actionpack 2.0.5 → 2.1.0

data/test/controller/request_forgery_protection_test.rb

@@ -1,4 +1,4 @@
-require File.dirname(__FILE__) + '/../abstract_unit'
+require 'abstract_unit'
 require 'digest/sha1'
 
 ActionController::Routing::Routes.draw do |map|
@@ -50,6 +50,14 @@ class CsrfCookieMonsterController < ActionController::Base
   protect_from_forgery :only => :index
 end
 
+# sessions are turned off
+class SessionOffController < ActionController::Base
+  protect_from_forgery :secret => 'foobar'
+  session :off
+  def rescue_action(e) raise e end
+  include RequestForgeryProtectionActions
+end
+
 class FreeCookieController < CsrfCookieMonsterController
   self.allow_forgery_protection = false
   
@@ -93,19 +101,79 @@ module RequestForgeryProtectionTests
     post :unsafe
     assert_response :success
   end
-  
+
   def test_should_not_allow_post_without_token
     assert_raises(ActionController::InvalidAuthenticityToken) { post :index }
   end
-  
+
   def test_should_not_allow_put_without_token
     assert_raises(ActionController::InvalidAuthenticityToken) { put :index }
   end
-  
+
   def test_should_not_allow_delete_without_token
     assert_raises(ActionController::InvalidAuthenticityToken) { delete :index }
   end
-  
+
+  def test_should_not_allow_api_formatted_post_without_token
+    assert_raises(ActionController::InvalidAuthenticityToken) do
+      post :index, :format => 'xml'
+    end
+  end
+
+  def test_should_not_allow_api_formatted_put_without_token
+    assert_raises(ActionController::InvalidAuthenticityToken) do
+      put :index, :format => 'xml'
+    end
+  end
+
+  def test_should_not_allow_api_formatted_delete_without_token
+    assert_raises(ActionController::InvalidAuthenticityToken) do
+      delete :index, :format => 'xml'
+    end
+  end
+
+  def test_should_not_allow_api_formatted_post_sent_as_url_encoded_form_without_token
+    assert_raises(ActionController::InvalidAuthenticityToken) do
+      @request.env['CONTENT_TYPE'] = Mime::URL_ENCODED_FORM.to_s
+      post :index, :format => 'xml'
+    end
+  end
+
+  def test_should_not_allow_api_formatted_put_sent_as_url_encoded_form_without_token
+    assert_raises(ActionController::InvalidAuthenticityToken) do
+      @request.env['CONTENT_TYPE'] = Mime::URL_ENCODED_FORM.to_s
+      put :index, :format => 'xml'
+    end
+  end
+
+  def test_should_not_allow_api_formatted_delete_sent_as_url_encoded_form_without_token
+    assert_raises(ActionController::InvalidAuthenticityToken) do
+      @request.env['CONTENT_TYPE'] = Mime::URL_ENCODED_FORM.to_s
+      delete :index, :format => 'xml'
+    end
+  end
+
+  def test_should_not_allow_api_formatted_post_sent_as_multipart_form_without_token
+    assert_raises(ActionController::InvalidAuthenticityToken) do
+      @request.env['CONTENT_TYPE'] = Mime::MULTIPART_FORM.to_s
+      post :index, :format => 'xml'
+    end
+  end
+
+  def test_should_not_allow_api_formatted_put_sent_as_multipart_form_without_token
+    assert_raises(ActionController::InvalidAuthenticityToken) do
+      @request.env['CONTENT_TYPE'] = Mime::MULTIPART_FORM.to_s
+      put :index, :format => 'xml'
+    end
+  end
+
+  def test_should_not_allow_api_formatted_delete_sent_as_multipart_form_without_token
+    assert_raises(ActionController::InvalidAuthenticityToken) do
+      @request.env['CONTENT_TYPE'] = Mime::MULTIPART_FORM.to_s
+      delete :index, :format => 'xml'
+    end
+  end
+
   def test_should_not_allow_xhr_post_without_token
     assert_raises(ActionController::InvalidAuthenticityToken) { xhr :post, :index }
   end
@@ -134,16 +202,19 @@ module RequestForgeryProtectionTests
   end
   
   def test_should_allow_post_with_xml
+    @request.env['CONTENT_TYPE'] = Mime::XML.to_s
     post :index, :format => 'xml'
     assert_response :success
   end
   
   def test_should_allow_put_with_xml
+    @request.env['CONTENT_TYPE'] = Mime::XML.to_s
     put :index, :format => 'xml'
     assert_response :success
   end
   
