1. 03 4月, 2010 1 次提交
    • W
      Refactored url_for in AV to have its own instances of the helpers instead of... · 3eb97531
      wycats 提交于
      Refactored url_for in AV to have its own instances of the helpers instead of proxying back to the controller. This potentially allows for more standalone usage of AV. It also kicked up a lot of dust in the tests, which were mocking out controllers to get this behavior. By moving it to the view, it made a lot of the tests more standalone (a win) 
      3eb97531
  2. 10 3月, 2010 1 次提交
  3. 21 2月, 2010 1 次提交
  4. 07 2月, 2010 1 次提交
  5. 02 2月, 2010 1 次提交
  6. 01 2月, 2010 2 次提交
    • Y
      For performance reasons, you can no longer call html_safe! on Strings.... · 4cbb9db0
      Yehuda Katz 提交于
      For performance reasons, you can no longer call html_safe! on Strings. Instead, all Strings are always not html_safe?. Instead, you can get a SafeBuffer from a String by calling #html_safe, which will SafeBuffer.new(self).
      
        * Additionally, instead of doing concat("</form>".html_safe), you can do
          safe_concat("</form>"), which will skip both the flag set, and the flag
          check.
        * For the first pass, I converted virtually all #html_safe!s to #html_safe,
          and the tests pass. A further optimization would be to try to use
          #safe_concat as much as possible, reducing the performance impact if
          we know up front that a String is safe.
      4cbb9db0
    • S
  7. 31 1月, 2010 2 次提交
  8. 28 1月, 2010 1 次提交
  9. 15 1月, 2010 1 次提交
  10. 14 1月, 2010 4 次提交
  11. 07 1月, 2010 1 次提交
  12. 03 1月, 2010 1 次提交
  13. 16 11月, 2009 1 次提交
  14. 08 10月, 2009 1 次提交
    • M
      Switch to on-by-default XSS escaping for rails. · 94159359
      Michael Koziarski 提交于
        This consists of:
      
        * String#html_safe! a method to mark a string as 'safe'
        * ActionView::SafeBuffer a string subclass which escapes anything unsafe which is concatenated to it
        * Calls to String#html_safe! throughout the rails helpers
        * a 'raw' helper which lets you concatenate trusted HTML from non-safety-aware sources (e.g. presantized strings in the DB)
        * New ERB implementation based on erubis which uses a SafeBuffer instead of a String
      
      Hat tip to Django for the inspiration.
      94159359
  15. 04 10月, 2009 1 次提交
  16. 12 9月, 2009 1 次提交
  17. 10 8月, 2009 1 次提交
  18. 09 8月, 2009 1 次提交
  19. 21 7月, 2009 1 次提交
  20. 20 7月, 2009 1 次提交
  21. 19 7月, 2009 2 次提交
  22. 03 7月, 2009 2 次提交
  23. 18 6月, 2009 1 次提交
  24. 09 6月, 2009 1 次提交
  25. 09 4月, 2009 1 次提交
  26. 27 2月, 2009 1 次提交
  27. 13 2月, 2009 1 次提交
  28. 11 2月, 2009 1 次提交
  29. 06 2月, 2009 1 次提交
  30. 01 2月, 2009 1 次提交
  31. 21 12月, 2008 1 次提交
  32. 20 7月, 2008 1 次提交
  33. 09 6月, 2008 1 次提交