actionpack 2.3.18 → 3.0.0.beta

data/lib/action_dispatch/http/upload.rb

@@ -0,0 +1,48 @@
+module ActionDispatch
+  module Http
+    module UploadedFile
+      def self.extended(object)
+        object.class_eval do
+          attr_accessor :original_path, :content_type
+          alias_method :local_path, :path if method_defined?(:path)
+        end
+      end
+
+      # Take the basename of the upload's original filename.
+      # This handles the full Windows paths given by Internet Explorer
+      # (and perhaps other broken user agents) without affecting
+      # those which give the lone filename.
+      # The Windows regexp is adapted from Perl's File::Basename.
+      def original_filename
+        unless defined? @original_filename
+          @original_filename =
+            unless original_path.blank?
+              if original_path =~ /^(?:.*[:\\\/])?(.*)/m
+                $1
+              else
+                File.basename original_path
+              end
+            end
+        end
+        @original_filename
+      end
+    end
+
+    module Upload
+      # Convert nested Hashs to HashWithIndifferentAccess and replace
+      # file upload hashs with UploadedFile objects
+      def normalize_parameters(value)
+        if Hash === value && value.has_key?(:tempfile)
+          upload = value[:tempfile]
+          upload.extend(UploadedFile)
+          upload.original_path = value[:filename]
+          upload.content_type = value[:type]
+          upload
+        else
+          super
+        end
+      end
+      private :normalize_parameters
+    end
+  end
+end

data/lib/action_dispatch/http/url.rb

@@ -0,0 +1,129 @@
+module ActionDispatch
+  module Http
+    module URL
+      # Returns the complete URL used for this request.
+      def url
+        protocol + host_with_port + request_uri
+      end
+
+      # Returns 'https://' if this is an SSL request and 'http://' otherwise.
+      def protocol
+        ssl? ? 'https://' : 'http://'
+      end
+
+      # Is this an SSL request?
+      def ssl?
+        @env['HTTPS'] == 'on' || @env['HTTP_X_FORWARDED_PROTO'] == 'https'
+      end
+
+      # Returns the \host for this request, such as "example.com".
+      def raw_host_with_port
+        if forwarded = env["HTTP_X_FORWARDED_HOST"]
+          forwarded.split(/,\s?/).last
+        else
+          env['HTTP_HOST'] || "#{env['SERVER_NAME'] || env['SERVER_ADDR']}:#{env['SERVER_PORT']}"
+        end
+      end
+
+      # Returns the host for this request, such as example.com.
+      def host
+        raw_host_with_port.sub(/:\d+$/, '')
+      end
+
+      # Returns a \host:\port string for this request, such as "example.com" or
+      # "example.com:8080".
+      def host_with_port
+        "#{host}#{port_string}"
+      end
+
+      # Returns the port number of this request as an integer.
+      def port
+        if raw_host_with_port =~ /:(\d+)$/
+          $1.to_i
+        else
+          standard_port
+        end
+      end
+
+      # Returns the standard \port number for this request's protocol.
+      def standard_port
+        case protocol
+          when 'https://' then 443
+          else 80
+        end
+      end
+
+      # Returns a \port suffix like ":8080" if the \port number of this request
+      # is not the default HTTP \port 80 or HTTPS \port 443.
+      def port_string
+        port == standard_port ? '' : ":#{port}"
+      end
+
+      def server_port
+        @env['SERVER_PORT'].to_i
+      end
+
+      # Returns the \domain part of a \host, such as "rubyonrails.org" in "www.rubyonrails.org". You can specify
+      # a different <tt>tld_length</tt>, such as 2 to catch rubyonrails.co.uk in "www.rubyonrails.co.uk".
+      def domain(tld_length = 1)
+        return nil unless named_host?(host)
+
+        host.split('.').last(1 + tld_length).join('.')
+      end
+
+      # Returns all the \subdomains as an array, so <tt>["dev", "www"]</tt> would be
+      # returned for "dev.www.rubyonrails.org". You can specify a different <tt>tld_length</tt>,
+      # such as 2 to catch <tt>["www"]</tt> instead of <tt>["www", "rubyonrails"]</tt>
+      # in "www.rubyonrails.co.uk".
+      def subdomains(tld_length = 1)
+        return [] unless named_host?(host)
+        parts = host.split('.')
+        parts[0..-(tld_length+2)]
+      end
+
+      # Returns the query string, accounting for server idiosyncrasies.
+      def query_string
+        @env['QUERY_STRING'].present? ? @env['QUERY_STRING'] : (@env['REQUEST_URI'].to_s.split('?', 2)[1] || '')
+      end
+
+      # Returns the request URI, accounting for server idiosyncrasies.
+      # WEBrick includes the full URL. IIS leaves REQUEST_URI blank.
+      def request_uri
+        if uri = @env['REQUEST_URI']
+          # Remove domain, which webrick puts into the request_uri.
+          (%r{^\w+\://[^/]+(/.*|$)$} =~ uri) ? $1 : uri
+        else
+          # Construct IIS missing REQUEST_URI from SCRIPT_NAME and PATH_INFO.
+          uri = @env['PATH_INFO'].to_s
+
+          if script_filename = @env['SCRIPT_NAME'].to_s.match(%r{[^/]+$})
+            uri = uri.sub(/#{script_filename}\//, '')
+          end
+
+          env_qs = @env['QUERY_STRING'].to_s
+          uri += "?#{env_qs}" unless env_qs.empty?
+
+          if uri.blank?
+            @env.delete('REQUEST_URI')
+          else
+            @env['REQUEST_URI'] = uri
+          end
+        end
+      end
+
+      # Returns the interpreted \path to requested resource after all the installation
+      # directory of this application was taken into account.
+      def path
+        path = request_uri.to_s[/\A[^\?]*/]
+        path.sub!(/\A#{ActionController::Base.relative_url_root}/, '')
+        path
+      end
+
+    private
+
+      def named_host?(host)
+        !(host.nil? || /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.match(host))
+      end
+    end
+  end
+end

