actionpack 3.2.19 → 4.0.0

data/CHANGELOG.md

@@ -1,389 +1,693 @@
-## Rails 3.2.19 (Jul 2, 2014) ##
+## Rails 4.0.0 (June 25, 2013) ##
 
-*   Fix regression when using `ActionView::Helpers::TranslationHelper#translate` with
-    `options[:raise]`.
+*   Merge `:action` from routing scope and assign endpoint if both `:controller`
+    and `:action` are present. The endpoint assignment only occurs if there is
+    no `:to` present in the options hash so should only affect routes using the
+    shorthand syntax (i.e. endpoint is inferred from the the path).
 
-    This regression was introduced at ec16ba75a5493b9da972eea08bae630eba35b62f.
+    Fixes #9856
 
-    *Shota Fukumori (sora_h)*
+    *Yves Senn*, *Andrew White*
 
+*   Use a case insensitive URI Regexp for #asset_path.
 
-## Rails 3.2.18 (May 6, 2014) ##
+    This fix a problem where the same asset path using different case are generating
+    different URIs.
 
-*   Only accept actions without File::SEPARATOR in the name.
+    Before:
 
-    This will avoid directory traversal in implicit render.
+        image_tag("HTTP://google.com")
+        # => "<img alt=\"Google\" src=\"/assets/HTTP://google.com\" />"
+        image_tag("http://google.com")
+        # => "<img alt=\"Google\" src=\"http://google.com\" />"
 
-    Fixes: CVE-2014-0130
+    After:
 
-    *Rafael Mendonça França*
+        image_tag("HTTP://google.com")
+        # => "<img alt=\"Google\" src=\"HTTP://google.com\" />"
+        image_tag("http://google.com")
+        # => "<img alt=\"Google\" src=\"http://google.com\" />"
 
+    *David Celis*
 
-## Rails 3.2.17 (Feb 18, 2014) ##
+*   Fix an issue where partials with a number in the filename weren't being digested for cache dependencies.
 
-*   Use the reference for the mime type to get the format
+    *Bryan Ricker*
 
-    Fixes: CVE-2014-0082
+*   Add support for passing custom url options other than `:host` and custom
+    status and flash options to `force_ssl`.
 
-*   Escape format, negative_format and units options of number helpers
+    *Andrew White*
 
-    Fixes: CVE-2014-0081
+*   The `force_ssl` command now builds the redirect url from `request.fullpath`.
+    This ensures that the format is maintained and it doesn't redirect to a route
+    that has the same parameters but is defined earlier in `routes.rb`. Also any
+    optional segments are maintained.
 
+    Fixes #7528, #9061, #10305.
 
-## Rails 3.2.16 (Dec 12, 2013) ##
+    *Andrew White*
 
-*   Deep Munge the parameters for GET and POST Fixes CVE-2013-6417
+*   Return a 405 Method Not Allowed response when a request contains an unknown
+    HTTP method.
 
-*   Stop using i18n's built in HTML error handling.  Fixes: CVE-2013-4491
+    *Lewis Marshall*
 
-*   Escape the unit value provided to number_to_currency Fixes CVE-2013-6415
+*   Add support for extracting the port from the `:host` option passed to `url_for`.
 
-*   Only use valid mime type symbols as cache keys CVE-2013-6414
+    *Andrew White*
 
-## Rails 3.2.15 (Oct 16, 2013) ##
+*   Add support for removing the subdomain from a url by passing `nil`, `false` or `''`.
+    Fixes #10180.
 
-*   Fix `ActionDispatch::RemoteIp::GetIp#calculate_ip` to only check for spoofing
-    attacks if both `HTTP_CLIENT_IP` and `HTTP_X_FORWARDED_FOR` are set.
+    *Derek Watson + Andrew White*
 
-    Fixes #12410
-    Backports #10844
+*   Element of the collection for `options_from_collection_for_select` helper can
+    optionally contain html attributes as the last element of the array as
+    `options_for_select` helper.
 
-    *Tamir Duberstein*
+    *Vasiliy Ermolovich*
 
-*   Fix the assert_recognizes test method so that it works when there are
-    constraints on the querystring.
+*   Fix explicit names on multiple file fields. If a file field tag has
+    the multiple option, it is turned into an array field (appending `[]`),
+    but if an explicit name is passed to `file_field` the `[]` is not
+    appended.
+    Fixes #9830.
 
-    Issue/Pull Request #9368
-    Backport #5219
+    *Ryan McGeary*
 
-    *Brian Hahn*
+*   Add block support for the `mail_to` helper, similar to the `link_to` helper.
 
-*   Fix to render partial by context(#11605).
+    *Sam Pohlenz*
 
-    *Kassio Borges*
+*   Automatically configure cookie-based sessions to be encrypted if
+    `secret_key_base` is set, falling back to signed if only `secret_token`
+    is set. Automatically upgrade existing signed cookie-based sessions from
+    Rails 3.x to be encrypted if both `secret_key_base` and `secret_token`
+    are set, or signed with the new key generator if only `secret_token` is
+    set. This leaves only the `config.session_store :cookie_store` option and
+    removes the two new options introduced in 4.0.0.beta1:
+    `encrypted_cookie_store` and `upgrade_signature_to_encryption_cookie_store`.
 
-*   Fix `ActionDispatch::Assertions::ResponseAssertions#assert_redirected_to`
-    does not show user-supplied message.
+    *Trevor Turk*
 
-    Issue: when `assert_redirected_to` fails due to the response redirect not
-    matching the expected redirect the user-supplied message (second parameter)
-    is not shown. This message is only shown if the response is not a redirect.
+*   Ensure consistent fallback to the default layout lookup for layouts set
+    using symbols or procs that return `nil`.
 
-    *Alexey Chernenkov*
+    All of the following layouts will result in the default layout lookup:
 
+        layout nil
 
-## Rails 3.2.14 (Jul 22, 2013) ##
+        layout proc { nil }
 
-*   Merge `:action` from routing scope and assign endpoint if both `:controller`
-    and `:action` are present. The endpoint assignment only occurs if there is
-    no `:to` present in the options hash so should only affect routes using the
-    shorthand syntax (i.e. endpoint is inferred from the the path).
+        layout :returns_nil
+        def returns_nil
+          nil
+        end
 
-    Fixes #9856
+    Previously symbols and procs which returned `nil` resulted in no layout which
+    differed from the `layout nil` behavior. To get the "no layout" behavior just
+    return `false` instead of `nil` for `layout`.
 
-    *Yves Senn*, *Andrew White*
+    *Chris Nicola*
 
-*   Always escape the result of `link_to_unless` method.
+*   Create `UpgradeLegacySignedCookieJar` to transparently upgrade existing signed
+    cookies generated by Rails 3.x to avoid invalidating them when upgrading to Rails 4.x.
 
-    Before:
+    *Trevor Turk + Neeraj Singh*
 
-        link_to_unless(true, '<b>Showing</b>', 'github.com')
-        # => "<b>Showing</b>"
+*   Raise an `ArgumentError` when a clashing named route is defined.
 
-    After:
+    *Trevor Turk*
 
-        link_to_unless(true, '<b>Showing</b>', 'github.com')
-        # => "&lt;b&gt;Showing&lt;/b&gt;"
+*   Allow default url options to accept host with protocol such as `http://`
 
-    *dtaniwaki*
+        config.action_mailer.default_url_options = { host: "http://mydomain.com" }
 
-*   Use a case insensitive URI Regexp for #asset_path.
+    *Richard Schneeman*
 
-    This fix a problem where the same asset path using different case are generating
-    different URIs.
+*   Ensure that digest authentication responds with a 401 status when a basic
+    header is received.
 
-    Before:
+    *Brad Dunbar*
 
-        image_tag("HTTP://google.com")
-        # => "<img alt=\"Google\" src=\"/assets/HTTP://google.com\" />"
-        image_tag("http://google.com")
-        # => "<img alt=\"Google\" src=\"http://google.com\" />"
+*   Include I18n locale fallbacks in view lookup.
+    Fixes #3512.
 
-    After:
+    *Juan Barreneche*
 
-        image_tag("HTTP://google.com")
-        # => "<img alt=\"Google\" src=\"HTTP://google.com\" />"
-        image_tag("http://google.com")
-        # => "<img alt=\"Google\" src=\"http://google.com\" />"
+*   Integration and functional tests allow headers and rack env
+    variables to be passed when performing requests.
+    Fixes #6513.
 
