actionpack 1.13.6 → 2.0.0

data/lib/action_controller/mime_types.rb

@@ -0,0 +1,20 @@
+# Build list of Mime types for HTTP responses
+# http://www.iana.org/assignments/media-types/
+
+Mime::Type.register "*/*", :all
+Mime::Type.register "text/plain", :text, [], %w(txt)
+Mime::Type.register "text/html", :html, %w( application/xhtml+xml ), %w( xhtml )
+Mime::Type.register "text/javascript", :js, %w( application/javascript application/x-javascript )
+Mime::Type.register "text/css", :css
+Mime::Type.register "text/calendar", :ics
+Mime::Type.register "text/csv", :csv
+Mime::Type.register "application/xml", :xml, %w( text/xml application/x-xml )
+Mime::Type.register "application/rss+xml", :rss
+Mime::Type.register "application/atom+xml", :atom
+Mime::Type.register "application/x-yaml", :yaml, %w( text/yaml )
+
+Mime::Type.register "multipart/form-data", :multipart_form
+Mime::Type.register "application/x-www-form-urlencoded", :url_encoded_form
+
+# http://www.ietf.org/rfc/rfc4627.txt
+Mime::Type.register "application/json", :json, %w( text/x-json )

data/lib/action_controller/polymorphic_routes.rb

@@ -0,0 +1,88 @@
+module ActionController
+  module PolymorphicRoutes
+    def polymorphic_url(record_or_hash_or_array, options = {})
+      record = extract_record(record_or_hash_or_array)
+
+      namespace = extract_namespace(record_or_hash_or_array)
+      
+      args = case record_or_hash_or_array
+        when Hash;  [ record_or_hash_or_array ]
+        when Array; record_or_hash_or_array.dup
+        else        [ record_or_hash_or_array ]
+      end
+
+      inflection =
+        case
+        when options[:action] == "new"
+          args.pop
+          :singular
+        when record.respond_to?(:new_record?) && record.new_record?
+          args.pop
+          :plural
+        else
+          :singular
+        end
+      
+      named_route = build_named_route_call(record_or_hash_or_array, namespace, inflection, options)
+      send!(named_route, *args)
+    end
+
+    def polymorphic_path(record_or_hash_or_array)
+      polymorphic_url(record_or_hash_or_array, :routing_type => :path)
+    end
+
+    %w(edit new formatted).each do |action|
+      module_eval <<-EOT, __FILE__, __LINE__
+        def #{action}_polymorphic_url(record_or_hash)
+          polymorphic_url(record_or_hash, :action => "#{action}")
+        end
+
+        def #{action}_polymorphic_path(record_or_hash)
+          polymorphic_url(record_or_hash, :action => "#{action}", :routing_type => :path)
+        end
+      EOT
+    end
+
+
+    private
+      def action_prefix(options)
+        options[:action] ? "#{options[:action]}_" : ""
+      end
+
+      def routing_type(options)
+        "#{options[:routing_type] || "url"}"
+      end
+
+      def build_named_route_call(records, namespace, inflection, options = {})
+        records = Array.new([extract_record(records)]) unless records.is_a?(Array)        
+        base_segment = "#{RecordIdentifier.send!("#{inflection}_class_name", records.pop)}_"
+
+        method_root = records.reverse.inject(base_segment) do |string, name|
+          segment = "#{RecordIdentifier.send!("singular_class_name", name)}_"
+          segment << string
+        end
+
+        action_prefix(options) + namespace + method_root + routing_type(options)
+      end
+
+      def extract_record(record_or_hash_or_array)
+        case record_or_hash_or_array
+          when Array; record_or_hash_or_array.last
+          when Hash;  record_or_hash_or_array[:id]
+          else        record_or_hash_or_array
+        end
+      end
+      
+      def extract_namespace(record_or_hash_or_array)
+        returning "" do |namespace|
+          if record_or_hash_or_array.is_a?(Array)
+            record_or_hash_or_array.delete_if do |record_or_namespace|
+              if record_or_namespace.is_a?(String) || record_or_namespace.is_a?(Symbol)
+                namespace << "#{record_or_namespace.to_s}_"
+              end
+            end
+          end  
+        end
+      end
+  end
+end