data/lib/action_dispatch/middleware/callbacks.rb

@@ -0,0 +1,50 @@
+module ActionDispatch
+  # Provide callbacks to be executed before and after the request dispatch.
+  #
+  # It also provides a to_prepare callback, which is performed in all requests
+  # in development by only once in production and notification callback for async
+  # operations.
+  #
+  class Callbacks
+    include ActiveSupport::Callbacks
+
+    define_callbacks :call, :terminator => "result == false", :rescuable => true
+    define_callbacks :prepare, :scope => :name
+
+    # Add a preparation callback. Preparation callbacks are run before every
+    # request in development mode, and before the first request in production mode.
+    #
+    # If a symbol with a block is given, the symbol is used as an identifier.
+    # That allows to_prepare to be called again with the same identifier to
+    # replace the existing callback. Passing an identifier is a suggested
+    # practice if the code adding a preparation block may be reloaded.
+    def self.to_prepare(*args, &block)
+      if args.first.is_a?(Symbol) && block_given?
+        define_method :"__#{args.first}", &block
+        set_callback(:prepare, :"__#{args.first}")
+      else
+        set_callback(:prepare, *args, &block)
+      end
+    end
+
+    def self.before(*args, &block)
+      set_callback(:call, :before, *args, &block)
+    end
+
+    def self.after(*args, &block)
+      set_callback(:call, :after, *args, &block)
+    end
+
+    def initialize(app, prepare_each_request = false)
+      @app, @prepare_each_request = app, prepare_each_request
+      run_callbacks(:prepare) unless @prepare_each_request
+    end
+
+    def call(env)
+      run_callbacks(:call) do
+        run_callbacks(:prepare) if @prepare_each_request
+        @app.call(env)
+      end
+    end
+  end
+end

