate `:disable_with` in favor of `'data-disable-with'` option for `button_to`, `button_tag` and `submit_tag` helpers.
*Carlos Galdino + Rafael Mendonça França*
* Deprecate `:mouseover` option for `image_tag` helper. *Rafael Mendonça França*
* Deprecate `button_to_function` and `link_to_function` helpers. *Rafael Mendonça França*
* Don't break Haml with textarea newline fix. GH #393, #4000, #5190, #5191
* Fix options handling on labels. GH #2492, #5614
* Added config.action_view.embed_authenticity_token_in_remote_forms to deal
with regression from 16ee611fa
* Set rendered_format when doing render :inline. GH #5632
* Fix the redirect when it receive blocks with arity of 1. Closes #5677
* Strip [nil] from parameters hash. Thanks to Ben Murphy for
reporting this! CVE-2012-2660
## Rails 3.2.3 (March 30, 2012) ##
* Allow to lazy load `default_form_builder` by passing a `String` instead of a constant. *Piotr Sarnacki*
* Fix #5632, render :inline set the proper rendered format. *Santiago Pastorino*
* Fix textarea rendering when using plugins like HAML. Such plugins encode the first newline character in the content. This issue was introduced in https://github.com/rails/rails/pull/5191 *James Coleman*
* Remove the leading \n added by textarea on assert_select. *Santiago Pastorino*
* Add `config.action_view.embed_authenticity_token_in_remote_forms` (defaults to true) which allows to set if authenticity token will be included by default in remote forms. If you change it to false, you can still force authenticity token by passing `:authenticity_token => true` in form options *Piotr Sarnacki*
* Do not include the authenticity token in forms where remote: true as ajax forms use the meta-tag value *DHH*
* Turn off verbose mode of rack-cache, we still have X-Rack-Cache to
check that info. Closes #5245. *Santiago Pastorino*
* Fix #5238, rendered_format is not set when template is not rendered. *Piotr Sarnacki*
* Upgrade rack-cache to 1.2. *José Valim*
* ActionController::SessionManagement is deprecated. *Santiago Pastorino*
* Since the router holds references to many parts of the system like engines, controllers and the application itself, inspecting the route set can actually be really slow, therefore we default alias inspect to to_s. *José Valim*
* Add a new line after the textarea opening tag. Closes #393 *Rafael Mendonça França*
* Always pass a respond block from to responder. We should let the responder to decide what to do with the given overridden response block, and not short circuit it. *sikachu*
* Fixes layout rendering regression from 3.2.2. *José Valim*
## Rails 3.2.2 (March 1, 2012) ##
* Format lookup for partials is derived from the format in which the template is being rendered. Closes #5025 part 2 *Santiago Pastorino*
* Use the right format when a partial is missing. Closes #5025. *Santiago Pastorino*
* Default responder will now always use your overridden block in `respond_with` to render your response. *Prem Sichanugrist*
* check_box helper with :disabled => true will generate a disabled hidden field to conform with the HTML convention where disabled fields are not submitted with the form.
This is a behavior change, previously the hidden tag had a value of the disabled checkbox.
*Tadas Tamosauskas*
## Rails 3.2.1 (January 26, 2012) ##
* Documentation improvements.
* Allow `form.select` to accept ranges (regression). *Jeremy Walker*
* `datetime_select` works with -/+ infinity dates. *Joe Van Dyk*
## Rails 3.2.0 (January 20, 2012) ##
* Setting config.assets.logger to false turn off Sprockets logger *Guillermo Iguaran*
* Add `config.action_dispatch.default_charset` to configure default charset for ActionDispatch::Response. *Carlos Antonio da Silva*
* Deprecate setting default charset at controller level, use the new `config.action_dispatch.default_charset` instead. *Carlos Antonio da Silva*
* Deprecate ActionController::UnknownAction in favour of AbstractController::ActionNotFound. *Carlos Antonio da Silva*
* Deprecate ActionController::DoubleRenderError in favour of AbstractController::DoubleRenderError. *Carlos Antonio da Silva*
* Deprecate method_missing handling for not found actions, use action_missing instead. *Carlos Antonio da Silva*
* Deprecate ActionController#rescue_action, ActionController#initialize_template_class, and ActionController#assign_shortcuts.
These methods were not being used internally anymore and are going to be removed in Rails 4. *Carlos Antonio da Silva*
* Add config.assets.logger to configure Sprockets logger *Rafael França*
* Use a BodyProxy instead of including a Module that responds to
close. Closes #4441 if Active Record is disabled assets are delivered
correctly *Santiago Pastorino*
* Rails initialization with initialize_on_precompile = false should set assets_dir *Santiago Pastorino*
* Add font_path helper method *Santiago Pastorino*
* Depends on rack ~> 1.4.0 *Santiago Pastorino*
* Add :gzip option to `caches_page`. The default option can be configured globally using `page_cache_compression` *Andrey Sitnik*
* The ShowExceptions middleware now accepts a exceptions application that is responsible to render an exception when the application fails. The application is invoked with a copy of the exception in `env["action_dispatch.exception"]` and with the PATH_INFO rewritten to the status code. *José Valim*
* Add `button_tag` support to ActionView::Helpers::FormBuilder.
This support mimics the default behavior of `submit_tag`.
Example:
<%= form_for @post do |f| %>
<%= f.button %>
<% end %>
* Date helpers accept a new option, `:use_two_digit_numbers = true`, that renders select boxes for months and days with a leading zero without changing the respective values.
For example, this is useful for displaying ISO8601-style dates such as '2011-08-01'. *Lennart Fridén and Kim Persson*
* Make ActiveSupport::Benchmarkable a default module for ActionController::Base, so the #benchmark method is once again available in the controller context like it used to be *DHH*
* Deprecated implied layout lookup in controllers whose parent had a explicit layout set:
class ApplicationController
layout "application"
end
class PostsController < ApplicationController
end
In the example above, Posts controller will no longer automatically look up for a posts layout.
If you need this functionality you could either remove `layout "application"` from ApplicationController or explicitly set it to nil in PostsController. *José Valim*
* Rails will now use your default layout (such as "layouts/application") when you specify a layout with `:only` and `:except` condition, and those conditions fail. *Prem Sichanugrist*
For example, consider this snippet:
class CarsController
layout 'single_car', :only => :show
end
Rails will use 'layouts/single_car' when a request comes in `:show` action, and use 'layouts/application' (or 'layouts/cars', if exists) when a request comes in for any other actions.
* form_for with +:as+ option uses "#{action}_#{as}" as css class and id:
Before:
form_for(@user, :as => 'client') # => "