data/lib/action_controller/record_identifier.rb

@@ -0,0 +1,91 @@
+module ActionController  
+  # The record identifier encapsulates a number of naming conventions for dealing with records, like Active Records or 
+  # Active Resources or pretty much any other model type that has an id. These patterns are then used to try elevate
+  # the view actions to a higher logical level. Example:
+  #
+  #   # routes
+  #   map.resources :posts
+  #
+  #   # view
+  #   <% div_for(post) do %>     <div id="post_45" class="post">
+  #     <%= post.body %>           What a wonderful world!
+  #   <% end %>                  </div>
+  #
+  #   # controller
+  #   def destroy
+  #     post = Post.find(params[:id])
+  #     post.destroy
+  #
+  #     respond_to do |format|
+  #       format.html { redirect_to(post) } # Calls polymorphic_url(post) which in turn calls post_url(post)
+  #       format.js do
+  #         # Calls: new Effect.fade('post_45');
+  #         render(:update) { |page| page[post].visual_effect(:fade) }
+  #       end
+  #     end
+  #   end
+  #
+  # As the example above shows, you can stop caring to a large extent what the actual id of the post is. You just know
+  # that one is being assigned and that the subsequent calls in redirect_to and the RJS expect that same naming 
+  # convention and allows you to write less code if you follow it.
+  module RecordIdentifier
+    extend self
+
+    # Returns plural/singular for a record or class. Example:
+    #
+    #   partial_path(post)   # => "posts/post"
+    #   partial_path(Person) # => "people/person"
+    def partial_path(record_or_class)
+      klass = class_from_record_or_class(record_or_class)
+      "#{klass.name.tableize}/#{klass.name.demodulize.underscore}"
+    end
+
+    # The DOM class convention is to use the singular form of an object or class. Examples:
+    #
+    #   dom_class(post)   # => "post"
+    #   dom_class(Person) # => "person"
+    #
+    # If you need to address multiple instances of the same class in the same view, you can prefix the dom_class:
+    #
+    #   dom_class(post, :edit)   # => "edit_post"
+    #   dom_class(Person, :edit) # => "edit_person"
+    def dom_class(record_or_class, prefix = nil)
+      [ prefix, singular_class_name(record_or_class) ].compact * '_'
+    end
+
+    # The DOM class convention is to use the singular form of an object or class with the id following an underscore. 
+    # If no id is found, prefix with "new_" instead. Examples:
+    #
+    #   dom_class(Post.new(:id => 45)) # => "post_45"
+    #   dom_class(Post.new)            # => "new_post"
+    #
+    # If you need to address multiple instances of the same class in the same view, you can prefix the dom_id:
+    #
+    #   dom_class(Post.new(:id => 45), :edit) # => "edit_post_45"
+    def dom_id(record, prefix = nil) 
+      prefix ||= 'new' unless record.id
+      [ prefix, singular_class_name(record), record.id ].compact * '_'
+    end
+
+    # Returns the plural class name of a record or class. Examples:
+    #
+    #   plural_class_name(post)             # => "posts"
+    #   plural_class_name(Highrise::Person) # => "highrise_people"
+    def plural_class_name(record_or_class)
+      singular_class_name(record_or_class).pluralize
+    end
+
+    # Returns the singular class name of a record or class. Examples:
+    #
+    #   singular_class_name(post)             # => "post"
+    #   singular_class_name(Highrise::Person) # => "highrise_person"
+    def singular_class_name(record_or_class)
+      class_from_record_or_class(record_or_class).name.underscore.tr('/', '_')
+    end
+
+    private
+      def class_from_record_or_class(record_or_class)
+        record_or_class.is_a?(Class) ? record_or_class : record_or_class.class
+      end
+  end
+end

data/lib/action_controller/request.rb

@@ -1,27 +1,38 @@
+require 'tempfile'
+require 'stringio'
+require 'strscan'
+
 module ActionController
-  # Subclassing AbstractRequest makes these methods available to the request objects used in production and testing,
-  # CgiRequest and TestRequest
+  # HTTP methods which are accepted by default. 
+  ACCEPTED_HTTP_METHODS = Set.new(%w( get head put post delete ))
+
+  # CgiRequest and TestRequest provide concrete implementations.
   class AbstractRequest
     cattr_accessor :relative_url_root
+    remove_method :relative_url_root
 