data/lib/action_dispatch/middleware/cascade.rb

@@ -0,0 +1,29 @@
+module ActionDispatch
+  class Cascade
+    def self.new(*apps)
+      apps = apps.flatten
+
+      case apps.length
+      when 0
+        raise ArgumentError, "app is required"
+      when 1
+        apps.first
+      else
+        super(apps)
+      end
+    end
+
+    def initialize(apps)
+      @apps = apps
+    end
+
+    def call(env)
+      result = nil
+      @apps.each do |app|
+        result = app.call(env)
+        break unless result[1]["X-Cascade"] == "pass"
+      end
+      result
+    end
+  end
+end

data/lib/action_dispatch/middleware/cookies.rb

@@ -0,0 +1,216 @@
+module ActionDispatch
+  class Request
+    def cookie_jar
+      env['action_dispatch.cookies'] ||= Cookies::CookieJar.build(self)
+    end
+  end
+
+  # Cookies are read and written through ActionController#cookies.
+  #
+  # The cookies being read are the ones received along with the request, the cookies
+  # being written will be sent out with the response. Reading a cookie does not get
+  # the cookie object itself back, just the value it holds.
+  #
+  # Examples for writing:
+  #
+  #   # Sets a simple session cookie.
+  #   cookies[:user_name] = "david"
+  #
+  #   # Sets a cookie that expires in 1 hour.
+  #   cookies[:login] = { :value => "XJ-122", :expires => 1.hour.from_now }
+  #
+  # Examples for reading:
+  #
+  #   cookies[:user_name] # => "david"
+  #   cookies.size        # => 2
+  #
+  # Example for deleting:
+  #
+  #   cookies.delete :user_name
+  #
+  # Please note that if you specify a :domain when setting a cookie, you must also specify the domain when deleting the cookie:
+  #
+  #  cookies[:key] = {
+  #    :value => 'a yummy cookie',
+  #    :expires => 1.year.from_now,
+  #    :domain => 'domain.com'
+  #  }
+  #
+  #  cookies.delete(:key, :domain => 'domain.com')
+  #
+  # The option symbols for setting cookies are:
+  #
+  # * <tt>:value</tt> - The cookie's value or list of values (as an array).
+  # * <tt>:path</tt> - The path for which this cookie applies.  Defaults to the root
+  #   of the application.
+  # * <tt>:domain</tt> - The domain for which this cookie applies.
+  # * <tt>:expires</tt> - The time at which this cookie expires, as a Time object.
+  # * <tt>:secure</tt> - Whether this cookie is a only transmitted to HTTPS servers.
+  #   Default is +false+.
+  # * <tt>:httponly</tt> - Whether this cookie is accessible via scripting or
+  #   only HTTP. Defaults to +false+.
+  class Cookies
+    class CookieJar < Hash #:nodoc:
+      def self.build(request)
+        new.tap do |hash|
+          hash.update(request.cookies)
+        end
+      end
+
+      def initialize
+        @set_cookies = {}
+        @delete_cookies = {}
+
+        super
+      end
+
+      # Returns the value of the cookie by +name+, or +nil+ if no such cookie exists.
+      def [](name)
+        super(name.to_s)
+      end
+
+      # Sets the cookie named +name+. The second argument may be the very cookie
+      # value, or a hash of options as documented above.
+      def []=(key, options)
+        if options.is_a?(Hash)
+          options.symbolize_keys!
+          value = options[:value]
+        else
+          value = options
+          options = { :value => value }
+        end
+
+        value = super(key.to_s, value)
+
+        options[:path] ||= "/"
+        @set_cookies[key] = options
+        value
+      end
+
+      # Removes the cookie on the client machine by setting the value to an empty string
+      # and setting its expiration date into the past. Like <tt>[]=</tt>, you can pass in
+      # an options hash to delete cookies with extra data such as a <tt>:path</tt>.
+      def delete(key, options = {})
+        options.symbolize_keys!
+        options[:path] ||= "/"
+        value = super(key.to_s)
+        @delete_cookies[key] = options
