actionpack 2.2.3 → 2.3.2
Sign up to get free protection for your applications and to get access to all the features.
Potentially problematic release.
This version of actionpack might be problematic. Click here for more details.
- data/CHANGELOG +433 -375
- data/MIT-LICENSE +1 -1
- data/README +21 -75
- data/Rakefile +1 -1
- data/lib/action_controller.rb +80 -43
- data/lib/action_controller/assertions/model_assertions.rb +1 -0
- data/lib/action_controller/assertions/response_assertions.rb +43 -16
- data/lib/action_controller/assertions/routing_assertions.rb +1 -1
- data/lib/action_controller/assertions/selector_assertions.rb +17 -12
- data/lib/action_controller/assertions/tag_assertions.rb +1 -4
- data/lib/action_controller/base.rb +153 -82
- data/lib/action_controller/benchmarking.rb +9 -9
- data/lib/action_controller/caching.rb +9 -11
- data/lib/action_controller/caching/actions.rb +11 -18
- data/lib/action_controller/caching/fragments.rb +28 -20
- data/lib/action_controller/caching/pages.rb +13 -15
- data/lib/action_controller/caching/sweeping.rb +2 -2
- data/lib/action_controller/cgi_ext.rb +0 -1
- data/lib/action_controller/cgi_ext/cookie.rb +2 -0
- data/lib/action_controller/cgi_process.rb +54 -162
- data/lib/action_controller/cookies.rb +13 -25
- data/lib/action_controller/dispatcher.rb +43 -122
- data/lib/action_controller/failsafe.rb +52 -0
- data/lib/action_controller/flash.rb +38 -47
- data/lib/action_controller/helpers.rb +13 -9
- data/lib/action_controller/http_authentication.rb +203 -23
- data/lib/action_controller/integration.rb +126 -70
- data/lib/action_controller/layout.rb +36 -39
- data/lib/action_controller/middleware_stack.rb +119 -0
- data/lib/action_controller/middlewares.rb +13 -0
- data/lib/action_controller/mime_responds.rb +19 -4
- data/lib/action_controller/mime_type.rb +8 -0
- data/lib/action_controller/params_parser.rb +71 -0
- data/lib/action_controller/performance_test.rb +0 -1
- data/lib/action_controller/polymorphic_routes.rb +36 -30
- data/lib/action_controller/reloader.rb +14 -0
- data/lib/action_controller/request.rb +107 -499
- data/lib/action_controller/request_forgery_protection.rb +7 -39
- data/lib/action_controller/rescue.rb +55 -35
- data/lib/action_controller/resources.rb +34 -31
- data/lib/action_controller/response.rb +99 -57
- data/lib/action_controller/rewindable_input.rb +28 -0
- data/lib/action_controller/routing.rb +7 -7
- data/lib/action_controller/routing/builder.rb +4 -1
- data/lib/action_controller/routing/optimisations.rb +1 -1
- data/lib/action_controller/routing/recognition_optimisation.rb +1 -2
- data/lib/action_controller/routing/route.rb +15 -5
- data/lib/action_controller/routing/route_set.rb +82 -35
- data/lib/action_controller/routing/segments.rb +35 -0
- data/lib/action_controller/session/abstract_store.rb +181 -0
- data/lib/action_controller/session/cookie_store.rb +197 -175
- data/lib/action_controller/session/mem_cache_store.rb +36 -83
- data/lib/action_controller/session_management.rb +26 -134
- data/lib/action_controller/streaming.rb +24 -7
- data/lib/action_controller/templates/rescues/diagnostics.erb +2 -2
- data/lib/action_controller/templates/rescues/template_error.erb +2 -2
- data/lib/action_controller/test_case.rb +87 -30
- data/lib/action_controller/test_process.rb +145 -104
- data/lib/action_controller/uploaded_file.rb +44 -0
- data/lib/action_controller/url_rewriter.rb +3 -6
- data/lib/action_controller/vendor/html-scanner.rb +16 -0
- data/lib/action_controller/vendor/html-scanner/html/selector.rb +1 -1
