Commit Graph

10770 Commits

Author SHA1 Message Date
Guillermo Iguaran
65d743904c Merge pull request #24701 from prathamesh-sonpatki/deprecate-request_via_redirect
Deprecate `request_via_redirect` method.
2016-04-24 00:04:26 -05:00
Prathamesh Sonpatki
3da0a2b065
Deprecate request_via_redirect method.
- Followup of https://github.com/rails/rails/issues/18693.
- I think we missed deprecating `request_via_redirect` in that pull
  request.
- Originally requested by DHH here
  https://github.com/rails/rails/issues/18333.
2016-04-24 07:18:11 +05:30
Vipul A M
1ffa1a852e Merge pull request #24697 from tomkadwill/action_pack_typos_2
Actionpack documentation typos [ci skip]
2016-04-23 19:03:28 +05:30
Tom Kadwill
51a2f7bb67 Actionpack documentation typos [ci skip] 2016-04-23 14:24:10 +01:00
Vipul A M
f0a2edc7fc Merge pull request #24669 from tomkadwill/action_pack_typos
Actioncable and Actionpack documentation typos [ci skip]
2016-04-22 02:07:29 +05:30
Tom Kadwill
5646895b7f Actioncable and Actionpack documentation typos [ci skip] 2016-04-21 21:32:06 +01:00
Jon Moss
7bd2f91773 Fix ApplicationController.renderer.defaults.merge!
Previously, users were trying to modify a frozen Hash. Includes a
regression test :)

Fixes #22975
2016-04-20 19:47:16 -04:00
Jeremy Daer
ee25e1992c
Merge pull request #24031 from samphilipd/sam/do_not_clobber_options_in_route_definitions
Do not destructively mutate passed options hash in route definitions
2016-04-19 15:01:28 -07:00
Anton Rieder
46d31a1453 Update send_data documentation [ci skip]
Add missing period after sentence.
2016-04-19 17:02:46 +02:00
Sean Griffin
94a1edbc02 Filter scalar values when params permit hashes or arrays
This brings the behavior more inline with other similar cases, such as
receiving a hash when an array of scalars was expected. Prior to this
commit, the key would be present, but the value would be `nil`
2016-04-15 09:09:50 -06:00
Rafael Mendonça França
0c21fb361c Merge pull request #24318 from bogdanvlviv/patch-1
extension synonyms yml and yaml
2016-04-12 23:26:45 -03:00
Vipul A M
94697bb8e7 Merge pull request #24504 from nickmalcolm/master
Encourage best practice in the HTTP Token authentication example code
2016-04-12 03:21:50 +05:30
Nick Malcolm
750e6dafd2 [ci skip] This modifies the HTTP Token authentication example's authenticate method, to use the secure_compare method with two constant-length strings. This defends against timing attacks, and is best practice. Using == for sensitive actions is not recommended, and this was the source of a CVE fixed in October 2015: 17e6f1507b 2016-04-12 09:41:51 +12:00
Vipul A M
ac027338e4 Pass over all Rails 5 warnings, to make sure:
- we are ending sentences properly
- fixing of space issues
- fixed continuity issues in some sentences.

Reverts 8fc97d198e .
This change reverts making sure we add '.' at end of deprecation sentences.
This is to keep sentences within Rails itself consistent and with a '.' at the end.
2016-04-12 02:26:56 +05:30
Xavier Noria
fca51a7c03 quick edits on the AC::API RDoc [ci skip]
In particular, the fact that ApplicationController is the only
one inheriting from AC::API is not a default. You could say at
most that generators generate them that way, but the creation
of controllers is something which is out of our control because
programmers write controllers by hand.

Instead, we can say that normally, conventionally, as in the
majority of Rails apps, that is the actually the case.
2016-04-05 11:06:09 -04:00
Ryan T. Hosford
f99106805d Fixes #24239
- skip calling helper_method if it's not there: if we don't have helpers, we needn't define one.
  - tests that an api controller can include and use ActionController::Cookies
2016-04-04 08:51:29 -05:00
Vijay Dev
bdcacc8566 Merge branch 'master' of github.com:rails/docrails 2016-04-03 16:51:27 +00:00
Vipul A M
0bbd9da004 Grammar fixes based on pass over ETag doc changes
[ci skip]
2016-04-03 03:01:49 +05:30
utilum
b20dec98fb Grammer fix in comment: capitalize first word in sentence [ci skip]. 2016-04-02 08:20:52 +02:00
Jeremy Daer
c1c9c69040 Strong ETag validators
* Introduce `Response#strong_etag=` and `#weak_etag=` and analogous options
  for `fresh_when` and `stale?`. `Response#etag=` sets a weak ETag.

