In the latest security releases render with a trailing slash no more call
render :file.
Also add a note about the security implications of using it with user
parameters.
Applications that use `redirect_to :back` can be forced to 500 by
clients that do not send the HTTP `Referer` (sic) header.
`redirect_back` requires the user to consider this possibility up front
and avoids this trivially-caused application error.
`redirect_to :back` is a somewhat common pattern in Rails apps, but it
is not completely safe. There are a number of circumstances where HTTP
referrer information is not available on the request. This happens often
with bot traffic and occasionally to user traffic depending on browser
security settings.
When there is no referrer available on the request, `redirect_to :back`
will raise `ActionController::RedirectBackError`, usually resulting in
an application error.
`redirect_back` takes a required `fallback_location` keyword argument
that specifies the redirect when the referrer information is not
available. This prevents 500 errors caused by
`ActionController::RedirectBackError`.
This is a squash of the following commits, from first to last:
-
Fix minor, random things I’ve come across lately that individually
did not seem worth making a PR for, so I saved them for one commit.
One common error is using “it’s” (which is an abbreviation of “it is”)
when the possessive “its” should be used for indicating possession.
-
Changes include the name of a test, so remove the `[skip ci]` (thanks @senny).
-
Line wrap the changes at 80 chars and add one more doc fix.
-
Add a missing line wrap in the Contributing to Ruby on Rails Guide.
-
Line wrap the `TIP` section in the Contributing to Ruby on Rails Guide as well.
Rendering the guide locally with `bundle exec rake guides:generate` did
not show any change in on-screen formatting after adding the line wrap.
The HTML generated is (extra line added to illustrate where the line
wrap takes place):
<div class="info"><p>Please squash your commits into a single commit
when appropriate. This
simplifies future cherry picks and also keeps the git log
clean.</p></div>
-
Squash commits.
`render :body` should just not set the `Content-Type` header. By
removing the header, it breaks the compatibility with other parts.
After this commit, `render :body` will returns `text/html` content type,
sets by default from `ActionDispatch::Response`, and it will preserve
the overridden content type if you override it.
Fixes#14197, #14238
This partially reverts commit 3047376870d4a7adc7ff15c3cb4852e073c8f1da.
The `as` option was already explained in a previous example
and doesn't need to be repeated. Explain only the `locals` option
which the example is meant for.