-    *David Celis + Rafael Mendonça França*
+    Example:
 
-*   Fix explicit names on multiple file fields. If a file field tag has
-    the multiple option, it is turned into an array field (appending `[]`),
-    but if an explicit name is passed to `file_field` the `[]` is not
-    appended.
-    Fixes #9830.
+        # integration test
+        get "/success", {}, "HTTP_REFERER" => "http://test.com/",
+                            "Accepts" => "text/plain, text/html"
 
-    *Ryan McGeary*
+        # functional test
+        @request.headers["Accepts"] = "text/plain, text/html"
 
-*   Fix assets loading performance in 3.2.13.
+    *Yves Senn*
 
-    Issue #8756 uses Sprockets for resolving files that already exist on disk,
-    for those files their extensions don't need to be rewritten.
+*   Http::Headers respects headers that are not prefixed with HTTP_
 
-    Fixes #9803.
+    *Yves Senn*
 
-    *Fred Wu*
+*   Fix incorrectly appended square brackets to a multiple select box
+    if an explicit name has been given and it already ends with "[]"
 
-*   Fix `ActionController#action_missing` not being called.
-    Fixes #9799.
+    Before:
 
-    *Janko Luin*
+        select(:category, [], {}, multiple: true, name: "post[category][]")
+        # => <select name="post[category][][]" ...>
 
-*   `ActionView::Helpers::NumberHelper#number_to_human` returns the number unaltered when
-    the units hash does not contain the needed key, e.g. when the number provided is less
-    than the largest key provided.
+    After:
 
-    Examples:
+        select(:category, [], {}, multiple: true, name: "post[category][]")
+        # => <select name="post[category][]" ...>
 
-        number_to_human(123, units: {})                # => 123
-        number_to_human(123, units: { thousand: 'k' }) # => 123
+    *Olek Janiszewski*
 
-    Fixes #9269.
-    Backport #9347.
+*   Fixed regression when using `assert_template` to verify files sent using
+    `render file: 'README.md'`.
+    Fixes #9464.
 
-    *Michael Hoffman*
+    *Justin Coyne*
 
-*   Include I18n locale fallbacks in view lookup.
-    Fixes GH#3512.
+*   Fixed `ActionView::Helpers::CaptureHelper#content_for` regression when trying to use it in
+    a boolean statement.
+    Fixes #9360.
 
-    *Juan Barreneche*
+    *Nikolay Shebanov*
 
-*   Fix `ActionDispatch::Request#formats` when the Accept request-header is an
-    empty string. Fix #7774 [Backport #8977, #9541]
+*   `format: true` does not override existing format constraints.
+    Fixes #9466.
 
-    *Soylent + Maxime Réty*
+    Example:
 
+        # This will force the .json extension.
+        get '/json_only', to: ok, format: true, constraints: { format: /json/ }
 
-## Rails 3.2.13 (Mar 18, 2013) ##
+    *Yves Senn*
 
-*   Fix incorrectly appended square brackets to a multiple select box
-    if an explicit name has been given and it already ends with "[]".
+*   Skip valid encoding checks for non-String parameters that come
+    from the matched route's defaults.
+    Fixes #9435.
 
-    Before:
+    Example:
 
-        select(:category, [], {}, multiple: true, name: "post[category][]")
-        # => <select name="post[category][][]" ...>
+        root to: 'main#posts', page: 1
 
-    After:
+    *Yves Senn*
 
-        select(:category, [], {}, multiple: true, name: "post[category][]")
-        # => <select name="post[category][]" ...>
+*   Don't verify Regexp requirements for non-Regexp `:constraints`.
+    Fixes #9432.
+
+    Example:
 
-    Backport #9616.
+        get '/photos.:format' => 'feeds#photos', constraints: {format: 'xml'}
 
-    *Olek Janiszewski*
+    *Yves Senn*
+
+*   Make `ActionDispatch::Journey::Path::Pattern#new` raise more meaningful exception message.
+
+    *Thierry Zires*
+
+*   Fix `respond_to` not using formats that have no block if all is present. *Michael Grosser*
+
+*   New applications use an encrypted session store by default.
+
+    *Santiago Pastorino*
 
 *   Determine the controller#action from only the matched path when using the
     shorthand syntax. Previously the complete path was used, which led
     to problems with nesting (scopes and namespaces).
     Fixes #7554.
-    Backport #9361.
 
     Example:
 
-        # this will route to questions#new
+        # This will route to questions#new.
         scope ':locale' do
           get 'questions/new'
         end
 
     *Yves Senn*
 
-*   Fix `assert_template` with `render :stream => true`.
-    Fix #1743.
-    Backport #5288.
+*   Remove support for parsing XML parameters from request. If you still want to parse XML
+    parameters, please install `actionpack-xml_parser' gem.
 
-    *Sergey Nartimov*
+    *Prem Sichanugrist*
+
+*   Remove support for parsing YAML parameters from request.
+
+    *Aaron Patterson*
+
+*   Add a message when you have no routes defined to both `rake routes` and
+    GET "/rails/info/routes" that lets you know you have none defined and links
+    to the Rails guide on the topic.
+
+    *Steve Klabnik*
+
+*   Change `image_alt` method to replace underscores/hyphens to spaces in filenames.
 
-*   Eagerly populate the http method lookup cache so local project inflections do
-    not interfere with use of underscore method ( and we don't need locks )
+    Previously, underscored filenames became `alt="A_long_file_name_with_underscores"`
+    in HTML, which is poor for accessibility. For instance, Apple's VoiceOver Utility
+    pronounces each underscore. `A_long_file_name` thus would be read as `A underscore
+    long underscore file underscore name.` Now underscored or hyphenated filenames
+    (both of which are very popular naming conventions) read more naturally in
+    screen readers by converting both hyphens and underscores to spaces.
 
-    *Aditya Sanghi*
+    Before:
+
+        image_tag('underscored_file_name.png')
+        # => <img alt="Underscored_file_name" src="/assets/underscored_file_name.png" />
+
+    After:
+
+        image_tag('underscored_file_name.png')
+        # => <img alt="Underscored file name" src="/assets/underscored_file_name.png" />
+
+    *Nick Cox*
+
+*   We don't support Ruby constant notation in the `:controller` option for route
+    definitions. So, this raises an `ArgumentError` now:
+
+        resources :posts, controller: "Admin::Posts" # WRONG
+
+    Use path notation instead:
+
+        resources :posts, controller: "admin/posts" # RIGHT
 
-*   `BestStandardsSupport` no longer duplicates `X-UA-Compatible` values on
-    each request to prevent header size from blowing up.
+    *Yves Senn*
+
+*   `assert_template` can be used to verify the locals of partials,
+    which live inside a directory.
+
+        # Prefixed partials inside directories worked and still work.
+        assert_template partial: 'directory/_partial', locals: {name: 'John'}
+
+        # This did not work but does now.
+        assert_template partial: 'directory/partial', locals: {name: 'John'}
+
+    Fixes #8516.
 
-    *Edward Anderson*
+    *Yves Senn*
+
+*   Fix `content_tag_for` with array HTML option.
+    It would embed array as string instead of joining it like `content_tag` does:
+
+        content_tag(:td, class: ["foo", "bar"]){}
+        # => <td class="foo bar"></td>
+
+    Before:
+
+        content_tag_for(:td, item, class: ["foo", "bar"])
+        # => <td class="item [&quot;foo&quot;, &quot;bar&quot;]" id="item_1"></td>
+
+    After:
+
+        content_tag_for(:td, item, class: ["foo", "bar"])
+        # => <td class="item foo bar" id="item_1"></td>
+
+    *Semyon Perepelitsa*
+
+*   Remove `BestStandardsSupport` middleware, !DOCTYPE html already triggers
+    standards mode per http://msdn.microsoft.com/en-us/library/jj676915(v=vs.85).aspx
+    and ChromeFrame header has been moved to `config.action_dispatch.default_headers`
+
+    *Guillermo Iguaran*
+
+*   Fix CSRF protection and `current_url?` helper to work with HEAD requests
+    now that `ActionDispatch::Head` has been removed in favor of `Rack::Head`.
+
+    *Michiel Sikkes*
+
+*   Change `asset_path` to not include `SCRIPT_NAME` when it's used
+    from a mounted engine. Fixes #8119.
+
+    *Piotr Sarnacki*
+
+*   Add JavaScript based routing path matcher to `/rails/info/routes`.
+    Routes can now be filtered by whether or not they match a path.
+
+    *Richard Schneeman*
+
+*   Change the behavior of route defaults so that explicit defaults are no longer
+    required where the key is not part of the path. For example:
+
+        resources :posts, bucket_type: 'posts'
+
+    will be required whenever constructing the url from a hash such as a functional
+    test or using `url_for` directly. However using the explicit form alters the
+    behavior so it's not required:
+
+        resources :projects, defaults: { bucket_type: 'projects' }
+
+    This changes existing behavior slightly in that any routes which only differ
+    in their defaults will match the first route rather than the closest match.
+
+    *Andrew White*
+
+*   Add support for routing constraints other than Regexp and String.
+    For example this now allows the use of arrays like this:
+
+        get '/foo/:action', to: 'foo', constraints: { subdomain: %w[www admin] }
+
+    or constraints where the request method returns an Fixnum like this:
+
+        get '/foo', to: 'foo#index', constraints: { port: 8080 }
+
+    Note that this only applies to constraints on the request - path constraints
+    still need to be specified as Regexps as the various constraints are compiled
+    into a single Regexp.
+
+    *Andrew White*
+
+*   Fix a bug in integration tests where setting the port via a url passed to
+    the process method was ignored when constructing the request environment.
+
+    *Andrew White*
+
+*   Allow `:selected` to be set on `date_select` tag helper.
+
+    *Colin Burn-Murdoch*
 
 *   Fixed JSON params parsing regression for non-object JSON content.
 
