Commit Graph

9526 Commits

Author SHA1 Message Date
Aaron Patterson
ed9b23d898 invert check so we fail faster
there's no reason to to_sym the string if it doesn't match the regexp
anyway
2014-07-31 11:25:01 -07:00
Aaron Patterson
3e9158bb95 do a hash lookup for collision detection
hash lookup should be faster than searching an array.
2014-07-31 11:22:05 -07:00
Carlos Antonio da Silva
ddb0d4bec1 Realign assignments ✂️ 2014-07-31 13:24:17 -03:00
Carlos Antonio da Silva
0b859dfefe Do not reassign variable when mutation is happening
These methods mutate the path variable/argument so there is no need
to reassign it every time.
2014-07-31 13:24:17 -03:00
Carlos Antonio da Silva
091a59301f Only concatenate path if it was given rather than converting blindly 2014-07-31 13:24:17 -03:00
Carlos Antonio da Silva
fafff357cc Rename variable to better show its intent 2014-07-31 13:24:17 -03:00
Carlos Antonio da Silva
277247110c Simplify conditional 2014-07-31 13:24:16 -03:00
Carlos Antonio da Silva
8d61463f34 Push options check up so we can simplify internal methods 2014-07-31 13:24:16 -03:00
Carlos Antonio da Silva
dccdee7e2d Simplify code branch, remove #tap 2014-07-31 09:47:46 -03:00
Carlos Antonio da Silva
a9c0eb4392 Avoid a new hash object 2014-07-31 09:43:02 -03:00
Aaron Patterson
3429b0ccba remove useless deup
every call to default_resources_path_names allocates a new hash, no need
to dup
2014-07-30 18:11:24 -07:00
Aaron Patterson
20ec0d2aae push options inside the scope object 2014-07-30 17:20:37 -07:00
Aaron Patterson
dc3f25c8a5 turn scope in to a linked list
this makes scope rollback much easier
2014-07-30 17:19:00 -07:00
Aaron Patterson
68aea29cf5 remove alias_method_chain
we can `super` in to the previous implementation.
2014-07-30 14:53:28 -07:00
Aaron Patterson
09603275e9 avoid instrospection on the module
we already know what helpers are path helpers, so just iterate through
that list and define the helpers with warnings
2014-07-30 14:51:28 -07:00
Aaron Patterson
d9108abcad fix variable name 2014-07-30 14:46:45 -07:00
Aaron Patterson
210b338db2 split path_helpers and url_helpers
this lets us avoid hard coding a regexp for separating path and url
helpers in the clear! method.
2014-07-30 14:46:07 -07:00
Aaron Patterson
cf6658c284 add will remove the method if it exists already 2014-07-30 14:38:50 -07:00
@schneems and @sgrif
2bbcca004c Deprecate *_path methods in mailers
Email does not support relative links since there is no implicit host. Therefore all links inside of emails must be fully qualified URLs. All path helpers are now deprecated. When removed, the error will give early indication to developers to use `*_url` methods instead.

Currently if a developer uses a `*_path` helper, their tests and `mail_view` will not catch the mistake. The only way to see the error is by sending emails in production. Preventing sending out emails with non-working path's is the desired end goal of this PR.

Currently path helpers are mixed-in to controllers (the ActionMailer::Base acts as a controller). All `*_url` and `*_path` helpers are made available through the same module. This PR separates this behavior into two modules so we can extend the `*_path` methods to add a Deprecation to them. Once deprecated we can use this same area to raise a NoMethodError and add an informative message directing the developer to use `*_url` instead.

The module with warnings is only mixed in when a controller returns false from the newly added `supports_relative_path?`.

Paired @sgrif & @schneems
2014-07-30 12:01:45 -05:00
Santiago Pastorino
4efb36e7b4 Revert "Merge pull request #15305 from tgxworld/remove_unnecessary_require"
This reverts commit f632f79b8dcd144408c66a544984b2ba9cf52f87, reversing
changes made to 98c7fe87690ca4de6c46e8f69806e82e3f8af42d.

