diff --git a/README.rdoc b/README.rdoc index dc8805245b774c44d6eeaf5895919d0cc6ba9416..78640b39aa3b0d95c0257ad2fcec4b86790c1c0a 100644 --- a/README.rdoc +++ b/README.rdoc @@ -76,4 +76,3 @@ to proceed. {Join us}[http://contributors.rubyonrails.org]! Ruby on Rails is released under the MIT license: * http://www.opensource.org/licenses/MIT - diff --git a/actionpack/lib/action_controller/caching/actions.rb b/actionpack/lib/action_controller/caching/actions.rb index e76a79f710c478823bbf3cc24e2f54375157a958..bd3b0b5df3a6c5181235d86d1145bf8d6b5c35ef 100644 --- a/actionpack/lib/action_controller/caching/actions.rb +++ b/actionpack/lib/action_controller/caching/actions.rb @@ -47,7 +47,8 @@ module Caching # And you can also use :if (or :unless) to pass a # proc that specifies when the action should be cached. # - # Finally, if you are using memcached, you can also pass :expires_in. + # As of Rails 3.0, you can also pass :expires_in with a time + # interval (in seconds) to schedule expiration of the cached item. # # The following example depicts some of the points made above: # diff --git a/actionpack/lib/action_dispatch/routing.rb b/actionpack/lib/action_dispatch/routing.rb index 2f6b9d266d1fb4806dc5b657a066d9217c477442..107fe80d1f64b5d5b223484d55fa9d09dec93143 100644 --- a/actionpack/lib/action_dispatch/routing.rb +++ b/actionpack/lib/action_dispatch/routing.rb @@ -190,7 +190,7 @@ module ActionDispatch # Examples: # # match 'post/:id' => 'posts#show', :via => :get - # match 'post/:id' => "posts#create_comment', :via => :post + # match 'post/:id' => 'posts#create_comment', :via => :post # # Now, if you POST to /posts/:id, it will route to the create_comment action. A GET on the same # URL will route to the show action. @@ -203,7 +203,7 @@ module ActionDispatch # Examples: # # get 'post/:id' => 'posts#show' - # post 'post/:id' => "posts#create_comment' + # post 'post/:id' => 'posts#create_comment' # # This syntax is less verbose and the intention is more apparent to someone else reading your code, # however if your route needs to respond to more than one HTTP method (or all methods) then using the diff --git a/activerecord/lib/active_record/locking/optimistic.rb b/activerecord/lib/active_record/locking/optimistic.rb index e643c0d437487d691ce23bd47a6bd66b170c1206..4d73cdd37a55c61ec65a3c1bc090f04f32dbe61f 100644 --- a/activerecord/lib/active_record/locking/optimistic.rb +++ b/activerecord/lib/active_record/locking/optimistic.rb @@ -40,11 +40,13 @@ module Locking # This locking mechanism will function inside a single Ruby process. To make it work across all # web requests, the recommended approach is to add +lock_version+ as a hidden field to your form. # - # You must ensure that your database schema defaults the +lock_version+ column to 0. - # # This behavior can be turned off by setting ActiveRecord::Base.lock_optimistically = false. - # To override the name of the +lock_version+ column, invoke the set_locking_column method. - # This method uses the same syntax as set_table_name + # To override the name of the +lock_version+ column, set the locking_column class attribute: + # + # class Person < ActiveRecord::Base + # self.locking_column = :lock_person + # end + # module Optimistic extend ActiveSupport::Concern diff --git a/activesupport/lib/active_support/message_encryptor.rb b/activesupport/lib/active_support/message_encryptor.rb index 6ec5a04933e02543cdb475a587800febc5c71c24..ada2e79ccb625f757aee3da39f86b58ab02fb09c 100644 --- a/activesupport/lib/active_support/message_encryptor.rb +++ b/activesupport/lib/active_support/message_encryptor.rb @@ -9,6 +9,11 @@ module ActiveSupport # # This can be used in situations similar to the MessageVerifier, but where you don't # want users to be able to determine the value of the payload. + # + # key = OpenSSL::Digest::SHA256.new('password').digest # => "\x89\xE0\x156\xAC..." + # crypt = ActiveSupport::MessageEncryptor.new(key) # => # + # encrypted_data = crypt.encrypt_and_sign('my secret data') # => "NlFBTTMwOUV5UlA1QlNEN2xkY2d6eThYWWh..." + # crypt.decrypt_and_verify(encrypted_data) # => "my secret data" class MessageEncryptor module NullSerializer #:nodoc: def self.load(value) @@ -23,6 +28,15 @@ def self.dump(value) class InvalidMessage < StandardError; end OpenSSLCipherError = OpenSSL::Cipher.const_defined?