1. 21 5月, 2012 1 次提交
    • A
      Return 400 Bad Request for URL paths with invalid encoding. · 3fc561a1
      Andrew White 提交于
      Passing path parameters with invalid encoding is likely to trigger errors
      further on like `ArgumentError (invalid byte sequence in UTF-8)`. This will
      result in a 500 error whereas the better error to return is a 400 error which
      allows exception notification libraries to filter it out if they wish.
      
      Closes #4450
      3fc561a1
  2. 15 5月, 2012 1 次提交
  3. 11 5月, 2012 2 次提交
  4. 09 5月, 2012 2 次提交
  5. 07 5月, 2012 1 次提交
  6. 05 5月, 2012 1 次提交
  7. 03 5月, 2012 1 次提交
    • A
      Reset the request parameters after a constraints check · 56030506
      Andrew White 提交于
      A callable object passed as a constraint for a route may access the request
      parameters as part of its check. This causes the combined parameters hash
      to be cached in the environment hash. If the constraint fails then any subsequent
      access of the request parameters will be against that stale hash.
      
      To fix this we delete the cache after every call to `matches?`. This may have a
      negative performance impact if the contraint wraps a large number of routes as the
      parameters hash is built by merging GET, POST and path parameters.
      
      Fixes #2510.
      56030506
  8. 30 4月, 2012 2 次提交
  9. 25 4月, 2012 1 次提交
    • J
      Remove default match without specified method · 56cdc81c
      Jose and Yehuda 提交于
      In the current router DSL, using the +match+ DSL
      method will match all verbs for the path to the
      specified endpoint.
      
      In the vast majority of cases, people are
      currently using +match+ when they actually mean
      +get+. This introduces security implications.
      
      This commit disallows calling +match+ without
      an HTTP verb constraint by default. To explicitly
      match all verbs, this commit also adds a
      :via => :all option to +match+.
      
      Closes #5964
      56cdc81c
  10. 26 3月, 2012 1 次提交
    • J
      Allow a defining custom member field on resources · 3e67e45d
      Jamie Macey 提交于
      By default, resources routes are created with :resource/:id. A model
      defining to_param can make prettier urls by using something more
      readable than an integer ID, but since the route picks it up as :id you
      wind up with awkward User.find_by_username(params[:id]) calls.
      
      By overriding the key to be used in @request.params you can be more
      obvious in your intent.
      3e67e45d
  11. 25 2月, 2012 2 次提交
  12. 22 2月, 2012 1 次提交
  13. 16 2月, 2012 1 次提交
  14. 11 2月, 2012 2 次提交
  15. 10 2月, 2012 1 次提交
  16. 06 2月, 2012 2 次提交
  17. 28 1月, 2012 2 次提交
  18. 26 1月, 2012 1 次提交
  19. 24 1月, 2012 1 次提交
  20. 14 1月, 2012 1 次提交
  21. 06 1月, 2012 1 次提交
  22. 22 12月, 2011 1 次提交
  23. 16 12月, 2011 1 次提交
  24. 13 12月, 2011 1 次提交
  25. 19 11月, 2011 3 次提交
  26. 14 10月, 2011 2 次提交
  27. 11 10月, 2011 1 次提交
  28. 22 9月, 2011 1 次提交
  29. 12 8月, 2011 1 次提交
  30. 26 7月, 2011 1 次提交