1. 07 1月, 2020 9 次提交
  2. 06 1月, 2020 5 次提交
  3. 05 1月, 2020 8 次提交
  4. 04 1月, 2020 13 次提交
  5. 03 1月, 2020 5 次提交
    • M
      When all IPs are trusted, use the furthest away · d160a8d6
      Matthew Draper 提交于
      Scenario: we have a REMOTE_ADDR of `127.0.0.1`, and X-Forwarded-For is
      `A, B, C`.
      
      Without any relevant trust, the `remote_ip` is `C`.
      
      If `C` is trusted, then the `remote_ip` is `B`.
      
      If `B` and `C` are trusted, then the `remote_ip` is `A`.
      
      If all of `A`, `B`, and `C` are trusted, then the `remote_ip` should
      still be `A`: if our trust was sufficient to get that far out before,
      trusting something else should not have us fall back to `127.0.0.1`.
      
      It is this last situation that we're correcting here:
      
      We trust `A` to give us accurate X-Forwarded-For information, yet it has
      chosen to leave it unset. Therefore, `A` is telling us that it is itself
      the client.
      d160a8d6
    • R
      14149105
    • R
      Merge pull request #38119 from alipman88/enforce_fresh_etag_after_collection_changes · 44af3395
      Rafael França 提交于
      Fix regression, enforce fresh ETag header after collection contents change
      44af3395
    • A
      Enforce fresh ETag header after collection changes · 58b04096
      Aaron Lipman 提交于
      Add ActiveRecord::Relation#cache_key_with_version. This method will be
      used by ActionController::ConditionalGet to ensure that when collection
      cache versioning is enabled, requests using ConditionalGet don't return
      the same ETag header after a collection is modified.
      
      Prior to the introduction of collection cache versioning in
      4f2ac80d, all collection cache keys
      included a version. However, with cache versioning enabled, collection
      cache keys remain constant. In turn, ETag headers remain constant,
      rendering them ineffective.
      
      This commit takes the cache_key_with_version method used for individual
      Active Record objects (from aa8749eb),
      and adds it to collections.
      58b04096
    • R
      Merge pull request #38140 from bogdanvlviv/HostAuthorization-to-Configuring-Middleware-guide · b8dc1305
      Rafael França 提交于
      Add `ActionDispatch::HostAuthorization` to "Configuring Middleware" guide [ci skip]
      b8dc1305