     *Dylan Smith*
 
-*   Prevent unnecessary asset compilation when using `javascript_include_tag` on
-    files with non-standard extensions.
+*   Extract `ActionDispatch::PerformanceTest` into https://github.com/rails/rails-perftest
+    You can add the gem to your Gemfile to keep using performance tests.
+
+        gem 'rails-perftest'
+
+    *Yves Senn*
 
-    *Noah Silas*
+*   Added view_cache_dependency API for declaring dependencies that affect
+    cache digest computation.
 
-*   Fixes issue where duplicate assets can be required with sprockets.
+    *Jamis Buck*
 
-    *Jeremy Jackson*
+*   `image_submit_tag` will set `alt` attribute from image source if not
+    specified.
 
-*   Bump `rack` dependency to 1.4.3, eliminate `Rack::File` headers deprecation warning.
+    *Nihad Abbasov*
 
-    *Sam Ruby + Carlos Antonio da Silva*
+*   Do not generate local variables for partials without object or collection.
+    Previously rendering a partial without giving `:object` or `:collection`
+    would generate a local variable with the partial name by default.
+
+    *Carlos Antonio da Silva*
+
+*   Return the last valid, non-private IP address from the X-Forwarded-For,
+    Client-IP and Remote-Addr headers, in that order. Document the rationale
+    for that decision, and describe the options that can be passed to the
+    RemoteIp middleware to change it.
+    Fixes #7979.
+
+    *André Arko*, *Steve Klabnik*, *Alexey Gaziev*
 
 *   Do not append second slash to `root_url` when using `trailing_slash: true`
+    Fixes #8700.
+
+    Before:
 
-    Fix #8700.
-    Backport #8701.
+        root_url(trailing_slash: true) # => http://test.host//
 
-    Example:
-        # before
-        root_url # => http://test.host//
+    After:
 
-        # after
-        root_url # => http://test.host/
+        root_url(trailing_slash: true) # => http://test.host/
 
     *Yves Senn*
 
-*   Fix a bug in `content_tag_for` that prevents it for work without a block.
+*   Allow to toggle dumps on error pages.
+
+    *Gosha Arinich*
+
+*   Fix a bug in `content_tag_for` that prevents it from working without a block.
 
     *Jasl*
 
-*   Clear url helper methods when routes are reloaded by removing the methods
-    explicitly rather than just clearing the module because it didn't work
-    properly and could be the source of a memory leak.
+*   Change the stylesheet of exception pages for development mode.
+    Additionally display also the line of code and fragment that raised
+    the exception in all exceptions pages.
+
+    *Guillermo Iguaran + Jorge Cuadrado*
+
+*   Do not append `charset=` parameter when `head` is called with a
+    `:content_type` option.
+    Fixes #8661.
+
+    *Yves Senn*
+
+*   Added `Mime::NullType` class. This  allows to use `html?`, `xml?`, `json?`, etc.
+    when the format of the request is unknown, without raising an exception.
+
+    *Angelo Capilleri*
+
+*   Integrate the Journey gem into Action Dispatch so that the global namespace
+    is not polluted with names that may be used as models.
 
     *Andrew White*
 
+*   Extract support for email address obfuscation via `:encode`, `:replace_at`, and `replace_dot`
+    options from the `mail_to` helper into the `actionview-encoded_mail_to` gem.
+
+    *Nick Reed + DHH*
+
+*   Handle `:protocol` option in `stylesheet_link_tag` and `javascript_include_tag`
+
+    *Vasiliy Ermolovich*
+
+*   Clear url helper methods when routes are reloaded. *Andrew White*
+
 *   Fix a bug in `ActionDispatch::Request#raw_post` that caused `env['rack.input']`
     to be read but not rewound.
 
     *Matt Venables*
 
+*   Prevent raising `EOFError` on multipart GET request (IE issue). *Adam Stankiewicz*
+
+*   Rename all action callbacks from *_filter to *_action to avoid the misconception that these
+    callbacks are only suited for transforming or halting the response. With the new style,
+    it's more inviting to use them as they were intended, like setting shared ivars for views.
+
+    Example:
+
+        class PeopleController < ActionController::Base
+          before_action :set_person,      except: [:index, :new, :create]
+          before_action :ensure_permission, only: [:edit, :update]
+
+          ...
+
+          private
+            def set_person
+              @person = current_account.people.find(params[:id])
+            end
+
+            def ensure_permission
+              current_person.can_change?(@person)
+            end
+        end
+
+    The old *_filter methods still work with no deprecation notice.
+
+    *DHH*
+
+*   Add `cache_if` and `cache_unless` for conditional fragment caching:
+
+    Example:
+
+        <%= cache_if condition, project do %>
+          <b>All the topics on this project</b>
+          <%= render project.topics %>
+        <% end %>
+
+        # and
+
+        <%= cache_unless condition, project do %>
+          <b>All the topics on this project</b>
+          <%= render project.topics %>
+        <% end %>
+
+    *Stephen Ausman + Fabrizio Regini + Angelo Capilleri*
+
+*   Add logging filter capability for redirect URLs:
+
+        config.filter_redirect << 'http://please.hide.it/'
+
+    *Fabrizio Regini*
+
+*   Fixed a bug that ignores constraints on a glob route. This was caused because the constraint
+    regular expression is overwritten when the `routes.rb` file is processed. Fixes #7924
+
+    *Maura Fitzgerald*
+
 *   More descriptive error messages when calling `render :partial` with
     an invalid `:layout` argument.
 
     Fixes #8376.
 
-        render :partial => 'partial', :layout => true
+        render partial: 'partial', layout: true
+
         # results in ActionView::MissingTemplate: Missing partial /true
 
     *Yves Senn*
 
-*   Accept symbols as `#send_data` :disposition value. [Backport #8329] *Elia Schito*
+*   Sweepers was extracted from Action Controller as `rails-observers` gem.
 
-*   Add i18n scope to `distance_of_time_in_words`. [Backport #7997] *Steve Klabnik*
+    *Rafael Mendonça França*
 
-*   Fix side effect of `url_for` changing the `:controller` string option. [Backport #6003]
-    Before:
+*   Add option flag to `CacheHelper#cache` to manually bypass automatic template digests:
 
-        controller = '/projects'
-        url_for :controller => controller, :action => 'status'
+        <% cache project, skip_digest: true do %>
+          ...
+        <% end %>
 
-        puts controller #=> 'projects'
+    *Drew Ulmer*
 
-    After
+*   Do not sort Hash options in `grouped_options_for_select`. *Sergey Kojin*
 
-        puts controller #=> '/projects'
+*   Accept symbols as `send_data :disposition` value *Elia Schito*
 
-    *Nikita Beloglazov + Andrew White*
+*   Add i18n scope to `distance_of_time_in_words`. *Steve Klabnik*
 
-*   Introduce `ActionView::Template::Handlers::ERB.escape_whitelist`. This is a list
-    of mime types where template text is not html escaped by default. It prevents `Jack & Joe`
-    from rendering as `Jack &amp; Joe` for the whitelisted mime types. The default whitelist
-    contains text/plain. Fix #7976 [Backport #8235]
+*   `assert_template`:
+    - is no more passing with empty string.
+    - is now validating option keys. It accepts: `:layout`, `:partial`, `:locals` and `:count`.
 
