Commit Graph

2135 Commits

Author SHA1 Message Date
Yves Senn
4d7f53379a cleanup, remove trailing whitespace within actionpack 2012-10-27 16:03:18 +02:00
Rafael Mendonça França
0c3ca0f013 Permit string and float values in the multiparameter attributes 2012-10-18 00:31:46 -03:00
dfens
ab9140ff02 Cleanup trailing whitespaces 2012-10-12 09:56:39 +02:00
Santiago Pastorino
bdd105d8b9 When executing permit with just a key that points to a hash, DO NOT allow all the hash
params.require(:person).permit(:projects_attributes) was returning
=> {"projects_attributes"=>{"0"=>{"name"=>"Project 1"}}}

When should return
=> {}

You should be doing ...
params.require(:person).permit(projects_attributes: :name)
to get just the projects attributes you want to allow
2012-10-12 01:01:26 -02:00
Yves Senn
af677da84c can't pass :locals to #assert_template without a view test case. Closes #3415
the documentation on #assert_template states that the :locals option is
only available in view test cases:

    # In a view test case, you can also assert that specific locals are passed
    # to partials:

I added a warning when it's passed in an inapropriate context to prevent
a NoMethodError.
2012-10-06 12:23:02 +02:00
Rafael Mendonça França
62aff55706 Allow parameter filters to match multi-parameter attributes
This will make easier to permit date/time attributes generated by
helpers like date_select.

[Sven Schwyn + Rafael Mendonça França]
2012-10-05 18:25:45 -03:00
Brendan Loudermilk
1aa522dc4e ActionController::Parameters#permit! is recursive 2012-10-04 11:51:08 -07:00
Francesco Rodriguez
e4d5b69b57 rename page_cache_extension option to default_static_extension 2012-10-03 15:35:19 -05:00
Francesco Rodriguez
2f81be178f extract AP Page and Action caching to actionpack-deprecated_caching gem 2012-10-03 11:14:28 -05:00
Steve Klabnik
561edbe71f Failsafe exception returns text/plain.
It's best to just return text/plain when something has gone terribly
wrong.

Fixes #5660.
2012-10-01 21:30:21 -07:00
Hugo Roque
19dff78d02 assert_template no more passing with what ever string that matches.
Given Im rendering an template `/layout/hello.html.erb`, assert_template was
passing with any string that matches. This behavior allowed false passing like:

	assert_template "layout"
	assert_template "out/hello"

Now the passing possibilities are:

	assert_template "layout/hello"
	assert_template "hello"