- data/lib/action_controller/vendor/rack-1.0/rack.rb +89 -0
- data/lib/action_controller/vendor/rack-1.0/rack/adapter/camping.rb +22 -0
- data/lib/action_controller/vendor/rack-1.0/rack/auth/abstract/handler.rb +37 -0
- data/lib/action_controller/vendor/rack-1.0/rack/auth/abstract/request.rb +37 -0
- data/lib/action_controller/vendor/rack-1.0/rack/auth/basic.rb +58 -0
- data/lib/action_controller/vendor/rack-1.0/rack/auth/digest/md5.rb +124 -0
- data/lib/action_controller/vendor/rack-1.0/rack/auth/digest/nonce.rb +51 -0
- data/lib/action_controller/vendor/rack-1.0/rack/auth/digest/params.rb +55 -0
- data/lib/action_controller/vendor/rack-1.0/rack/auth/digest/request.rb +40 -0
- data/lib/action_controller/vendor/rack-1.0/rack/auth/openid.rb +480 -0
- data/lib/action_controller/vendor/rack-1.0/rack/builder.rb +63 -0
- data/lib/action_controller/vendor/rack-1.0/rack/cascade.rb +36 -0
- data/lib/action_controller/vendor/rack-1.0/rack/chunked.rb +49 -0
- data/lib/action_controller/vendor/rack-1.0/rack/commonlogger.rb +61 -0
- data/lib/action_controller/vendor/rack-1.0/rack/conditionalget.rb +45 -0
- data/lib/action_controller/vendor/rack-1.0/rack/content_length.rb +29 -0
- data/lib/action_controller/vendor/rack-1.0/rack/content_type.rb +23 -0
- data/lib/action_controller/vendor/rack-1.0/rack/deflater.rb +85 -0
- data/lib/action_controller/vendor/rack-1.0/rack/directory.rb +153 -0
- data/lib/action_controller/vendor/rack-1.0/rack/file.rb +88 -0
- data/lib/action_controller/vendor/rack-1.0/rack/handler.rb +48 -0
- data/lib/action_controller/vendor/rack-1.0/rack/handler/cgi.rb +61 -0
- data/lib/action_controller/vendor/rack-1.0/rack/handler/evented_mongrel.rb +8 -0
- data/lib/action_controller/vendor/rack-1.0/rack/handler/fastcgi.rb +89 -0
- data/lib/action_controller/vendor/rack-1.0/rack/handler/lsws.rb +55 -0
- data/lib/action_controller/vendor/rack-1.0/rack/handler/mongrel.rb +84 -0
- data/lib/action_controller/vendor/rack-1.0/rack/handler/scgi.rb +59 -0
- data/lib/action_controller/vendor/rack-1.0/rack/handler/swiftiplied_mongrel.rb +8 -0
- data/lib/action_controller/vendor/rack-1.0/rack/handler/thin.rb +18 -0
- data/lib/action_controller/vendor/rack-1.0/rack/handler/webrick.rb +67 -0
- data/lib/action_controller/vendor/rack-1.0/rack/head.rb +19 -0
- data/lib/action_controller/vendor/rack-1.0/rack/lint.rb +462 -0
- data/lib/action_controller/vendor/rack-1.0/rack/lobster.rb +65 -0
- data/lib/action_controller/vendor/rack-1.0/rack/lock.rb +16 -0
- data/lib/action_controller/vendor/rack-1.0/rack/methodoverride.rb +27 -0
- data/lib/action_controller/vendor/rack-1.0/rack/mime.rb +204 -0
- data/lib/action_controller/vendor/rack-1.0/rack/mock.rb +160 -0
- data/lib/action_controller/vendor/rack-1.0/rack/recursive.rb +57 -0
- data/lib/action_controller/vendor/rack-1.0/rack/reloader.rb +64 -0
- data/lib/action_controller/vendor/rack-1.0/rack/request.rb +241 -0
- data/lib/action_controller/vendor/rack-1.0/rack/response.rb +179 -0
- data/lib/action_controller/vendor/rack-1.0/rack/session/abstract/id.rb +142 -0
- data/lib/action_controller/vendor/rack-1.0/rack/session/cookie.rb +91 -0
- data/lib/action_controller/vendor/rack-1.0/rack/session/memcache.rb +109 -0
- data/lib/action_controller/vendor/rack-1.0/rack/session/pool.rb +100 -0
- data/lib/action_controller/vendor/rack-1.0/rack/showexceptions.rb +349 -0
- data/lib/action_controller/vendor/rack-1.0/rack/showstatus.rb +106 -0
- data/lib/action_controller/vendor/rack-1.0/rack/static.rb +38 -0