   def test_should_allow_delete_with_xml
+    @request.env['CONTENT_TYPE'] = Mime::XML.to_s
     delete :index, :format => 'xml'
     assert_response :success
   end
@@ -224,3 +295,19 @@ class FreeCookieControllerTest < Test::Unit::TestCase
     end
   end
 end
+
+class SessionOffControllerTest < Test::Unit::TestCase
+  def setup
+    @controller = SessionOffController.new
+    @request    = ActionController::TestRequest.new
+    @response   = ActionController::TestResponse.new
+    @token      = OpenSSL::HMAC.hexdigest(OpenSSL::Digest::Digest.new('SHA1'), 'abc', '123')
+  end
+
+  def test_should_raise_correct_exception
+    @request.session = {} # session(:off) doesn't appear to work with controller tests
+    assert_raises(ActionController::InvalidAuthenticityToken) do
+      post :index, :authenticity_token => @token
+    end
+  end
+end

data/test/controller/request_test.rb

@@ -1,4 +1,4 @@
-require File.dirname(__FILE__) + '/../abstract_unit'
+require 'abstract_unit'
 require 'action_controller/integration'
 
 class RequestTest < Test::Unit::TestCase
@@ -622,7 +622,7 @@ class UrlEncodedRequestParameterParsingTest < Test::Unit::TestCase
       "ie_products[string]" => [ UploadedStringIO.new("Microsoft") ],
       "ie_products[file]" => [ ie_file ],
       "text_part" => [non_file_text_part]
-    }
+      }
 
     expected_output =  {
       "something" => "",
@@ -726,6 +726,18 @@ class UrlEncodedRequestParameterParsingTest < Test::Unit::TestCase
     expected = { "test2" => "value1" }
     assert_equal expected, ActionController::AbstractRequest.parse_request_parameters(input)
   end
+
+  def test_parse_params_with_array_prefix_and_hashes
+    input = { "a[][b][c]" => %w(d) }
+    expected = {"a" => [{"b" => {"c" => "d"}}]}
+    assert_equal expected, ActionController::AbstractRequest.parse_request_parameters(input)
+  end
+
+  def test_parse_params_with_complex_nesting
+    input = { "a[][b][c][][d][]" => %w(e) }
+    expected = {"a" => [{"b" => {"c" => [{"d" => ["e"]}]}}]}
+    assert_equal expected, ActionController::AbstractRequest.parse_request_parameters(input)
+  end
 end
 
 
@@ -753,13 +765,36 @@ class MultipartRequestParameterParsingTest < Test::Unit::TestCase
     assert_equal 'contents', file.read
   end
 
+  def test_boundary_problem_file
+    params = process('boundary_problem_file')
+    assert_equal %w(file foo), params.keys.sort
+
+    file = params['file']
+    foo  = params['foo']
+    
+    if RUBY_VERSION > '1.9'
+      assert_kind_of File, file
+    else
+      assert_kind_of Tempfile, file
+    end
+    
+    assert_equal 'file.txt', file.original_filename
+    assert_equal "text/plain", file.content_type
+    
+    assert_equal 'bar', foo
+  end
+  
   def test_large_text_file
     params = process('large_text_file')
     assert_equal %w(file foo), params.keys.sort
     assert_equal 'bar', params['foo']
 
     file = params['file']
-    assert_kind_of Tempfile, file
+    if RUBY_VERSION > '1.9'
+      assert_kind_of File, file
+    else
+      assert_kind_of Tempfile, file
+    end
     assert_equal 'file.txt', file.original_filename
     assert_equal "text/plain", file.content_type
     assert ('a' * 20480) == file.read
@@ -800,8 +835,10 @@ class MultipartRequestParameterParsingTest < Test::Unit::TestCase
     assert_equal 'bar', params['foo']
 
     # Ruby CGI doesn't handle multipart/mixed for us.
-    assert_kind_of String, params['files']
-    assert_equal 19756, params['files'].size
+    files = params['files']
+    assert_kind_of String, files
+    files.force_encoding('ASCII-8BIT') if files.respond_to?(:force_encoding)
+    assert_equal 19756, files.size
   end
 
   private
@@ -814,8 +851,13 @@ class MultipartRequestParameterParsingTest < Test::Unit::TestCase
     end
 end
 
