1. 03 5月, 2010 1 次提交
  2. 03 4月, 2010 1 次提交
  3. 28 3月, 2010 1 次提交
  4. 12 3月, 2010 2 次提交
  5. 09 3月, 2010 1 次提交
  6. 08 3月, 2010 5 次提交
  7. 01 2月, 2010 1 次提交
    • Y
      For performance reasons, you can no longer call html_safe! on Strings.... · 4cbb9db0
      Yehuda Katz 提交于
      For performance reasons, you can no longer call html_safe! on Strings. Instead, all Strings are always not html_safe?. Instead, you can get a SafeBuffer from a String by calling #html_safe, which will SafeBuffer.new(self).
      
        * Additionally, instead of doing concat("</form>".html_safe), you can do
          safe_concat("</form>"), which will skip both the flag set, and the flag
          check.
        * For the first pass, I converted virtually all #html_safe!s to #html_safe,
          and the tests pass. A further optimization would be to try to use
          #safe_concat as much as possible, reducing the performance impact if
          we know up front that a String is safe.
      4cbb9db0
  8. 16 1月, 2010 1 次提交
  9. 11 1月, 2010 1 次提交
  10. 04 1月, 2010 2 次提交
  11. 26 12月, 2009 4 次提交
  12. 02 12月, 2009 1 次提交
  13. 09 10月, 2009 1 次提交
  14. 08 10月, 2009 1 次提交
    • M
      Switch to on-by-default XSS escaping for rails. · 94159359
      Michael Koziarski 提交于
        This consists of:
      
        * String#html_safe! a method to mark a string as 'safe'
        * ActionView::SafeBuffer a string subclass which escapes anything unsafe which is concatenated to it
        * Calls to String#html_safe! throughout the rails helpers
        * a 'raw' helper which lets you concatenate trusted HTML from non-safety-aware sources (e.g. presantized strings in the DB)
        * New ERB implementation based on erubis which uses a SafeBuffer instead of a String
      
      Hat tip to Django for the inspiration.
      94159359
  15. 16 8月, 2009 3 次提交
    • Y
      Caches and cache clearing seems to actually work, but the actual architecture... · 9b552fb3
      Yehuda Katz 提交于
      Caches and cache clearing seems to actually work, but the actual architecture is kind of messy. Next: CLEAN UP.
      9b552fb3
    • Y
      More cleanup of ActionView and reduction in need for blocks in some cases: · 9f5cd015
      Yehuda Katz 提交于
        * only one of partial_name or :as will be available as a local
        * `object` is removed
        * Simplify _layout_for in most cases.
          * Remove <% render :partial do |args| %>
          * <% render :partial do %> still works fine
      9f5cd015
    • Y
      Clean up ActionView some: · 27adcd1c
      Yehuda Katz 提交于
        * Call _evaluate_assigns_and_ivars at the two entry points so we don't have to
          do a check at every render.
        * Make template.render viable without having to go through a wrapper method
        * Remove old TemplateHandler#render(template, local_assigns) path so we don't have
          to set self.template every time we render a template.
        * Move Template rescuing code to Template#render so it gets caught every time.
        * Pull in some tests from Pratik that test render @object in ActionView
      27adcd1c
  16. 12 8月, 2009 2 次提交
  17. 09 8月, 2009 5 次提交
  18. 08 8月, 2009 2 次提交
  19. 07 8月, 2009 5 次提交
    • Y
      Get all ActionController partial rendering to use ActionView's partial code. Consequences: · bfe58ac0
      Yehuda Katz 提交于
        * It is not possible to always pre-determine the layout before going to ActionView.
          This was *already* broken for render :partial => @object, :layout => true. This is
          now handled by overriding render_to_body in layouts.rb and manually injecting the
          partial's response. This needs to be done in ActionController since ActionController
          knows enough to get _layout_for_option. There is probably a better abstraction here.
        * As a result, all partial rendering can correctly restrict their layouts to the mime
          type of the rendered partial. This could have previously caused a bug in some edge cases.
        * If other layout-like options are added, they might need to add special code for the
          case of render :partial. We should try to think of an alternate solution, if possible,
          but this works for the cases we know of now.
      bfe58ac0
    • Y
      Continue reworking the partial path. · d94ba112
      Yehuda Katz 提交于
        * TODO: Review ActionController calling render_template for certain partials.
          Might we be able to save logic by always delegating to AV's render_partial?
      d94ba112
    • Y
      Modify various partial methods to carry along the block that can be passed in with render · 493d84ce
      Yehuda Katz 提交于
        * _render_single_template, which renders a template without layout
        * _render_partial_unknown_type, which renders a partial of unknown type
          (the entry method for most partial rendering; supports strings, objects, and collections)
        * _render_partial_object, which renders a partial for a single object.
        * extracted _render_partial_path so it can be used to render the spacer without going
          through the public render :partial
      493d84ce
    • Y
      Some more AV work: · 59e475e3
      Yehuda Katz 提交于
        * rename _render_partial to _render_partial_unknown_type to reflect that for this call, 
        	we don't know the type.
        * Merge _render_partial_with_block and _render_partial_with_layout to _render_partial
          * TODO: Check to see if any more logic can be shared
          * TODO: See about streamlining block path so we can get rid of @_proc_for_layout
        * Remove @exempt_from_layout as it is no longer needed
      59e475e3
    • Y