- 04 9月, 2014 1 次提交
-
-
由 Kasper Timm Hansen 提交于
-
- 02 9月, 2014 1 次提交
-
-
由 Matthew Draper 提交于
We're seeing too many failures to believe otherwise. This reverts commits bc116a55, cbde413d, bf0a6793, and 2440933f.
-
- 01 9月, 2014 1 次提交
-
-
由 Sammy Larbi 提交于
Suppose you have two resources routed in the following manner: ```ruby resources :blogs do resources :posts end resources :posts ``` When using polymorphic resource routing like `url_for([@blog, @post])`, and `@blog` is `nil` Rails should still try to match the route to the top-level posts resource. Fixes #16754
-
- 30 8月, 2014 1 次提交
-
-
由 Robin Dupret 提交于
When we are loading a component and we want to know its version, we are actually not speaking about the constant but the library itself. [ci skip] [Godfrey Chan & Xavier Noria]
-
- 29 8月, 2014 1 次提交
-
-
由 Peter Suschlik 提交于
IPAddr::InvalidAddressError does not exist in Ruby 1.9.3 and fails for JRuby in 1.9 mode. As IPAddr::InvalidAddressError is a subclass of ArgumentError (via IPAddr::Error) just rescuing ArgumentError is fine.
-
- 28 8月, 2014 3 次提交
-
-
由 Akira Matsuda 提交于
This actually was testing test everything, so why not do it simpler?
-
由 Akira Matsuda 提交于
-
由 schneems 提交于
Dir.glob can be a security concern. The original use was to provide logic of fallback files. Example a request to `/` should render the file from `/public/index.html`. We can replace the dir glob with the specific logic it represents. The glob {,index,index.html} will look for the current path, then in the directory of the path with index file and then in the directory of the path with index.html. This PR replaces the glob logic by manually checking each potential match. Best case scenario this results in one less file API request, worst case, this has one more file API request. Related to #16464 Update: added a test for when a file of a given name (`public/bar.html` and a directory `public/bar` both exist in the same root directory. Changed logic to accommodate this scenario.
-
- 27 8月, 2014 2 次提交
-
-
由 Yves Senn 提交于
-
由 Peter Suschlik 提交于
This commit improves performance of cookie tests: Ruby | After | Before ----- | --------:| --------: MRI | 5.03s | 9.28s JRuby | 25.45s | 1648.23s Please note the improvement for JRuby.
-
- 25 8月, 2014 2 次提交
-
-
由 Agis- 提交于
https://github.com/rails/rails/commit/402c2af55053c2f29319091ad21fd6fa6b90ee89 introduced a regression that caused any constraints added to redirect routes to be ignored. Fixes #16605
-
由 schneems 提交于
- don't mutate PATH_INFO in env, test - test fallback content type matches Rack::File - change assertion style - make HTTP_ACCEPT_ENCODING comparison case insensitive - return gzip path from method instead of true/false so we don't have to assume later - don't allocate un-needed hash. Original comments: https://github.com/rails/rails/commit/ cfaaacd9#commitcomment-7468728 cc @jeremy
-
- 23 8月, 2014 1 次提交
-
-
由 Agis- 提交于
https://github.com/rails/rails/commit/c64bff2c87ebf363703c63ecd4a96d56a1a78364 added support and enabled parallel execution of the actionpack tests. However it introduced https://github.com/rails/rails/commit/c64bff2c87ebf363703c63ecd4a96d56a1a78364 since one cannot connect to a socket file that's inside a Vagrant synced folder due to security restrictions, and DRb tries to. Also rename the temporary files to make it obvious that they're rails-related, since now they're placed outside the project's directory. Fixes https://github.com/rails/rails/commit/c64bff2c87ebf363703c63ecd4a96d56a1a78364
-
- 22 8月, 2014 1 次提交
-
-
由 Sam Aarons 提交于
Refactored IP address checking in ActionDispatch::RemoteIp to rely on the IPAddr class instead of the unwieldly regular expression to match IP addresses. This commit keeps the same api but allows users to pass IPAddr objects to config.action_dispatch.trusted_proxies in addition to passing strings and regular expressions. Example: # config/environments/production.rb config.action_dispatch.trusted_proxies = IPAddr.new('4.8.15.0/16')
-
- 21 8月, 2014 3 次提交
-
-
由 Guo Xiang Tan 提交于
We should assert that routes will not be recognized if the verbs do not match.