-    *Joost Baaij*
+    *Roberto Soares*
 
-*   `BestStandardsSupport` middleware now appends it's `X-UA-Compatible` value to app's
-    returned value if any. Fix #8086 [Backport #8093]
+*   Allow setting a symbol as path in scope on routes. This is now allowed:
 
-    *Nikita Afanasenko*
+        scope :api do
+          resources :users
+        end
 
-*   prevent double slashes in engine urls when `Rails.application.default_url_options[:trailing_slash] = true` is set
-    Fix #7842
+    It is also possible to pass multiple symbols to scope to shorten multiple nested scopes:
 
-    *Yves Senn*
+        scope :api do
+          scope :v1 do
+            resources :users
+          end
+        end
 
-*   Fix input name when `:multiple => true` and `:index` are set.
+    can be rewritten as:
+
+        scope :api, :v1 do
+          resources :users
+        end
+
+    *Guillermo Iguaran + Amparo Luna*
+
+*   Fix error when using a non-hash query argument named "params" in `url_for`.
 
     Before:
 
-        check_box("post", "comment_ids", { :multiple => true, :index => "foo" }, 1)
-        #=> <input name=\"post[foo][comment_ids]\" type=\"hidden\" value=\"0\" /><input id=\"post_foo_comment_ids_1\" name=\"post[foo][comment_ids]\" type=\"checkbox\" value=\"1\" />
+        url_for(params: "") # => undefined method `reject!' for "":String
 
     After:
 
-        check_box("post", "comment_ids", { :multiple => true, :index => "foo" }, 1)
-        #=> <input name=\"post[foo][comment_ids][]\" type=\"hidden\" value=\"0\" /><input id=\"post_foo_comment_ids_1\" name=\"post[foo][comment_ids][]\" type=\"checkbox\" value=\"1\" />
+        url_for(params: "") # => http://www.example.com?params=
 
-    Fix #8108
+    *tumayun + Carlos Antonio da Silva*
 
-    *Daniel Fox, Grant Hutchins & Trace Wax*
+*   Render every partial with a new `ActionView::PartialRenderer`. This resolves
+    issues when rendering nested partials.
+    Fixes #8197.
 
+    *Yves Senn*
 
-## Rails 3.2.12 (Feb 11, 2013) ##
+*   Introduce `ActionView::Template::Handlers::ERB.escape_whitelist`. This is a list
+    of mime types where template text is not html escaped by default. It prevents `Jack & Joe`
+    from rendering as `Jack &amp; Joe` for the whitelisted mime types. The default whitelist
+    contains `text/plain`.
+    Fixes #7976.
 
-*   No changes.
+    *Joost Baaij*
 
+*   Fix input name when `multiple: true` and `:index` are set.
 
-## Rails 3.2.11 (Jan 8, 2013) ##
+    Before:
 
-*   Strip nils from collections on JSON and XML posts. [CVE-2013-0155]
+        check_box("post", "comment_ids", { multiple: true, index: "foo" }, 1)
+        # => <input name=\"post[foo][comment_ids]\" type=\"hidden\" value=\"0\" /><input id=\"post_foo_comment_ids_1\" name=\"post[foo][comment_ids]\" type=\"checkbox\" value=\"1\" />
 
+    After:
 
-## Rails 3.2.10 (Jan 2, 2013) ##
+        check_box("post", "comment_ids", { multiple: true, index: "foo" }, 1)
+        # => <input name=\"post[foo][comment_ids][]\" type=\"hidden\" value=\"0\" /><input id=\"post_foo_comment_ids_1\" name=\"post[foo][comment_ids][]\" type=\"checkbox\" value=\"1\" />
 
-*   No changes.
+    Fixes #8108.
 
+    *Daniel Fox, Grant Hutchins & Trace Wax*
 
-## Rails 3.2.9 (Nov 12, 2012) ##
+*   `date_select` helper accepts `with_css_classes: true` to add css classes similar with type
+    of generated select tags.
 
-*   Clear url helpers when reloading routes.
+    *Pavel Nikitin*
 
-    *Santiago Pastorino*
+*   Only non-js/css under `app/assets` path will be included in default `config.assets.precompile`.
 
-*   Revert the shorthand routes scoped with `:module` option fix
-    This added a regression since it is changing the URL mapping.
-    This makes the stable release backward compatible.
+    *Josh Peek*
 
-    *Rafael Mendonça França*
+*   Remove support for the `RAILS_ASSET_ID` environment configuration
+    (no longer needed now that we have the asset pipeline).
 
-*   Revert the `assert_template` fix to not pass with ever string that matches the template name.
-    This added a regression since people were relying on this buggy behavior.
-    This will introduce back #3849 but this stable release will be backward compatible.
-    Fixes #8068.
+    *Josh Peek*
 
-    *Rafael Mendonça França*
+*   Remove old `asset_path` configuration (no longer needed now that we have the asset pipeline).
 
-*   Revert the rename of internal variable on ActionController::TemplateAssertions to prevent
-    naming collisions. This added a regression related with shoulda-matchers, since it is
-    expecting the [instance variable @layouts](https://github.com/thoughtbot/shoulda-matchers/blob/9e1188eea68c47d9a56ce6280e45027da6187ab1/lib/shoulda/matchers/action_controller/render_with_layout_matcher.rb#L74).
-    This will introduce back #7459 but this stable release will be backward compatible.
-    Fixes #8068.
+    *Josh Peek*
 
-    *Rafael Mendonça França*
+*   `assert_template` can be used to assert on the same template with different locals
+    Fixes #3675.
+
+    *Yves Senn*
+
+*   Remove old asset tag concatenation (no longer needed now that we have the asset pipeline).
 
-*   Accept :remote as symbolic option for `link_to` helper. *Riley Lynch*
+    *Josh Peek*
+
+*   Accept `:remote` as symbolic option for `link_to` helper. *Riley Lynch*
 
 *   Warn when the `:locals` option is passed to `assert_template` outside of a view test case
-    Fix #3415
+    Fixes #3415.
 
     *Yves Senn*
 
-*   Rename internal variables on ActionController::TemplateAssertions to prevent
-    naming collisions. @partials, @templates and @layouts are now prefixed with an underscore.
-    Fix #7459
+*   The `Rack::Cache` middleware is now disabled by default. To enable it,
+    set `config.action_dispatch.rack_cache = true` and add `gem rack-cache` to your Gemfile.
+
+    *Guillermo Iguaran*
+
+*   `ActionController::Base.page_cache_extension` option is deprecated
+    in favour of `ActionController::Base.default_static_extension`.
+
+    *Francesco Rodriguez*
+
+*   Action and Page caching has been extracted from Action Dispatch
+    as `actionpack-action_caching` and `actionpack-page_caching` gems.
+    Please read the `README.md` file on both gems for the usage.
+
+    *Francesco Rodriguez*
+
+*   Failsafe exception returns `text/plain`. *Steve Klabnik*
+
+*   Rename internal variables on `ActionController::TemplateAssertions` to prevent
+    naming collisions. `@partials`, `@templates` and `@layouts` are now prefixed with an underscore.
+    Fixes #7459.
 
     *Yves Senn*
 
-*   `resource` and `resources` don't modify the passed options hash
-    Fix #7777
+*   `resource` and `resources` don't modify the passed options hash.
+    Fixes #7777.
 
     *Yves Senn*
 
-*   Precompiled assets include aliases from foo.js to foo/index.js and vice versa.
+*   Precompiled assets include aliases from `foo.js` to `foo/index.js` and vice versa.
 
         # Precompiles phone-<digest>.css and aliases phone/index.css to phone.css.
         config.assets.precompile = [ 'phone.css' ]
@@ -416,366 +720,511 @@
 
     *Hugolnx*
 
-*   Handle `ActionDispatch::Http::UploadedFile` like `Rack::Test::UploadedFile`, don't call to_param on it. Since
-    `Rack::Test::UploadedFile` isn't API compatible this is needed to test file uploads that rely on `tempfile`
-    being available.
+*   `image_tag` will set the same width and height for image if numerical value
+    passed to `size` option.
+
+    *Nihad Abbasov*
+
+*   Deprecate `Mime::Type#verify_request?` and `Mime::Type.browser_generated_types`,
+    since they are no longer used inside of Rails, they will be removed in Rails 4.1.
 