- data/lib/action_controller/vendor/rack-1.0/rack/urlmap.rb +55 -0
- data/lib/action_controller/vendor/rack-1.0/rack/utils.rb +392 -0
- data/lib/action_controller/verification.rb +1 -1
- data/lib/action_pack.rb +1 -1
- data/lib/action_pack/version.rb +2 -2
- data/lib/action_view.rb +22 -17
- data/lib/action_view/base.rb +53 -79
- data/lib/action_view/erb/util.rb +38 -0
- data/lib/action_view/helpers.rb +24 -5
- data/lib/action_view/helpers/active_record_helper.rb +2 -2
- data/lib/action_view/helpers/asset_tag_helper.rb +81 -50
- data/lib/action_view/helpers/atom_feed_helper.rb +1 -1
- data/lib/action_view/helpers/benchmark_helper.rb +26 -5
- data/lib/action_view/helpers/date_helper.rb +82 -7
- data/lib/action_view/helpers/form_helper.rb +295 -64
- data/lib/action_view/helpers/form_options_helper.rb +160 -18
- data/lib/action_view/helpers/form_tag_helper.rb +2 -2
- data/lib/action_view/helpers/number_helper.rb +31 -18
- data/lib/action_view/helpers/prototype_helper.rb +2 -12
- data/lib/action_view/helpers/sanitize_helper.rb +0 -10
- data/lib/action_view/helpers/scriptaculous_helper.rb +1 -0
- data/lib/action_view/helpers/tag_helper.rb +3 -4
- data/lib/action_view/helpers/text_helper.rb +99 -122
- data/lib/action_view/helpers/translation_helper.rb +19 -1
- data/lib/action_view/helpers/url_helper.rb +25 -2
- data/lib/action_view/inline_template.rb +1 -1
- data/lib/action_view/locale/en.yml +19 -1
- data/lib/action_view/partials.rb +46 -9
- data/lib/action_view/paths.rb +28 -84
- data/lib/action_view/reloadable_template.rb +117 -0
- data/lib/action_view/renderable.rb +28 -35
- data/lib/action_view/renderable_partial.rb +3 -4
- data/lib/action_view/template.rb +172 -31
- data/lib/action_view/template_error.rb +8 -9
- data/lib/action_view/template_handler.rb +1 -1
- data/lib/action_view/template_handlers.rb +9 -6
- data/lib/action_view/template_handlers/erb.rb +2 -39
- data/lib/action_view/template_handlers/rjs.rb +1 -0
- data/lib/action_view/test_case.rb +27 -1
- data/test/abstract_unit.rb +23 -17
- data/test/active_record_unit.rb +5 -4
- data/test/activerecord/active_record_store_test.rb +139 -106
- data/test/activerecord/render_partial_with_record_identification_test.rb +5 -21
- data/test/controller/action_pack_assertions_test.rb +25 -23
- data/test/controller/addresses_render_test.rb +3 -6
- data/test/controller/assert_select_test.rb +83 -70
- data/test/controller/base_test.rb +11 -13
- data/test/controller/benchmark_test.rb +3 -3
- data/test/controller/caching_test.rb +34 -24
- data/test/controller/capture_test.rb +3 -6
- data/test/controller/content_type_test.rb +3 -6
- data/test/controller/cookie_test.rb +31 -66
- data/test/controller/deprecation/deprecated_base_methods_test.rb +9 -11
- data/test/controller/dispatcher_test.rb +23 -28
- data/test/controller/fake_models.rb +8 -0
- data/test/controller/filters_test.rb +6 -2
- data/test/controller/flash_test.rb +2 -6
- data/test/controller/helper_test.rb +15 -1
- data/test/controller/html-scanner/document_test.rb +1 -1
- data/test/controller/html-scanner/sanitizer_test.rb +1 -1
- data/test/controller/http_basic_authentication_test.rb +88 -0
- data/test/controller/http_digest_authentication_test.rb +178 -0
- data/test/controller/integration_test.rb +56 -52
- data/test/controller/layout_test.rb +46 -44
- data/test/controller/middleware_stack_test.rb +90 -0
- data/test/controller/mime_responds_test.rb +7 -11
- data/test/controller/mime_type_test.rb +9 -0
- data/test/controller/polymorphic_routes_test.rb +235 -151
