Commit Graph

403 Commits

Author SHA1 Message Date
Xavier Noria
92f9ff8cc3 converts hashes in arrays of unfiltered params to unpermitted params [fixes #13382] 2013-12-21 01:16:38 +01:00
Jeremy Kemper
c437a98aca Merge pull request #13188 from imanel/skip_deep_munge
Add configuration option to optionally disable deep_munge

Conflicts:
	actionpack/CHANGELOG.md
2013-12-19 23:39:17 -07:00
Ryunosuke SATO
d54bc032c9 Show routes defined under assets prefix
Closes #9625
2013-12-19 09:51:17 -02:00
Jeremy Kemper
1650bb3d56 CSRF protection from cross-origin <script> tags
Thanks to @homakov for sounding the alarm about JSONP-style data leaking
2013-12-17 13:14:17 -07:00
Rafael Mendonça França
1454f2c20a Merge pull request #13290 from strzalek/inline-syntax-docs
Variants inline syntax documentation
2013-12-12 07:59:17 -08:00
Łukasz Strzałkowski
3ce9563d42 Variants inline syntax documentation [ci skip]
* Extend method documentation
  * Mention it in actionpack/CHANGELOG
  * Update release notes
2013-12-12 13:20:45 +01:00
Carlos Antonio da Silva
fe24f3560a Changelog improvements [ci skip] 2013-12-12 08:33:46 -02:00
Trent Ogren
96a6703ed9 Update CHANGELOG entry for Session#fetch
This reverts the changes to CHANGELOG.md in commit
38f8872aa5fd8f0a1d0895e9eb41f73261acd040.
2013-12-11 19:26:45 -06:00
Piotr Sarnacki
e6c602da90 Fix mounting engines inside a resources block
When a route is mounted inside a resources block, it's automatically
prefixed, so a following code:

    resources :users do
      mount Blog::Engine => '/blog'
    end

will generate a user_blog path helper.

In order to access engine helpers, we also use "mounted_helpers", a list
of helpers associated with each mounted engine, so a path to blog's post
can be generated using user_blog.post_path(user, post).

The problem I'm fixing here is that mount used a raw :as option, without
taking nestings into account. As a result, blog was added to a route set
as a `user_blog`, but helper was generated for just `blog`.

This commit applies the proper logic for defining a helper for a mounted
engine nested in resources or resource block.

(closes #8533)
2013-12-10 21:38:41 +01:00
David Heinemeier Hansson
13dd38cee7 Add Mime::Type.register "text/vcard", :vcf to the default list of mime types 2013-12-05 15:49:06 -08:00
Bernard Potocki
e8572cf2f9 Add configuration option to optionally disable deep_munge 2013-12-05 12:08:34 +01:00
Yves Senn
d71c1fc6a7 add missing CHANGELOG entry for d8c6f52. [ci skip]
Discoverd by #13175.
2013-12-05 11:41:12 +01:00
Shota Fukumori (sora_h)
c1d5477b63 Escalate missing error when :raise is true
Before ec16ba75a5493b9da972eea08bae630eba35b62f,
ActionView::Helpers::TranslationHelper#translate has raised errors with
specifying options[:raise] to true.

This should work by this fix:

     begin
       t(:"translations.missing", raise: true)
     rescue I18n::MissingTranslationData
       p :hello!
     end
2013-12-05 09:20:58 +09:00
Rafael Mendonça França
2d061c2c4f Update changelog [ci skip] 2013-12-04 17:48:32 -02:00
Łukasz Strzałkowski
2d3a6a0cb8 Action Pack Variants
By default, variants in the templates will be picked up if a variant is set
and there's a match. The format will be:

  app/views/projects/show.html.erb
  app/views/projects/show.html+tablet.erb
  app/views/projects/show.html+phone.erb

If request.variant = :tablet is set, we'll automatically be rendering the
html+tablet template.