fixing assert_template bug when template matches expected, but not ends with

Cherry Pick Merge: Fixes issue #3849 assert_template false positive

taking redundant test off

prevening incorrect assert_template when rendering with repeated names in path

updating CHANGELOG with bugfix: assert_template false passing
2012-09-29 23:31:49 -03:00
Francesco Rodriguez
9142da09e5 move metal/caching_test into controller/caching_test 2012-09-27 23:10:53 -05:00
Rafael Mendonça França
610cf9da96 remove method redefinition warnings
actionpack/test/template/spec_type_test.rb:32: warning: method redefined; discarding old test_spec_type_wont_match_non_space_characters
actionpack/test/controller/spec_type_test.rb:30: warning: previous definition of test_spec_type_wont_match_non_space_characters was here
2012-09-27 18:44:25 -03:00
Mike Moore
b2e5db9c71 Allow strings in the controller test describe blocks
Allow controller tests using the spec DSL to match strings.
Add test coverage for the register_spec_type calls.
2012-09-24 14:21:47 -06:00
Mike Moore
fdc11fd01a Support controller tests using spec DSL - fixes #7743
Add tests for controller tests using the minitest spec DSL.
2012-09-24 14:15:21 -06:00
Philip Arndt
45d6944afa Correct parameter access.
* The params as supplied pass born in authors[0] but not authors[1] so it seems like the test isn't covering what it should be covering.
2012-09-19 13:46:01 +12:00
David Heinemeier Hansson
c49d959e9d Merge pull request #7251 from rails/integrate-strong_parameters
Integrate strong_parameters in Rails 4
2012-09-18 12:33:13 -07:00
Yves Senn
370dcd99b7 log 404 status when ActiveRecord::RecordNotFound was raised (#7646) 2012-09-17 18:16:41 +02:00
Guillermo Iguaran
91bcebbdef Support fields_for attributes, which may have numeric symbols as hash keys 2012-09-16 23:58:21 -05:00
Guillermo Iguaran
1aaf4490b2 Add config.action_controller.permit_all_attributes to bypass StrongParameters protection 2012-09-16 23:58:21 -05:00
Guillermo Iguaran
1e1bee3ab9 Change tainted/untainted wording to permitted/forbidden 2012-09-16 23:58:21 -05:00
Guillermo Iguaran
8cfe95d719 Don't use assert_nothing_raised when assert_equal is used 2012-09-16 23:58:21 -05:00
Guillermo Iguaran
b4d9a586bc require abstract_unit in parameters tests 2012-09-16 23:58:20 -05:00
Guillermo Iguaran
8c4de0e67f Remove integration between attr_accessible/protected and AC::Metal::ParamsWrapper 2012-09-16 23:58:20 -05:00
Guillermo Iguaran
885005461b Integrate ActionController::Parameters from StrongParameters gem 2012-09-16 23:58:19 -05:00
Michael Koziarski
bb732beba7 Merge pull request #7616 from lest/null-session-forgery-protection
Implement :null_session CSRF protection method
2012-09-13 20:44:45 -07:00
Sergey Nartimov
95be790ece Implement :null_session CSRF protection method
It's further work on CSRF after 245941101b1ea00a9b1af613c20b0ee994a43946.

The :null_session CSRF protection method provide an empty session during
request processing but doesn't reset it completely (as :reset_session
does).
2012-09-13 12:07:37 +03:00
Rafael Mendonça França
d0c25f253f Define a SynchronousQueue for test in Action Pack.
We don't need to rely on rails/queueing in Action Pack tests
2012-09-12 15:33:42 -03:00
Bogdan Gusiev
6777f7b75d AS::Callbacks: deprecate monkey patch of object callbacks 2012-09-07 14:42:31 +03:00
David Heinemeier Hansson
ed5c938fa3 Added controller-level etag additions that will be part of the action etag computation *Jeremy Kemper/DHH* 2012-08-29 15:06:30 -05:00
David Heinemeier Hansson
502d5e24e2 Add automatic template digests to all CacheHelper#cache calls (originally spiked in the cache_digests plugin) *DHH* 2012-08-29 14:23:56 -05:00
schneems
0b6175ac2d Add Missing Keys from Journey on failed URL format
Many named routes have keys that are required to successfully resolve. If a key is left off like this:

    <%= link_to 'user', user_path %>

This will produce an error like this:

    No route matches {:action=>"show", :controller=>"users"}

Since we know that the :id is missing, we can add extra debugging information to the error message.

    No route matches {:action=>"show", :controller=>"users"} missing required keys: [:id]


This will help new and seasoned developers look closer at their parameters. I've also subclassed the routing error to be clear that this error is a result of attempting to generate a url and not because the user is trying to visit a bad url. 

While this may sound trivial this error message is misleading and confuses most developers. The important part isn't what's in the options its's what's missing. Adding this information to the error message will make debugging much more obvious. 

This is the sister pull request of https://github.com/rails/journey/pull/44 which will be required to get they missing keys into the correct error message. 

