actionpack 2.3.18 → 3.0.0.beta

data/lib/{action_controller → action_dispatch/http}/mime_type.rb

@@ -1,10 +1,33 @@
 require 'set'
+require 'active_support/core_ext/class/attribute_accessors'
 
 module Mime
-  SET              = []
-  EXTENSION_LOOKUP = Hash.new { |h, k| h[k] = Type.new(k) unless k.blank? }
+  class Mimes < Array
+    def symbols
+      @symbols ||= map {|m| m.to_sym }
+    end
+
+    %w(<< concat shift unshift push pop []= clear compact! collect!
+    delete delete_at delete_if flatten! map! insert reject! reverse!
+    replace slice! sort! uniq!).each do |method|
+      module_eval <<-CODE, __FILE__, __LINE__ + 1
+        def #{method}(*)
+          @symbols = nil
+          super
+        end
+      CODE
+    end
+  end
+
+  SET              = Mimes.new
+  EXTENSION_LOOKUP = {}
   LOOKUP           = Hash.new { |h, k| h[k] = Type.new(k) unless k.blank? }
 
+  def self.[](type)
+    return type if type.is_a?(Type)
+    Type.lookup_by_extension(type.to_s)
+  end
+
   # Encapsulates the notion of a mime type. Can be used at render time, for example, with:
   #
   #   class PostsController < ActionController::Base
@@ -27,7 +50,7 @@ module Mime
     # only needs to protect against these types.
     @@browser_generated_types = Set.new [:html, :url_encoded_form, :multipart_form, :text]
     cattr_reader :browser_generated_types
-
+    attr_reader :symbol
 
     @@unverifiable_types = Set.new [:text, :json, :csv, :xml, :rss, :atom, :yaml]
     def self.unverifiable_types
@@ -67,7 +90,7 @@ module Mime
       end
 
       def lookup_by_extension(extension)
-        EXTENSION_LOOKUP[extension]
+        EXTENSION_LOOKUP[extension.to_s]
       end
 
       # Registers an alias that's not used on mime type lookup, but can be referenced directly. Especially useful for
@@ -81,7 +104,7 @@ module Mime
 
         SET << Mime.const_get(symbol.to_s.upcase)
 
-        ([string] + mime_type_synonyms).each { |string| LOOKUP[string] = SET.last } unless skip_lookup
+        ([string] + mime_type_synonyms).each { |str| LOOKUP[str] = SET.last } unless skip_lookup
         ([symbol.to_s] + extension_synonyms).each { |ext| EXTENSION_LOOKUP[ext] = SET.last }
       end
 
@@ -187,17 +210,13 @@ module Mime
     # Returns true if Action Pack should check requests using this Mime Type for possible request forgery.  See
     # ActionController::RequestForgeryProtection.
     def verify_request?
-      browser_generated?
+      @@browser_generated_types.include?(to_sym)
     end
 
     def html?
       @@html_types.include?(to_sym) || @string =~ /html/
     end
 
-    def browser_generated?
-      @@browser_generated_types.include?(to_sym)
-    end
-
     private
       def method_missing(method, *args)
         if method.to_s =~ /(\w+)\?$/
@@ -209,4 +228,4 @@ module Mime
   end
 end
 
-require 'action_controller/mime_types'
+require 'action_dispatch/http/mime_types'

data/lib/{action_controller → action_dispatch/http}/mime_types.rb

@@ -1,9 +1,8 @@
 # Build list of Mime types for HTTP responses
 # http://www.iana.org/assignments/media-types/
 
-Mime::Type.register "*/*", :all
-Mime::Type.register "text/plain", :text, [], %w(txt)
 Mime::Type.register "text/html", :html, %w( application/xhtml+xml ), %w( xhtml )
+Mime::Type.register "text/plain", :text, [], %w(txt)
 Mime::Type.register "text/javascript", :js, %w( application/javascript application/x-javascript )
 Mime::Type.register "text/css", :css
 Mime::Type.register "text/calendar", :ics
@@ -18,4 +17,7 @@ Mime::Type.register "application/x-www-form-urlencoded", :url_encoded_form
 