- data/test/controller/rack_test.rb +52 -81
- data/test/controller/redirect_test.rb +6 -14
- data/test/controller/render_test.rb +273 -60
- data/test/controller/request/json_params_parsing_test.rb +45 -0
- data/test/controller/request/multipart_params_parsing_test.rb +223 -0
- data/test/controller/request/query_string_parsing_test.rb +120 -0
- data/test/controller/request/url_encoded_params_parsing_test.rb +184 -0
- data/test/controller/request/xml_params_parsing_test.rb +88 -0
- data/test/controller/request_forgery_protection_test.rb +17 -98
- data/test/controller/request_test.rb +45 -530
- data/test/controller/rescue_test.rb +45 -22
- data/test/controller/resources_test.rb +112 -37
- data/test/controller/routing_test.rb +1442 -1384
- data/test/controller/selector_test.rb +3 -3
- data/test/controller/send_file_test.rb +30 -3
- data/test/controller/session/cookie_store_test.rb +169 -240
- data/test/controller/session/mem_cache_store_test.rb +94 -148
- data/test/controller/session/test_session_test.rb +58 -0
- data/test/controller/test_test.rb +32 -13
- data/test/controller/url_rewriter_test.rb +54 -4
- data/test/controller/verification_test.rb +1 -1
- data/test/controller/view_paths_test.rb +15 -15
- data/test/controller/webservice_test.rb +178 -147
- data/test/fixtures/alternate_helpers/foo_helper.rb +3 -0
- data/test/fixtures/layout_tests/alt/layouts/alt.rhtml +0 -0
- data/test/fixtures/layouts/default_html.html.erb +1 -0
- data/test/fixtures/layouts/xhr.html.erb +2 -0
- data/test/fixtures/multipart/empty +10 -0
- data/test/fixtures/multipart/hello.txt +1 -0
- data/test/fixtures/multipart/none +9 -0
- data/test/fixtures/public/500.da.html +1 -0
- data/test/fixtures/quiz/questions/_question.html.erb +1 -0
- data/test/fixtures/replies.yml +1 -1
- data/test/fixtures/test/_one.html.erb +1 -0
- data/test/fixtures/test/_two.html.erb +1 -0
- data/test/fixtures/test/dont_pick_me +1 -0
- data/test/fixtures/test/hello.builder +1 -1
- data/test/fixtures/test/hello_world.da.html.erb +1 -0
- data/test/fixtures/test/hello_world.erb~ +1 -0
- data/test/fixtures/test/hello_world.pt-BR.html.erb +1 -0
- data/test/fixtures/test/malformed/malformed.en.html.erb~ +1 -0
- data/test/fixtures/test/malformed/malformed.erb~ +1 -0
- data/test/fixtures/test/malformed/malformed.html.erb~ +1 -0
- data/test/fixtures/test/render_explicit_html_template.js.rjs +1 -0
- data/test/fixtures/test/render_implicit_html_template.js.rjs +1 -0
- data/test/fixtures/test/render_implicit_html_template_from_xhr_request.da.html.erb +1 -0
- data/test/fixtures/test/render_implicit_html_template_from_xhr_request.html.erb +1 -0
- data/test/fixtures/test/render_implicit_js_template_without_layout.js.erb +1 -0
- data/test/fixtures/test/utf8.html.erb +2 -0
- data/test/template/active_record_helper_i18n_test.rb +31 -33
- data/test/template/active_record_helper_test.rb +34 -0
- data/test/template/asset_tag_helper_test.rb +52 -14
- data/test/template/atom_feed_helper_test.rb +3 -5
- data/test/template/benchmark_helper_test.rb +50 -24
- data/test/template/compiled_templates_test.rb +177 -33
- data/test/template/date_helper_i18n_test.rb +88 -81
- data/test/template/date_helper_test.rb +427 -43
- data/test/template/form_helper_test.rb +243 -44
- data/test/template/form_options_helper_test.rb +631 -565
- data/test/template/form_tag_helper_test.rb +9 -2
- data/test/template/javascript_helper_test.rb +0 -5
- data/test/template/number_helper_i18n_test.rb +60 -48