(:CipherError) ? OpenSSL::Cipher::CipherError : OpenSSL::CipherError + # Initialize a new MessageEncryptor. + # +secret+ must be at least as long as the cipher key size. For the default 'aes-256-cbc' cipher, + # this is 256 bits. If you are using a user-entered secret, you can generate a suitable key with + # OpenSSL::Digest::SHA256.new(user_secret).digest or similar. + # + # Options: + # * :cipher - Cipher to use. Can be any cipher returned by OpenSSL::Cipher.ciphers. Default is 'aes-256-cbc' + # * :serializer - Object serializer to use. Default is +Marshal+. + # def initialize(secret, options = {}) @secret = secret @cipher = options[:cipher] || 'aes-256-cbc' diff --git a/install.rb b/install.rb index 05bba27a14a6e932647280a145cbaaa5789f7e3f..abc02249c2cdcd92e8a1e56ed09d188052d0542f 100644 --- a/install.rb +++ b/install.rb @@ -8,4 +8,4 @@ puts "Installing Rails..." `gem build rails.gemspec` `gem install rails-#{version}.gem --no-ri --no-rdoc ` -`rm rails-#{version}.gem` \ No newline at end of file +`rm rails-#{version}.gem` diff --git a/load_paths.rb b/load_paths.rb index 17f5ce180dcc4faf11c90d9ec4aee72bc813bf46..6b224d4ad5080b7b370069819df836436948a93d 100644 --- a/load_paths.rb +++ b/load_paths.rb @@ -1,4 +1,4 @@ # bust gem prelude require 'rubygems' unless defined? Gem require 'bundler' -Bundler.setup \ No newline at end of file +Bundler.setup diff --git a/railties/guides/source/active_record_querying.textile b/railties/guides/source/active_record_querying.textile index 8517f6fb19167e26168e406c126515e5e755ff37..3b4f2befdaa533f7adba40aa6a1b0b9a289f2576 100644 --- a/railties/guides/source/active_record_querying.textile +++ b/railties/guides/source/active_record_querying.textile @@ -404,6 +404,8 @@ Or ordering by multiple fields: Client.order("orders_count ASC, created_at DESC") +# OR +Client.order("orders_count ASC", "created_at DESC") h3. Selecting Specific Fields @@ -608,7 +610,7 @@ This method accepts *no* arguments. h3. Readonly Objects -Active Record provides +readonly+ method on a relation to explicitly disallow modification or deletion of any of the returned object. Any attempt to alter or destroy a readonly record will not succeed, raising an +ActiveRecord::ReadOnlyRecord+ exception. +Active Record provides +readonly+ method on a relation to explicitly disallow modification of any of the returned objects. Any attempt to alter a readonly record will not succeed, raising an +ActiveRecord::ReadOnlyRecord+ exception. client = Client.readonly.first @@ -648,15 +650,13 @@ c2.save # Raises an ActiveRecord::StaleObjectError You're then responsible for dealing with the conflict by rescuing the exception and either rolling back, merging, or otherwise apply the business logic needed to resolve the conflict. -NOTE: You must ensure that your database schema defaults the +lock_version+ column to +0+. - This behavior can be turned off by setting ActiveRecord::Base.lock_optimistically = false. -To override the name of the +lock_version+ column, +ActiveRecord::Base+ provides a class method called +set_locking_column+: +To override the name of the +lock_version+ column, +ActiveRecord::Base+ provides a class attribute called +locking_column+: class Client < ActiveRecord::Base - set_locking_column :lock_client_column + self.locking_column = :lock_client_column end diff --git a/railties/guides/source/association_basics.textile b/railties/guides/source/association_basics.textile index 451653655f6870438847d59d22adcb956d293540..a55ed38d1b544d6bee4486ddc19352c6c0bb3ca6 100644 --- a/railties/guides/source/association_basics.textile +++ b/railties/guides/source/association_basics.textile @@ -1120,7 +1120,7 @@ h6(#has_many-collection-find). collection.find(...) The collection.find method finds objects within the collection. It uses the same syntax and options as +ActiveRecord::Base.find+. -@open_orders = @customer.orders.where(:open => 1) +@open_orders = @customer.orders.find(1) h6(#has_many-collection-where). collection.where(...) @@ -1242,7 +1242,7 @@ h6(#has_many-counter_sql). +:counter_sql+ Normally Rails automatically generates the proper SQL to count the association members. With the +:counter_sql+ option, you can specify a complete SQL statement to count them yourself. -NOTE: If you specify +:finder_sql+ but not +:counter_sql+, then the counter SQL will be generated by substituting +SELECT COUNT(*) FROM+ for the +SELECT ... FROM+ clause of your +:finder_sql+ statement. +NOTE: If you specify +:finder_sql+ but not +:counter_sql+, then the counter SQL will be generated by substituting the +SELECT ... FROM+ clause of your +:finder_sql+ statement by +SELECT COUNT(*) FROM+. h6(#has_many-dependent). +:dependent+ @@ -1545,12 +1545,9 @@ h6(#has_and_belongs_to_many-collection-find). collection.find(...)