-    # Returns the hash of environment variables for this request,
+    # The hash of environment variables for this request,
     # such as { 'RAILS_ENV' => 'production' }.
     attr_reader :env
 
-    # Returns both GET and POST parameters in a single hash.
-    def parameters
-      @parameters ||= request_parameters.update(query_parameters).update(path_parameters).with_indifferent_access
+    # The true HTTP request method as a lowercase symbol, such as :get.
+    # UnknownHttpMethod is raised for invalid methods not listed in ACCEPTED_HTTP_METHODS.
+    def request_method
+      @request_method ||= begin
+        method = ((@env['REQUEST_METHOD'] == 'POST' && !parameters[:_method].blank?) ? parameters[:_method].to_s : @env['REQUEST_METHOD']).downcase
+        if ACCEPTED_HTTP_METHODS.include?(method)
+          method.to_sym
+        else
+          raise UnknownHttpMethod, "#{method}, accepted HTTP methods are #{ACCEPTED_HTTP_METHODS.to_a.to_sentence}"
+        end
+      end
     end
 
-    # Returns the HTTP request method as a lowercase symbol (:get, for example). Note, HEAD is returned as :get
-    # since the two are supposedly to be functionaly equivilent for all purposes except that HEAD won't return a response
-    # body (which Rails also takes care of elsewhere).
+    # The HTTP request method as a lowercase symbol, such as :get.
+    # Note, HEAD is returned as :get since the two are functionally
+    # equivalent from the application's perspective.
     def method
-      @request_method ||= (!parameters[:_method].blank? && @env['REQUEST_METHOD'] == 'POST') ?
-        parameters[:_method].to_s.downcase.to_sym :
-        @env['REQUEST_METHOD'].downcase.to_sym
-      
-      @request_method == :head ? :get : @request_method
+      request_method == :head ? :get : request_method
     end
 
     # Is this a GET (or HEAD) request?  Equivalent to request.method == :get
@@ -31,63 +42,83 @@ module ActionController
 
     # Is this a POST request?  Equivalent to request.method == :post
     def post?
-      method == :post
+      request_method == :post
     end
 
     # Is this a PUT request?  Equivalent to request.method == :put
     def put?
-      method == :put
+      request_method == :put
     end
 
     # Is this a DELETE request?  Equivalent to request.method == :delete
     def delete?
-      method == :delete
+      request_method == :delete
     end
 
-    # Is this a HEAD request?  HEAD is mapped as :get for request.method, so here we ask the 
-    # REQUEST_METHOD header directly. Thus, for head, both get? and head? will return true.
+    # Is this a HEAD request? request.method sees HEAD as :get, so check the
+    # HTTP method directly.
     def head?
-      @env['REQUEST_METHOD'].downcase.to_sym == :head
+      request_method == :head
     end
 
-    # Determine whether the body of a HTTP call is URL-encoded (default)
-    # or matches one of the registered param_parsers. 
+    def headers
+      @env
+    end
+
+    def content_length
+      @content_length ||= env['CONTENT_LENGTH'].to_i
+    end
+
+    # The MIME type of the HTTP request, such as Mime::XML.
     #
     # For backward compatibility, the post format is extracted from the
     # X-Post-Data-Format HTTP header if present.
     def content_type
-      @content_type ||=
-        begin
-          content_type = @env['CONTENT_TYPE'].to_s.downcase
-          
-          if x_post_format = @env['HTTP_X_POST_DATA_FORMAT']
-            case x_post_format.to_s.downcase
-            when 'yaml'
-              content_type = 'application/x-yaml'
-            when 'xml'
-              content_type = 'application/xml'
-            end
-          end
-          
-          Mime::Type.lookup(content_type)
-        end
+      @content_type ||= Mime::Type.lookup(content_type_without_parameters)
     end
 
     # Returns the accepted MIME type for the request
     def accepts
       @accepts ||=
         if @env['HTTP_ACCEPT'].to_s.strip.empty?
-          [ content_type, Mime::ALL ]
+          [ content_type, Mime::ALL ].compact # make sure content_type being nil is not included
         else
           Mime::Type.parse(@env['HTTP_ACCEPT'])
         end
     end
 
