Commit Graph

11378 Commits

Author SHA1 Message Date
Rafael Mendonça França
6947e3a2b5 Remove unused fixtures
These fixtures are not used in actionpack tests.
2014-07-16 14:48:45 -03:00
Santiago Pastorino
341698ed40 Don't accept parameters as argument for redirect to [via @homakov]
Closes #16170
2014-07-16 12:21:51 -03:00
Aaron Patterson
7880f39e1d Fix 1.9. uggghhhhhh get it together @tenderlove 💣 2014-07-15 18:43:47 -07:00
Aaron Patterson
993ca82d70 fix for 1.9 kwargs syntax 2014-07-15 18:20:50 -07:00
Aaron Patterson
1ae9f056c5 routed applications will respond to these methods 2014-07-15 18:20:45 -07:00
Aaron Patterson
f3c1832ad4 stop passing recall to url_for 2014-07-15 15:53:00 -07:00
Aaron Patterson
8e105a5538 rack 1.6 encodes the filenames in posts correctly now 2014-07-15 15:31:31 -07:00
Aaron Patterson
3ef98a1439 fix warnings 2014-07-15 15:24:23 -07:00
Aaron Patterson
8eb7bcb6e5 stop calling url_for with recall parameters and actually use a request 2014-07-15 15:19:41 -07:00
Aaron Patterson
a3ca700c58 execute a request and check the path_parameters
This actually runs a request through the system, using the actual
routing methods as we would use in production, then tests the
path_parameters set on the request object.  The `recognize_path` method
isn't actually used in production, so testing what it returns isn't
useful.
2014-07-15 14:56:17 -07:00
Aaron Patterson
ab1e3228f8 set set in the setup method 2014-07-15 14:54:02 -07:00
Aaron Patterson
07f7f3a67c remove useless ivar set 2014-07-15 14:53:51 -07:00
Aaron Patterson
0777b17daf RouteSet should be in charge of constructing the dispather
Now we can override how requests are dispatched in the routeset object
2014-07-15 14:53:08 -07:00
Matthew Draper
7b52a26bc4 Merge pull request #16168 from greysteil/stash-path-info
Stash original path in `ShowExceptions` middleware
2014-07-14 23:33:48 +09:30
Grey Baker
f49d20ef36 Stash original path in ShowExceptions middleware
`ActionDispatch::ShowExceptions` overwrites `PATH_INFO` with the status code
for the exception defined in `ExceptionWrapper`, so the path the user was
visiting when an exception occurred was not previously available to any custom
exceptions_app.

The original `PATH_INFO` is now stashed in
`env["action_dispatch.original_path"]`.
2014-07-14 11:55:44 +01:00
Santosh Wadghule
dfee0327b5 Fix typos like a html to an html and 'an mail' to 'an email'. [ci skip] 2014-07-14 00:14:47 +05:30
Agis-
e67f001e7c Use #bytesize instead of #size when checking for cookie overflow
Although the cookie values happens to be ASCII strings because they are
Base64 encoded, it is semantically incorrect to check for the number of the
characters in the cookie, when we actually want to check for the number of the
bytes it consists of.

Furthermore it is unecessary coupling with the current implementation that
uses Base64 for encoding the values.
2014-07-11 13:24:49 +03:00
Godfrey Chan
00aae7cb38 Synced 4.2 release notes with the latest commits.
Also reordered some of the items to put newer ones on top (same order as
CHANGELOGs), which makes it easier to diff while we are still working on it.
2014-07-11 02:16:57 -07:00
Godfrey Chan
013c74d645 Removed single space padding from empty response body.
`render nothing: true` or rendering a `nil` body no longer add a single
space to the response body.

The old behavior was added as a workaround for a bug in an early version of
Safari, where the HTTP headers are not returned correctly if the response
body has a 0-length. This is been fixed since and the workaround is no
longer necessary.