- data/test/template/number_helper_test.rb +1 -0
- data/test/template/render_test.rb +117 -35
- data/test/template/test_test.rb +4 -6
- data/test/template/text_helper_test.rb +129 -50
- data/test/template/translation_helper_test.rb +23 -19
- data/test/template/url_helper_test.rb +35 -2
- data/test/view/test_case_test.rb +8 -0
- metadata +197 -23
- data/lib/action_controller/assertions.rb +0 -69
- data/lib/action_controller/caching/sql_cache.rb +0 -18
- data/lib/action_controller/cgi_ext/session.rb +0 -53
- data/lib/action_controller/components.rb +0 -169
- data/lib/action_controller/rack_process.rb +0 -297
- data/lib/action_controller/request_profiler.rb +0 -169
- data/lib/action_controller/session/active_record_store.rb +0 -340
- data/lib/action_controller/session/drb_server.rb +0 -32
- data/lib/action_controller/session/drb_store.rb +0 -35
- data/test/controller/cgi_test.rb +0 -269
- data/test/controller/components_test.rb +0 -156
- data/test/controller/http_authentication_test.rb +0 -54
- data/test/controller/integration_upload_test.rb +0 -43
- data/test/controller/session_fixation_test.rb +0 -89
- data/test/controller/session_management_test.rb +0 -178
- data/test/fixtures/test/hello_world.js +0 -1
@@ -1,54 +0,0 @@
|
|
1
|
-
require 'abstract_unit'
|
2
|
-
|
3
|
-
class HttpBasicAuthenticationTest < Test::Unit::TestCase
|
4
|
-
include ActionController::HttpAuthentication::Basic
|
5
|
-
|
6
|
-
class DummyController
|
7
|
-
attr_accessor :headers, :renders, :request
|
8
|
-
|
9
|
-
def initialize
|
10
|
-
@headers, @renders = {}, []
|
11
|
-
@request = ActionController::TestRequest.new
|
12
|
-
end
|
13
|
-
|
14
|
-
def render(options)
|
15
|
-
self.renders << options
|
16
|
-
end
|
17
|
-
end
|
18
|
-
|
19
|
-
def setup
|
20
|
-
@controller = DummyController.new
|
21
|
-
@credentials = ActionController::HttpAuthentication::Basic.encode_credentials("dhh", "secret")
|
22
|
-
end
|
23
|
-
|
24
|
-
def test_successful_authentication
|
25
|
-
login = Proc.new { |user_name, password| user_name == "dhh" && password == "secret" }
|
26
|
-
set_headers
|
27
|
-
assert authenticate(@controller, &login)
|
28
|
-
|
29
|
-
set_headers ''
|
30
|
-
assert_nothing_raised do
|
31
|
-
assert !authenticate(@controller, &login)
|
32
|
-
end
|
33
|
-
|
34
|
-
set_headers nil
|
35
|
-
set_headers @credentials, 'REDIRECT_X_HTTP_AUTHORIZATION'
|
36
|
-
assert authenticate(@controller, &login)
|
37
|
-
end
|
38
|
-
|
39
|
-
def test_failing_authentication
|
40
|
-
set_headers
|
41
|
-
assert !authenticate(@controller) { |user_name, password| user_name == "dhh" && password == "incorrect" }
|
42
|
-
end
|
43
|
-
|
44
|
-
def test_authentication_request
|
45
|
-
authentication_request(@controller, "Megaglobalapp")
|
46
|
-
assert_equal 'Basic realm="Megaglobalapp"', @controller.headers["WWW-Authenticate"]
|
47
|
-
assert_equal :unauthorized, @controller.renders.first[:status]
|
48
|
-
end
|
49
|
-
|
50
|
-
private
|
51
|
-
def set_headers(value = @credentials, name = 'HTTP_AUTHORIZATION')
|
52
|
-
@controller.request.env[name] = value
|
53
|
-
end
|
54
|
-
end
|
@@ -1,43 +0,0 @@
|
|
1
|
-
require 'abstract_unit'
|
2
|
-
require 'action_controller/integration'
|
3
|
-
require 'action_controller/routing'
|
4
|
-
|
5
|
-
unless defined? ApplicationController
|
6
|
-
class ApplicationController < ActionController::Base
|
7
|
-
end
|
8
|
-
end
|
9
|
-
|
10
|
-
class UploadTestController < ActionController::Base
|
11
|
-
session :off
|
12
|
-
|
13
|
-
def update
|
14
|
-