Closes #16343
2014-07-30 09:46:33 -03:00
Aaron Patterson
d7b726be00 oops! 💣
use helpers.include? so we don't get any false positives
2014-07-29 12:18:21 -07:00
Aaron Patterson
f889831ed6 ask the named routes collection if the route is defined
we should not be accessing internals to figure out if a method is
defined.
2014-07-29 12:15:04 -07:00
Aaron Patterson
0088b08dca helpers should be a Set so it doesn't grow unbounded
since helpers is a set, we can be confident about when to remove methods
from the module.
2014-07-29 11:48:14 -07:00
Aaron Patterson
41931b8af1 pass the module to define_named_route_methods
after this, we can disconnect @module from the instance
2014-07-29 11:32:17 -07:00
Aaron Patterson
a2e926698d only ask for the routes module once
we can cache the module on the stack, then reuse it
2014-07-29 11:28:45 -07:00
Aaron Patterson
d2d3376903 eval_block should be private 2014-07-29 11:07:43 -07:00
Aaron Patterson
9f63a78d55 remove the mounted? method
we know the routes should not be "optimized" when mounting an
application
2014-07-28 14:07:53 -07:00
Aaron Patterson
099fd0efc4 remove some caching
this caching doesn't increase performance, but does increase complexity.
remove it for now and find better ways to speed up this code.
2014-07-28 13:57:05 -07:00
David Albert
dce49f83c8 Fix protect_from_forgery docs 2014-07-27 13:20:58 -04:00
Yves Senn
6d87b78ab3 docs, add ref where to find valid head status symbols.
[ci skip]
2014-07-25 15:31:24 +02:00
Guo Xiang Tan
cc10288e5f Bug fix for assert_template when opening a new session.
See https://github.com/rails/rails/pull/16234#commitcomment-7115670.
2014-07-25 00:38:50 +08:00
Guo Xiang Tan
d14f646997 Fix AC::TemplateAssertions instance variables not resetting.
Fixes https://github.com/rails/rails/issues/16119.
2014-07-21 08:47:26 +08:00
Gaurish Sharma
78788ad723 Performed Returns true if redirect/render has happened 2014-07-19 20:06:59 +05:30
Earl J St Sauver
9ff18e4626
LOCALHOST definition should match any 127.0.0.0/8 address
The entire 127.0.0.0/8 range is assigned to the loopback address, not
only 127.0.0.0/24. This patch allows ActionDispatch::Request::LOCALHOST
to match any IPv4 127.0.0.0/8 loopback address.

The only place that the #local? method was previously under test was
in the show_expectations_test.rb file. I don't particularly like that
that's implicitly where this code is under test, and I feel like I
should move some of that testing code into the
test/dispatch/request_test.rb file, but I wanted some feedback first.

Credit goes to @sriedel for discovering the issue and adding the
patch.
2014-07-18 13:23:45 -04:00
Guo Xiang Tan
ee35b79d4c Prefer to pass block when logging.
The Logger by default includes a guard which checks for the
logging level. By removing the custom logging guards, we can decouple
the logging guard from the logging action to be done.

This also follows the good practice listed on http://guides.rubyonrails.org/debugging_rails_applications.html#impact-of-logs-on-performance.
2014-07-18 15:04:43 +08:00
Aaron Patterson
932386be8a recall should be path_parameters, also make it required
"recall" is a terrible name.  This variable contains the parameters that
we got from the path (e.g. for "/posts/1" it has :controller => "posts",
:id => "1").  Since it contains the parameters we got from the path,
"path_parameters" is a better name.  We always pass path_parameters to
`generate`, so lets make it required.
2014-07-17 11:26:59 -07:00
Aaron Patterson
212057b912 pass the route name to define_url_helper
this allows us to avoid 2 hash allocations per named helper definition,
also we can avoid a `merge` and `delete`.
2014-07-17 11:21:17 -07:00
Aaron Patterson
2888f8653e use a strategy object for generating urls in named helpers
since we know that the route should be a path or fully qualified, we can
pass a strategy object that handles generation.  This allows us to
eliminate an "if only_path" branch when generating urls.
2014-07-17 10:47:58 -07:00
Aaron Patterson
0e26271456 extract path building to a method 2014-07-16 18:15:15 -07:00
Aaron Patterson
69799eda94 break out path building logic to methods 2014-07-16 18:13:22 -07:00
Aaron Patterson
f875331e32 only extract :params from the options hash once 2014-07-16 17:27:03 -07:00
Aaron Patterson
1e930e7a48 we do not need to dup the options hash, it is private and a new object each call 2014-07-16 16:31:07 -07:00
Aaron Patterson
9b15828b5c push rails app testing up
this way we only have to test for whether it is a rails app once.
2014-07-16 16:13:08 -07:00
Aaron Patterson
4a7b95985f Rails-ish apps should descend from Rails::Railtie
Use an is_a check to ensure it's a Railsish app so we can avoid
respond_to calls everywhere.
2014-07-16 15:41:47 -07:00
Aaron Patterson
d66536d7d4 app should always be a class (I suppose) 2014-07-16 15:08:55 -07:00
Aaron Patterson
832d2c40df we should be checking if the app is a class
Hopefully `object.class` always returns something that is_a?(Class), so
the previous logic didn't really make sense.
2014-07-16 14:49:45 -07:00
Aaron Patterson
f636652dd5 extract inner options before delegating to the helper
If we extract the options from the user facing method call ASAP, then we
can simplify internal logic.
2014-07-16 11:55:05 -07:00
Aaron Patterson
90f0cdc906 always transcode the file to utf-8
people may be passing filenames to the constructor that are not utf-8,
but they will assome that calling `original_filename` returns utf-8
(because that's what it used to do).
2014-07-16 11:35:27 -07:00
Santiago Pastorino
341698ed40 Don't accept parameters as argument for redirect to [via @homakov]
Closes #16170
2014-07-16 12:21:51 -03:00
Aaron Patterson
1ae9f056c5 routed applications will respond to these methods 2014-07-15 18:20:45 -07:00
Aaron Patterson
8e105a5538 rack 1.6 encodes the filenames in posts correctly now 2014-07-15 15:31:31 -07:00
Aaron Patterson
0777b17daf RouteSet should be in charge of constructing the dispather
Now we can override how requests are dispatched in the routeset object
2014-07-15 14:53:08 -07:00
Rafael Mendonça França
158a6dfcd2 We don't need loofah for the assertions
We can just use nokogiri
2014-07-15 13:40:21 -03:00
Grey Baker
f49d20ef36 Stash original path in ShowExceptions middleware
`ActionDispatch::ShowExceptions` overwrites `PATH_INFO` with the status code
for the exception defined in `ExceptionWrapper`, so the path the user was
visiting when an exception occurred was not previously available to any custom
exceptions_app.