-    *Tim Vandecasteele*
+    *Michael Grosser*
 
-*   Respect `config.digest = false` for `asset_path`
+*   `ActionDispatch::Http::UploadedFile` now delegates `close` to its tempfile. *Sergio Gil*
 
-    Previously, the `asset_path` internals only respected the `:digest`
-    option, but ignored the global config setting. This meant that
-    `config.digest = false` could not be used in conjunction with
-    `config.compile = false` this corrects the behavior.
+*   Add `ActionController::StrongParameters`, this module converts `params` hash into
+    an instance of ActionController::Parameters that allows whitelisting of permitted
+    parameters. Non-permitted parameters are forbidden to be used in Active Model by default
+    For more details check the documentation of the module or the
+    [strong_parameters gem](https://github.com/rails/strong_parameters)
 
-    *Peter Wagenet*
+    *DHH + Guillermo Iguaran*
 
-*   Fix #7646, the log now displays the correct status code when an exception is raised.
+*   Remove Integration between `attr_accessible`/`attr_protected` and
+    `ActionController::ParamsWrapper`. ParamWrapper now wraps all the parameters returned
+    by the class method `attribute_names`.
+
+    *Guillermo Iguaran*
+
+*   Log now displays the correct status code when an exception is raised.
+    Fixes #7646.
 
     *Yves Senn*
 
-*   Fix handling of date selects when using both disabled and discard options.
-    Fixes #7431.
+*   Allow pass couple extensions to `ActionView::Template.register_template_handler` call.
 
-    *Vasiliy Ermolovich*
+    *Tima Maslyuchenko*
 
-*   Fix select_tag when option_tags is nil.
-    Fixes #7404.
+*   Sprockets integration has been extracted from Action Pack to the `sprockets-rails`
+    gem. `rails` gem is depending on `sprockets-rails` by default.
 
-    *Sandeep Ravichandran*
+    *Guillermo Iguaran*
 
-*   `javascript_include_tag :all` will now not include `application.js` if the file does not exists. *Prem Sichanugrist*
+*   `ActionDispatch::Session::MemCacheStore` now uses `dalli` instead of the deprecated
+    `memcache-client` gem.
 
-*   Support cookie jar options (e.g., domain :all) for all session stores.
-    Fixes GH#3047, GH#2483.
+    *Arun Agrawal + Guillermo Iguaran*
 
-    *Ravil Bayramgalin*
+*   Support multiple etags in If-None-Match header. *Travis Warlick*
 
-*   Performance Improvement to send_file: Avoid having to pass an open file handle as the response body. Rack::Sendfile
-    will usually intercept the response and just uses the path directly, so no reason to open the file. This performance
-    improvement also resolves an issue with jRuby encodings, and is the reason for the backport, see issue #6844.
+*   Allow to configure how unverified request will be handled using `:with`
+    option in `protect_from_forgery` method.
 
-    *Jeremy Kemper & Erich Menge*
+    Valid unverified request handling methods are:
 
+    - `:exception` - Raises ActionController::InvalidAuthenticityToken exception.
+    - `:reset_session` - Resets the session.
+    - `:null_session` - Provides an empty session during request but doesn't
+      reset it completely. Used as default if `:with` option is not specified.
 
-## Rails 3.2.8 (Aug 9, 2012) ##
+    New applications are generated with:
 
-*   There is an XSS vulnerability in the strip_tags helper in Ruby on Rails, the
-    helper doesn't correctly handle malformed html.  As a result an attacker can
-    execute arbitrary javascript through the use of specially crafted malformed
-    html.
+        protect_from_forgery with: :exception
 
-    *Marek from Nethemba (www.nethemba.com) & Santiago Pastorino*
+    *Sergey Nartimov*
 
-*   When a "prompt" value is supplied to the `select_tag` helper, the "prompt" value is not escaped.
-    If untrusted data is not escaped, and is supplied as the prompt value, there is a potential for XSS attacks.
-    Vulnerable code will look something like this:
-    select_tag("name", options, :prompt => UNTRUSTED_INPUT)
+*   Add `.ruby` template handler, this handler simply allows arbitrary Ruby code as a template. *Guillermo Iguaran*
 
-    *Santiago Pastorino*
+*   Add `separator` option for `ActionView::Helpers::TextHelper#excerpt`:
 
-*   Reverted the deprecation of `:confirm`. *Rafael Mendonça França*
+        excerpt('This is a very beautiful morning', 'very', separator: ' ', radius: 1)
+        # => ...a very beautiful...
 
-*   Reverted the deprecation of `:disable_with`. *Rafael Mendonça França*
+    *Guirec Corbel*
 
-*   Reverted the deprecation of `:mouseover` option to `image_tag`. *Rafael Mendonça França*
+*   Added controller-level etag additions that will be part of the action etag computation *Jeremy Kemper/DHH*
 
-*   Reverted the deprecation of `button_to_function` and `link_to_function` helpers.
+        class InvoicesController < ApplicationController
+          etag { current_user.try :id }
 
-    *Rafael Mendonça França*
+          def show
+            # Etag will differ even for the same invoice when it's viewed by a different current_user
+            @invoice = Invoice.find(params[:id])
+            fresh_when(@invoice)
+          end
+        end
 
+*   Add automatic template digests to all `CacheHelper#cache` calls (originally spiked in the `cache_digests` plugin) *DHH*
 
-## Rails 3.2.7 (Jul 26, 2012) ##
+*   When building a URL fails, add missing keys provided by Journey. Failed URL
+    generation now returns a 500 status instead of a 404.
 
-*   Do not convert digest auth strings to symbols. CVE-2012-3424
+    *Richard Schneeman*
 
-*   Bump Journey requirements to 1.0.4
+*   Deprecate availability of `ActionView::RecordIdentifier` in controllers by default.
+    It's view specific and can be easily included in controllers manually if someone
+    really needs it. Also deprecate calling `ActionController::RecordIdentifier.dom_id` and
+    `dom_class` directly, in favor of `ActionView::RecordIdentifier.dom_id` and `dom_class`.
+    `RecordIdentifier` will be removed from `ActionController::Base` in Rails 4.1.
 
-*   Add support for optional root segments containing slashes
+    *Piotr Sarnacki*
 
-*   Fixed bug creating invalid HTML in select options
+*   Fix `ActionView::RecordIdentifier` to work as a singleton. *Piotr Sarnacki*
 
-*   Show in log correct wrapped keys
+*   Deprecate `Template#mime_type`, it will be removed in Rails 4.1 in favor of `#type`.
+    *Piotr Sarnacki*
 
-*   Fix NumberHelper options wrapping to prevent verbatim blocks being rendered instead of line continuations.
+*   Move vendored html-scanner from `action_controller` to `action_view` directory. If you
+    require it directly, please use 'action_view/vendor/html-scanner', reference to
+    'action_controller/vendor/html-scanner' will be removed in Rails 4.1. *Piot Sarnacki*
 
-*   ActionController::Metal doesn't have logger method, check it and then delegate
+*   Fix handling of date selects when using both disabled and discard options.
+    Fixes #7431.
 
-*   ActionController::Caching depends on RackDelegation and AbstractController::Callbacks
+    *Vasiliy Ermolovich*
 
+*   `ActiveRecord::SessionStore` is extracted out of Rails into a gem `activerecord-session_store`.
+    Setting `config.session_store` to `:active_record_store` will no longer work and will break
+    if the `activerecord-session_store` gem isn't available. *Prem Sichanugrist*
 
-## Rails 3.2.6 (Jun 12, 2012) ##
+*   Fix `select_tag` when `option_tags` is nil.
+    Fixes #7404.
 
-*   nil is removed from array parameter values
+    *Sandeep Ravichandran*
 
-    CVE-2012-2694
+*   Add `Request#formats=(extensions)` that lets you set multiple formats directly in a prioritized order.
 
-*   Deprecate `:confirm` in favor of `':data => { :confirm => "Text" }'` option for `button_to`, `button_tag`, `image_submit_tag`, `link_to` and `submit_tag` helpers.
+    Example of using this for custom iphone views with an HTML fallback:
 
-    *Carlos Galdino*
+        class ApplicationController < ActionController::Base
+          before_filter :adjust_format_for_iphone_with_html_fallback
 
-*   Allow to use mounted_helpers (helpers for accessing mounted engines) in ActionView::TestCase. *Piotr Sarnacki*
+          private
+            def adjust_format_for_iphone_with_html_fallback
+              request.formats = [ :iphone, :html ] if request.env["HTTP_USER_AGENT"][/iPhone/]
+            end
+        end
 
-*   Include mounted_helpers (helpers for accessing mounted engines) in ActionDispatch::IntegrationTest by default. *Piotr Sarnacki*
+    *DHH*
 
+*   Add Routing Concerns to declare common routes that can be reused inside
+    others resources and routes.
 