SessionUploadTest.last_request_type = ActionController::Base.param_parsers[request.content_type]
|
15
|
-
render :text => "got here"
|
16
|
-
end
|
17
|
-
end
|
18
|
-
|
19
|
-
class SessionUploadTest < ActionController::IntegrationTest
|
20
|
-
FILES_DIR = File.dirname(__FILE__) + '/../fixtures/multipart'
|
21
|
-
|
22
|
-
class << self
|
23
|
-
attr_accessor :last_request_type
|
24
|
-
end
|
25
|
-
|
26
|
-
# def setup
|
27
|
-
# @session = ActionController::Integration::Session.new
|
28
|
-
# end
|
29
|
-
def test_post_with_upload
|
30
|
-
uses_mocha "test_post_with_upload" do
|
31
|
-
ActiveSupport::Dependencies.stubs(:load?).returns(false)
|
32
|
-
with_routing do |set|
|
33
|
-
set.draw do |map|
|
34
|
-
map.update 'update', :controller => "upload_test", :action => "update", :method => :post
|
35
|
-
end
|
36
|
-
|
37
|
-
params = { :uploaded_data => fixture_file_upload(FILES_DIR + "/mona_lisa.jpg", "image/jpg") }
|
38
|
-
post '/update', params, :location => 'blah'
|
39
|
-
assert_equal(:multipart_form, SessionUploadTest.last_request_type)
|
40
|
-
end
|
41
|
-
end
|
42
|
-
end
|
43
|
-
end
|
@@ -1,89 +0,0 @@
|
|
1
|
-
require 'abstract_unit'
|
2
|
-
|
3
|
-
|
4
|
-
class SessionFixationTest < Test::Unit::TestCase
|
5
|
-
class MockCGI < CGI #:nodoc:
|
6
|
-
attr_accessor :stdoutput, :env_table
|
7
|
-
|
8
|
-
def initialize(env, data = '')
|
9
|
-
self.env_table = env
|
10
|
-
self.stdoutput = StringIO.new
|
11
|
-
super(nil, StringIO.new(data))
|
12
|
-
end
|
13
|
-
end
|
14
|
-
|
15
|
-
class TestController < ActionController::Base
|
16
|
-
session :session_key => '_myapp_session_id', :secret => CGI::Session.generate_unique_id, :except => :default_session_key
|
17
|
-
session :cookie_only => false, :only => :allow_session_fixation
|
18
|
-
|
19
|
-
def default_session_key
|
20
|
-
render :text => "default_session_key"
|
21
|
-
end
|
22
|
-
|
23
|
-
def custom_session_key
|
24
|
-
render :text => "custom_session_key: #{params[:id]}"
|
25
|
-
end
|
26
|
-
|
27
|
-
def allow_session_fixation
|
28
|
-
render :text => "allow_session_fixation"
|
29
|
-
end
|
30
|
-
|
31
|
-
def rescue_action(e) raise end
|
32
|
-
end
|
33
|
-
|
34
|
-
def setup
|
35
|
-
@controller = TestController.new
|
36
|
-
end
|
37
|
-
|
38
|
-
def test_should_be_able_to_make_a_successful_request
|
39
|
-
cgi = mock_cgi_for_request_to(:custom_session_key, :id => 1)
|
40
|
-
|
41
|
-
assert_nothing_raised do
|
42
|
-
@controller.send(:process, ActionController::CgiRequest.new(cgi, {}), ActionController::CgiResponse.new(cgi))
|
43
|
-
end
|
44
|
-
assert_equal 'custom_session_key: 1', @controller.response.body
|
45
|
-
assert_not_nil @controller.session
|
46
|
-
end
|
47
|
-
|
48
|
-
def test_should_catch_session_fixation_attempt
|
49
|
-
cgi = mock_cgi_for_request_to(:custom_session_key, :_myapp_session_id => 42)
|
50
|
-
|
51
|
-
assert_raises ActionController::CgiRequest::SessionFixationAttempt do
|
52
|
-
@controller.send(:process, ActionController::CgiRequest.new(cgi, {}), ActionController::CgiResponse.new(cgi))
|
53
|
-
end
|
54
|
-
assert_nil @controller.session
|
55
|
-
end
|
56
|
-
|
57
|
-
def test_should_not_catch_session_fixation_attempt_when_cookie_only_setting_is_disabled
|
58
|
-
cgi = mock_cgi_for_request_to(:allow_session_fixation, :_myapp_session_id => 42)
|
59
|
-
|
60
|
-
assert_nothing_raised do
|
61
|
-
@controller.send(:process, ActionController::CgiRequest.new(cgi, {}), ActionController::CgiResponse.new(cgi))
|
62
|
-
end
|
63
|
-
assert ! @controller.response.body.blank?
