1. 06 11月, 2009 1 次提交
  2. 01 11月, 2009 1 次提交
  3. 29 10月, 2009 1 次提交
  4. 10 10月, 2009 1 次提交
  5. 09 10月, 2009 1 次提交
  6. 08 10月, 2009 1 次提交
    • M
      Switch to on-by-default XSS escaping for rails. · 94159359
      Michael Koziarski 提交于
        This consists of:
      
        * String#html_safe! a method to mark a string as 'safe'
        * ActionView::SafeBuffer a string subclass which escapes anything unsafe which is concatenated to it
        * Calls to String#html_safe! throughout the rails helpers
        * a 'raw' helper which lets you concatenate trusted HTML from non-safety-aware sources (e.g. presantized strings in the DB)
        * New ERB implementation based on erubis which uses a SafeBuffer instead of a String
      
      Hat tip to Django for the inspiration.
      94159359
  7. 29 9月, 2009 1 次提交
    • E
      Ported the new ActionView::TestCase from 2-3-stable to master [#3260 · 8ffc2e3b
      Erik Ostrom 提交于
      state:resolved]
      
      The test case now mimicks the template environment more closely, so it's
      possible to use render, load helper dependencies.
      
      This also fixes assert_select, and similar assertions. Because view tests
      and helpers generally don't render full templates assert_select looks
      first in rendered and then in output_buffer to find the rendered output.
      
      Additional `master'-only changes: Made the Action Pack Rakefile run the
      ActionView::TestCase tests, and made ActionView::Rendering#_render_text
      always return a string.
      Signed-off-by: NJoshua Peek <josh@joshpeek.com>
      8ffc2e3b
  8. 25 9月, 2009 1 次提交
  9. 16 8月, 2009 4 次提交
  10. 12 8月, 2009 2 次提交
  11. 09 8月, 2009 5 次提交
  12. 08 8月, 2009 2 次提交
  13. 07 8月, 2009 12 次提交
  14. 19 7月, 2009 1 次提交
  15. 26 6月, 2009 1 次提交
  16. 19 6月, 2009 2 次提交
  17. 18 6月, 2009 3 次提交