The original `PATH_INFO` is now stashed in
`env["action_dispatch.original_path"]`.
2014-07-14 11:55:44 +01:00
Agis-
e67f001e7c Use #bytesize instead of #size when checking for cookie overflow
Although the cookie values happens to be ASCII strings because they are
Base64 encoded, it is semantically incorrect to check for the number of the
characters in the cookie, when we actually want to check for the number of the
bytes it consists of.

Furthermore it is unecessary coupling with the current implementation that
uses Base64 for encoding the values.
2014-07-11 13:24:49 +03:00
Godfrey Chan
013c74d645 Removed single space padding from empty response body.
`render nothing: true` or rendering a `nil` body no longer add a single
space to the response body.

The old behavior was added as a workaround for a bug in an early version of
Safari, where the HTTP headers are not returned correctly if the response
body has a 0-length. This is been fixed since and the workaround is no
longer necessary.

Use `render body: ' '` if the old behavior is desired.
2014-07-10 16:33:22 -07:00
Rafael Mendonça França
3229eda00c Merge pull request #11218 from kaspth/loofah-integration
Loofah-integration

Conflicts:
	actionpack/CHANGELOG.md
	actionview/CHANGELOG.md
2014-07-10 16:52:00 -03:00
Aaron Patterson
93fb4c1e62 Merge branch 'rosetta_flash' of https://github.com/gcampbell/rails into gcampbell-rosetta_flash
* 'rosetta_flash' of https://github.com/gcampbell/rails:
  Address CVE-2014-4671 (JSONP Flash exploit)

Conflicts:
	actionpack/CHANGELOG.md
2014-07-10 10:20:16 -07:00
Karl Entwistle
8a29713134 Force encoding of US-ASCII to UTF-8 in unescape_uri.
Because URI paths may contain non US-ASCII characters we need to force
the encoding of any unescaped URIs to UTF-8 if they are US-ASCII.
This essentially replicates the functionality of the monkey patch to
URI.parser.unescape in active_support/core_ext/uri.rb.