-
 class XmlParamsParsingTest < Test::Unit::TestCase
+  def test_hash_params
+    person = parse_body("<person><name>David</name></person>")[:person]
+    assert_kind_of Hash, person
+    assert_equal 'David', person['name']
+  end
+
   def test_single_file
     person = parse_body("<person><name>David</name><avatar type='file' name='me.jpg' content_type='image/jpg'>#{ActiveSupport::Base64.encode64('ABC')}</avatar></person>")
 
@@ -862,3 +904,19 @@ class LegacyXmlParamsParsingTest < XmlParamsParsingTest
       ActionController::CgiRequest.new(cgi).request_parameters
     end
 end
+
+class JsonParamsParsingTest < Test::Unit::TestCase
+  def test_hash_params
+    person = parse_body({:person => {:name => "David"}}.to_json)[:person]
+    assert_kind_of Hash, person
+    assert_equal 'David', person['name']
+  end
+
+  private
+    def parse_body(body)
+      env = { 'CONTENT_TYPE'   => 'application/json',
+              'CONTENT_LENGTH' => body.size.to_s }
+      cgi = ActionController::Integration::Session::StubCGI.new(env, body)
+      ActionController::CgiRequest.new(cgi).request_parameters
+    end
+end

data/test/controller/rescue_test.rb

@@ -1,4 +1,4 @@
-require File.dirname(__FILE__) + '/../abstract_unit'
+require 'abstract_unit'
 
 uses_mocha 'rescue' do
 
@@ -279,7 +279,7 @@ class RescueTest < Test::Unit::TestCase
     assert_equal ActionController::Rescue::DEFAULT_RESCUE_TEMPLATE, templates.default
     assert_equal ActionController::Rescue::DEFAULT_RESCUE_TEMPLATE, templates[Exception.new]
 
-    assert_equal 'missing_template',  templates[ActionController::MissingTemplate.name]
+    assert_equal 'missing_template',  templates[ActionView::MissingTemplate.name]
     assert_equal 'routing_error',     templates[ActionController::RoutingError.name]
     assert_equal 'unknown_action',    templates[ActionController::UnknownAction.name]
     assert_equal 'template_error',    templates[ActionView::TemplateError.name]
@@ -305,7 +305,9 @@ class RescueTest < Test::Unit::TestCase
   
   def test_not_implemented
     with_all_requests_local false do
-      head :not_implemented
+      with_rails_public_path(".") do
+        head :not_implemented
+      end
     end
     assert_response :not_implemented
     assert_equal "GET, PUT", @response.headers['Allow']
@@ -313,7 +315,9 @@ class RescueTest < Test::Unit::TestCase
 
   def test_method_not_allowed
     with_all_requests_local false do
-      get :method_not_allowed
+      with_rails_public_path(".") do
+        get :method_not_allowed
+      end
     end
     assert_response :method_not_allowed
     assert_equal "GET, HEAD, PUT", @response.headers['Allow']
@@ -391,7 +395,19 @@ class RescueTest < Test::Unit::TestCase
       @request.remote_addr = old_remote_addr
     end
 
-    def with_rails_root(path = nil)
+    def with_rails_public_path(rails_root)
+      old_rails = Object.const_get(:Rails) rescue nil
+      mod = Object.const_set(:Rails, Module.new)
+      (class << mod; self; end).instance_eval do
+        define_method(:public_path) { "#{rails_root}/public" }
+      end
+      yield
+    ensure
+      Object.module_eval { remove_const(:Rails) } if defined?(Rails)
+      Object.const_set(:Rails, old_rails) if old_rails
+    end
+
+    def with_rails_root(path = nil,&block)
       old_rails_root = RAILS_ROOT if defined?(RAILS_ROOT)
       if path
         silence_warnings { Object.const_set(:RAILS_ROOT, path) }
@@ -399,7 +415,7 @@ class RescueTest < Test::Unit::TestCase
         Object.remove_const(:RAILS_ROOT) rescue nil
       end
 
-      yield
+      with_rails_public_path(path, &block)
 
     ensure
       if old_rails_root

data/test/controller/resources_test.rb

@@ -1,4 +1,4 @@
-require File.dirname(__FILE__) + '/../abstract_unit'
+require 'abstract_unit'
 
 class ResourcesController < ActionController::Base
   def index() render :nothing => true end
@@ -76,6 +76,12 @@ class ResourcesTest < Test::Unit::TestCase
     end
   end
 