In the controller, we can also tailer to the variants with this syntax:

  class ProjectsController < ActionController::Base
    def show
      respond_to do |format|
        format.html do |html|
          @stars = @project.stars

          html.tablet { @notifications = @project.notifications }
          html.phone  { @chat_heads    = @project.chat_heads }
        end

        format.js
        format.atom
      end
    end
  end

The variant itself is nil by default, but can be set in before filters, like
so:

  class ApplicationController < ActionController::Base
    before_action do
      if request.user_agent =~ /iPad/
        request.variant = :tablet
      end
    end
  end

This is modeled loosely on custom mime types, but it's specifically not
intended to be used together. If you're going to make a custom mime type,
you don't need a variant. Variants are for variations on a single mime
types.
2013-12-04 00:13:16 +01:00
Carlos Antonio da Silva
7c20a8b558 Changelog improvements [ci skip] 2013-12-03 14:38:12 -02:00
Guillermo Iguaran
9ed3aab692 Merge branch 'format_localized_template' of https://github.com/acapilleri/rails
Conflicts:
	actionpack/CHANGELOG.md
2013-12-03 02:34:11 -05:00
Angelo capilleri
43962d6ec5 Fix header Content-Type: #<Mime::NullType:...> in localized template
This PR fixes #13064 regression bug introduced by the #8085

Now in _process_format when the format is a Mime::NullType nothing is written in self.content_type.
In this way the method Response#assign_default_content_type_and_charset can
write the the default mime_type.
2013-12-03 07:46:39 +01:00
Andrew White
d2e1caaab9 Try to escape each part of a path redirect route correctly
A path redirect may contain any and all parts of a url which have different
escaping rules for each part. This commit tries to escape each part correctly
by splitting the string into three chunks - path (which may also include a host),
query and fragment; then it applies the correct escape pattern to each part.

Whilst using `URI.parse` would be better, unfortunately the possible presence
of %{name} parameters in the path redirect string prevents us from using it so
we have to use a regular expression instead.

Fixes #13110.
2013-12-02 05:16:05 +00:00
Yves Senn
7c6d99e81e first pass through CHANGELOGS to extract 4_1_release_notes. [ci skip]
Extract **notable changes**, **deprecations** and **removals** from
each CHANGELOG.

I tried to reference the commits and pull requests for new features
and deprecations.

In the process I also made some minor changes to the CHANGELOGS.

The 4_1_release_notes guide is declared WIP.
2013-11-28 17:24:15 +01:00
Victor Costan
c759a93454 Better error message for typos in assert_response argument.
This commit makes it really easy to debug errors due to typos like
"assert_response :succezz".
2013-11-25 03:09:02 -05:00
Carlos Antonio da Silva
18964368f3 Improve changelogs
Also make Action Mailer changelog format more consistent with the
others [ci skip]
2013-11-22 08:30:04 -02:00
Yves Senn
f71cbb81ff unify punctuation in Action Pack changelog. [ci skip] 2013-11-21 18:10:38 +01:00
Sıtkı Bağdat
6701b4cf41 Fix for routes task
This commit fixes formatting issue for `rake routes` task, when a section is shorter than a header.
2013-11-21 18:35:58 +02:00
chocoby
04907b64ac Fix CHANGELOG typo [ci skip] 2013-11-15 22:22:49 +09:00
Andrey Ognevsky
d04c4fac3b Take Hash with options inside Array in #url_for 2013-11-15 15:50:42 +04:00
Damien Mathieu
38f8872aa5 session#fetch doesn't behave exactly like Hash#fetch.
Mention it in the changelog and add a test checking for regressions.

Hash#fetch isn't adding the defaultly returned value.
However, in the session, saving it is the behavior we should expect.

See discussion in #12692
2013-10-30 15:04:22 +01:00
Damien Mathieu
84c9f4164b add the fetch method to sessions 2013-10-29 20:37:15 +01:00
Robin Dupret
cbb32ec244 Add a changelog entry for #12656 [ci skip] 2013-10-27 16:03:38 +01:00
Rafael Mendonça França
6c570648ad Merge pull request #10471 from andyw8/button_to_params
Add params option for button_to

Conflicts:
	actionpack/CHANGELOG.md
2013-10-24 18:02:19 -02:00
Rafael Mendonça França
6ac677fd87 Improve the CHANGELOG entry [ci skip] 2013-10-24 14:43:07 -02:00
Tima Maslyuchenko
1ea072f88c update CHANGELOG 2013-10-24 10:46:57 +03:00
Andrew White
9dbd208562 Respect SCRIPT_NAME when using redirect with a relative path
Example:
    # application routes.rb
    mount BlogEngine => '/blog'

    # engine routes.rb
    get '/admin' => redirect('admin/dashboard')

This now redirects to the path `/blog/admin/dashboard`, whereas before it
would've generated an invalid url because there would be no slash between
the host name and the path. It also allows redirects to work where the
application is deployed to a subdirectory of a website.

