In the current router DSL, using the +match+ DSL
method will match all verbs for the path to the
specified endpoint.

In the vast majority of cases, people are
currently using +match+ when they actually mean
+get+. This introduces security implications.

This commit disallows calling +match+ without
an HTTP verb constraint by default. To explicitly
match all verbs, this commit also adds a
:via => :all option to +match+.

Closes #5964

Closes #5632

Previously `rendered_format` was set only based on mime types
passed in Accept header, which was wrong if first type from
Accept was different than rendered partial. The fix is to simply
move setting rendered_format to the place where template
is available and grab format from the template. If it fails
we can fallback to formats passed by Accept header.

Fix for #5440

* Do not reopen AV::Base to define default form builder
  Inside the load hook we are already in AV::Base context.

* Do not pass the given block to the form builder
  The block is evaluated in fields_for context using capture, with the
  builder as argument. This means we do not need to give the block to the
  FormBuilder itself.

minor

Revert "Added ActiveRecord::Base#last_modified to work with the new fresh_when/stale? conditional get methods from Action Pack"

Needless indirection with no added value.

This reverts commit 535853e8.

Added ActiveRecord::Base#last_modified to work with the new fresh_when/stale? conditional get methods from Action Pack

For example, calling hello.erb is now deprecated. Since Rails 3.0
passing the handler had no effect whatsover. This commit simply
deprecates such cases so we can clean up the code in later releases.

  fix issues/1951

  https://github.com/rails/rails/issues/1951
  Namespaced model partial_path is wrong in namespaced controllers

This fixes CVE-2011-0449

Fix header capitalization by explicitly upcasing first letter of every word, and avoiding capitalize. [#5636 state:resolved]

code gardening: we have assert_(nil|blank|present), more concise, with better default failure messages - let's use them

Signed-off-by: NJosé Valim <jose.valim@gmail.com>

This reverts commit ade756fe.

This reverts commits af0d1a88 and 64d109e3.

* Default Encoding.default_internal to UTF-8
* Eliminated the use of file-wide magic comments to coerce code evaluated inside the file
* Read templates as BINARY, use default_external or template-wide magic comments
  inside the Template to set the initial encoding
  * This means that template handlers in Ruby 1.9 will receive Strings encoded
    in default_internal (UTF-8 by default)
* Create a better Exception for encoding issues, and use it when the template
  source has bytes that are not compatible with the specified encoding
* Allow template handlers to opt-into handling BINARY. If they do so, they
  need to do some of their own manual encoding work
* Added a "Configuration Gotchas" section to the intro Rails Guide instructing
  users to use UTF-8 for everything
* Use config.encoding= in Ruby 1.8, and raise if a value that is an invalid
  $KCODE value is used

Also:
* Fixed a few tests that were assert() rather than assert_equal() and
  were caught by Minitest requiring a String for the message
* Fixed a test where an assert_select was misformed, also caught by
  Minitest being more restrictive
* Fixed a test where a Rack response was returning a String rather
  than an Enumerable