 # http://www.ietf.org/rfc/rfc4627.txt
 # http://www.json.org/JSONRequest.html
-Mime::Type.register "application/json", :json, %w( text/x-json application/jsonrequest )
+Mime::Type.register "application/json", :json, %w( text/x-json application/jsonrequest )
+
+# Create Mime::ALL but do not add it to the SET.
+Mime::ALL = Mime::Type.new("*/*", :all, [])

data/lib/action_dispatch/http/parameters.rb

@@ -0,0 +1,49 @@
+require 'active_support/core_ext/hash/keys'
+
+module ActionDispatch
+  module Http
+    module Parameters
+      # Returns both GET and POST \parameters in a single hash.
+      def parameters
+        @env["action_dispatch.request.parameters"] ||= request_parameters.merge(query_parameters).update(path_parameters).with_indifferent_access
+      end
+      alias :params :parameters
+
+      def path_parameters=(parameters) #:nodoc:
+        @env.delete("action_dispatch.request.symbolized_path_parameters")
+        @env.delete("action_dispatch.request.parameters")
+        @env["action_dispatch.request.path_parameters"] = parameters
+      end
+
+      # The same as <tt>path_parameters</tt> with explicitly symbolized keys.
+      def symbolized_path_parameters
+        @env["action_dispatch.request.symbolized_path_parameters"] ||= path_parameters.symbolize_keys
+      end
+
+      # Returns a hash with the \parameters used to form the \path of the request.
+      # Returned hash keys are strings:
+      #
+      #   {'action' => 'my_action', 'controller' => 'my_controller'}
+      #
+      # See <tt>symbolized_path_parameters</tt> for symbolized keys.
+      def path_parameters
+        @env["action_dispatch.request.path_parameters"] ||= {}
+      end
+
+    private
+      # Convert nested Hashs to HashWithIndifferentAccess
+      def normalize_parameters(value)
+        case value
+        when Hash
+          h = {}
+          value.each { |k, v| h[k] = normalize_parameters(v) }
+          h.with_indifferent_access
+        when Array
+          value.map { |e| normalize_parameters(e) }
+        else
+          value
+        end
+      end
+    end
+  end
+end