-## Rails 3.2.5 (Jun 1, 2012) ##
+    Code before:
 
-*   No changes.
+        resources :messages do
+          resources :comments
+        end
 
+        resources :posts do
+          resources :comments
+          resources :images, only: :index
+        end
 
-## Rails 3.2.4 (May 31, 2012) ##
+    Code after:
 
-*   Deprecate old APIs for highlight, excerpt and word_wrap *Jeremy Walker*
+        concern :commentable do
+          resources :comments
+        end
 
-*   Deprecate `:disable_with` in favor of `'data-disable-with'` option for `button_to`, `button_tag` and `submit_tag` helpers.
+        concern :image_attachable do
+          resources :images, only: :index
+        end
 
-    *Carlos Galdino + Rafael Mendonça França*
+        resources :messages, concerns: :commentable
 
-*   Deprecate `:mouseover` option for `image_tag` helper. *Rafael Mendonça França*
+        resources :posts, concerns: [:commentable, :image_attachable]
 
-*   Deprecate `button_to_function` and `link_to_function` helpers. *Rafael Mendonça França*
+    *DHH + Rafael Mendonça França*
 
-*   Don't break Haml with textarea newline fix.  GH #393, #4000, #5190, #5191
+*   Add `start_hour` and `end_hour` options to the `select_hour` helper. *Evan Tann*
 
-*   Fix options handling on labels. GH #2492, #5614
+*   Raises an `ArgumentError` when the first argument in `form_for` contain `nil`
+    or is empty.
 
-*   Added config.action_view.embed_authenticity_token_in_remote_forms to deal
-    with regression from 16ee611fa
+    *Richard Schneeman*
 
-*   Set rendered_format when doing render :inline. GH #5632
+*   Add 'X-Frame-Options' => 'SAMEORIGIN'
+    'X-XSS-Protection' => '1; mode=block' and
+    'X-Content-Type-Options' => 'nosniff'
+    as default headers.
 
-*   Fix the redirect when it receive blocks with arity of 1. Closes #5677
+    *Egor Homakov*
 
-*   Strip [nil] from parameters hash. Thanks to Ben Murphy for
-    reporting this! CVE-2012-2660
+*   Allow data attributes to be set as a first-level option for `form_for`, so you can write `form_for @record, data: { behavior: 'autosave' }` instead of `form_for @record, html: { data: { behavior: 'autosave' } }` *DHH*
 
+*   Deprecate `button_to_function` and `link_to_function` helpers.
 
-## Rails 3.2.3 (March 30, 2012) ##
+    We recommend the use of Unobtrusive JavaScript instead. For example:
 
-*   Allow to lazy load `default_form_builder` by passing a `String` instead of a constant. *Piotr Sarnacki*
+        link_to "Greeting", "#", class: "nav_link"
 
-*   Fix #5632, render :inline set the proper rendered format. *Santiago Pastorino*
+        $(function() {
+          $('.nav_link').click(function() {
+            // Some complex code
 
-*   Fix textarea rendering when using plugins like HAML. Such plugins encode the first newline character in the content. This issue was introduced in https://github.com/rails/rails/pull/5191 *James Coleman*
+            return false;
+          });
+        });
 
-*   Remove the leading \n added by textarea on assert_select. *Santiago Pastorino*
+    or
 
-*   Add `config.action_view.embed_authenticity_token_in_remote_forms` (defaults to true) which allows to set if authenticity token will be included by default in remote forms. If you change it to false, you can still force authenticity token by passing `:authenticity_token => true` in form options *Piotr Sarnacki*
+        link_to "Greeting", '#', onclick: "alert('Hello world!'); return false", class: "nav_link"
 
-*   Do not include the authenticity token in forms where remote: true as ajax forms use the meta-tag value *DHH*
+    for simple cases.
 
-*   Turn off verbose mode of rack-cache, we still have X-Rack-Cache to
-    check that info. Closes #5245. *Santiago Pastorino*
+    *Rafael Mendonça França*
 
-*   Fix #5238, rendered_format is not set when template is not rendered. *Piotr Sarnacki*
+*   `javascript_include_tag :all` will now not include `application.js` if the file does not exists. *Prem Sichanugrist*
 
-*   Upgrade rack-cache to 1.2. *José Valim*
+*   Send an empty response body when call `head` with status between 100 and 199, 204, 205 or 304.
 
-*   ActionController::SessionManagement is deprecated. *Santiago Pastorino*
+    *Armand du Plessis*
 
-*   Since the router holds references to many parts of the system like engines, controllers and the application itself, inspecting the route set can actually be really slow, therefore we default alias inspect to to_s. *José Valim*
+*   Fixed issue with where digest authentication would not work behind a proxy. *Arthur Smith*
 
-*   Add a new line after the textarea opening tag. Closes #393 *Rafael Mendonça França*
+*   Added `ActionController::Live`.  Mix it in to your controller and you can
+    stream data to the client live.  For example:
 
-*   Always pass a respond block from to responder. We should let the responder to decide what to do with the given overridden response block, and not short circuit it. *sikachu*
+        class FooController < ActionController::Base
+          include ActionController::Live
 
-*   Fixes layout rendering regression from 3.2.2. *José Valim*
+          def index
+            100.times {
+              # Client will see this as it's written
+              response.stream.write "hello world\n"
+              sleep 1
+            }
+            response.stream.close
+          end
+        end
 
+    *Aaron Patterson*
 
-## Rails 3.2.2 (March 1, 2012) ##
+*   Remove `ActionDispatch::Head` middleware in favor of `Rack::Head`. *Santiago Pastorino*
 
-*   Format lookup for partials is derived from the format in which the template is being rendered. Closes #5025 part 2 *Santiago Pastorino*
+*   Deprecate `:confirm` in favor of `data: { confirm: "Text" }` option for `button_to`, `button_tag`, `image_submit_tag`, `link_to` and `submit_tag` helpers.
 
-*   Use the right format when a partial is missing. Closes #5025. *Santiago Pastorino*
+    *Carlos Galdino + Rafael Mendonça França*
 
-*   Default responder will now always use your overridden block in `respond_with` to render your response. *Prem Sichanugrist*
+*   Show routes in exception page while debugging a `RoutingError` in development.
 
-*   check_box helper with :disabled => true will generate a disabled hidden field to conform with the HTML convention where disabled fields are not submitted with the form.
-    This is a behavior change, previously the hidden tag had a value of the disabled checkbox.
-    *Tadas Tamosauskas*
+    *Richard Schneeman + Mattt Thompson + Yves Senn*
 
+*   Add `ActionController::Flash.add_flash_types` method to allow people to register their own flash types. e.g.:
 
-## Rails 3.2.1 (January 26, 2012) ##
+        class ApplicationController
+          add_flash_types :error, :warning
+        end
 
-*   Documentation improvements.
+    If you add the above code, you can use `<%= error %>` in an erb, and `redirect_to /foo, error: 'message'` in a controller.
 
-*   Allow `form.select` to accept ranges (regression). *Jeremy Walker*
+    *kennyj*
 
-*   `datetime_select` works with -/+ infinity dates. *Joe Van Dyk*
+*   Remove Active Model dependency from Action Pack. *Guillermo Iguaran*
 
+*   Support unicode characters in routes. Route will be automatically escaped, so instead of manually escaping:
 
-## Rails 3.2.0 (January 20, 2012) ##
+        get Rack::Utils.escape('こんにちは') => 'home#index'
 
-*   Setting config.assets.logger to false turn off Sprockets logger *Guillermo Iguaran*
+    You just have to write the unicode route:
 
-*   Add `config.action_dispatch.default_charset` to configure default charset for ActionDispatch::Response. *Carlos Antonio da Silva*
+        get 'こんにちは' => 'home#index'
 
-*   Deprecate setting default charset at controller level, use the new `config.action_dispatch.default_charset` instead. *Carlos Antonio da Silva*
+    *kennyj*
 
-*   Deprecate ActionController::UnknownAction in favour of AbstractController::ActionNotFound. *Carlos Antonio da Silva*
+*   Return proper format on exceptions. *Santiago Pastorino*
 
-*   Deprecate ActionController::DoubleRenderError in favour of AbstractController::DoubleRenderError. *Carlos Antonio da Silva*
+*   Allow to use `mounted_helpers` (helpers for accessing mounted engines) in `ActionView::TestCase`. *Piotr Sarnacki*
 
-*   Deprecate method_missing handling for not found actions, use action_missing instead. *Carlos Antonio da Silva*
+*   Include `mounted_helpers` (helpers for accessing mounted engines) in `ActionDispatch::IntegrationTest` by default. *Piotr Sarnacki*
 
-*   Deprecate ActionController#rescue_action, ActionController#initialize_template_class, and ActionController#assign_shortcuts.
-    These methods were not being used internally anymore and are going to be removed in Rails 4. *Carlos Antonio da Silva*
+*   Extracted redirect logic from `ActionController::ForceSSL::ClassMethods.force_ssl`  into `ActionController::ForceSSL#force_ssl_redirect`
 
