Commit Graph

12909 Commits

Author SHA1 Message Date
Jordan Owens
918f0eea97 Prevent attempt to serve a request with a null byte
File paths cannot contain null byte characters and methods that do path
operations such as Rack::Utils#clean_path_info will raise unwanted
errors.
2016-01-12 14:05:54 -05:00
Rashmi Yadav
1b608a695c Update copyright notices to 2016 [ci skip] 2015-12-31 18:27:19 +02:00
Kasper Timm Hansen
4ff5f6a15b Merge pull request #22850 from prathamesh-sonpatki/fix_ac_params_unsafe_h_2
Fix AC::Parameters#to_unsafe_h to return all unfiltered values
2015-12-31 09:04:42 +01:00
Prathamesh Sonpatki
28f648dbc7 Fix AC::Parameters#to_unsafe_h to return all unfiltered values
- AC::Parameters#convert_parameters_to_hashes should return filtered or
  unfiltered values based on whether it is called from `to_h` or `to_unsafe_h`
  instead of always defaulting to `to_h`.
- Fixes #22841
2015-12-31 12:32:29 +05:30
Rafael França
1f85e1c9f3 Merge pull request #22826 from timrogers/actiondispatch-ssl-config
Configurable redirect and secure cookies for ActionDispatch::SSL
2015-12-31 03:25:47 -02:00
Rafaël Blais Masson
040ed26656 Avoid Time.parse for static date
Benchmark.ips do |x|
    x.report('Time.parse') { Time.parse('2011-01-01') }
    x.report('Time.new')   { Time.new(2011, 1, 1) }
  end

  Calculating -------------------------------------
            Time.parse     6.640k i/100ms
              Time.new    15.082k i/100ms
  -------------------------------------------------
            Time.parse     71.915k (± 3.1%) i/s -    365.200k
              Time.new    167.645k (± 3.3%) i/s -    844.592k
2015-12-30 14:36:32 -05:00
Prathamesh Sonpatki
07af4dfd00 Fix test for AC::Parameters#to_unsafe_h
- Test should call `to_unsafe_h` instead of `to_h`
2015-12-30 20:54:46 +05:30
Richard Schneeman
cc5ae3e6df Merge pull request #22830 from jcoyne/parameters_include
Add AC::Parameters#include?
2015-12-29 14:14:51 -06:00
Jorge Bejar
44ca804229 Format from Accept headers have higher precedence than path extension format 2015-12-29 13:43:14 -03:00
Jorge Bejar
9a85da9367 Rely on default Mime format when MimeNegotiation#format_from_path_extension is not a valid type
Closes #22747
2015-12-29 13:42:57 -03:00
Justin Coyne
ff8a62d1d0 Add AC::Parameters#include?
Fixes #22818
2015-12-29 10:11:26 -06:00
Tim Rogers
32b1c90837 Flexible configuration for ActionDispatch::SSL 2015-12-29 13:07:51 +00:00
Tim Rogers
9e0fa4cddd Improve RDoc documentation of ActionDispatch::SSL 2015-12-24 14:11:51 +00:00
Rafael Mendonça França
d182c22e91 Currectly test the Middleware#== 2015-12-22 17:09:26 -02:00
Rafael Mendonça França
d9f4a2839f Merge pull request #22743 from maclover7/fix-22738
Add #== back to ActionDispatch::MiddlewareStack::Middleware
2015-12-22 15:04:53 -02:00
Yves Senn
099082690d release notes, extract notable changes from Action Pack CHANGELOG.
[ci skip]
2015-12-22 12:19:37 +01:00
Jon Moss
0c5287a668 Add #== back to ActionDispatch::MiddlewareStack::Middleware
This was causing bug #22738 to occur. Also added extra tests to make
sure everything is A-OK.
2015-12-21 19:55:10 -05:00
Matthew Draper
b7ac079068 Remember the parameter hash we return
Callers expect to be able to manipulate it.
2015-12-22 05:48:38 +10:30
Genadi Samokovarov
c5b6ec7b0f No more no changes entries in the CHANGELOGs
During the `5.0.0.beta1` release, the CHANGELOGs got an entry like the
following:

```
* No changes.
```

It is kinda confusing as there are indeed changes after it. Not a
biggie, just a small pass over the CHANGELOGs.