+    # Returns the Mime type for the format used in the request. If there is no format available, the first of the 
+    # accept types will be used. Examples:
+    #
+    #   GET /posts/5.xml   | request.format => Mime::XML
+    #   GET /posts/5.xhtml | request.format => Mime::HTML
+    #   GET /posts/5       | request.format => request.accepts.first (usually Mime::HTML for browsers)
+    def format
+      @format ||= parameters[:format] ? Mime::Type.lookup_by_extension(parameters[:format]) : accepts.first
+    end
+    
+    
+    # Sets the format by string extension, which can be used to force custom formats that are not controlled by the extension.
+    # Example:
+    #
+    #   class ApplicationController < ActionController::Base
+    #     before_filter :adjust_format_for_iphone
+    #   
+    #     private
+    #       def adjust_format_for_iphone
+    #         request.format = :iphone if request.env["HTTP_USER_AGENT"][/iPhone/]
+    #       end
+    #   end
+    def format=(extension)
+      parameters[:format] = extension.to_s
+      format
+    end
+
     # Returns true if the request's "X-Requested-With" header contains
     # "XMLHttpRequest". (The Prototype Javascript library sends this header with
     # every Ajax request.)
     def xml_http_request?
-      not /XMLHttpRequest/i.match(@env['HTTP_X_REQUESTED_WITH']).nil?
+      !(@env['HTTP_X_REQUESTED_WITH'] !~ /XMLHttpRequest/i)
     end
     alias xhr? :xml_http_request?
 
@@ -97,12 +128,17 @@ module ActionController
     # falling back to REMOTE_ADDR.  HTTP_X_FORWARDED_FOR may be a comma-
     # delimited list in the case of multiple chained proxies; the first is
     # the originating IP.
+    #
+    # Security note: do not use if IP spoofing is a concern for your
+    # application. Since remote_ip checks HTTP headers for addresses forwarded
+    # by proxies, the client may send any IP. remote_addr can't be spoofed but
+    # also doesn't work behind a proxy, since it's always the proxy's IP.
     def remote_ip
       return @env['HTTP_CLIENT_IP'] if @env.include? 'HTTP_CLIENT_IP'
 
       if @env.include? 'HTTP_X_FORWARDED_FOR' then
         remote_ips = @env['HTTP_X_FORWARDED_FOR'].split(',').reject do |ip|
-            ip =~ /^unknown$|^(10|172\.(1[6-9]|2[0-9]|30|31)|192\.168)\./i
+          ip.strip =~ /^unknown$|^(10|172\.(1[6-9]|2[0-9]|30|31)|192\.168)\./i
         end
 
         return remote_ips.first.strip unless remote_ips.empty?
@@ -111,10 +147,60 @@ module ActionController
       @env['REMOTE_ADDR']
     end
 
+    # Returns the lowercase name of the HTTP server software.
+    def server_software
+      (@env['SERVER_SOFTWARE'] && /^([a-zA-Z]+)/ =~ @env['SERVER_SOFTWARE']) ? $1.downcase : nil
+    end
+
+
+    # Returns the complete URL used for this request
+    def url
+      protocol + host_with_port + request_uri
+    end
+
+    # Return 'https://' if this is an SSL request and 'http://' otherwise.
+    def protocol
+      ssl? ? 'https://' : 'http://'
+    end
+
+    # Is this an SSL request?
+    def ssl?
+      @env['HTTPS'] == 'on' || @env['HTTP_X_FORWARDED_PROTO'] == 'https'
+    end
+
+    # Returns the host for this request, such as example.com.
+    def host
+    end
+
+    # Returns a host:port string for this request, such as example.com or
+    # example.com:8080.
+    def host_with_port
+      @host_with_port ||= host + port_string
+    end
+
+    # Returns the port number of this request as an integer.
+    def port
+      @port_as_int ||= @env['SERVER_PORT'].to_i
+    end
+
+    # Returns the standard port number for this request's protocol
+    def standard_port
+      case protocol
+        when 'https://' then 443
+        else 80
+      end
+    end
+
+    # Returns a port suffix like ":8080" if the port number of this request
+    # is not the default HTTP port 80 or HTTPS port 443.
+    def port_string
+      (port == standard_port) ? '' : ":#{port}"
+    end
+
     # Returns the domain part of a host, such as rubyonrails.org in "www.rubyonrails.org". You can specify
     # a different <tt>tld_length</tt>, such as 2 to catch rubyonrails.co.uk in "www.rubyonrails.co.uk".
     def domain(tld_length = 1)
-      return nil if !/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/.match(host).nil? or host.nil?
+      return nil unless named_host?(host)
 