Example Development Error in Rails: http://cl.ly/image/3S0T0n1T3421
2012-08-28 08:53:45 -07:00
Piotr Sarnacki
e1ffd82e76 Deprecate AV::RecordIdentifier in controllers
Methods provided by RecordIdentifier are not widely used in controllers
nowadays as they're view specific (this is probably a legacy left after
RJS rendering directly in controllers). However if people still need to
use it, it's trivial to include ActionView::RecordIdentifier by
themselves.
2012-08-28 11:19:37 +02:00
Piotr Sarnacki
9b0ac0bc74 Use ActionView::Base.logger instead of AC::Base.logger 2012-08-28 10:51:05 +02:00
Piotr Sarnacki
ba83aa7f03 Move action_controller/vendor/html-scanner to action_view
This is another step in moving Action View's dependencies in Action Pack
to Action View itself. Also, HtmlScanner seems to be better suited for
views rather than controllers.
2012-08-28 10:51:03 +02:00
Piotr Sarnacki
264624049e Move ActionController::RecordIdentifier to ActionView
Since it's more about DOM classes and ids it belongs to Action View
better. What's more, it's more convenient to make it part of Action View
to follow the rule that Action Pack can depend on Action View, but not
the other way round.
2012-08-28 10:51:03 +02:00
tomykaira
503c1c04ad Access @rs only through attr_accessor 2012-08-20 21:47:00 +09:00
Rafael Mendonça França
546497d027 Extract common controllers to abstract_unit 2012-08-13 21:43:18 -03:00
Aaron Patterson
581a927710 set the controller under test so we no longer need the reset! method 2012-08-09 18:06:13 -07:00
Xavier Noria
447b6a4e67 removes usage of Object#in? from the code base (the method remains defined by Active Support)
Selecting which key extensions to include in active_support/rails
made apparent the systematic usage of Object#in? in the code base.
After some discussion in

    5ea6b0df9a

we decided to remove it and use plain Ruby, which seems enough
for this particular idiom.

In this commit the refactor has been made case by case. Sometimes
include? is the natural alternative, others a simple || is the
way you actually spell the condition in your head, others a case
statement seems more appropriate. I have chosen the one I liked
the most in each case.
2012-08-06 00:30:02 +02:00
Aaron Patterson
c391919180 make sure the body finishes rendering before checking response closure 2012-08-03 00:27:39 -04:00
Armand du Plessis
c62abed8ca Collapsed dual checks (one for content headers and one for content) into a single check.
Rails includes a single character body to a head(:no_content) response to work around an old Safari bug where headers were ignored if no body sent.

This patch brings the behavior slightly closer to spec if :no_content/204 is explicity requested via a head only response.

Status comparison done on symbolic and numeric values

Not returning any content when responding with head and limited to a status code that explicitly states no content will be returned - 100..199, 204, 205, 304.
2012-08-02 16:01:08 -07:00
Rafael Mendonça França
6e523766d8 Merge pull request #7240 from steveklabnik/fix_2301
Fix for digest authentication bug - issue #2301 in rails/rails
2012-08-02 13:50:54 -07:00
Xavier Noria
5ea6b0df9a load active_support/core_ext/object/inclusion in active_support/rails 2012-08-02 21:59:22 +02:00
Arthur Smith
b3e2abc4b1 Fix for digest authentication bug - issue #2301 in rails/rails 2012-08-02 15:24:08 -04:00
Santiago Pastorino
b6ab441772 html_escape should escape single quotes
https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet#RULE_.231_-_HTML_Escape_Before_Inserting_Untrusted_Data_into_HTML_Element_Content
Closes #7215
2012-07-31 22:26:52 -03:00
Aaron Patterson
fa3c4ea6d0 close the response when the response body is set so that normal render calls will work 2012-07-29 21:43:07 -07:00
Aaron Patterson
4509494f70 header hash is duped before being sent up the rack stack 2012-07-29 21:43:07 -07:00
Aaron Patterson
619e7c8db8 make sure set_response! sets the correct response object 2012-07-29 21:43:06 -07:00
Aaron Patterson
38cfbb8aa7 Controller actions are processed in a separate thread for live
responses.

Processing controller actions in a separate thread allows us to work
around the rack api - we can allow the user to set status and headers,
then block until the first bytes are written.  As soon as the first
bytes are written, the main thread can return the status, headers, and
(essentially) a queue for the body.
2012-07-29 21:43:05 -07:00