diff --git a/guides/source/4_0_release_notes.md b/guides/source/4_0_release_notes.md index 4f437da2b801252af2863f92e68c289023abb9ba..260405842ac54ced2f820a71a274abed6c3be99b 100644 --- a/guides/source/4_0_release_notes.md +++ b/guides/source/4_0_release_notes.md @@ -70,7 +70,7 @@ Major Features ### ActionPack -* **Strong parameters** ([commit](https://github.com/rails/rails/commit/a8f6d5c6450a7fe058348a7f10a908352bb6c7fc)) - Only allow allowlisted parameters to update model objects (`params.permit(:title, :text)`). +* **Strong parameters** ([commit](https://github.com/rails/rails/commit/a8f6d5c6450a7fe058348a7f10a908352bb6c7fc)) - Only allow trusted parameters to update model objects (`params.permit(:title, :text)`). * **Routing concerns** ([commit](https://github.com/rails/rails/commit/0dd24728a088fcb4ae616bb5d62734aca5276b1b)) - In the routing DSL, factor out common subroutes (`comments` from `/posts/1/comments` and `/videos/1/comments`). * **ActionController::Live** ([commit](https://github.com/rails/rails/commit/af0a9f9eefaee3a8120cfd8d05cbc431af376da3)) - Stream JSON with `response.stream`. * **Declarative ETags** ([commit](https://github.com/rails/rails/commit/ed5c938fa36995f06d4917d9543ba78ed506bb8d)) - Add controller-level etag additions that will be part of the action etag computation. diff --git a/guides/source/4_1_release_notes.md b/guides/source/4_1_release_notes.md index f0d40985fe3f0f4fccda76c5ef98105b3991af14..4730bc4e1adc9dac4782839ce1728d836e694f21 100644 --- a/guides/source/4_1_release_notes.md +++ b/guides/source/4_1_release_notes.md @@ -719,7 +719,7 @@ for detailed changes. responsibilities within a class. ([Commit](https://github.com/rails/rails/commit/1eee0ca6de975b42524105a59e0521d18b38ab81)) -* Added `Object#presence_in` to simplify value allowlisting. +* Added `Object#presence_in` to simplify adding values to an allowlist. ([Commit](https://github.com/rails/rails/commit/4edca106daacc5a159289eae255207d160f22396)) diff --git a/guides/source/action_controller_overview.md b/guides/source/action_controller_overview.md index 58c1d5494c001a00ecf2c3437c6c31329fa03060..fd95dbbd03deb8ebc90671279f12c2ada8242cb0 100644 --- a/guides/source/action_controller_overview.md +++ b/guides/source/action_controller_overview.md @@ -193,7 +193,7 @@ In a given request, the method is not actually called for every single generated With strong parameters, Action Controller parameters are forbidden to be used in Active Model mass assignments until they have been -allowlisted. This means that you'll have to make a conscious decision about +allowed. This means that you'll have to make a conscious decision about which attributes to allow for mass update. This is a better security practice to help prevent accidentally allowing users to update sensitive model attributes. @@ -269,7 +269,7 @@ but be careful because this opens the door to arbitrary input. In this case, `permit` ensures values in the returned structure are permitted scalars and filters out anything else. -To allowlist an entire hash of parameters, the `permit!` method can be +To allow an entire hash of parameters, the `permit!` method can be used: ```ruby @@ -291,7 +291,7 @@ params.permit(:name, { emails: [] }, { family: [ :name ], hobbies: [] }]) ``` -This declaration allowlists the `name`, `emails`, and `friends` +This declaration allows the `name`, `emails`, and `friends` attributes. It is expected that `emails` will be an array of permitted scalar values, and that `friends` will be an array of resources with specific attributes: they should have a `name` attribute (any @@ -326,7 +326,7 @@ parameters when you use `accepts_nested_attributes_for` in combination with a `has_many` association: ```ruby -# To allowlist the following data: +# To allow the following data: # {"book" => {"title" => "Some Book", # "chapters_attributes" => { "1" => {"title" => "First Chapter"}, # "2" => {"title" => "Second Chapter"}}}} @@ -336,7 +336,7 @@ params.require(:book).permit(:title, chapters_attributes: [:title]) Imagine a scenario where you have parameters representing a product name and a hash of arbitrary data associated with that product, and -you want to allowlist the product name attribute and also the whole +you want to allow the product name attribute and also the whole data hash: ```ruby diff --git a/guides/source/configuring.md b/guides/source/configuring.md index dfeb1f27ec95c97b74dc493cbf34583855449ae8..8cf13995959a78f1e7bc87733366cc062f6fc5d7 100644 --- a/guides/source/configuring.md +++ b/guides/source/configuring.md @@ -275,7 +275,7 @@ config.middleware.delete Rack::MethodOverride All these configuration options are delegated to the `I18n` library. -* `config.i18n.available_locales` allowlists the available locales for the app. Defaults to all locale keys found in locale files, usually only `:en` on a new application. +* `config.i18n.available_locales` defines the available locales for the app. Defaults to all locale keys found in locale files, usually only `:en` on a new application. * `config.i18n.default_locale` sets the default locale of an application used for i18n. Defaults to `:en`. @@ -444,7 +444,7 @@ The schema dumper adds two additional configuration options: * `config.action_controller.action_on_unpermitted_parameters` enables logging or raising an exception if parameters that are not explicitly permitted are found. Set to `:log` or `:raise` to enable. The default value is `:log` in development and test environments, and `false` in all other environments. -* `config.action_controller.always_permitted_parameters` sets a list of allowlisted parameters that are permitted by default. The default values are `['controller', 'action']`. +* `config.action_controller.always_permitted_parameters` sets a list of allowed parameters that are permitted by default. The default values are `['controller', 'action']`. * `config.action_controller.enable_fragment_cache_logging` determines whether to log fragment cache reads and writes in verbose format as follows: diff --git a/guides/source/debugging_rails_applications.md b/guides/source/debugging_rails_applications.md index 902b9797dfdb438171bc9ff957b4de77652c580c..88d205e1abb448d9f35e3329a8f9d32437103dcc 100644 --- a/guides/source/debugging_rails_applications.md +++ b/guides/source/debugging_rails_applications.md @@ -888,7 +888,7 @@ do that with `local_variables`. ### Settings -* `config.web_console.allowlisted_ips`: Authorized list of IPv4 or IPv6 +* `config.web_console.whitelisted_ips`: Authorized list of IPv4 or IPv6 addresses and networks (defaults: `127.0.0.1/8, ::1`). * `config.web_console.whiny_requests`: Log a message when a console rendering is prevented (defaults: `true`). diff --git a/guides/source/form_helpers.md b/guides/source/form_helpers.md index 86d0e6b18b8ed5dbde03772652708ad8a093f585..c6b9d56fb26271bf86110a5ae466b2590d04b4cf 100644 --- a/guides/source/form_helpers.md +++ b/guides/source/form_helpers.md @@ -953,7 +953,7 @@ If the associated object is already saved, `fields_for` autogenerates a hidden i ### The Controller As usual you need to -[allowlist the parameters](action_controller_overview.html#strong-parameters) in +[declare the allowed parameters](action_controller_overview.html#strong-parameters) in the controller before you pass them to the model: ```ruby @@ -999,7 +999,7 @@ remove addresses: <% end %> ``` -Don't forget to update the allowlisted params in your controller to also include +Don't forget to update the permitted params in your controller to also include the `_destroy` field: ```ruby