  Strong ETags are desirable when you're serving byte-for-byte identical
  responses that support Range requests, like PDFs or videos (typically
  done by reproxying the response from a backend storage service).
  Also desirable when fronted by some CDNs that support strong ETags
  only, like Akamai.

* No longer strips quotes (`"`) from ETag values before comparing them.
  Quotes are significant, part of the ETag. A quoted ETag and an unquoted
  one are not the same entity.

* Support `If-None-Match: *`. Rarely useful for GET requests; meant
  to provide some optimistic concurrency control for PUT requests.
2016-03-31 18:15:32 -07:00
Prathamesh Sonpatki
317fbb037f Fix deprecation warning for ParamsParser instance 😄 2016-03-30 10:16:07 +05:30
Rafael Mendonça França
5ed3801481 Deprecate ActionDispatch::ParamsParser instance.
Related with 38d2bf5fd1f3e014f2397898d371c339baa627b1.

cc @tenderlove
2016-03-30 01:17:05 -03:00
Grey Baker
67263020ec Fix typo in headers comment 2016-03-29 12:21:21 +01:00
Bogdan
3a37c4e371 extension synonyms yml and yaml 2016-03-27 17:20:28 +03:00
Prathamesh Sonpatki
91eeefc795 [ci skip] Fix example of ActionController::Parameters#to_unsafe_h
- Added missing `"`.
2016-03-24 20:58:42 +05:30
Jeremy Daer
96ec8d92b1 Merge pull request #24037 from jeremy/implicit-render-raises-on-browser-GET-requests-only
Are you missing that template or did you omit it on purpose?
2016-03-23 13:25:57 -07:00
Arkadiusz Fal
1d6b77cc4d Fix typo for redirect_back
indetical -> identical
[skip ci]
2016-03-22 19:21:24 +01:00
Jon Moss
6c6a22176f Fix request.reset_session for API controllers
Due to that `ActionDispatch::Flash` (the flash API's middleware) is not
included for API controllers, the `request.reset_session` method, which
relies on there being a `flash=` method which is in fact defined by the
middleware, was previously breaking. Similarly to how
add46482a540b33184f3011c5c307f4b8e90c9cc created a method to be
overridden by the flash middleware in order to ensure non-breakage, this
is how flashes are now reset.

Fixes #24222
2016-03-19 21:52:45 -04:00
Bart de Water
9a0fc9a7ad Add explanation about accepts_nested_attributes_for keys in the strong parameters documentation [skip ci] 2016-03-12 19:10:15 +01:00
Gaurish Sharma
8b44687e9e Add example for ActionController::Parameters#to_unsafe_h
[ci-skip]
2016-03-12 13:33:08 +05:30
Sean Griffin
12cce89c89 Break up a circular require between AP/AV
Right now referencing the constant `AbstractController::Rendering`
causes `ActionView::Base` to be loaded, and thus the load hooks for
action_view are run. If that load hook references any part of action
view that then references action controller (such as
`ActionView::TestCase`), the constant `AbstractController::Rendering`
will attempt to be autoloaded and blow up.

With this change, `ActionView::LoadPaths` no longer requires
`ActionView::Base` (which it had no reason to require). There was a
needed class from `AbstractController::Base` in the Rendering module,
which I've moved into its own file so we don't need to load
all of `AbstractController::Base` there.

This commit fixes
https://github.com/rails/rails-controller-testing/issues/21
2016-03-11 14:42:47 -07:00
Sean Griffin
b76b817629 Use the most highest priority exception handler when cause is set
There was some subtle breakage caused by #18774, when we removed
`#original_exception` in favor of `#cause`. However, `#cause` is
automatically set by Ruby when raising an exception from a rescue block.
With this change, we will use whichever handler has the highest priority
(whichever call to `rescue_from` came last). In cases where the outer
has lower precidence than the cause, but the outer is what should be
handled, cause will need to be explicitly unset.