       host.split('.').last(1 + tld_length).join('.')
     end
@@ -123,16 +209,18 @@ module ActionController
     # You can specify a different <tt>tld_length</tt>, such as 2 to catch ["www"] instead of ["www", "rubyonrails"]
     # in "www.rubyonrails.co.uk".
     def subdomains(tld_length = 1)
-      return [] unless host
+      return [] unless named_host?(host)
       parts = host.split('.')
       parts[0..-(tld_length+2)]
     end
 
-    # Receive the raw post data.
-    # This is useful for services such as REST, XMLRPC and SOAP
-    # which communicate over HTTP POST but don't use the traditional parameter format.
-    def raw_post
-      @env['RAW_POST_DATA']
+    # Return the query string, accounting for server idiosyncracies.
+    def query_string
+      if uri = @env['REQUEST_URI']
+        uri.split('?', 2)[1] || ''
+      else
+        @env['QUERY_STRING'] || ''
+      end
     end
 
     # Return the request URI, accounting for server idiosyncracies.
@@ -149,23 +237,19 @@ module ActionController
         unless (env_qs = @env['QUERY_STRING']).nil? || env_qs.empty?
           uri << '?' << env_qs
         end
-        @env['REQUEST_URI'] = uri
-      end
-    end
 
-    # Return 'https://' if this is an SSL request and 'http://' otherwise.
-    def protocol
-      ssl? ? 'https://' : 'http://'
-    end
-
-    # Is this an SSL request?
-    def ssl?
-      @env['HTTPS'] == 'on' || @env['HTTP_X_FORWARDED_PROTO'] == 'https'
+        if uri.nil?
+          @env.delete('REQUEST_URI')
+          uri
+        else
+          @env['REQUEST_URI'] = uri
+        end
+      end
     end
 
     # Returns the interpreted path to requested resource after all the installation directory of this application was taken into account
     def path
-      path = (uri = request_uri) ? uri.split('?').first : ''
+      path = (uri = request_uri) ? uri.split('?').first.to_s : ''
 
       # Cut off the path to the installation directory if given
       path.sub!(%r/^#{relative_url_root}/, '')
@@ -187,29 +271,20 @@ module ActionController
       end
     end
 
-    # Returns the port number of this request as an integer.
-    def port
-      @port_as_int ||= @env['SERVER_PORT'].to_i
-    end
 
-    # Returns the standard port number for this request's protocol
-    def standard_port
-      case protocol
-        when 'https://' then 443
-        else 80
+    # Read the request body. This is useful for web services that need to
+    # work with raw requests directly.
+    def raw_post
+      unless env.include? 'RAW_POST_DATA'
+        env['RAW_POST_DATA'] = body.read(content_length)
+        body.rewind if body.respond_to?(:rewind)
       end
+      env['RAW_POST_DATA']
     end
 
-    # Returns a port suffix like ":8080" if the port number of this request
-    # is not the default HTTP port 80 or HTTPS port 443.
-    def port_string
-      (port == standard_port) ? '' : ":#{port}"
-    end
-
-    # Returns a host:port string for this request, such as example.com or
-    # example.com:8080.
-    def host_with_port
-      host + port_string
+    # Returns both GET and POST parameters in a single hash.
+    def parameters
+      @parameters ||= request_parameters.merge(query_parameters).update(path_parameters).with_indifferent_access
     end
 
     def path_parameters=(parameters) #:nodoc:
@@ -222,31 +297,29 @@ module ActionController
       @symbolized_path_parameters ||= path_parameters.symbolize_keys
     end
 
-    # Returns a hash with the parameters used to form the path of the request 
+    # Returns a hash with the parameters used to form the path of the request.
+    # Returned hash keys are strings.  See <tt>symbolized_path_parameters</tt> for symbolized keys.
     #
     # Example: 
     #
-    #   {:action => 'my_action', :controller => 'my_controller'}
+    #   {'action' => 'my_action', 'controller' => 'my_controller'}
     def path_parameters
       @path_parameters ||= {}
     end
 
