actionpack 1.12.5 → 1.13.0

data/lib/action_controller/cgi_ext/raw_post_data_fix.rb

@@ -1,27 +1,48 @@
 class CGI #:nodoc:
-  # Add @request.env['RAW_POST_DATA'] for the vegans.
   module QueryExtension
     # Initialize the data from the query.
     #
     # Handles multipart forms (in particular, forms that involve file uploads).
     # Reads query parameters in the @params field, and cookies into @cookies.
-    def initialize_query()
+    def initialize_query
       @cookies = CGI::Cookie::parse(env_table['HTTP_COOKIE'] || env_table['COOKIE'])
 
-      #fix some strange request environments
+      # Fix some strange request environments.
       if method = env_table['REQUEST_METHOD']
         method = method.to_s.downcase.intern
       else
         method = :get
       end
 
-      if method == :post && (boundary = multipart_form_boundary)
-        @multipart = true
-        @params = read_multipart(boundary, Integer(env_table['CONTENT_LENGTH']))
-      else
-        @multipart = false
-        @params = CGI::parse(read_query_params(method) || "")
+      # POST assumes missing Content-Type is application/x-www-form-urlencoded.
+      content_type = env_table['CONTENT_TYPE']
+      if content_type.blank? && method == :post
+        content_type = 'application/x-www-form-urlencoded'
       end
+
+      # Force content length to zero if missing.
+      content_length = env_table['CONTENT_LENGTH'].to_i
+
+      # Set multipart to false by default.
+      @multipart = false
+
+      # POST and PUT may have params in entity body. If content type is
+      # missing for POST, assume urlencoded. If content type is missing
+      # for PUT, don't assume anything and don't parse the parameters:
+      # it's likely binary data.
+      #
+      # The other HTTP methods have their params in the query string.
+      if method == :post || method == :put
+        if boundary = extract_multipart_form_boundary(content_type)
+          @multipart = true
+          @params = read_multipart(boundary, content_length)
+        elsif content_type.blank? || content_type !~ %r{application/x-www-form-urlencoded}i
+          read_params(method, content_length)
+          @params = {}
+        end
+      end
+
+      @params ||= CGI.parse(read_params(method, content_length))
     end
 
     private
@@ -29,16 +50,16 @@ class CGI #:nodoc:
         MULTIPART_FORM_BOUNDARY_RE = %r|\Amultipart/form-data.*boundary=\"?([^\";,]+)\"?|n #"
       end
 
-      def multipart_form_boundary
-        MULTIPART_FORM_BOUNDARY_RE.match(env_table['CONTENT_TYPE']).to_a.pop
+      def extract_multipart_form_boundary(content_type)
+        MULTIPART_FORM_BOUNDARY_RE.match(content_type).to_a.pop
       end
 
       if defined? MOD_RUBY
-        def read_params_from_query
+        def read_query
           Apache::request.args || ''
         end
       else
-        def read_params_from_query
+        def read_query
           # fixes CGI querystring parsing for lighttpd
           env_qs = env_table['QUERY_STRING']
           if env_qs.blank? && !(uri = env_table['REQUEST_URI']).blank?
@@ -49,25 +70,25 @@ class CGI #:nodoc:
         end
       end
 
-      def read_params_from_post
+      def read_body(content_length)
         stdinput.binmode if stdinput.respond_to?(:binmode)
-        content = stdinput.read(Integer(env_table['CONTENT_LENGTH'])) || ''
-        # fix for Safari Ajax postings that always append \000
+        content = stdinput.read(content_length) || ''
+        # Fix for Safari Ajax postings that always append \000
         content.chop! if content[-1] == 0
-        content.gsub! /&_=$/, ''
+        content.gsub!(/&_=$/, '')
         env_table['RAW_POST_DATA'] = content.freeze
       end
 