+  def test_override_paths_for_default_restful_actions
+    resource = ActionController::Resources::Resource.new(:messages,
+      :path_names => {:new => 'nuevo', :edit => 'editar'})
+    assert_equal resource.new_path, "#{resource.path}/nuevo"
+  end
+
   def test_multiple_default_restful_routes
     with_restful_routing :messages, :comments do
       assert_simply_restful_for :messages
@@ -203,6 +209,45 @@ class ResourcesTest < Test::Unit::TestCase
     end
   end
 
+  def test_member_when_override_paths_for_default_restful_actions_with
+    [:put, :post].each do |method|
+      with_restful_routing :messages, :member => { :mark => method }, :path_names => {:new => 'nuevo'} do
+        mark_options = {:action => 'mark', :id => '1', :controller => "messages"}
+        mark_path    = "/messages/1/mark"
+
+        assert_restful_routes_for :messages, :path_names => {:new => 'nuevo'} do |options|
+          assert_recognizes(options.merge(mark_options), :path => mark_path, :method => method)
+        end
+
+        assert_restful_named_routes_for :messages, :path_names => {:new => 'nuevo'} do |options|
+          assert_named_route mark_path, :mark_message_path, mark_options
+        end
+      end
+    end
+  end
+
+  def test_member_when_changed_default_restful_actions_and_path_names_not_specified
+    default_path_names = ActionController::Base.resources_path_names
+    ActionController::Base.resources_path_names = {:new => 'nuevo', :edit => 'editar'}
+
+    with_restful_routing :messages do
+      new_options = { :action => 'new', :controller => 'messages' }
+      new_path = "/messages/nuevo"
+      edit_options = { :action => 'edit', :id => '1', :controller => 'messages' }
+      edit_path = "/messages/1/editar"
+
+      assert_restful_routes_for :messages do |options|
+        assert_recognizes(options.merge(new_options), :path => new_path, :method => :get)
+      end
+
+      assert_restful_routes_for :messages do |options|
+        assert_recognizes(options.merge(edit_options), :path => edit_path, :method => :get)
+      end
+    end
+  ensure
+    ActionController::Base.resources_path_names = default_path_names
+  end
+
   def test_with_two_member_actions_with_same_method
     [:put, :post].each do |method|
       with_restful_routing :messages, :member => { :mark => method, :unmark => method } do
@@ -609,6 +654,35 @@ class ResourcesTest < Test::Unit::TestCase
     end
   end
 
+  def test_with_path_segment
+    with_restful_routing :messages, :as => 'reviews' do
+      assert_simply_restful_for :messages, :as => 'reviews'
+    end
+  end
+
+  def test_multiple_with_path_segment_and_controller
+    with_routing do |set|
+      set.draw do |map|
+        map.resources :products do |products|
+          products.resources :product_reviews, :as => 'reviews', :controller => 'messages'
+        end
+        map.resources :tutors do |tutors|
+          tutors.resources :tutor_reviews, :as => 'reviews', :controller => 'comments'
+        end
+      end
+
+      assert_simply_restful_for :product_reviews, :controller=>'messages', :as => 'reviews', :name_prefix => 'product_', :path_prefix => 'products/1/', :options => {:product_id => '1'}
+      assert_simply_restful_for :tutor_reviews,:controller=>'comments', :as => 'reviews', :name_prefix => 'tutor_', :path_prefix => 'tutors/1/', :options => {:tutor_id => '1'}
+    end
+  end
+
+  def test_with_path_segment_path_prefix_requirements
+    expected_options = {:controller => 'messages', :action => 'show', :thread_id => '1.1.1', :id => '1'}
+    with_restful_routing :messages, :as => 'comments',:path_prefix => '/thread/:thread_id', :requirements => { :thread_id => /[0-9]\.[0-9]\.[0-9]/ } do
+      assert_recognizes(expected_options, :path => 'thread/1.1.1/comments/1', :method => :get)
+    end
+  end
+
   protected
     def with_restful_routing(*args)
       with_routing do |set|
@@ -639,11 +713,18 @@ class ResourcesTest < Test::Unit::TestCase
       options[:options] ||= {}
       options[:options][:controller] = options[:controller] || controller_name.to_s
 