Fixes #23925
2016-03-11 10:53:01 -07:00
Sean Griffin
3bfda09fa0 Merge pull request #22854 from jcoyne/missing_template
Default rendering behavior if respond_to collector doesn't have a block.
2016-03-11 10:29:10 -07:00
Damir
40f6d200cf [skip ci] Reorder paragraphs
The previous order made sense [when `match` was used twice to point to two different actions](7305ef842b). In this case the note was misleading as posting to `/posts/:id` would still route to `show` action.
2016-03-10 15:01:27 +01:00
yuuji.yaginuma
5ad722c23b add return values to example [ci skip] 2016-03-10 07:48:23 +09:00
Sean Griffin
5cd2beb013 Add ActionController::Parameters#dig
This method will only be added when used with Ruby 2.3.0 or greater.
This method has the same behavior as `Hash#dig`, except it will convert
hashes to `ActionController::Parameters`, similar to `#[]` and `#fetch`.
2016-03-09 09:49:23 -07:00
Gareth du Plooy
2c5c1276a8 Pass headers through to payload for logging.
Make request headers available in the event payload so that it is available to attached ActionController::LogSubscribers.
2016-03-08 22:59:27 -05:00
Scott Bronson
4ca01d95f6 extract ActionDispatch::IntegrationTest::Behavior
Similar to 176fbfd6, this makes it possible for other test
frameworks to hook into Rails integration test facilities.
2016-03-07 11:38:43 -08:00
Yves Senn
ab7ad20125 Merge pull request #24086 from yui-knk/do_not_ad_integration_test_class
Prevent not-intended loading of `ActionDispatch::IntegrationTest`
2016-03-07 09:12:18 +01:00
yui-knk
9a642931fb Prevent not-intended loading of ActionDispatch::IntegrationTest
After 9d378747326d26cf1afdac4433ead22967af0984 `ActionDispatch::IntegrationTest`
class is loaded and defined in all Rails environments, not only test but also
production. This is not-intended loading of a class which is only used in
test environment.
To prevent not-intended loading, add `ActiveSupport.run_load_hooks` to
`ActionDispatch::IntegrationTest` with `action_dispatch_integration_test` name
and use it in `ActionMailer`.
2016-03-07 16:48:18 +09:00
Rafael França
cf1d45bd89 Merge pull request #24091 from mcfiredrill/fix-helper-method-docs
clarify that helper_method makes both methods available in the view [ci skip]
2016-03-07 00:00:22 -03:00
Tony Miller
05516a3156 clarify that helper_method makes both methods available in the view
It's probably obvious to most, but clarify that `:helper_method` will make both
of these methods available to the view.
2016-03-07 11:54:20 +09:00
Jean Boussier
3d6c124dc1 Remove http_cache_forever's version parameter 2016-03-05 00:41:10 -05:00
Sam Davies
fea7c9fed6 Do not destructively mutate passed options hash in route definitions
- Fixes #24030

An example scope might be specified as such:

```ruby
HTML = { constraints: { format: :html } }.freeze
scope HTML do
  get 'x'
end
```

This currently raises an error because the mapper attempts to
destructively modify the passed options hash. This is dangerous because
this options hash might even be shared with other scopes.

We should instead always instantiate a new object instead of modifying
the passed options.
2016-03-03 21:23:19 -03:00
Jeremy Daer
af260f649b Refinement of our "are you missing a template or did you omit it on purpose?" heuristics
Narrows the "are you in a browser, viewing the page?" check to exclude
non-GET requests. Allows content-less APIs to use implicit responses
without having to set a fake request format.

This will need further attention. If you forget to redirect from a POST
to a GET, you'll get a 204 No Content response that browsers will
typically treat as… do nothing. It'll seem like the form just didn't
work and knowing where to start debugging is non-obvious.

On the flip side, redirecting from POST and others is the default, done
everywhere, so it's less likely to be removed or otherwise missed.

Alternatives are to do more explicit browser sniffing.

Ref #23827.
2016-03-03 16:43:28 -07:00
Kasper Timm Hansen
daeaac7027 [ci skip] Fix constrain_to documentation.
Forgot to update the documentation on the line just above the one
I was changing in 4933132. Well done, Kasper 👍
2016-03-03 21:28:58 +01:00
Kasper Timm Hansen
493313228a Rename constrain_to to exclude.
`ActionDispatch::SSL` redirects all HTTP requests to HTTPS, not just some.
The `constrain_to` option inverts this, so it sounds like the middleware
only handles a few requests, rather than the majority with a few routes to
opt out of the redirect.

Renaming to `exclude` matches this intent more closely.
2016-03-03 21:09:58 +01:00
Xavier Noria
ba438dbfae Merge pull request #24027 from mechanicles/a-to-an
Change 'a HTTP' to 'an HTTP' [ci skip]
2016-03-03 07:23:45 -08:00
Santosh Wadghule
ea36c579c6 Change 'a HTTP' to 'an HTTP' [ci skip] 2016-03-03 20:28:01 +05:30
Jon Atack
eba0041c21 Niceify the dynamic routes deprecation messages
Follow-up to #23980.

- Fix grammar: "be remove" -> "be removed".

- Wrap lines at 80 chars.

Lurvely ;-)
2016-03-03 14:33:30 +01:00