since ActionDispatch::Http::Parameters#encode_params will force encoding on all params strings (when using an encoding aware Ruby), dup all strings passed into process.  This prevents modification of params passed in and, more importantly, doesn't barf when a frozen string is passed
thanks and high fives to kinsteronline

Signed-off-by: NJosé Valim <jose.valim@gmail.com>

Currently, we output:

  "><script type="text/javascript">window.location = "/500.html"</script></html>

Added stream as class level method to make it explicit when to stream.
Render also accepts :stream as option.

- Closes #6692
Signed-off-by: NJosé Valim <jose.valim@gmail.com>

After a long list of discussion about the performance problem from using varargs and the reason that we can't find a great pair for it, it would be best to remove support for it for now.

It will come back if we can find a good pair for it. For now, Bon Voyage, `#among?`.

There're a lot of places in Rails source code which make a lot of sense to switching to Object#in? or Object#either? instead of using [].include?.

Improved formatting of csrf_helper and improved test coverage

raise if someone tries to modify the flash when it was already streamed back to the client or converted to HTTP headers

Signed-off-by: NJosé Valim <jose.valim@gmail.com>

Signed-off-by: NJosé Valim <jose.valim@gmail.com>

when using respond_with with an invalid resource and custom options, the default response status and error messages should be returned
Signed-off-by: NJosé Valim <jose.valim@gmail.com>

Added Base.http_basic_authenticate_with to do simple http basic authentication with a single class method call [DHH]

This would become useful for site which sometime transferring sensitive information such as account information on particular controller or action.

This featured was requested by DHH.

The method_name argument is "default_render" for implicit actions
so use the action_name attribute to determine which callbacks to run.

[#5673 state:resolved]

Signed-off-by: NAndrew White <andyw@pixeltrix.co.uk>

Fix Action caching bug where an action that has a non-cacheable response always renders a nil response body. It now correctly renders the response body.

Note that only GET and HTTP 200 responses can be cached.

[#6480 state:committed]
Signed-off-by: NSantiago Pastorino <santiago@wyeworks.com>

Unfortunately the previous method of browser detection and XHR whitelisting is unable to prevent requests issued from some Flash animations and Java applets.  To ease the work required to include the CSRF token in ajax requests rails now supports providing the token in a custom http header:

 X-CSRF-Token: ...

This fixes CVE-2011-0447