-    # Returns the lowercase name of the HTTP server software.
-    def server_software
-      (@env['SERVER_SOFTWARE'] && /^([a-zA-Z]+)/ =~ @env['SERVER_SOFTWARE']) ? $1.downcase : nil
-    end
 
     #--
     # Must be implemented in the concrete request
     #++
-    def query_parameters #:nodoc:
+
+    # The request body is an IO input stream.
+    def body
     end
 
-    def request_parameters #:nodoc:
+    def query_parameters #:nodoc:
     end
 
-    # Returns the host for this request, such as example.com.
-    def host
+    def request_parameters #:nodoc:
     end
 
     def cookies #:nodoc:
@@ -261,5 +334,397 @@ module ActionController
 
     def reset_session #:nodoc:
     end
+
+    protected
+      # The raw content type string. Use when you need parameters such as
+      # charset or boundary which aren't included in the content_type MIME type.
+      # Overridden by the X-POST_DATA_FORMAT header for backward compatibility.
+      def content_type_with_parameters
+        content_type_from_legacy_post_data_format_header ||
+          env['CONTENT_TYPE'].to_s
+      end
+
+      # The raw content type string with its parameters stripped off.
+      def content_type_without_parameters
+        @content_type_without_parameters ||= self.class.extract_content_type_without_parameters(content_type_with_parameters)
+      end
+
+    private
+      def content_type_from_legacy_post_data_format_header
+        if x_post_format = @env['HTTP_X_POST_DATA_FORMAT']
+          case x_post_format.to_s.downcase
+            when 'yaml';  'application/x-yaml'
+            when 'xml';   'application/xml'
+          end
+        end
+      end
+
+      def parse_formatted_request_parameters
+        return {} if content_length.zero?
+
+        content_type, boundary = self.class.extract_multipart_boundary(content_type_with_parameters)
+
+        # Don't parse params for unknown requests.
+        return {} if content_type.blank?
+
+        mime_type = Mime::Type.lookup(content_type)
+        strategy = ActionController::Base.param_parsers[mime_type]
+
+        # Only multipart form parsing expects a stream.
+        body = (strategy && strategy != :multipart_form) ? raw_post : self.body
+
+        case strategy
+          when Proc
+            strategy.call(body)
+          when :url_encoded_form
+            self.class.clean_up_ajax_request_body! body
+            self.class.parse_query_parameters(body)
+          when :multipart_form
+            self.class.parse_multipart_form_parameters(body, boundary, content_length, env)
+          when :xml_simple, :xml_node
+            body.blank? ? {} : Hash.from_xml(body).with_indifferent_access
+          when :yaml
+            YAML.load(body)
+          else
+            {}
+        end
+      rescue Exception => e # YAML, XML or Ruby code block errors
+        raise
+        { "body" => body,
+          "content_type" => content_type_with_parameters,
+          "content_length" => content_length,
+          "exception" => "#{e.message} (#{e.class})",
+          "backtrace" => e.backtrace }
+      end
+
+      def named_host?(host)
+        !(host.nil? || /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.match(host))
+      end
+
+    class << self
+      def parse_query_parameters(query_string)
+        return {} if query_string.blank?
+
+        pairs = query_string.split('&').collect do |chunk|
+          next if chunk.empty?
+          key, value = chunk.split('=', 2)
+          next if key.empty?
+          value = value.nil? ? nil : CGI.unescape(value)
+          [ CGI.unescape(key), value ]
+        end.compact
+
+        UrlEncodedPairParser.new(pairs).result
+      end
+
+      def parse_request_parameters(params)
+        parser = UrlEncodedPairParser.new
+
+        params = params.dup
+        until params.empty?
+          for key, value in params
+            if key.blank?
+              params.delete key
+            elsif !key.include?('[')
+              # much faster to test for the most common case first (GET)
+              # and avoid the call to build_deep_hash
+              parser.result[key] = get_typed_value(value[0])
+              params.delete key
+            elsif value.is_a?(Array)
+              parser.parse(key, get_typed_value(value.shift))
+              params.delete key if value.empty?
+            else
+              raise TypeError, "Expected array, found #{value.inspect}"
+            end
+          end
+        end
+
+        parser.result
+      end
+