data/lib/action_dispatch/http/request.rb

@@ -0,0 +1,223 @@
+require 'tempfile'
+require 'stringio'
+require 'strscan'
+
+require 'active_support/core_ext/hash/indifferent_access'
+require 'active_support/core_ext/string/access'
+require 'action_dispatch/http/headers'
+
+module ActionDispatch
+  class Request < Rack::Request
+    include ActionDispatch::Http::Cache::Request
+    include ActionDispatch::Http::MimeNegotiation
+    include ActionDispatch::Http::Parameters
+    include ActionDispatch::Http::FilterParameters
+    include ActionDispatch::Http::Upload
+    include ActionDispatch::Http::URL
+
+    %w[ AUTH_TYPE GATEWAY_INTERFACE
+        PATH_TRANSLATED REMOTE_HOST
+        REMOTE_IDENT REMOTE_USER REMOTE_ADDR
+        SERVER_NAME SERVER_PROTOCOL
+
+        HTTP_ACCEPT HTTP_ACCEPT_CHARSET HTTP_ACCEPT_ENCODING
+        HTTP_ACCEPT_LANGUAGE HTTP_CACHE_CONTROL HTTP_FROM
+        HTTP_NEGOTIATE HTTP_PRAGMA ].each do |env|
+      class_eval <<-METHOD, __FILE__, __LINE__ + 1
+        def #{env.sub(/^HTTP_/n, '').downcase}
+          @env["#{env}"]
+        end
+      METHOD
+    end
+
+    def key?(key)
+      @env.key?(key)
+    end
+
+    HTTP_METHODS = %w(get head put post delete options)
+    HTTP_METHOD_LOOKUP = HTTP_METHODS.inject({}) { |h, m| h[m] = h[m.upcase] = m.to_sym; h }
+
+    # Returns the true HTTP request \method as a lowercase symbol, such as
+    # <tt>:get</tt>. If the request \method is not listed in the HTTP_METHODS
+    # constant above, an UnknownHttpMethod exception is raised.
+    def request_method
+      method = env["rack.methodoverride.original_method"] || env["REQUEST_METHOD"]
+      HTTP_METHOD_LOOKUP[method] || raise(ActionController::UnknownHttpMethod, "#{method}, accepted HTTP methods are #{HTTP_METHODS.to_sentence(:locale => :en)}")
+    end
+
+    # Returns the HTTP request \method used for action processing as a
+    # lowercase symbol, such as <tt>:post</tt>. (Unlike #request_method, this
+    # method returns <tt>:get</tt> for a HEAD request because the two are
+    # functionally equivalent from the application's perspective.)
+    def method
+      method = env["REQUEST_METHOD"]
+      HTTP_METHOD_LOOKUP[method] || raise(ActionController::UnknownHttpMethod, "#{method}, accepted HTTP methods are #{HTTP_METHODS.to_sentence(:locale => :en)}")
+    end
+
+    # Is this a GET (or HEAD) request?  Equivalent to <tt>request.method == :get</tt>.
+    def get?
+      method == :get
+    end
+
+    # Is this a POST request?  Equivalent to <tt>request.method == :post</tt>.
+    def post?
+      method == :post
+    end
+
+    # Is this a PUT request?  Equivalent to <tt>request.method == :put</tt>.
+    def put?
+      method == :put
+    end
+
+    # Is this a DELETE request?  Equivalent to <tt>request.method == :delete</tt>.
+    def delete?
+      method == :delete
+    end
+
+    # Is this a HEAD request? Since <tt>request.method</tt> sees HEAD as <tt>:get</tt>,
+    # this \method checks the actual HTTP \method directly.
+    def head?
+      request_method == :head
+    end
+
+    # Provides access to the request's HTTP headers, for example:
+    #
+    #   request.headers["Content-Type"] # => "text/plain"
+    def headers
+      Http::Headers.new(@env)
+    end
+
+    def forgery_whitelisted?
+      method == :get || xhr? || content_type.nil? || !content_type.verify_request?
+    end
+
+    def media_type
+      content_type.to_s
+    end
+
+    # Returns the content length of the request as an integer.
+    def content_length
+      super.to_i
+    end
+
+    # Returns true if the request's "X-Requested-With" header contains
+    # "XMLHttpRequest". (The Prototype Javascript library sends this header with
+    # every Ajax request.)
+    def xml_http_request?
+      !(@env['HTTP_X_REQUESTED_WITH'] !~ /XMLHttpRequest/i)
+    end
+    alias :xhr? :xml_http_request?
+
+    # Which IP addresses are "trusted proxies" that can be stripped from