-      collection_path            = "/#{options[:path_prefix]}#{controller_name}"
+      new_action    = ActionController::Base.resources_path_names[:new] || "new"
+      edit_action   = ActionController::Base.resources_path_names[:edit] || "edit"
+      if options[:path_names]
+        new_action  = options[:path_names][:new] if options[:path_names][:new]
+        edit_action = options[:path_names][:edit] if options[:path_names][:edit]
+      end
+
+      collection_path            = "/#{options[:path_prefix]}#{options[:as] || controller_name}"
       member_path                = "#{collection_path}/1"
-      new_path                   = "#{collection_path}/new"
-      edit_member_path           = "#{member_path}/edit"
-      formatted_edit_member_path = "#{member_path}/edit.xml"
+      new_path                   = "#{collection_path}/#{new_action}"
+      edit_member_path           = "#{member_path}/#{edit_action}"
+      formatted_edit_member_path = "#{member_path}/#{edit_action}.xml"
 
       with_options(options[:options]) do |controller|
         controller.assert_routing collection_path,            :action => 'index'
@@ -692,18 +773,25 @@ class ResourcesTest < Test::Unit::TestCase
       get :index, options[:options]
       options[:options].delete :action
 
-      full_prefix = "/#{options[:path_prefix]}#{controller_name}"
+      full_prefix = "/#{options[:path_prefix]}#{options[:as] || controller_name}"
       name_prefix = options[:name_prefix]
-      
+
+      new_action  = "new"
+      edit_action = "edit"
+      if options[:path_names]
+        new_action  = options[:path_names][:new]  || "new"
+        edit_action = options[:path_names][:edit] || "edit"
+      end
+
       assert_named_route "#{full_prefix}",            "#{name_prefix}#{controller_name}_path",              options[:options]
       assert_named_route "#{full_prefix}.xml",        "formatted_#{name_prefix}#{controller_name}_path",    options[:options].merge(            :format => 'xml')
       assert_named_route "#{full_prefix}/1",          "#{name_prefix}#{singular_name}_path",                options[:options].merge(:id => '1')
       assert_named_route "#{full_prefix}/1.xml",      "formatted_#{name_prefix}#{singular_name}_path",      options[:options].merge(:id => '1', :format => 'xml')
 
-      assert_named_route "#{full_prefix}/new",        "new_#{name_prefix}#{singular_name}_path",            options[:options]
-      assert_named_route "#{full_prefix}/new.xml",    "formatted_new_#{name_prefix}#{singular_name}_path",  options[:options].merge(            :format => 'xml')
-      assert_named_route "#{full_prefix}/1/edit",     "edit_#{name_prefix}#{singular_name}_path",           options[:options].merge(:id => '1')
-      assert_named_route "#{full_prefix}/1/edit.xml", "formatted_edit_#{name_prefix}#{singular_name}_path", options[:options].merge(:id => '1', :format => 'xml')
+      assert_named_route "#{full_prefix}/#{new_action}",        "new_#{name_prefix}#{singular_name}_path",            options[:options]
+      assert_named_route "#{full_prefix}/#{new_action}.xml",    "formatted_new_#{name_prefix}#{singular_name}_path",  options[:options].merge(            :format => 'xml')
+      assert_named_route "#{full_prefix}/1/#{edit_action}",     "edit_#{name_prefix}#{singular_name}_path",           options[:options].merge(:id => '1')
+      assert_named_route "#{full_prefix}/1/#{edit_action}.xml", "formatted_edit_#{name_prefix}#{singular_name}_path", options[:options].merge(:id => '1', :format => 'xml')
 
       yield options[:options] if block_given?
     end
@@ -712,7 +800,7 @@ class ResourcesTest < Test::Unit::TestCase
       options[:options] ||= {}
       options[:options][:controller] = options[:controller] || singleton_name.to_s.pluralize
 
-      full_path           = "/#{options[:path_prefix]}#{singleton_name}"
+      full_path           = "/#{options[:path_prefix]}#{options[:as] || singleton_name}"
       new_path            = "#{full_path}/new"
       edit_path           = "#{full_path}/edit"
       formatted_edit_path = "#{full_path}/edit.xml"
@@ -751,7 +839,7 @@ class ResourcesTest < Test::Unit::TestCase
       get :show, options[:options]
       options[:options].delete :action
 
-      full_path = "/#{options[:path_prefix]}#{singleton_name}"
+      full_path = "/#{options[:path_prefix]}#{options[:as] || singleton_name}"
       name_prefix = options[:name_prefix]
 
       assert_named_route "#{full_path}",          "#{name_prefix}#{singleton_name}_path",                options[:options]
@@ -784,4 +872,4 @@ class ResourcesTest < Test::Unit::TestCase
       end
       true
     end
-end
+end