Use `render body: ' '` if the old behavior is desired.
2014-07-10 16:33:22 -07:00
Aaron Patterson
93fb4c1e62 Merge branch 'rosetta_flash' of https://github.com/gcampbell/rails into gcampbell-rosetta_flash
* 'rosetta_flash' of https://github.com/gcampbell/rails:
  Address CVE-2014-4671 (JSONP Flash exploit)

Conflicts:
	actionpack/CHANGELOG.md
2014-07-10 10:20:16 -07:00
Karl Entwistle
8a29713134 Force encoding of US-ASCII to UTF-8 in unescape_uri.
Because URI paths may contain non US-ASCII characters we need to force
the encoding of any unescaped URIs to UTF-8 if they are US-ASCII.
This essentially replicates the functionality of the monkey patch to
URI.parser.unescape in active_support/core_ext/uri.rb.

Fixes #16104.
2014-07-10 10:02:11 +01:00
Santiago Pastorino
cb377455fe Merge pull request #16091 from tgxworld/reduce_creation_of_subscribers
Reduce number of subscriptions created.
2014-07-09 19:05:13 -03:00
Greg Campbell
4003a5bd76 Address CVE-2014-4671 (JSONP Flash exploit)
Adds a comment before JSONP callbacks. See
http://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/ for more
details on the exploit in question.
2014-07-09 11:37:19 -07:00
Guo Xiang Tan
eeed9d59b2 Fix weird comment. [CI SKIP] 2014-07-09 13:55:42 +08:00
Aaron Patterson
97d62a32f8 Merge pull request #13999 from jamox/update_rack
This updates rails to use edge rack
2014-07-08 11:46:56 -07:00
Guo Xiang Tan
b925074bdd Reduce number of subscriptions created. 2014-07-08 15:25:14 +08:00
Aaron Patterson
1e7f28c985 remove the mounted_helpers respond_to check
It always responds to mounted_helpers now
2014-07-07 10:29:19 -07:00
Aaron Patterson
09eeb3fc04 always test against a routed rack app so there are always url_helpers 2014-07-07 10:22:13 -07:00
Seb Jacobs
e972d34120 Generate shallow paths for all children of shallow resources.
Prior to this commit shallow resources would only generate paths for
non-direct children (with a nested depth greater than 1).

Take the following routes file.

    resources :blogs do
      resources :posts, shallow: true do
        resources :comments do
          resources :tags
        end
      end
    end

This would generate shallow paths for `tags` nested under `posts`,
e.g `/posts/:id/tags/`, however it would not generate shallow paths
for `comments` nested under `posts`, e.g `/posts/:id/comments/new`.

This commit changes the behaviour of the route mapper so that it
generate paths for direct children of shallow resources, for example
if you take the previous routes file, this will now generate
shallow paths for `comments` nested under `posts`, .e.g
`posts/:id/comments/new`.

This was the behaviour in Rails `4.0.4` however this was broken in
@jcoglan's fix for another routes related issue[1].

This also fixes an issue[2] reported by @smdern.

[1] https://github.com/rails/rails/commit/d0e5963
[2] https://github.com/rails/rails/issues/15783
2014-07-06 08:52:32 +01:00
Rafael Mendonça França
540a0ba8e2 Merge pull request #16013 from tgxworld/remove_symbolized_path_parameters
Remove symbolized_path_parameters.
2014-07-04 14:17:34 -03:00
Rafael Mendonça França
2fd8dd7feb Merge pull request #16011 from xjlu/token_and_options
Improve token_and_options regex and test
2014-07-04 14:02:21 -03:00
Akshay Vishnoi
3ac3760c69 [ci skip] /javascript/ -> JavaScript - cover whole app 2014-07-04 03:00:09 +05:30
Guo Xiang Tan
cb5f2d3215 Remove symbolized_path_parameters.
This pull request is a continuation of https://github.com/rails/rails/commit/925bd975 and https://github.com/rails/rails/commit/8d8ebe3d.
2014-07-02 16:05:55 -07:00
Lucas Mazza
b00b638b95 Change the JSON renderer to enforce the 'JS' Content Type
The controller can set the response format as 'JSON' before the renderer code be
evaluated, so we must replace it when necessary.