|
64
|
-
assert_not_nil @controller.session
|
65
|
-
end
|
66
|
-
|
67
|
-
def test_should_catch_session_fixation_attempt_with_default_session_key
|
68
|
-
ActionController::Base.session_store = :p_store # using the default session_key is not possible with cookie store
|
69
|
-
cgi = mock_cgi_for_request_to(:default_session_key, :_session_id => 42)
|
70
|
-
|
71
|
-
assert_raises ActionController::CgiRequest::SessionFixationAttempt do
|
72
|
-
@controller.send(:process, ActionController::CgiRequest.new(cgi, {}), ActionController::CgiResponse.new(cgi))
|
73
|
-
end
|
74
|
-
assert @controller.response.body.blank?
|
75
|
-
assert_nil @controller.session
|
76
|
-
end
|
77
|
-
|
78
|
-
private
|
79
|
-
|
80
|
-
def mock_cgi_for_request_to(action, params = {})
|
81
|
-
MockCGI.new({
|
82
|
-
"REQUEST_METHOD" => "GET",
|
83
|
-
"QUERY_STRING" => "action=#{action}&#{params.to_query}",
|
84
|
-
"REQUEST_URI" => "/",
|
85
|
-
"SERVER_PORT" => "80",
|
86
|
-
"HTTP_HOST" => "testdomain.com" }, '')
|
87
|
-
end
|
88
|
-
|
89
|
-
end
|
@@ -1,178 +0,0 @@
|
|
1
|
-
require 'abstract_unit'
|
2
|
-
|
3
|
-
class SessionManagementTest < Test::Unit::TestCase
|
4
|
-
class SessionOffController < ActionController::Base
|
5
|
-
session :off
|
6
|
-
|
7
|
-
def show
|
8
|
-
render :text => "done"
|
9
|
-
end
|
10
|
-
|
11
|
-
def tell
|
12
|
-
render :text => "done"
|
13
|
-
end
|
14
|
-
end
|
15
|
-
|
16
|
-
class SessionOffOnController < ActionController::Base
|
17
|
-
session :off
|
18
|
-
session :on, :only => :tell
|
19
|
-
|
20
|
-
def show
|
21
|
-
render :text => "done"
|
22
|
-
end
|
23
|
-
|
24
|
-
def tell
|
25
|
-
render :text => "done"
|
26
|
-
end
|
27
|
-
end
|
28
|
-
|
29
|
-
class TestController < ActionController::Base
|
30
|
-
session :off, :only => :show
|
31
|
-
session :session_secure => true, :except => :show
|
32
|
-
session :off, :only => :conditional,
|
33
|
-
:if => Proc.new { |r| r.parameters[:ws] }
|
34
|
-
|
35
|
-
def show
|
36
|
-
render :text => "done"
|
37
|
-
end
|
38
|
-
|
39
|
-
def tell
|
40
|
-
render :text => "done"
|
41
|
-
end
|
42
|
-
|
43
|
-
def conditional
|
44
|
-
render :text => ">>>#{params[:ws]}<<<"
|
45
|
-
end
|
46
|
-
end
|
47
|
-
|
48
|
-
class SpecializedController < SessionOffController
|
49
|
-
session :disabled => false, :only => :something
|
50
|
-
|
51
|
-
def something
|
52
|
-
render :text => "done"
|
53
|
-
end
|
54
|
-
|
55
|
-
def another
|
56
|
-
render :text => "done"
|
57
|
-
end
|
58
|
-
end
|
59
|
-
|
60
|
-
class AssociationCachingTestController < ActionController::Base
|
61
|
-
class ObjectWithAssociationCache
|
62
|
-
def initialize
|
63
|
-
@cached_associations = false
|
64
|
-
end
|
65
|
-
|
66
|
-
def fetch_associations
|
67
|
-
@cached_associations = true
|
68
|
-
end
|
69
|
-
|
70
|
-
def clear_association_cache
|
71
|
-
@cached_associations = false
|
72
|
-
end
|
73
|
-
|
74
|
-
def has_cached_associations?