[ci skip]
2015-12-21 11:46:38 +02:00
Vijay Dev
b691d62be9 Merge branch 'master' of github.com:rails/docrails 2015-12-20 12:33:46 +00:00
eileencodes
099ddfdefd Add CHANGELOG headers for Rails 5.0.0.beta1 2015-12-18 15:58:25 -05:00
eileencodes
7eae0bb88e Change alpha to beta1 to prep for release of Rails 5
🎉 🍻
2015-12-18 12:14:09 -05:00
Rafael França
027d964d89 Merge pull request #22650 from derekprior/dp-actionpack-warnings
Fix "instance variable not initialized" in tests
2015-12-18 12:49:36 -02:00
Rafael França
b5c13fcdaa Merge pull request #20797 from byroot/prevent-url-for-ac-parameters
Prevent ActionController::Parameters in url_for
2015-12-18 12:47:38 -02:00
David Heinemeier Hansson
ea4f0e2bab Refer to rails command instead of rake in a bunch of places
Still more to do. Please assist!
2015-12-18 13:01:10 +01:00
Derek Prior
31ef17a5eb
Fix "instance variable not initialized" in tests
The ActionPack test suite had a handful of these warnings when run. This
was due to `assert_response` being tested outside the context of a
controller instance where those instance variables would already have
been initialized.
2015-12-17 21:20:25 -05:00
Derek Prior
91e3aa1942
Document when fallback_location is used [ci-skip]
If you're not familiar with how the `Referer` header works, you likely
won't understand why you need to provide a fallback or under what
circumstances it would be used.

Hopefully this clarifies things a bit.
2015-12-17 20:57:42 -05:00
Kasper Timm Hansen
4b46c5ce83 Only dup Ruby's Hash and Array.
When calling `to_h` on an `ActionController::Parameters` instance it would
`deep_dup` its internal parameters.

This inadvertently called `dup` on a passed Active Record model which would
create new models. Fix by only dupping Ruby's Arrays and Hashes.
2015-12-17 21:55:03 +01:00
Derek Prior
dc4429ca3b
Deprecate redirect_to :back
Applications that use `redirect_to :back` can be forced to 500 by
clients that do not send the HTTP `Referer` (sic) header.
`redirect_back` requires the user to consider this possibility up front
and avoids this trivially-caused application error.
2015-12-16 11:42:25 -05:00
Derek Prior
13fd5586ce
Add redirect_back for safer referrer redirects
`redirect_to :back` is a somewhat common pattern in Rails apps, but it
is not completely safe. There are a number of circumstances where HTTP
referrer information is not available on the request. This happens often
with bot traffic and occasionally to user traffic depending on browser
security settings.

When there is no referrer available on the request, `redirect_to :back`
will raise `ActionController::RedirectBackError`, usually resulting in
an application error.