Fixes #15081
2014-07-02 20:02:00 -03:00
Rafael Mendonça França
f838caf350 Fix typo 2014-07-02 12:10:58 -03:00
Xinjiang Lu
b39a344426 Improve token_and_options regex and test
add a test case to test the regex for the helper method raw_params
2014-07-01 13:08:22 -07:00
Nishant Modak
59ad995ff9 flash doesn't pass objects #15522 [ci skip] 2014-07-01 23:26:14 +05:30
ShunsukeAida
cac24516b3 makes it sound less misleading 2014-07-02 00:32:23 +09:00
Ciro Santilli
fbb04475eb Fix doc unwanted dl Admin:: [ci skip] 2014-07-01 11:50:51 +02:00
Aaron Patterson
da57d0b2d4 push host / port / protocol extraction up
Then we only need to extract host once.
2014-06-30 15:37:12 -07:00
Rafael Mendonça França
ebdedaec32 Merge pull request #15933 from rafael/master
Add always permitted parameters as a configurable option.

[Rafael Mendonça França + Gary S. Weaver]
2014-06-27 18:16:52 -03:00
Rafael Chacón
58399e1dc3 Improvements per code review.
* General style fixes.
* Add changes to configuration guide.
* Add missing tests.
2014-06-27 13:08:40 -07:00
Rafael Chacón
c197a7dc41 Add always_permitted_parameters as an option.
* This commit adds back the always_permitted_parameters
  configuration option to strong paramaters.
* The initial pull requests where this feature was added
  are the following:
  - https://github.com/rails/rails/pull/12682
  - https://github.com/rails/strong_parameters/pull/174
2014-06-26 23:01:30 -07:00
Rafael Mendonça França
5b23e31771 Merge pull request #15836 from DNNX/router-swap-select-sort
Replace x.sort_by!.select! with x.select!.sort_by!
2014-06-24 14:26:29 -03:00
Yves Senn
9ac1ce11ad :nodoc: all does not remove the constants from the API. [ci skip]
Need to add individual `:nodoc:` for nested classes / modules to completely
remove the constants from the API.
2014-06-24 14:16:29 +02:00
Viktar Basharymau
8ee785a17f Replace x.sort_by!.select! with x.select!.sort_by!
The latter has the same speed as the former in the worst case
and faster in general, because it is always better to sort less items.

Unfortunately, `routes.select!{...}.sort_by!{...}` is not possible here
because `select!` returns `nil`, so select! and sort! must be done
in two steps.
2014-06-20 17:16:11 +03:00
Matthew Draper
edc0f27197 Merge pull request #15537 from tgxworld/fix_state_leak
Fix state leak.
2014-06-20 14:53:20 +09:30
Aaron Patterson
ef686a6095 add both branches to the only_path conditional 2014-06-19 14:19:44 -07:00
Viktar Basharymau
453cd7b617 Relpace =~ Regexp.new str with .include? str in AC::Base#_valid_action_name?
Because it is more natural way to test substring inclusion. Also, in
this particular case it is much faster.

In general, using `Regexp.new str` for such kind of things is dangerous.
The string must be escaped, unless you know what you're doing. Example:

    Regexp.new "\\" # HELLO WINDOWS
    # RegexpError: too short escape sequence: /\/

The right way to do this is escape the string

    Regexp.new Regexp.escape "\\"
    # => /\\/

Here is the benchmark showing how faster `include?` call is.

```
require 'benchmark/ips'

Benchmark.ips do |x|
  x.report('include?') { !"index".to_s.include? File::SEPARATOR }
  x.report('   !~   ') { "index" !~ Regexp.new(File::SEPARATOR) }
end

__END__
Calculating -------------------------------------
            include?     75754 i/100ms
               !~        21089 i/100ms
-------------------------------------------------
            include?  3172882.3 (±4.5%) i/s -   15832586 in   5.000659s
               !~      322918.8 (±8.6%) i/s -    1602764 in   4.999509s
```

Extra `.to_s` call is needed to handle the case when `action_name` is
`nil`. If it is omitted, some tests fail.
2014-06-19 18:39:58 +03:00
Aditya Kapoor
7ddaf10fcb [ci skip] /javascript/ ~> JavaScript 2014-06-17 02:07:07 +05:30