Fixes #7977
2013-10-10 13:03:26 +01:00
Yves Senn
2b21bddc9e add dots after Fixes #YYYYY in actionpack CHANGELOG. [ci skip] 2013-10-09 11:49:12 +02:00
BlueHotDog
8642c2aadc Fixing repond_with working directly on the options hash
This fixes an issue where the respond_with worked directly with the given
options hash, so that if a user relied on it after calling respond_with,
the hash wouldn't be the same.

Fixes #12029
2013-10-09 12:36:26 +03:00
Andrew White
28b4ffc379 Add changlog entry for #10844 2013-09-30 12:51:37 +01:00
kennyj
277918e61a Strong parameters should permit nested number as key. Closes #12293 2013-09-27 03:53:45 +09:00
Derek Prior
a78c10d3c7 Fix regex used to find URI schemes in redirect_to
The previous regex was allowing `_` in the URI scheme, which is not
allowed by RFC 3986. This change brings the regex in line with the RFC.
2013-09-19 09:23:20 -04:00
Derek Prior
1dacfbabf3 Fix incorrect assert_redirected_to failure message
In some instances, `assert_redirected_to` assertion was returning an
incorrect and misleading failure message when the assertion failed.
This was due to a disconnect in how the assertion computes the redirect
string for the failure message and how `redirect_to` computes the
string that is actually used for redirection.

I made the `_compute_redirect_to_loaction` method used by `redirect_to`
public and call that from the method `assert_redirect_to` uses to
calculate the URL.

The reveals a new test failure due to the regex used by
`_compute_redirect_to_location` allow `_` in the URL scheme.
2013-09-19 09:23:20 -04:00
Andy Waite
e6e0579def Add params option for button_to
The parameters are rendered as hidden form fields within the generated
form. This is useful for when a record has multiple buttons associated
with it, each of which target the same controller method, but which
need to submit different attributes.
2013-09-18 19:56:46 +01:00
kennyj
0cc6508120 Fix an issue where router can't recognize downcased url encoding path. 2013-09-19 02:43:22 +09:00
Ricardo de Cillo
1413ee991c Custom flash should be defined only for the class that defines it and it's subclasses. 2013-09-13 10:19:29 -03:00
Rafael Mendonça França
b262248997 Add CHANGELOG entry for #12149
[ci skip]
2013-09-12 19:22:06 -03:00
José Valim
a41669563b Remove BasicRendering and remove template functionality from AbsC::Rendering 2013-09-09 12:33:53 -03:00
Carlos Antonio da Silva
701664b56b Improve AP changelog regarding AV extraction [ci skip] 2013-08-26 23:46:28 -03:00
Łukasz Strzałkowski
44bc45b014 Update AP changelog 2013-08-25 11:40:10 +02:00
Kir Shatrov
a725a453b3 Display exceptions in text format for xhr request 2013-08-22 22:20:34 +04:00
Nicholas Jakobsen
55cbb85fb7 Execute conditional procs on controller filters only for current action.
:only and :except options for controller filters are now added before
:if and :unless. This prevents running :if and :unless procs when not
on the specified. Closes #11786.
2013-08-10 09:13:20 -07:00
Ryan McGeary
51520a75d5 Pass assert_dom_equal message arg to underlying assertion
#assert_dom_equal and #assert_dom_not_equal both take a "failure"
message argument, but this argument was not utilized.
2013-08-04 11:18:46 -04:00
Andrew White
4db0637d55 Allow overriding of all headers from passed environment hash
Allow REMOTE_ADDR, HTTP_HOST and HTTP_USER_AGENT to be overridden from
the environment passed into `ActionDispatch::TestRequest.new`.

Fixes #11590
2013-07-25 07:54:57 +01:00