This consists of:

  * String#html_safe! a method to mark a string as 'safe'
  * ActionView::SafeBuffer a string subclass which escapes anything unsafe which is concatenated to it
  * Calls to String#html_safe! throughout the rails helpers
  * a 'raw' helper which lets you concatenate trusted HTML from non-safety-aware sources (e.g. presantized strings in the DB)
  * New ERB implementation based on erubis which uses a SafeBuffer instead of a String

Hat tip to Django for the inspiration.

Allow fields_for on a nested_attributes association to accept an explicit collection to be used. [#2648 state:resolved]
Signed-off-by: NEloy Duran <eloy.de.enige@gmail.com>

Signed-off-by: NJosé Valim <jose.valim@gmail.com>

Signed-off-by: NPratik Naik <pratiknaik@gmail.com>

Signed-off-by: NYehuda Katz + Carl Lerche <ykatz+clerche@engineyard.com>

Made label target radio button tags with values. Radio button now respects inherited :index options when generating id.
Signed-off-by: NMichael Koziarski <michael@koziarski.com>

Signed-off-by: NDavid Heinemeier Hansson <david@loudthinking.com>

Changed API of NestedAttributes to take an array, or hash with index keys, of hashes that have the id on the inside of the attributes hash and updated the FormBuilder to produce such hashes. Also fixed NestedAttributes with composite ids.
Signed-off-by: NMichael Koziarski <michael@koziarski.com>
Signed-off-by: NEloy Duran <eloy.de.enige@gmail.com>
[#1892 state:committed]

Move checkbox hidden field before the actual checkbox so the actual value doesn't get clobbered [#1863 state:resolved]

Allowing an object to be passed explicitly to a fields_for with nested_attributes on one-to-one associations
Signed-off-by: NMichael Koziarski <michael@koziarski.com>
[#1849 state:committed]

Signed-Off-By: NMichael Koziarski <michael@koziarski.com>

[#1202 state:committed]

Signed-off-by: NJoshua Peek <josh@joshpeek.com>

Use output_buffer reader and writer methods exclusively instead of hitting the instance variable so others can override the methods.

Signed-off-by: NPratik Naik <pratiknaik@gmail.com>

Fixed that TextHelper#text_field would corrypt when raw HTML was used as the value (mchenryc, Kevin Glowacz) [#80 state:resolved]

Signed-off-by: NJoshua Peek <josh@joshpeek.com>

git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@9088 5ecf4fe2-1ee6-0310-87b1-e25e094e27de

Introduce the :index option for form_for and fields_for to simplify multi-model forms (see http://railscasts.com/episodes/75). Closes #9883.


git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@8786 5ecf4fe2-1ee6-0310-87b1-e25e094e27de

git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@8564 5ecf4fe2-1ee6-0310-87b1-e25e094e27de

git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@8253 5ecf4fe2-1ee6-0310-87b1-e25e094e27de

git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@8252 5ecf4fe2-1ee6-0310-87b1-e25e094e27de

git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@8045 5ecf4fe2-1ee6-0310-87b1-e25e094e27de

FormHelper's auto_index should use #to_param instead of #id_before_type_cast.  Closes #9994 [mattly]

git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@8033 5ecf4fe2-1ee6-0310-87b1-e25e094e27de

git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@8007 5ecf4fe2-1ee6-0310-87b1-e25e094e27de

git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@7779 5ecf4fe2-1ee6-0310-87b1-e25e094e27de

Allow ability to disable request forgery protection, disable it in test mode by default.  Closes #9693 [lifofifo]

git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@7668 5ecf4fe2-1ee6-0310-87b1-e25e094e27de

Merge csrf_killer plugin into rails.  Adds RequestForgeryProtection model that verifies session-specific _tokens for non-GET requests.  [Rick]

git-svn-id: http://svn-commit.rubyonrails.org/rails/trunk@7592 5ecf4fe2-1ee6-0310-87b1-e25e094e27de