Fixes #16104.
2014-07-10 10:02:11 +01:00
Santiago Pastorino
cb377455fe Merge pull request #16091 from tgxworld/reduce_creation_of_subscribers
Reduce number of subscriptions created.
2014-07-09 19:05:13 -03:00
Greg Campbell
4003a5bd76 Address CVE-2014-4671 (JSONP Flash exploit)
Adds a comment before JSONP callbacks. See
http://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/ for more
details on the exploit in question.
2014-07-09 11:37:19 -07:00
Guo Xiang Tan
eeed9d59b2 Fix weird comment. [CI SKIP] 2014-07-09 13:55:42 +08:00
Aaron Patterson
97d62a32f8 Merge pull request #13999 from jamox/update_rack
This updates rails to use edge rack
2014-07-08 11:46:56 -07:00
Guo Xiang Tan
b925074bdd Reduce number of subscriptions created. 2014-07-08 15:25:14 +08:00
Aaron Patterson
1e7f28c985 remove the mounted_helpers respond_to check
It always responds to mounted_helpers now
2014-07-07 10:29:19 -07:00
Aaron Patterson
09eeb3fc04 always test against a routed rack app so there are always url_helpers 2014-07-07 10:22:13 -07:00
Seb Jacobs
e972d34120 Generate shallow paths for all children of shallow resources.
Prior to this commit shallow resources would only generate paths for
non-direct children (with a nested depth greater than 1).

Take the following routes file.

    resources :blogs do
      resources :posts, shallow: true do
        resources :comments do
          resources :tags
        end
      end
    end

This would generate shallow paths for `tags` nested under `posts`,
e.g `/posts/:id/tags/`, however it would not generate shallow paths
for `comments` nested under `posts`, e.g `/posts/:id/comments/new`.

This commit changes the behaviour of the route mapper so that it
generate paths for direct children of shallow resources, for example
if you take the previous routes file, this will now generate
shallow paths for `comments` nested under `posts`, .e.g
`posts/:id/comments/new`.

This was the behaviour in Rails `4.0.4` however this was broken in
@jcoglan's fix for another routes related issue[1].

This also fixes an issue[2] reported by @smdern.

[1] https://github.com/rails/rails/commit/d0e5963
[2] https://github.com/rails/rails/issues/15783
2014-07-06 08:52:32 +01:00
Rafael Mendonça França
540a0ba8e2 Merge pull request #16013 from tgxworld/remove_symbolized_path_parameters
Remove symbolized_path_parameters.
2014-07-04 14:17:34 -03:00
Rafael Mendonça França
2fd8dd7feb Merge pull request #16011 from xjlu/token_and_options
Improve token_and_options regex and test
2014-07-04 14:02:21 -03:00
Akshay Vishnoi
3ac3760c69 [ci skip] /javascript/ -> JavaScript - cover whole app 2014-07-04 03:00:09 +05:30
Guo Xiang Tan
cb5f2d3215 Remove symbolized_path_parameters.
This pull request is a continuation of https://github.com/rails/rails/commit/925bd975 and https://github.com/rails/rails/commit/8d8ebe3d.
2014-07-02 16:05:55 -07:00
Lucas Mazza
b00b638b95 Change the JSON renderer to enforce the 'JS' Content Type
The controller can set the response format as 'JSON' before the renderer code be
evaluated, so we must replace it when necessary.

Fixes #15081
2014-07-02 20:02:00 -03:00
Xinjiang Lu
b39a344426 Improve token_and_options regex and test
add a test case to test the regex for the helper method raw_params
2014-07-01 13:08:22 -07:00
Nishant Modak
59ad995ff9 flash doesn't pass objects #15522 [ci skip] 2014-07-01 23:26:14 +05:30
ShunsukeAida
cac24516b3 makes it sound less misleading 2014-07-02 00:32:23 +09:00
Ciro Santilli
fbb04475eb Fix doc unwanted dl Admin:: [ci skip] 2014-07-01 11:50:51 +02:00
Aaron Patterson
da57d0b2d4 push host / port / protocol extraction up
Then we only need to extract host once.
2014-06-30 15:37:12 -07:00
Rafael Mendonça França
ebdedaec32 Merge pull request #15933 from rafael/master
Add always permitted parameters as a configurable option.

[Rafael Mendonça França + Gary S. Weaver]
2014-06-27 18:16:52 -03:00
Rafael Chacón
58399e1dc3 Improvements per code review.
* General style fixes.
* Add changes to configuration guide.
* Add missing tests.
2014-06-27 13:08:40 -07:00
Rafael Chacón
c197a7dc41 Add always_permitted_parameters as an option.
* This commit adds back the always_permitted_parameters
  configuration option to strong paramaters.
* The initial pull requests where this feature was added
  are the following:
  - https://github.com/rails/rails/pull/12682
  - https://github.com/rails/strong_parameters/pull/174
2014-06-26 23:01:30 -07:00
Amiel Martin
6b0e834a19 Use #model_name on instances instead of classes
This allows rails code to be more confdent when asking for a model name, instead of having to ask for the class.