+      def parse_multipart_form_parameters(body, boundary, content_length, env)
+        parse_request_parameters(read_multipart(body, boundary, content_length, env))
+      end
+
+      def extract_multipart_boundary(content_type_with_parameters)
+        if content_type_with_parameters =~ MULTIPART_BOUNDARY
+          ['multipart/form-data', $1.dup]
+        else
+          extract_content_type_without_parameters(content_type_with_parameters)
+        end
+      end
+
+      def extract_content_type_without_parameters(content_type_with_parameters)
+        $1.strip.downcase if content_type_with_parameters =~ /^([^,\;]*)/
+      end
+
+      def clean_up_ajax_request_body!(body)
+        body.chop! if body[-1] == 0
+        body.gsub!(/&_=$/, '')
+      end
+
+
+      private
+        def get_typed_value(value)
+          case value
+            when String
+              value
+            when NilClass
+              ''
+            when Array
+              value.map { |v| get_typed_value(v) }
+            else
+              if value.is_a?(UploadedFile)
+                # Uploaded file
+                if value.original_filename
+                  value
+                # Multipart param
+                else
+                  result = value.read
+                  value.rewind
+                  result
+                end
+              # Unknown value, neither string nor multipart.
+              else
+                raise "Unknown form value: #{value.inspect}"
+              end
+          end
+        end
+
+
+        MULTIPART_BOUNDARY = %r|\Amultipart/form-data.*boundary=\"?([^\";,]+)\"?|n
+
+        EOL = "\015\012"
+
+        def read_multipart(body, boundary, content_length, env)
+          params = Hash.new([])
+          boundary = "--" + boundary
+          quoted_boundary = Regexp.quote(boundary, "n")
+          buf = ""
+          bufsize = 10 * 1024
+          boundary_end=""
+
+          # start multipart/form-data
+          body.binmode if defined? body.binmode
+          boundary_size = boundary.size + EOL.size
+          content_length -= boundary_size
+          status = body.read(boundary_size)
+          if nil == status
+            raise EOFError, "no content body"
+          elsif boundary + EOL != status
+            raise EOFError, "bad content body"
+          end
+
+          loop do
+            head = nil
+            content =
+              if 10240 < content_length
+                UploadedTempfile.new("CGI")
+              else
+                UploadedStringIO.new
+              end
+            content.binmode if defined? content.binmode
+
+            until head and /#{quoted_boundary}(?:#{EOL}|--)/n.match(buf)
+
+              if (not head) and /#{EOL}#{EOL}/n.match(buf)
+                buf = buf.sub(/\A((?:.|\n)*?#{EOL})#{EOL}/n) do
+                  head = $1.dup
+                  ""
+                end
+                next
+              end
+
+              if head and ( (EOL + boundary + EOL).size < buf.size )
+                content.print buf[0 ... (buf.size - (EOL + boundary + EOL).size)]
+                buf[0 ... (buf.size - (EOL + boundary + EOL).size)] = ""
+              end
+
+              c = if bufsize < content_length
+                    body.read(bufsize)
+                  else
+                    body.read(content_length)
+                  end
+              if c.nil? || c.empty?
+                raise EOFError, "bad content body"
+              end
+              buf.concat(c)
+              content_length -= c.size
+            end
+
+            buf = buf.sub(/\A((?:.|\n)*?)(?:[\r\n]{1,2})?#{quoted_boundary}([\r\n]{1,2}|--)/n) do
+              content.print $1
+              if "--" == $2
+                content_length = -1
+              end
+             boundary_end = $2.dup
+              ""
+            end
+
+            content.rewind
+
+            head =~ /Content-Disposition:.* filename=(?:"((?:\\.|[^\"])*)"|([^;]*))/ni
+            if filename = $1 || $2
+              if /Mac/ni.match(env['HTTP_USER_AGENT']) and
+                  /Mozilla/ni.match(env['HTTP_USER_AGENT']) and
+                  (not /MSIE/ni.match(env['HTTP_USER_AGENT']))
+                filename = CGI.unescape(filename)
+              end
+              content.original_path = filename.dup
+            end
+
+            head =~ /Content-Type: ([^\r]*)/ni
+            content.content_type = $1.dup if $1
+
+            head =~ /Content-Disposition:.* name="?([^\";]*)"?/ni
+            name = $1.dup if $1
+
+            if params.has_key?(name)