+    # the right-hand-side of X-Forwarded-For
+    TRUSTED_PROXIES = /^127\.0\.0\.1$|^(10|172\.(1[6-9]|2[0-9]|30|31)|192\.168)\./i
+
+    # Determines originating IP address.  REMOTE_ADDR is the standard
+    # but will fail if the user is behind a proxy.  HTTP_CLIENT_IP and/or
+    # HTTP_X_FORWARDED_FOR are set by proxies so check for these if
+    # REMOTE_ADDR is a proxy.  HTTP_X_FORWARDED_FOR may be a comma-
+    # delimited list in the case of multiple chained proxies; the last
+    # address which is not trusted is the originating IP.
+    def remote_ip
+      remote_addr_list = @env['REMOTE_ADDR'] && @env['REMOTE_ADDR'].scan(/[^,\s]+/)
+
+      unless remote_addr_list.blank?
+        not_trusted_addrs = remote_addr_list.reject {|addr| addr =~ TRUSTED_PROXIES || addr =~ ActionController::Base.trusted_proxies}
+        return not_trusted_addrs.first unless not_trusted_addrs.empty?
+      end
+      remote_ips = @env['HTTP_X_FORWARDED_FOR'] && @env['HTTP_X_FORWARDED_FOR'].split(',')
+
+      if @env.include? 'HTTP_CLIENT_IP'
+        if ActionController::Base.ip_spoofing_check && remote_ips && !remote_ips.include?(@env['HTTP_CLIENT_IP'])
+          # We don't know which came from the proxy, and which from the user
+          raise ActionController::ActionControllerError.new <<EOM
+IP spoofing attack?!
+HTTP_CLIENT_IP=#{@env['HTTP_CLIENT_IP'].inspect}
+HTTP_X_FORWARDED_FOR=#{@env['HTTP_X_FORWARDED_FOR'].inspect}
+EOM
+        end
+
+        return @env['HTTP_CLIENT_IP']
+      end
+
+      if remote_ips
+        while remote_ips.size > 1 && (TRUSTED_PROXIES =~ remote_ips.last.strip || ActionController::Base.trusted_proxies =~ remote_ips.last.strip)
+          remote_ips.pop
+        end
+
+        return remote_ips.last.strip
+      end
+
+      @env['REMOTE_ADDR']
+    end
+
+    # Returns the lowercase name of the HTTP server software.
+    def server_software
+      (@env['SERVER_SOFTWARE'] && /^([a-zA-Z]+)/ =~ @env['SERVER_SOFTWARE']) ? $1.downcase : nil
+    end
+
+    # Read the request \body. This is useful for web services that need to
+    # work with raw requests directly.
+    def raw_post
+      unless @env.include? 'RAW_POST_DATA'
+        @env['RAW_POST_DATA'] = body.read(@env['CONTENT_LENGTH'].to_i)
+        body.rewind if body.respond_to?(:rewind)
+      end
+      @env['RAW_POST_DATA']
+    end
+
+    # The request body is an IO input stream. If the RAW_POST_DATA environment
+    # variable is already set, wrap it in a StringIO.
+    def body
+      if raw_post = @env['RAW_POST_DATA']
+        raw_post.force_encoding(Encoding::BINARY) if raw_post.respond_to?(:force_encoding)
+        StringIO.new(raw_post)
+      else
+        @env['rack.input']
+      end
+    end
+
+    def form_data?
+      FORM_DATA_MEDIA_TYPES.include?(content_type.to_s)
+    end
+
+    def body_stream #:nodoc:
+      @env['rack.input']
+    end
+
+    def reset_session
+      self.session_options.delete(:id)
+      self.session = {}
+    end
+
+    def session=(session) #:nodoc:
+      @env['rack.session'] = session
+    end
+
+    def session_options=(options)
+      @env['rack.session.options'] = options
+    end
+
+    # Override Rack's GET method to support indifferent access
+    def GET
+      @env["action_dispatch.request.query_parameters"] ||= normalize_parameters(super)
+    end
+    alias :query_parameters :GET
+
+    # Override Rack's POST method to support indifferent access
+    def POST
+      @env["action_dispatch.request.request_parameters"] ||= normalize_parameters(super)
+    end
+    alias :request_parameters :POST
+
+
+    # Returns the authorization header regardless of whether it was specified directly or through one of the
+    # proxy alternatives.
+    def authorization
+      @env['HTTP_AUTHORIZATION']   ||
+      @env['X-HTTP_AUTHORIZATION'] ||
+      @env['X_HTTP_AUTHORIZATION'] ||
+      @env['REDIRECT_X_HTTP_AUTHORIZATION']
+    end
+  end
+end