-      def read_query_params(method)
+      def read_params(method, content_length)
         case method
           when :get
-            read_params_from_query
+            read_query
           when :post, :put
-            read_params_from_post
+            read_body(content_length)
           when :cmd
             read_from_cmdline
-          else # when :head, :delete, :options
-            read_params_from_query
+          else # :head, :delete, :options, :trace, :connect
+            read_query
         end
       end
   end # module QueryExtension

data/lib/action_controller/cgi_process.rb

@@ -8,13 +8,13 @@ module ActionController #:nodoc:
     # sessions (large performance increase if sessions are not needed). The <tt>session_options</tt> are the same as for CGI::Session:
     #
     # * <tt>:database_manager</tt> - standard options are CGI::Session::FileStore, CGI::Session::MemoryStore, and CGI::Session::PStore
-    #   (default). Additionally, there is CGI::Session::DRbStore and CGI::Session::ActiveRecordStore. Read more about these in 
+    #   (default). Additionally, there is CGI::Session::DRbStore and CGI::Session::ActiveRecordStore. Read more about these in
     #   lib/action_controller/session.
     # * <tt>:session_key</tt> - the parameter name used for the session id. Defaults to '_session_id'.
     # * <tt>:session_id</tt> - the session id to use.  If not provided, then it is retrieved from the +session_key+ parameter
     #   of the request, or automatically generated for a new session.
     # * <tt>:new_session</tt> - if true, force creation of a new session.  If not set, a new session is only created if none currently
-    #   exists.  If false, a new session is never created, and if none currently exists and the +session_id+ option is not set, 
+    #   exists.  If false, a new session is never created, and if none currently exists and the +session_id+ option is not set,
     #   an ArgumentError is raised.
     # * <tt>:session_expires</tt> - the time the current session expires, as a +Time+ object.  If not set, the session will continue
     #   indefinitely.
@@ -22,10 +22,10 @@ module ActionController #:nodoc:
     #   server.
     # * <tt>:session_secure</tt> - if +true+, this session will only work over HTTPS.
     # * <tt>:session_path</tt> - the path for which this session applies.  Defaults to the directory of the CGI script.
-    def self.process_cgi(cgi = CGI.new, session_options = {}) 
+    def self.process_cgi(cgi = CGI.new, session_options = {})
       new.process_cgi(cgi, session_options)
     end
-  
+
     def process_cgi(cgi, session_options = {}) #:nodoc:
       process(CgiRequest.new(cgi, session_options), CgiResponse.new(cgi)).out
     end
@@ -51,7 +51,7 @@ module ActionController #:nodoc:
       if (qs = @cgi.query_string) && !qs.empty?
         qs
       elsif uri = @env['REQUEST_URI']
-        parts = uri.split('?')  
+        parts = uri.split('?')
         parts.shift
         parts.join('?')
       else
@@ -60,7 +60,8 @@ module ActionController #:nodoc:
     end
 
     def query_parameters
-      (qs = self.query_string).empty? ? {} : CGIMethods.parse_query_parameters(qs)
+      @query_parameters ||=
+        (qs = self.query_string).empty? ? {} : CGIMethods.parse_query_parameters(qs)
     end
 
     def request_parameters
@@ -71,7 +72,7 @@ module ActionController #:nodoc:
           CGIMethods.parse_request_parameters(@cgi.params)
         end
     end
-   
+
     def cookies
       @cgi.cookies.freeze
     end
@@ -101,15 +102,26 @@ module ActionController #:nodoc:
     end
 
     def session
-      unless @session
+      unless defined?(@session)
         if @session_options == false
           @session = Hash.new
         else
           stale_session_check! do
-            if session_options_with_string_keys['new_session'] == true
-              @session = new_session
-            else
-              @session = CGI::Session.new(@cgi, session_options_with_string_keys)
+            case value = session_options_with_string_keys['new_session']
+              when true
+                @session = new_session
+              when false
+                begin
+                  @session = CGI::Session.new(@cgi, session_options_with_string_keys)
+                # CGI::Session raises ArgumentError if 'new_session' == false
+                # and no session cookie or query param is present.
+                rescue ArgumentError
+                  @session = Hash.new
+                end
+              when nil
+                @session = CGI::Session.new(@cgi, session_options_with_string_keys)
+              else
+                raise ArgumentError, "Invalid new_session option: #{value}"
             end
             @session['__valid_session']
           end
@@ -119,7 +131,7 @@ module ActionController #:nodoc:
     end
 
     def reset_session
-      @session.delete if CGI::Session === @session
+      @session.delete if defined?(@session) && @session.is_a?(CGI::Session)
       @session = new_session
     end
 