|
75
|
-
@cached_associations
|
76
|
-
end
|
77
|
-
end
|
78
|
-
|
79
|
-
def show
|
80
|
-
session[:object] = ObjectWithAssociationCache.new
|
81
|
-
session[:object].fetch_associations
|
82
|
-
if session[:object].has_cached_associations?
|
83
|
-
render :text => "has cached associations"
|
84
|
-
else
|
85
|
-
render :text => "does not have cached associations"
|
86
|
-
end
|
87
|
-
end
|
88
|
-
|
89
|
-
def tell
|
90
|
-
if session[:object]
|
91
|
-
if session[:object].has_cached_associations?
|
92
|
-
render :text => "has cached associations"
|
93
|
-
else
|
94
|
-
render :text => "does not have cached associations"
|
95
|
-
end
|
96
|
-
else
|
97
|
-
render :text => "there is no object"
|
98
|
-
end
|
99
|
-
end
|
100
|
-
end
|
101
|
-
|
102
|
-
|
103
|
-
def setup
|
104
|
-
@request, @response = ActionController::TestRequest.new,
|
105
|
-
ActionController::TestResponse.new
|
106
|
-
end
|
107
|
-
|
108
|
-
def test_session_off_globally
|
109
|
-
@controller = SessionOffController.new
|
110
|
-
get :show
|
111
|
-
assert_equal false, @request.session_options
|
112
|
-
get :tell
|
113
|
-
assert_equal false, @request.session_options
|
114
|
-
end
|
115
|
-
|
116
|
-
def test_session_off_then_on_globally
|
117
|
-
@controller = SessionOffOnController.new
|
118
|
-
get :show
|
119
|
-
assert_equal false, @request.session_options
|
120
|
-
get :tell
|
121
|
-
assert_instance_of Hash, @request.session_options
|
122
|
-
assert_equal false, @request.session_options[:disabled]
|
123
|
-
end
|
124
|
-
|
125
|
-
def test_session_off_conditionally
|
126
|
-
@controller = TestController.new
|
127
|
-
get :show
|
128
|
-
assert_equal false, @request.session_options
|
129
|
-
get :tell
|
130
|
-
assert_instance_of Hash, @request.session_options
|
131
|
-
assert @request.session_options[:session_secure]
|
132
|
-
end
|
133
|
-
|
134
|
-
def test_controller_specialization_overrides_settings
|
135
|
-
@controller = SpecializedController.new
|
136
|
-
get :something
|
137
|
-
assert_instance_of Hash, @request.session_options
|
138
|
-
get :another
|
139
|
-
assert_equal false, @request.session_options
|
140
|
-
end
|
141
|
-
|
142
|
-
def test_session_off_with_if
|
143
|
-
@controller = TestController.new
|
144
|
-
get :conditional
|
145
|
-
assert_instance_of Hash, @request.session_options
|
146
|
-
get :conditional, :ws => "ws"
|
147
|
-
assert_equal false, @request.session_options
|
148
|
-
end
|
149
|
-
|
150
|
-
def test_session_store_setting
|
151
|
-
ActionController::Base.session_store = :drb_store
|
152
|
-
assert_equal CGI::Session::DRbStore, ActionController::Base.session_store
|
153
|
-
|
154
|
-
if Object.const_defined?(:ActiveRecord)
|
155
|
-
ActionController::Base.session_store = :active_record_store
|
156
|
-
assert_equal CGI::Session::ActiveRecordStore, ActionController::Base.session_store
|
157
|
-
end
|
158
|
-
end
|
159
|
-
|
160
|
-
def test_process_cleanup_with_session_management_support
|
161
|
-
@controller = AssociationCachingTestController.new
|
162
|
-
get :show
|
163
|
-
assert_equal "has cached associations", @response.body
|
164
|
-
get :tell
|
165
|
-
assert_equal "does not have cached associations", @response.body
|
166
|
-
end
|
167
|
-
|
168
|
-
def test_session_is_enabled
|
169
|
-
@controller = TestController.new
|
170
|
-
get :show
|
171
|
-
assert_nothing_raised do
|
172
|
-
assert_equal false, @controller.session_enabled?
|
173
|
-
end
|
174
|
-
|
175
|
-
get :tell
|
176
|
-
assert @controller.session_enabled?
|
177
|
-
end
|
178
|
-
end
|
@@ -1 +0,0 @@
|
|
1
|
-
var greeting = 'Hallo World!';
|