+        value
+      end
+
+      # Returns a jar that'll automatically set the assigned cookies to have an expiration date 20 years from now. Example:
+      #
+      #   cookies.permanent[:prefers_open_id] = true
+      #   # => Set-Cookie: prefers_open_id=true; path=/; expires=Sun, 16-Dec-2029 03:24:16 GMT
+      #
+      # This jar is only meant for writing. You'll read permanent cookies through the regular accessor.
+      #
+      # This jar allows chaining with the signed jar as well, so you can set permanent, signed cookies. Examples:
+      #
+      #   cookies.permanent.signed[:remember_me] = current_user.id
+      #   # => Set-Cookie: discount=BAhU--848956038e692d7046deab32b7131856ab20e14e; path=/; expires=Sun, 16-Dec-2029 03:24:16 GMT
+      def permanent
+        @permanent ||= PermanentCookieJar.new(self)
+      end
+
+      # Returns a jar that'll automatically generate a signed representation of cookie value and verify it when reading from
+      # the cookie again. This is useful for creating cookies with values that the user is not supposed to change. If a signed
+      # cookie was tampered with by the user (or a 3rd party), an ActiveSupport::MessageVerifier::InvalidSignature exception will
+      # be raised.
+      #
+      # This jar requires that you set a suitable secret for the verification on ActionController::Base.cookie_verifier_secret.
+      #
+      # Example:
+      #
+      #   cookies.signed[:discount] = 45
+      #   # => Set-Cookie: discount=BAhpMg==--2c1c6906c90a3bc4fd54a51ffb41dffa4bf6b5f7; path=/
+      #
+      #   cookies.signed[:discount] # => 45
+      def signed
+        @signed ||= SignedCookieJar.new(self)
+      end
+
+      def write(response)
+        @set_cookies.each { |k, v| response.set_cookie(k, v) }
+        @delete_cookies.each { |k, v| response.delete_cookie(k, v) }
+      end
+    end
+
+    class PermanentCookieJar < CookieJar #:nodoc:
+      def initialize(parent_jar)
+        @parent_jar = parent_jar
+      end
+
+      def []=(key, options)
+        if options.is_a?(Hash)
+          options.symbolize_keys!
+        else
+          options = { :value => options }
+        end
+
+        options[:expires] = 20.years.from_now
+        @parent_jar[key] = options
+      end
+
+      def signed
+        @signed ||= SignedCookieJar.new(self)
+      end
+
+      def controller
+        @parent_jar.controller
+      end
+
+      def method_missing(method, *arguments, &block)
+        @parent_jar.send(method, *arguments, &block)
+      end
+    end
+
+    class SignedCookieJar < CookieJar #:nodoc:
+      def initialize(parent_jar)
+        unless ActionController::Base.cookie_verifier_secret
+          raise "You must set ActionController::Base.cookie_verifier_secret to use signed cookies"
+        end
+
+        @parent_jar = parent_jar
+        @verifier = ActiveSupport::MessageVerifier.new(ActionController::Base.cookie_verifier_secret)
+      end
+
+      def [](name)
+        if value = @parent_jar[name]
+          @verifier.verify(value)
+        end
+      end
+
+      def []=(key, options)
+        if options.is_a?(Hash)
+          options.symbolize_keys!
+          options[:value] = @verifier.generate(options[:value])
+        else
+          options = { :value => @verifier.generate(options) }
+        end
+
+        @parent_jar[key] = options
+      end
+
+      def method_missing(method, *arguments, &block)
+        @parent_jar.send(method, *arguments, &block)
+      end
+    end
+
+    def initialize(app)
+      @app = app
+    end
+
+    def call(env)
+      status, headers, body = @app.call(env)
+
+      if cookie_jar = env['action_dispatch.cookies']
+        response = Rack::Response.new(body, status, headers)
+        cookie_jar.write(response)
+        response.to_a
+      else
+        [status, headers, body]
+      end
+    end
+  end
+end