-*   Add config.assets.logger to configure Sprockets logger *Rafael França*
+    *Jeremy Friesen*
 
-*   Use a BodyProxy instead of including a Module that responds to
-    close. Closes #4441 if Active Record is disabled assets are delivered
-    correctly *Santiago Pastorino*
+*   Make possible to use a block in `button_to` if the button text is hard
+    to fit into the name parameter, e.g.:
 
-*   Rails initialization with initialize_on_precompile = false should set assets_dir *Santiago Pastorino*
+        <%= button_to [:make_happy, @user] do %>
+          Make happy <strong><%= @user.name %></strong>
+        <% end %>
+        # => "<form method="post" action="/users/1/make_happy" class="button_to">
+        #      <div>
+        #        <button type="submit">
+        #          Make happy <strong>Name</strong>
+        #        </button>
+        #      </div>
+        #    </form>"
 
-*   Add font_path helper method *Santiago Pastorino*
+    *Sergey Nartimov*
 
-*   Depends on rack ~> 1.4.0 *Santiago Pastorino*
+*   Change a way of ordering helpers from several directories. Previously,
+    when loading helpers from multiple paths, all of the helpers files were
+    gathered into one array an then they were sorted. Helpers from different
+    directories should not be mixed before loading them to make loading more
+    predictable. The most common use case for such behavior is loading helpers
+    from engines. When you load helpers from application and engine Foo, in
+    that order, first rails will load all of the helpers from application,
+    sorted alphabetically and then it will do the same for Foo engine.
 
-*   Add :gzip option to `caches_page`. The default option can be configured globally using `page_cache_compression` *Andrey Sitnik*
+    *Piotr Sarnacki*
 
-*   The ShowExceptions middleware now accepts a exceptions application that is responsible to render an exception when the application fails. The application is invoked with a copy of the exception in `env["action_dispatch.exception"]` and with the PATH_INFO rewritten to the status code. *José Valim*
+*   `truncate` now always returns an escaped HTML-safe string. The option `:escape` can be used as
+    false to not escape the result.
 
-*   Add `button_tag` support to ActionView::Helpers::FormBuilder.
+    *Li Ellis Gallardo + Rafael Mendonça França*
 
-    This support mimics the default behavior of `submit_tag`.
+*   `truncate` now accepts a block to show extra content when the text is truncated. *Li Ellis Gallardo*
 
-    Example:
+*   Add `week_field`, `week_field_tag`, `month_field`, `month_field_tag`, `datetime_local_field`,
+    `datetime_local_field_tag`, `datetime_field` and `datetime_field_tag` helpers. *Carlos Galdino*
 
-        <%= form_for @post do |f| %>
-          <%= f.button %>
-        <% end %>
+*   Add `color_field` and `color_field_tag` helpers. *Carlos Galdino*
 
-*   Date helpers accept a new option, `:use_two_digit_numbers = true`, that renders select boxes for months and days with a leading zero without changing the respective values.
-    For example, this is useful for displaying ISO8601-style dates such as '2011-08-01'. *Lennart Fridén and Kim Persson*
+*   `assert_generates`, `assert_recognizes`, and `assert_routing` all raise
+    `Assertion` instead of `RoutingError` *David Chelimsky*
 
-*   Make ActiveSupport::Benchmarkable a default module for ActionController::Base, so the #benchmark method is once again available in the controller context like it used to be *DHH*
+*   URL path parameters with invalid encoding now raise `ActionController::BadRequest`. *Andrew White*
 
-*   Deprecated implied layout lookup in controllers whose parent had a explicit layout set:
+*   Malformed query and request parameter hashes now raise `ActionController::BadRequest`. *Andrew White*
 
-        class ApplicationController
-          layout "application"
-        end
+*   Add `divider` option to `grouped_options_for_select` to generate a separator
+    `optgroup` automatically, and deprecate `prompt` as third argument, in favor
+    of using an options hash. *Nicholas Greenfield*
 
-        class PostsController < ApplicationController
-        end
+*   Add `time_field` and `time_field_tag` helpers which render an `input[type="time"]` tag. *Alex Soulim*
 
-    In the example above, Posts controller will no longer automatically look up for a posts layout.
+*   Removed old text helper apis from `highlight`, `excerpt` and `word_wrap`. *Jeremy Walker*
 
-    If you need this functionality you could either remove `layout "application"` from ApplicationController or explicitly set it to nil in PostsController. *José Valim*
+*   Templates without a handler extension now raises a deprecation warning but still
+    defaults to ERB. In future releases, it will simply return the template contents. *Steve Klabnik*
 
-*   Rails will now use your default layout (such as "layouts/application") when you specify a layout with `:only` and `:except` condition, and those conditions fail. *Prem Sichanugrist*
+*   Deprecate `:disable_with` in favor of `data: { disable_with: "Text" }` option from `submit_tag`, `button_tag` and `button_to` helpers.
 
-    For example, consider this snippet:
+    *Carlos Galdino + Rafael Mendonça França*
 
-        class CarsController
-          layout 'single_car', :only => :show
-        end
+*   Remove `:mouseover` option from `image_tag` helper. *Rafael Mendonça França*
 
-    Rails will use 'layouts/single_car' when a request comes in `:show` action, and use 'layouts/application' (or 'layouts/cars', if exists) when a request comes in for any other actions.
+*   The `select` method (select tag) forces `:include_blank` if `required` is true and
+    `display size` is one and `multiple` is not true. *Angelo Capilleri*
 
-*   form_for with +:as+ option uses "#{action}_#{as}" as css class and id:
+*   Copy literal route constraints to defaults so that url generation know about them.
+    The copied constraints are `:protocol`, `:subdomain`, `:domain`, `:host` and `:port`.
 
-    Before:
+    *Andrew White*
 
-        form_for(@user, :as => 'client') # => "<form class="client_new">..."
+*   `respond_to` and `respond_with` now raise `ActionController::UnknownFormat` instead
+    of directly returning head 406. The exception is rescued and converted to 406
+    in the exception handling middleware. *Steven Soroka*
 
-    Now:
+*   Allows `assert_redirected_to` to match against a regular expression. *Andy Lindeman*
 
-        form_for(@user, :as => 'client') # => "<form class="new_client">..."
+*   Add backtrace to development routing error page. *Richard Schneeman*
 
-    *Vasiliy Ermolovich*
+*   Replace `include_seconds` boolean argument with `include_seconds: true` option
+    in `distance_of_time_in_words` and `time_ago_in_words` signature. *Dmitriy Kiriyenko*
 
-*   Allow rescue responses to be configured through a railtie as in `config.action_dispatch.rescue_responses`. Please look at ActiveRecord::Railtie for an example *José Valim*
+*   Make current object and counter (when it applies) variables accessible when
+    rendering templates with :object / :collection. *Carlos Antonio da Silva*
 
-*   Allow fresh_when/stale? to take a record instead of an options hash *DHH*
+*   JSONP now uses mimetype `text/javascript` instead of `application/json`. *omjokine*
 
-*   Assets should use the request protocol by default or default to relative if no request is available *Jonathan del Strother*
+*   Allow to lazy load `default_form_builder` by passing a `String` instead of a constant. *Piotr Sarnacki*
 
-*   Log "Filter chain halted as CALLBACKNAME rendered or redirected" every time a before callback halts *José Valim*
+*   Session arguments passed to `process` calls in functional tests are now merged into
+    the existing session, whereas previously they would replace the existing session.
+    This change may break some existing tests if they are asserting the exact contents of
+    the session but should not break existing tests that only assert individual keys.
 
-*   You can provide a namespace for your form to ensure uniqueness of id attributes on form elements.
-    The namespace attribute will be prefixed with underscore on the generate HTML id. *Vasiliy Ermolovich*
+    *Andrew White*
 
-    Example:
+*   In the routes DSL the `:via` option of `match` is now mandatory.
 
-        <%= form_for(@offer, :namespace => 'namespace') do |f| %>
-          <%= f.label :version, 'Version' %>:
-          <%= f.text_field :version %>
-        <% end %>
+    For routes that respond to one single verb it is recommended to use the more specific
+    macros `get`, `post`, etc. instead. You can still map all HTTP verbs to one action
+    with `match`, but it has to be explictly configured using `:via => :all`.
+
+    *José Valim and Yehuda Katz*
 
-*   Refactor ActionDispatch::ShowExceptions. The controller is responsible for choosing to show exceptions when `consider_all_requests_local` is false.
+*   Add `index` method to FormBuilder class. *Jorge Bejar*
 
-    It's possible to override `show_detailed_exceptions?` in controllers to specify which requests should provide debugging information on errors. The default value is now false, meaning local requests in production will no longer show the detailed exceptions page unless `show_detailed_exceptions?` is overridden and set to `request.local?`.
+*   Remove the leading \n added by textarea on `assert_select`. *Santiago Pastorino*
 
-*   Responders now return 204 No Content for API requests without a response body (as in the new scaffold) *José Valim*
+*   Changed default value for `config.action_view.embed_authenticity_token_in_remote_forms`
+    to `false`. This change breaks remote forms that need to work also without JavaScript,
+    so if you need such behavior, you can either set it to `true` or explicitly pass
+    `authenticity_token: true` in form options.
 