Rails core discussion here: https://groups.google.com/forum/#!topic/rubyonrails-core/ThSaXw9y1F8
2014-06-24 17:20:24 -07:00
Rafael Mendonça França
5b23e31771 Merge pull request #15836 from DNNX/router-swap-select-sort
Replace x.sort_by!.select! with x.select!.sort_by!
2014-06-24 14:26:29 -03:00
Yves Senn
9ac1ce11ad :nodoc: all does not remove the constants from the API. [ci skip]
Need to add individual `:nodoc:` for nested classes / modules to completely
remove the constants from the API.
2014-06-24 14:16:29 +02:00
Viktar Basharymau
8ee785a17f Replace x.sort_by!.select! with x.select!.sort_by!
The latter has the same speed as the former in the worst case
and faster in general, because it is always better to sort less items.

Unfortunately, `routes.select!{...}.sort_by!{...}` is not possible here
because `select!` returns `nil`, so select! and sort! must be done
in two steps.
2014-06-20 17:16:11 +03:00
Matthew Draper
edc0f27197 Merge pull request #15537 from tgxworld/fix_state_leak
Fix state leak.
2014-06-20 14:53:20 +09:30
Aaron Patterson
ef686a6095 add both branches to the only_path conditional 2014-06-19 14:19:44 -07:00
Viktar Basharymau
453cd7b617 Relpace =~ Regexp.new str with .include? str in AC::Base#_valid_action_name?
Because it is more natural way to test substring inclusion. Also, in
this particular case it is much faster.

In general, using `Regexp.new str` for such kind of things is dangerous.
The string must be escaped, unless you know what you're doing. Example:

    Regexp.new "\\" # HELLO WINDOWS
    # RegexpError: too short escape sequence: /\/

The right way to do this is escape the string

    Regexp.new Regexp.escape "\\"
    # => /\\/

Here is the benchmark showing how faster `include?` call is.

```
require 'benchmark/ips'

Benchmark.ips do |x|
  x.report('include?') { !"index".to_s.include? File::SEPARATOR }
  x.report('   !~   ') { "index" !~ Regexp.new(File::SEPARATOR) }
end

__END__
Calculating -------------------------------------
            include?     75754 i/100ms
               !~        21089 i/100ms
-------------------------------------------------
            include?  3172882.3 (±4.5%) i/s -   15832586 in   5.000659s
               !~      322918.8 (±8.6%) i/s -    1602764 in   4.999509s
```

Extra `.to_s` call is needed to handle the case when `action_name` is
`nil`. If it is omitted, some tests fail.
2014-06-19 18:39:58 +03:00
Aditya Kapoor
7ddaf10fcb [ci skip] /javascript/ ~> JavaScript 2014-06-17 02:07:07 +05:30
Timm
5ffc36d476 Add document_root_element to ActionDispatch::IntegrationTest so assert_select can be called without specifying a root. 2014-06-16 21:04:25 +02:00
Timm
9efdffe437 Moved html_document to ActionDispatch::Assertions. Included the Rails::Dom::Testing::Assertions there as well. 2014-06-16 21:04:20 +02:00
Timm
83f1563ee6 Support for changes in SelectorAssertions. 2014-06-16 21:04:19 +02:00
Timm
6061472b8c Changed deprecation message in dom and selector assertions in Action Dispatch. 2014-06-16 21:04:18 +02:00
Timm
fa916af696 Removed tag.rb, since it is actually removed, not just deprecated. [ci skip] 2014-06-16 21:04:17 +02:00
Timm
a766a025e6 Moved ActionView::Assertions dependency from Action Pack's lib to abstract_unit.rb. 2014-06-16 21:04:16 +02:00
Timm
4e97d7585a Added deprecation warning to ActionDispatch::Assertions::TagAssertions. 2014-06-16 21:04:12 +02:00
Timm
dddf86a3b7 Trimmed deprecation message for ActionDispatch::Assertions::SelectorAssertions. 2014-06-16 21:04:05 +02:00
Timm
748f28157b Require ActionView::Assertions in ActionController test_case.rb. 2014-06-16 21:04:02 +02:00
Timm
95c517b6d6 Moved Dom and Selector assertions from ActionDispatch to ActionView. 2014-06-16 21:04:01 +02:00
Timm
9f73f9f38c Fixed: assert_select_encoded finds the right content. No longer uses a <encoded> wrapper. Updated tests to reflect this. 2014-06-16 21:04:00 +02:00
Timm
1bc0bece5b Removed mention of css_select supporting substitution values. It is not tested anywhere. 2014-06-16 21:04:00 +02:00