@@ -141,11 +153,11 @@ module ActionController #:nodoc:
       def stale_session_check!
         yield
       rescue ArgumentError => argument_error
-        if argument_error.message =~ %r{undefined class/module (\w+)}
+        if argument_error.message =~ %r{undefined class/module ([\w:]+)}
           begin
             Module.const_missing($1)
           rescue LoadError, NameError => const_error
-            raise ActionController::SessionRestoreError, <<end_msg
+            raise ActionController::SessionRestoreError, <<-end_msg
 Session contains objects whose class definition isn\'t available.
 Remember to require the classes for all objects kept in the session.
 (Original exception: #{const_error.message} [#{const_error.class}])
@@ -159,7 +171,7 @@ end_msg
       end
 
       def session_options_with_string_keys
-        @session_options_with_string_keys ||= DEFAULT_SESSION_OPTIONS.merge(@session_options).inject({}) { |options, (k,v)| options[k.to_s] = v; options }
+        @session_options_with_string_keys ||= DEFAULT_SESSION_OPTIONS.merge(@session_options).stringify_keys
       end
   end
 
@@ -170,38 +182,49 @@ end_msg
     end
 
     def out(output = $stdout)
-      convert_content_type!(@headers)
+      convert_content_type!
+      set_content_length!
+
       output.binmode      if output.respond_to?(:binmode)
       output.sync = false if output.respond_to?(:sync=)
-      
+
       begin
         output.write(@cgi.header(@headers))
 
         if @cgi.send(:env_table)['REQUEST_METHOD'] == 'HEAD'
           return
         elsif @body.respond_to?(:call)
+          # Flush the output now in case the @body Proc uses
+          # #syswrite.
+          output.flush if output.respond_to?(:flush)
           @body.call(self, output)
         else
           output.write(@body)
         end
 
         output.flush if output.respond_to?(:flush)
-      rescue Errno::EPIPE => e
-        # lost connection to the FCGI process -- ignore the output, then
+      rescue Errno::EPIPE, Errno::ECONNRESET
+        # lost connection to parent process, ignore output
       end
     end
 
     private
-      def convert_content_type!(headers)
-        if header = headers.delete("Content-Type")
-          headers["type"] = header
+      def convert_content_type!
+        if content_type = @headers.delete("Content-Type")
+          @headers["type"] = content_type
         end
-        if header = headers.delete("Content-type")
-          headers["type"] = header
+        if content_type = @headers.delete("Content-type")
+          @headers["type"] = content_type
         end
-        if header = headers.delete("content-type")
-          headers["type"] = header
+        if content_type = @headers.delete("content-type")
+          @headers["type"] = content_type
         end
       end
+      
+      # Don't set the Content-Length for block-based bodies as that would mean reading it all into memory. Not nice
+      # for, say, a 2GB streaming file.
+      def set_content_length!
+        @headers["Content-Length"] = @body.size unless @body.respond_to?(:call)
+      end
   end
 end

data/lib/action_controller/components.rb

@@ -50,14 +50,9 @@ module ActionController #:nodoc:
       base.send :attr_accessor, :parent_controller
       
       base.class_eval do
-        alias_method :process_cleanup_without_components, :process_cleanup
-        alias_method :process_cleanup, :process_cleanup_with_components
-        
-        alias_method :set_session_options_without_components, :set_session_options
-        alias_method :set_session_options, :set_session_options_with_components
-        
-        alias_method :flash_without_components, :flash
-        alias_method :flash, :flash_with_components
+        alias_method_chain :process_cleanup, :components
+        alias_method_chain :set_session_options, :components
+        alias_method_chain :flash, :components
 