+              params[name].push(content)
+            else
+              params[name] = [content]
+            end
+            break if buf.size == 0
+            break if content_length == -1
+          end
+          raise EOFError, "bad boundary end of body part" unless boundary_end=~/--/
+
+	  begin
+            body.rewind if body.respond_to?(:rewind)
+	  rescue Errno::ESPIPE
+            # Handles exceptions raised by input streams that cannot be rewound
+            # such as when using plain CGI under Apache
+	  end
+
+          params
+        end
+    end
+  end
+
+  class UrlEncodedPairParser < StringScanner #:nodoc:
+    attr_reader :top, :parent, :result
+
+    def initialize(pairs = [])
+      super('')
+      @result = {}
+      pairs.each { |key, value| parse(key, value) }
+    end
+
+    KEY_REGEXP = %r{([^\[\]=&]+)}
+    BRACKETED_KEY_REGEXP = %r{\[([^\[\]=&]+)\]}
+
+    # Parse the query string
+    def parse(key, value)
+      self.string = key
+      @top, @parent = result, nil
+
+      # First scan the bare key
+      key = scan(KEY_REGEXP) or return
+      key = post_key_check(key)
+
+      # Then scan as many nestings as present
+      until eos?
+        r = scan(BRACKETED_KEY_REGEXP) or return
+        key = self[1]
+        key = post_key_check(key)
+      end
+
+      bind(key, value)
+    end
+
+    private
+      # After we see a key, we must look ahead to determine our next action. Cases:
+      #
+      #   [] follows the key. Then the value must be an array.
+      #   = follows the key. (A value comes next)
+      #   & or the end of string follows the key. Then the key is a flag.
+      #   otherwise, a hash follows the key.
+      def post_key_check(key)
+        if scan(/\[\]/) # a[b][] indicates that b is an array
+          container(key, Array)
+          nil
+        elsif check(/\[[^\]]/) # a[b] indicates that a is a hash
+          container(key, Hash)
+          nil
+        else # End of key? We do nothing.
+          key
+        end
+      end
+
+      # Add a container to the stack.
+      def container(key, klass)
+        type_conflict! klass, top[key] if top.is_a?(Hash) && top.key?(key) && ! top[key].is_a?(klass)
+        value = bind(key, klass.new)
+        type_conflict! klass, value unless value.is_a?(klass)
+        push(value)
+      end
+
+      # Push a value onto the 'stack', which is actually only the top 2 items.
+      def push(value)
+        @parent, @top = @top, value
+      end
+
+      # Bind a key (which may be nil for items in an array) to the provided value.
+      def bind(key, value)
+        if top.is_a? Array
+          if key
+            if top[-1].is_a?(Hash) && ! top[-1].key?(key)
+              top[-1][key] = value
+            else
+              top << {key => value}.with_indifferent_access
+              push top.last
+            end
+          else
+            top << value
+          end
+        elsif top.is_a? Hash
+          key = CGI.unescape(key)
+          parent << (@top = {}) if top.key?(key) && parent.is_a?(Array)
+          return top[key] ||= value
+        else
+          raise ArgumentError, "Don't know what to do: top is #{top.inspect}"
+        end
+
+        return value
+      end
+
+      def type_conflict!(klass, value)
+        raise TypeError, "Conflicting types for parameter containers. Expected an instance of #{klass} but found an instance of #{value.class}. This can be caused by colliding Array and Hash parameters like qs[]=value&qs[key]=value."
+      end
+  end
+
+  module UploadedFile
+    def self.included(base)
+      base.class_eval do
+        attr_accessor :original_path, :content_type
+        alias_method :local_path, :path
+      end
+    end
+
+    # Take the basename of the upload's original filename.
+    # This handles the full Windows paths given by Internet Explorer
+    # (and perhaps other broken user agents) without affecting
+    # those which give the lone filename.
+    # The Windows regexp is adapted from Perl's File::Basename.
+    def original_filename
+      unless defined? @original_filename
+        @original_filename =
+          unless original_path.blank?
+            if original_path =~ /^(?:.*[:\\\/])?(.*)/m
+              $1
+            else
+              File.basename original_path
+            end
+          end
+      end
+      @original_filename
+    end
+  end
+
+  class UploadedStringIO < StringIO
+    include UploadedFile
+  end
+
+  class UploadedTempfile < Tempfile
+    include UploadedFile
   end
 end