- AC::Parameters#convert_parameters_to_hashes should return filtered or
unfiltered values based on whether it is called from `to_h` or `to_unsafe_h`
instead of always defaulting to `to_h`.
- Fixes#22841
The ActionPack test suite had a handful of these warnings when run. This
was due to `assert_response` being tested outside the context of a
controller instance where those instance variables would already have
been initialized.
When calling `to_h` on an `ActionController::Parameters` instance it would
`deep_dup` its internal parameters.
This inadvertently called `dup` on a passed Active Record model which would
create new models. Fix by only dupping Ruby's Arrays and Hashes.
Applications that use `redirect_to :back` can be forced to 500 by
clients that do not send the HTTP `Referer` (sic) header.
`redirect_back` requires the user to consider this possibility up front
and avoids this trivially-caused application error.
`redirect_to :back` is a somewhat common pattern in Rails apps, but it
is not completely safe. There are a number of circumstances where HTTP
referrer information is not available on the request. This happens often
with bot traffic and occasionally to user traffic depending on browser
security settings.
When there is no referrer available on the request, `redirect_to :back`
will raise `ActionController::RedirectBackError`, usually resulting in
an application error.
`redirect_back` takes a required `fallback_location` keyword argument
that specifies the redirect when the referrer information is not
available. This prevents 500 errors caused by
`ActionController::RedirectBackError`.
Follow-up to PR #19977, which helpfully added the redirection path to the error message of assert_response if response is a redirection, but which removed the response code, obscuring the type of redirect.
This PR:
- brings back the response code in the error message,
- updates the tests so the new messages can be tested,
- and adds test cases for the change.
I did this change but it is affecting how the request params end up
after being processed by the router.
To be in the safe side, I just take the format from the extension in the
URL when is not present in those params and it's being used only for the
`Request#formats` method
All of our tests were testing the `ActionController::Live` behavior in a
standalone environment, without going through the router or behaving
like a real application.
This resulted in `ActionController::Live` throwing the exception
`undefined method 'request' for #<ActionDispatch::Request:0x00000003ad1148>`
because `make_response!` was expecting a response instead of a request.
The expectation of a response came from `set_response!` in non-router
tests setting the response and passing it to `make_response!`. In the
case of an application we would hit `serve` in `RouteSet` first which
would send us to `make_response!` with a request sent instead of a
response.
The changes here remove `set_response!` so `make_response!` always
receives a request.
Thanks to KalabiYau for help with the investigation and solution.
Fixes#22524
[Eileen M. Uchitelle & KalabiYau]
Per this comment
https://github.com/rails/rails/pull/18334#issuecomment-69234050 we want
`protect_from_forgery` to default to `prepend: false`.
`protect_from_forgery` will now be insterted into the callback chain at the
point it is called in your application. This is useful for cases where you
want to `protect_from_forgery` after you perform required authentication
callbacks or other callbacks that are required to run after forgery protection.
If you want `protect_from_forgery` callbacks to always run first, regardless of
position they are called in your application, then you can add `prepend: true`
to your `protect_from_forgery` call.
Example:
```ruby
protect_from_forgery prepend: true
```
We want to get rid of the `Live::Response` so we are consolidating methods
from `Live::Response` and `Response` by merging them together.
This adds an `#empty` method to the request so we don't need to
hard-code the empty array each time we call an empty
`ActionDispatch::Request`.
The work here is a continuation on combining controller and integration
test code bases into one.
- `assert_predicate` appends its own error message at the end of message
generated by `assert_response` and because of that the error message
displays the whole `response` object.
- For eg.
Expected response to be a <success>, but was a redirect to <http://test.host/posts>.
Expected #<ActionDispatch::TestResponse:0x007fb1cc1cf6f8....(lambda)>}>> to be successful?.
- Complete message can be found here -
https://gist.github.com/prathamesh-sonpatki/055afb74b66108e71ded#file-gistfile1-txt-L19.
- After this change the message from `assert_predicate` won't be
displayed and only message generated by `assert_response` will be shown
as follows:
Expected response to be a <success>, but was a redirect to <http://test.host/posts>
There were two places where the tld_length default
was hard-coded to 1, both overriding the real default
value of ActionDispatch::Http::URL.tld_length in this
set of tests.
This commit removes both of those, relying on the
actual value of ActionDispatch::Http::URL.tld_length,
unless it's specifically overridden.
- If the assert_response is checking for any non-redirect response like
:success and actual response is :redirect then, the error message displayed
was -
Expected response to be a <success>, but was <302>
- This commit adds the redirect path to the error message of
assert_response if the response is :redirect.
So above message is changed to -
Expected response to be a <success>, but was a redirect to <http://test.host/posts/lol>