         alias_method :component_request?, :parent_controller       
       end
@@ -80,11 +75,13 @@ module ActionController #:nodoc:
       #     will also use /code/weblog/components as template root 
       #     and find templates in /code/weblog/components/admin/parties/users/
       def uses_component_template_root
-        path_of_calling_controller = File.dirname(caller[0].split(/:\d+:/).first)
-        path_of_controller_root    = path_of_calling_controller.sub(/#{controller_path.split("/")[0..-2]}$/, "") # " (for ruby-mode)
+        path_of_calling_controller = File.dirname(caller[1].split(/:\d+:/, 2).first)
+        path_of_controller_root    = path_of_calling_controller.sub(/#{Regexp.escape(File.dirname(controller_path))}$/, "")
 
         self.template_root = path_of_controller_root
       end
+
+      deprecate :uses_component_template_root => 'Components are deprecated and will be removed in Rails 2.0.'
     end
 
     module InstanceMethods
@@ -116,27 +113,26 @@ module ActionController #:nodoc:
         end
 
         def flash_with_components(refresh = false) #:nodoc:
-          if @flash.nil? || refresh
-            @flash = 
-              if @parent_controller
+          if !defined?(@_flash) || refresh
+            @_flash =
+              if defined?(@parent_controller)
                 @parent_controller.flash
               else
                 flash_without_components
               end
           end
-          
-          @flash
+          @_flash
         end
 
       private
         def component_response(options, reuse_response)
           klass    = component_class(options)
           request  = request_for_component(klass.controller_name, options)
-          response = reuse_response ? @response : @response.dup
+          new_response = reuse_response ? response : response.dup
 
-          klass.process_with_components(request, response, self)
+          klass.process_with_components(request, new_response, self)
         end
-        
+
         # determine the controller class for the component request
         def component_class(options)
           if controller = options[:controller]
@@ -145,22 +141,22 @@ module ActionController #:nodoc:
             self.class
           end
         end
-        
+
         # Create a new request object based on the current request.
         # The new request inherits the session from the current request,
         # bypassing any session options set for the component controller's class
         def request_for_component(controller_name, options)
-          request         = @request.dup
-          request.session = @request.session
-        
-          request.instance_variable_set(
+          new_request         = request.dup
+          new_request.session = request.session
+
+          new_request.instance_variable_set(
             :@parameters,
             (options[:params] || {}).with_indifferent_access.update(
               "controller" => controller_name, "action" => options[:action], "id" => options[:id]
             )
           )
-          
-          request
+
+          new_request
         end
 
         def component_logging(options)

data/lib/action_controller/cookies.rb

@@ -4,13 +4,14 @@ module ActionController #:nodoc:
   # itself back -- just the value it holds). Examples for writing:
   #
   #   cookies[:user_name] = "david" # => Will set a simple session cookie
-  #   cookies[:login] = { :value => "XJ-122", :expires => Time.now + 360} # => Will set a cookie that expires in 1 hour
-  #   
+  #   cookies[:login] = { :value => "XJ-122", :expires => 1.hour.from_now }
+  #   # => Will set a cookie that expires in 1 hour
+  #
   # Examples for reading:
   #
   #   cookies[:user_name] # => "david"
   #   cookies.size         # => 2
-  # 
+  #
   # Example for deleting:
   #
   #   cookies.delete :user_name
@@ -32,13 +33,13 @@ module ActionController #:nodoc:
 
       # Deprecated cookie writer method
       def cookie(*options)
-        @response.headers["cookie"] << CGI::Cookie.new(*options)
+        response.headers['cookie'] << CGI::Cookie.new(*options)
       end
   end
-  
+
   class CookieJar < Hash #:nodoc:
     def initialize(controller)
-      @controller, @cookies = controller, controller.instance_variable_get("@cookies")
+      @controller, @cookies = controller, controller.request.cookies
       super()
       update(@cookies)
     end
@@ -48,7 +49,7 @@ module ActionController #:nodoc:
     def [](name)
       @cookies[name.to_s].value.first if @cookies[name.to_s] && @cookies[name.to_s].respond_to?(:value)
     end
-    
+
     def []=(name, options)
       if options.is_a?(Hash)
         options = options.inject({}) { |options, pair| options[pair.first.to_s] = pair.last; options }
@@ -56,10 +57,10 @@ module ActionController #:nodoc:
       else
         options = { "name" => name.to_s, "value" => options }
       end
-      
+
       set_cookie(options)
     end
-    
+
     # Removes the cookie on the client machine by setting the value to an empty string
     # and setting its expiration date into the past
     def delete(name)