-
由 Guo Xiang Tan 提交于
Follow up to rails#15321 Instead of duplicating the routes, we will first match the HEAD request to HEAD routes. If no match is found, we will then map the HEAD request to GET routes.
-
由 schneems 提交于
If someone is using ActionDispatch::Static to serve assets and makes it past the `match?` then the file exists on disk and it will be served. This PR adds in logic that checks to see if the file being served is already compressed (via gzip) and on disk, if it is it will be served as long as the client can handle gzip encoding. If not, then a non gzip file will be served. This additional logic slows down an individual asset request but should speed up the consumer experience as compressed files are served and production applications should be delivered with a CDN. This PR allows a CDN to cache a gzip file by setting the `Vary` header appropriately. In net this should speed up a production application that are using Rails as an origin for a CDN. Non-asset request speed is not affected in this PR.
-
- 20 8月, 2014 5 次提交
-
-
由 David Heinemeier Hansson 提交于
-
由 Bradley Buda 提交于
This merges in the code from the breach-mitigation-rails gem that masks authenticity tokens on each request by XORing them with a random set of bytes. The masking is used to make it impossible for an attacker to steal a CSRF token from an SSL session by using techniques like the BREACH attack. The patch is pretty simple - I've copied over the [relevant code](https://github.com/meldium/breach-mitigation-rails/blob/master/lib/breach_mitigation/masking_secrets.rb) and updated the tests to pass, mostly by adjusting stubs and mocks.
-
由 Rafael Mendonça França 提交于
-
由 Rafael Mendonça França 提交于
-
由 Rafael Mendonça França 提交于
Related with #11795.
-
- 19 8月, 2014 9 次提交
-
-
由 Godfrey Chan 提交于
-
由 Prem Sichanugrist 提交于
Ruby 1.9.3 does not implement Hash#to_h, so we can't call `super` on it.
-
由 Prem Sichanugrist 提交于
* `each` * `each_pair` * `delete` * `select!`
-
由 Prem Sichanugrist 提交于
-
由 Prem Sichanugrist 提交于
-
由 Prem Sichanugrist 提交于
This is to make sure that `permitted` status is maintained on the resulting object. I found these methods that needs to be redefined by looking for `self.class.new` in the code. * extract! * transform_keys * transform_values
-
由 Prem Sichanugrist 提交于
`ActionController::Parameters#to_h` now returns a `Hash` with unpermitted keys removed. This change is to reflect on a security concern where some method performed on an `ActionController::Parameters` may yield a `Hash` object which does not maintain `permitted?` status. If you would like to get a `Hash` with all the keys intact, duplicate and mark it as permitted before calling `#to_h`. params = ActionController::Parameters.new(name: 'Senjougahara Hitagi') params.to_h # => {} unsafe_params = params.dup.permit! unsafe_params.to_h # => {"name"=>"Senjougahara Hitagi"} safe_params = params.permit(:name) safe_params.to_h # => {"name"=>"Senjougahara Hitagi"} This change is consider a stopgap as we cannot chage the code to stop `ActionController::Parameters` to inherit from `HashWithIndifferentAccess` in the next minor release. Also, adding a CHANGELOG entry to mention that `ActionController::Parameters` will not inheriting from `HashWithIndifferentAccess` in the next major version.
-
由 Rafael Mendonça França 提交于
-
由 Santiago Pastorino 提交于
-
- 18 8月, 2014 9 次提交
-
-
由 Akira Matsuda 提交于
-
由 Lucas Mazza 提交于
This method was removed at 210b338d but it is used by third party gems to check if a named route was defined. To help on the upgrade path on 4.2.0 we bring it back and emit a deprecation warning.
-
由 Godfrey Chan 提交于
Use the Active Support JSON encoder for cookie jars using the `:json` or `:hybrid` serializer. This allows you to serialize custom Ruby objects into cookies by defining the `#as_json` hook on such objects. Fixes #16520.
-
由 Godfrey Chan 提交于
-
由 Godfrey Chan 提交于
-
由 Godfrey Chan 提交于
-
由 Godfrey Chan 提交于
-
由 Kasper Timm Hansen 提交于
- Default to Rails::DeprecatedSanitizer in ActionView::Helpers::SanitizeHelper. - Add upgrade notes. - Add sanitizer to new applications Gemfiles. - Remove 'rails-dom-testing' as a dependency.
-
由 José Valim 提交于
-