1. 08 10月, 2009 2 次提交
    • M
      Switch to on-by-default XSS escaping for rails. · 94159359
      Michael Koziarski 提交于
        This consists of:
      
        * String#html_safe! a method to mark a string as 'safe'
        * ActionView::SafeBuffer a string subclass which escapes anything unsafe which is concatenated to it
        * Calls to String#html_safe! throughout the rails helpers
        * a 'raw' helper which lets you concatenate trusted HTML from non-safety-aware sources (e.g. presantized strings in the DB)
        * New ERB implementation based on erubis which uses a SafeBuffer instead of a String
      
      Hat tip to Django for the inspiration.
      94159359
    • J
      Do not ignore .empty_directory files. · f27e7ebc
      José Valim 提交于
      Signed-off-by: NCarl Lerche <carllerche@mac.com>
      f27e7ebc
  2. 07 10月, 2009 6 次提交
  3. 06 10月, 2009 4 次提交
  4. 05 10月, 2009 7 次提交
  5. 04 10月, 2009 12 次提交
  6. 02 10月, 2009 3 次提交
  7. 01 10月, 2009 2 次提交
  8. 30 9月, 2009 4 次提交