data/lib/action_controller/{dependencies.rb → deprecated_dependencies.rb}

@@ -1,33 +1,10 @@
 module ActionController #:nodoc:
   module Dependencies #:nodoc:
-    def self.append_features(base)
-      super
+    def self.included(base)
       base.extend(ClassMethods)
     end
 
-    # Dependencies control what classes are needed for the controller to run its course. This is an alternative to doing explicit
-    # +require+ statements that bring a number of benefits. It's more succinct, communicates what type of dependency we're talking about,
-    # can trigger special behavior (as in the case of +observer+), and enables Rails to be clever about reloading in cached environments
-    # like FCGI. Example:
-    #
-    #   class ApplicationController < ActionController::Base
-    #     model    :account, :company, :person, :project, :category
-    #     helper   :access_control
-    #     service  :notifications, :billings
-    #     observer :project_change_observer
-    #   end
-    #
-    # Please note that a controller like ApplicationController will automatically attempt to require_dependency on a model of its 
-    # singuralized name and a helper of its name. If nothing is found, no error is raised. This is especially useful for concrete 
-    # controllers like PostController:
-    #
-    #   class PostController < ApplicationController
-    #     # model  :post (already required)
-    #     # helper :post (already required)
-    #   end
-    #
-    # Also note, that if the models follow the pattern of just 1 class per file in the form of MyClass => my_class.rb, then these
-    # classes don't have to be required as Active Support will auto-require them.
+    # Deprecated module. The responsibility of loading dependencies belong with Active Support now.
     module ClassMethods #:nodoc:
       # Specifies a variable number of models that this controller depends on. Models are normally Active Record classes or a similar
       # backend for modelling entity classes.
@@ -35,6 +12,7 @@ module ActionController #:nodoc:
         require_dependencies(:model, models)
         depend_on(:model, models)
       end
+      deprecate :model
 
       # Specifies a variable number of services that this controller depends on. Services are normally singletons or factories, like
       # Action Mailer service or a Payment Gateway service.
@@ -42,6 +20,7 @@ module ActionController #:nodoc:
         require_dependencies(:service, services)
         depend_on(:service, services)
       end
+      deprecate :service
       
       # Specifies a variable number of observers that are to govern when this controller is handling actions. The observers will
       # automatically have .instance called on them to make them active on assignment.
@@ -50,16 +29,19 @@ module ActionController #:nodoc:
         depend_on(:observer, observers)
         instantiate_observers(observers)
       end
+      deprecate :observer
 
       # Returns an array of symbols that specify the dependencies on a given layer. For the example at the top, calling
       # <tt>ApplicationController.dependencies_on(:model)</tt> would return <tt>[:account, :company, :person, :project, :category]</tt>
       def dependencies_on(layer)
         read_inheritable_attribute("#{layer}_dependencies")
       end
-    
+      deprecate :dependencies_on
+
       def depend_on(layer, dependencies) #:nodoc:
         write_inheritable_array("#{layer}_dependencies", dependencies)
       end
+      deprecate :depend_on
 
       private
         def instantiate_observers(observers)
@@ -72,7 +54,7 @@ module ActionController #:nodoc:
               require_dependency(dependency.to_s)
             rescue LoadError => e
               raise LoadError.new("Missing #{layer} #{dependency}.rb").copy_blame!(e)
-            rescue Object => exception
+            rescue Exception => exception  # error from loaded file
               exception.blame_file! "=> #{layer} #{dependency}.rb"
               raise
             end