data/lib/action_dispatch/http/response.rb

@@ -0,0 +1,209 @@
+require 'digest/md5'
+require 'active_support/core_ext/module/delegation'
+
+module ActionDispatch # :nodoc:
+  # Represents an HTTP response generated by a controller action. One can use
+  # an ActionDispatch::Response object to retrieve the current state
+  # of the response, or customize the response. An Response object can
+  # either represent a "real" HTTP response (i.e. one that is meant to be sent
+  # back to the web browser) or a test response (i.e. one that is generated
+  # from integration tests). See CgiResponse and TestResponse, respectively.
+  #
+  # Response is mostly a Ruby on Rails framework implement detail, and
+  # should never be used directly in controllers. Controllers should use the
+  # methods defined in ActionController::Base instead. For example, if you want
+  # to set the HTTP response's content MIME type, then use
+  # ActionControllerBase#headers instead of Response#headers.
+  #
+  # Nevertheless, integration tests may want to inspect controller responses in
+  # more detail, and that's when Response can be useful for application
+  # developers. Integration test methods such as
+  # ActionDispatch::Integration::Session#get and
+  # ActionDispatch::Integration::Session#post return objects of type
+  # TestResponse (which are of course also of type Response).
+  #
+  # For example, the following demo integration "test" prints the body of the
+  # controller response to the console:
+  #
+  #  class DemoControllerTest < ActionDispatch::IntegrationTest
+  #    def test_print_root_path_to_console
+  #      get('/')
+  #      puts @response.body
+  #    end
+  #  end
+  class Response < Rack::Response
+    include ActionDispatch::Http::Cache::Response
+
+    attr_accessor :request, :blank
+
+    attr_writer :header, :sending_file
+    alias_method :headers=, :header=
+
+    def initialize
+      @status = 200
+      @header = {}
+      @cache_control = {}
+
+      @writer = lambda { |x| @body << x }
+      @block = nil
+      @length = 0
+
+      @body, @cookie = [], []
+      @sending_file = false
+
+      @blank = false
+      @etag = nil
+
+      yield self if block_given?
+    end
+
+    def status=(status)
+      @status = Rack::Utils.status_code(status)
+    end
+
+    # The response code of the request
+    def response_code
+      @status
+    end
+
+    # Returns a String to ensure compatibility with Net::HTTPResponse
+    def code
+      @status.to_s
+    end
+
+    def message
+      Rack::Utils::HTTP_STATUS_CODES[@status]
+    end
+    alias_method :status_message, :message
+
+    def body
+      str = ''
+      each { |part| str << part.to_s }
+      str
+    end
+
+    EMPTY = " "
+
+    def body=(body)
+      @blank = true if body == EMPTY
+      @body = body.respond_to?(:to_str) ? [body] : body
+    end
+
+    def body_parts
+      @body
+    end
+
+    def location
+      headers['Location']
+    end
+    alias_method :redirect_url, :location
+
+    def location=(url)
+      headers['Location'] = url
+    end
+
+    # Sets the HTTP response's content MIME type. For example, in the controller
+    # you could write this:
+    #
+    #  response.content_type = "text/plain"
+    #
+    # If a character set has been defined for this response (see charset=) then
+    # the character set information will also be included in the content type
+    # information.
+    attr_accessor :charset, :content_type
+
+    CONTENT_TYPE    = "Content-Type"
+
+    cattr_accessor(:default_charset) { "utf-8" }
+
+    def to_a
+      assign_default_content_type_and_charset!
+      handle_conditional_get!
+      self["Set-Cookie"] = @cookie.join("\n") unless @cookie.blank?
+      self["ETag"]       = @etag if @etag
+      super
+    end
+
+    alias prepare! to_a
+
+    def each(&callback)
+      if @body.respond_to?(:call)
+        @writer = lambda { |x| callback.call(x) }
+        @body.call(self, self)
+      else
+        @body.each { |part| callback.call(part.to_s) }
+      end
+
+      @writer = callback
+      @block.call(self) if @block
+    end
+
+    def write(str)
+      str = str.to_s
+      @writer.call str
+      str
+    end
+
+    # Returns the response cookies, converted to a Hash of (name => value) pairs
+    #
+    #   assert_equal 'AuthorOfNewPage', r.cookies['author']
+    def cookies
+      cookies = {}
+      if header = @cookie
+        header = header.split("\n") if header.respond_to?(:to_str)
+        header.each do |cookie|
+          if pair = cookie.split(';').first
+            key, value = pair.split("=").map { |v| Rack::Utils.unescape(v) }
+            cookies[key] = value
+          end
+        end
+      end
+      cookies
+    end
+
+    def set_cookie(key, value)
+      case value
+      when Hash
+        domain  = "; domain="  + value[:domain]    if value[:domain]
+        path    = "; path="    + value[:path]      if value[:path]
+        # According to RFC 2109, we need dashes here.
+        # N.B.: cgi.rb uses spaces...
+        expires = "; expires=" + value[:expires].clone.gmtime.
+          strftime("%a, %d-%b-%Y %H:%M:%S GMT")    if value[:expires]
+        secure = "; secure"  if value[:secure]
+        httponly = "; HttpOnly" if value[:httponly]
+        value = value[:value]
+      end
+      value = [value]  unless Array === value
+      cookie = Rack::Utils.escape(key) + "=" +
+        value.map { |v| Rack::Utils.escape v }.join("&") +
+        "#{domain}#{path}#{expires}#{secure}#{httponly}"
+
+      @cookie << cookie
+    end
+
+    def delete_cookie(key, value={})
+      @cookie.reject! { |cookie|
+        cookie =~ /\A#{Rack::Utils.escape(key)}=/
+      }
+
+      set_cookie(key,
+                 {:value => '', :path => nil, :domain => nil,
+                   :expires => Time.at(0) }.merge(value))
+    end
+
+    private
+      def assign_default_content_type_and_charset!
+        return if headers[CONTENT_TYPE].present?
+
+        @content_type ||= Mime::HTML
+        @charset      ||= self.class.default_charset
+
+        type = @content_type.to_s.dup
+        type << "; charset=#{@charset}" unless @sending_file
+
+        headers[CONTENT_TYPE] = type
+      end
+
+  end
+end