`redirect_back` takes a required `fallback_location` keyword argument
that specifies the redirect when the referrer information is not
available.  This prevents 500 errors caused by
`ActionController::RedirectBackError`.
2015-12-16 11:42:05 -05:00
Rafael França
d953512360 Merge pull request #22605 from tonyta/delete-dead-comments
Delete dead code comments
2015-12-16 14:23:31 -02:00
Rafael França
b7a7e82207 Merge pull request #22598 from yui-knk/deprecate_string_callback
Deprecate passing string to define callback.
2015-12-16 13:54:02 -02:00
yui-knk
21f4017fd9 Deprecate passing string to define callback. 2015-12-16 19:56:20 +09:00
Tony Ta
2eda1a98e0 deletes code commented out in 72160d9f 2015-12-15 22:28:50 -08:00
Sean Griffin
1ad94e760d Merge pull request #14212 from tylerhunt/fix-token-regex
Handle tab in token authentication header.
2015-12-15 10:59:54 -07:00
Rafael Mendonça França
dc3d3fb0b9 Remove warning of shadowing variable 2015-12-15 15:52:57 -02:00
Jean Boussier
4752e7d837 Prevent ActionController::Parameters from being passed to url_for directly 2015-12-15 13:16:54 +01:00
Sam Stephenson
99caf9ae7e Add fragment_cache_key macro for controller-wide fragment cache key prefixes 2015-12-14 19:53:43 -06:00
Sam Stephenson
1a404abc03 Remove ActionView::Helpers::CacheHelper#fragment_cache_key
Introduced in e56c63542780fe2fb804636a875f95cae08ab3f4, `CacheHelper#fragment_cache_key` is a duplicate of `ActionController::Caching::Fragments#fragment_cache_key`.

We now require the view to provide this method on its own (as with `view_cache_dependencies`); `ActionController::Caching::Fragments` exports its version as a `helper_method`.
2015-12-14 17:57:39 -06:00
Sean Griffin
1dc1c8e40b Merge pull request #22564 from maximeg/legit_name_errors
Don't catch all NameError to reraise as ActionController::RoutingError
2015-12-14 10:17:42 -07:00
Prem Sichanugrist
6d4aef984c Make Parameters#to_h and #to_unsafe_h return HWIA
This makes these two methods to be more inline with the previous
behavior of Parameters as Parameters used to be inherited from HWIA.

Fixes #21391
2015-12-14 10:28:54 -05:00
eileencodes
cd355a8eeb Fix spacing on CHANGELOG name
So that it appears correctly in the CHANGELOG on github.
2015-12-12 14:44:59 -05:00
eileencodes
4414c5d179 Remove ActionController::TestCase from documentation
In Rails 5.1 `ActionController::TestCase` will be moved out of Rails
into it's own gem.

Please use `ActionDispatch::IntegrationTest` going foward.

Because this will be moved to a gem I used `# :stopdoc:` instead of
deleting the documentation. This will remove it from the Rails
documentation but still leave the method documented for when we move it
to a gem.

Guides have been updated to use the routing structure used in Integration
and all test examples have been updated to inherit from
`ActionDispatch::IntegrationTest` instead of `ActionController::TestCase.

Fixes #22496
2015-12-12 14:44:50 -05:00
Maxime Garcia
d3dd3847bc Don't catch all NameError to reraise as ActionController::RoutingError #22368 2015-12-12 11:22:08 +01:00
Jon Atack
c6fe614e45 Show redirect response code in assert_response messages
Follow-up to PR #19977, which helpfully added the redirection path to the error message of assert_response if response is a redirection, but which removed the response code, obscuring the type of redirect.

This PR:

- brings back the response code in the error message,

- updates the tests so the new messages can be tested,

- and adds test cases for the change.
2015-12-11 18:18:08 +01:00
Rafael França
b0e5fc2737 Merge pull request #22514 from prathamesh-sonpatki/use-assert-over-assert-predicate
Use assert over assert_predicate in assert_response
2015-12-11 14:11:15 -02:00
Santiago Pastorino
b11bca98bf Merge pull request #20831 from jmbejar/rails-api-json-error-response
Rails API: Ability to return error responses in json format also in development
2015-12-09 15:26:46 -03:00
Jorge Bejar
cdb7a8477f Avoid calling AD::MimeNegotiation#format_from_path_extension method twice 2015-12-09 14:18:13 -03:00
Jorge Bejar
da5acae032 Avoid warning because of the mime type 2015-12-09 10:53:46 -03:00
Jorge Bejar
84e8accd6f Do not add format key to request_params
I did this change but it is affecting how the request params end up
after being processed by the router.

To be in the safe side, I just take the format from the extension in the
URL when is not present in those params and it's being used only for the
`Request#formats` method
2015-12-09 10:53:46 -03:00