< The collection.find method finds objects within the collection. It uses the same syntax and options as +ActiveRecord::Base.find+. It also adds the additional condition that the object must be in the collection. -@new_assemblies = @part.assemblies.all( - :conditions => ["created_at > ?", 2.days.ago]) +@assembly = @part.assemblies.find(1) -NOTE: Beginning with Rails 3, supplying options to the +ActiveRecord::Base.find+ method is discouraged. Use collection.where instead when you need to pass conditions. - h6(#has_and_belongs_to_many-collection-where). collection.where(...) The collection.where method finds objects within the collection based on the conditions supplied but the objects are loaded lazily meaning that the database is queried only when the object(s) are accessed. It also adds the additional condition that the object must be in the collection. @@ -1669,7 +1666,7 @@ h6(#has_and_belongs_to_many-counter_sql). +:counter_sql+ Normally Rails automatically generates the proper SQL to count the association members. With the +:counter_sql+ option, you can specify a complete SQL statement to count them yourself. -NOTE: If you specify +:finder_sql+ but not +:counter_sql+, then the counter SQL will be generated by substituting +SELECT COUNT(*) FROM+ for the +SELECT ... FROM+ clause of your +:finder_sql+ statement. +NOTE: If you specify +:finder_sql+ but not +:counter_sql+, then the counter SQL will be generated by substituting the +SELECT ... FROM+ clause of your +:finder_sql+ statement by +SELECT COUNT(*) FROM+. h6(#has_and_belongs_to_many-delete_sql). +:delete_sql+ diff --git a/railties/guides/source/form_helpers.textile b/railties/guides/source/form_helpers.textile index 1681629620fc9f068816082433ceb814cf88bb9c..9758b639cf44e41d3b7a741143c7203ba8997503 100644 --- a/railties/guides/source/form_helpers.textile +++ b/railties/guides/source/form_helpers.textile @@ -754,7 +754,7 @@ produces exactly the same output as the previous example. h3. Forms to external resources -If you need to post some data to an external resource it is still great to build your from using rails form helpers. But sometimes you need to set an +authenticity_token+ for this resource. You can do it by passing an +:authenticity_token => 'your_external_token'+ parameter to the +form_tag+ options: +If you need to post some data to an external resource it is still great to build your form using rails form helpers. But sometimes you need to set an +authenticity_token+ for this resource. You can do it by passing an +:authenticity_token => 'your_external_token'+ parameter to the +form_tag+ options: <%= form_tag 'http://farfar.away/form', :authenticity_token => 'external_token') do %> diff --git a/railties/guides/source/security.textile b/railties/guides/source/security.textile index c2ef7bf9b51d18a8fdd790965829624e7ce27c58..b1a09c0c05973f9614ecf3513dd92e8f67257d71 100644 --- a/railties/guides/source/security.textile +++ b/railties/guides/source/security.textile @@ -385,7 +385,7 @@ params[:user] # => {:name => “ow3ned”, :admin => true} So if you create a new user using mass-assignment, it may be too easy to become an administrator. -Note that this vulnerability is not restricted to database columns. Any setter method, unless explicitly protected, is accessible via the attributes= method. In fact, this vulnerability is extended even further with the introduction of nested mass assignment (and nested object forms) in Rails 2.3+. The +accepts_nested_attributes_for+ declaration provides us the ability to extend mass assignment to model associations (+has_many+, +has_one+, +has_and_belongs_to_many+). For example: +Note that this vulnerability is not restricted to database columns. Any setter method, unless explicitly protected, is accessible via the attributes= method. In fact, this vulnerability is extended even further with the introduction of nested mass assignment (and nested object forms) in Rails 2.3. The +accepts_nested_attributes_for+ declaration provides us the ability to extend mass assignment to model associations (+has_many+, +has_one+, +has_and_belongs_to_many+). For example: class Person < ActiveRecord::Base