-*   Added ActionDispatch::RequestId middleware that'll make a unique X-Request-Id header available to the response and enables the ActionDispatch::Request#uuid method. This makes it easy to trace requests from end-to-end in the stack and to identify individual requests in mixed logs like Syslog *DHH*
+*   Added `ActionDispatch::SSL` middleware that when included force all the requests to be under HTTPS protocol. *Rafael Mendonça França*
 
-*   Limit the number of options for select_year to 1000.
+*   Add `include_hidden` option to select tag. With `include_hidden: false` select with `multiple` attribute doesn't generate hidden input with blank value. *Vasiliy Ermolovich*
 
-    Pass the :max_years_allowed option to set your own limit.
+*   Removed default `size` option from the `text_field`, `search_field`, `telephone_field`, `url_field`, `email_field` helpers. *Philip Arndt*
 
-    *Libo Cannici*
+*   Removed default `cols` and `rows` options from the `text_area` helper. *Philip Arndt*
 
-*   Passing formats or handlers to render :template and friends is deprecated. For example: *Nick Sutterer & José Valim*
+*   Adds support for layouts when rendering a partial with a given collection. *serabe*
 
-        render :template => "foo.html.erb"
+*   Allows the route helper `root` to take a string argument. For example, `root 'pages#main'`. *bcardarella*
 
-    Instead, you can provide :handlers and :formats directly as option:
-             render :template => "foo", :formats => [:html, :js], :handlers => :erb
+*   Forms of persisted records use always PATCH (via the `_method` hack). *fxn*
 
-*   Changed log level of warning for missing CSRF token from :debug to :warn. *Mike Dillon*
+*   For resources, both PATCH and PUT are routed to the `update` action. *fxn*
 
-*   content_tag_for and div_for can now take the collection of records. It will also yield the record as the first argument if you set a receiving argument in your block *Prem Sichanugrist*
+*   Don't ignore `force_ssl` in development. This is a change of behavior - use a `:if` condition to recreate the old behavior.
 
-    So instead of having to do this:
+        class AccountsController < ApplicationController
+          force_ssl if: :ssl_configured?
 
-        @items.each do |item|
-          content_tag_for(:li, item) do
-             Title: <%= item.title %>
+          def ssl_configured?
+            !Rails.env.development?
           end
         end
 
-    You can now do this:
+    *Pat Allan*
 
-        content_tag_for(:li, @items) do |item|
-          Title: <%= item.title %>
-        end
+*   Adds support for the PATCH verb:
+      * Request objects respond to `patch?`.
+      * Routes have a new `patch` method, and understand `:patch` in the
+        existing places where a verb is configured, like `:via`.
+      * New method `patch` available in functional tests.
+      * If `:patch` is the default verb for updates, edits are
+        tunneled as PATCH rather than as PUT, and routing acts accordingly.
+      * New method `patch_via_redirect` available in integration tests.
+
+    *dlee*
+
+*   `expires_in` accepts a `must_revalidate` flag. If true, "must-revalidate"
+    is added to the Cache-Control header. *fxn*
+
+*   Add `date_field` and `date_field_tag` helpers which render an `input[type="date"]` tag *Olek Janiszewski*
+
+*   Adds `image_url`, `javascript_url`, `stylesheet_url`, `audio_url`, `video_url`, and `font_url`
+    to assets tag helper. These URL helpers will return the full path to your assets. This is useful
+    when you are going to reference this asset from external host. *Prem Sichanugrist*
+
+*   Default responder will now always use your overridden block in `respond_with` to render your response. *Prem Sichanugrist*
+
+*   Allow `value_method` and `text_method` arguments from `collection_select` and
+    `options_from_collection_for_select` to receive an object that responds to `:call`,
+    such as a `proc`, to evaluate the option in the current element context. This works
+    the same way with `collection_radio_buttons` and `collection_check_boxes`.
+
+    *Carlos Antonio da Silva + Rafael Mendonça França*
+
+*   Add `collection_check_boxes` form helper, similar to `collection_select`:
+    Example:
+
+        collection_check_boxes :post, :author_ids, Author.all, :id, :name
+        # Outputs something like:
+        <input id="post_author_ids_1" name="post[author_ids][]" type="checkbox" value="1" />
+        <label for="post_author_ids_1">D. Heinemeier Hansson</label>
+        <input id="post_author_ids_2" name="post[author_ids][]" type="checkbox" value="2" />
+        <label for="post_author_ids_2">D. Thomas</label>
+        <input name="post[author_ids][]" type="hidden" value="" />
+
+    The label/check_box pairs can be customized with a block.
+
+    *Carlos Antonio da Silva + Rafael Mendonça França*
+
+*   Add `collection_radio_buttons` form helper, similar to `collection_select`:
+    Example:
+
+        collection_radio_buttons :post, :author_id, Author.all, :id, :name
+        # Outputs something like:
+        <input id="post_author_id_1" name="post[author_id]" type="radio" value="1" />
+        <label for="post_author_id_1">D. Heinemeier Hansson</label>
+        <input id="post_author_id_2" name="post[author_id]" type="radio" value="2" />
+        <label for="post_author_id_2">D. Thomas</label>
+
+    The label/radio_button pairs can be customized with a block.
+
+    *Carlos Antonio da Silva + Rafael Mendonça França*
+
+*   `check_box` with `:form` html5 attribute will now replicate the `:form`
+    attribute to the hidden field as well. *Carlos Antonio da Silva*
+
+*   `label` form helper accepts `for: nil` to not generate the attribute. *Carlos Antonio da Silva*
+
+*   Add `:format` option to `number_to_percentage`. *Rodrigo Flores*
+
+*   Add `config.action_view.logger` to configure logger for Action View. *Rafael Mendonça França*
+
+*   Deprecated `ActionController::Integration` in favour of `ActionDispatch::Integration`.
 
-*   send_file now guess the mime type *Esad Hajdarevic*
+*   Deprecated `ActionController::IntegrationTest` in favour of `ActionDispatch::IntegrationTest`.
 
-*   Mime type entries for PDF, ZIP and other formats were added *Esad Hajdarevic*
+*   Deprecated `ActionController::PerformanceTest` in favour of `ActionDispatch::PerformanceTest`.
 
-*   Generate hidden input before select with :multiple option set to true.
-    This is useful when you rely on the fact that when no options is set,
-    the state of select will be sent to rails application. Without hidden field
-    nothing is sent according to HTML spec *Bogdan Gusiev*
+*   Deprecated `ActionController::AbstractRequest` in favour of `ActionDispatch::Request`.
 
-*   Refactor ActionController::TestCase cookies *Andrew White*
+*   Deprecated `ActionController::Request` in favour of `ActionDispatch::Request`.
 
-    Assigning cookies for test cases should now use cookies[], e.g:
+*   Deprecated `ActionController::AbstractResponse` in favour of `ActionDispatch::Response`.
 
-        cookies[:email] = 'user@example.com'
-        get :index
-        assert_equal 'user@example.com', cookies[:email]
+*   Deprecated `ActionController::Response` in favour of `ActionDispatch::Response`.
 
-    To clear the cookies, use clear, e.g:
+*   Deprecated `ActionController::Routing` in favour of `ActionDispatch::Routing`.
 
-        cookies.clear
-        get :index
-        assert_nil cookies[:email]
+*   `check_box helper` with `disabled: true` will generate a disabled
+    hidden field to conform with the HTML convention where disabled fields are
+    not submitted with the form. This is a behavior change, previously the hidden
+    tag had a value of the disabled checkbox. *Tadas Tamosauskas*
 
-    We now no longer write out HTTP_COOKIE and the cookie jar is
-    persistent between requests so if you need to manipulate the environment
-    for your test you need to do it before the cookie jar is created.
+*   `favicon_link_tag` helper will now use the favicon in app/assets by default. *Lucas Caton*
 
-*   ActionController::ParamsWrapper on ActiveRecord models now only wrap
-    attr_accessible attributes if they were set, if not, only the attributes
-    returned by the class method attribute_names will be wrapped. This fixes
-    the wrapping of nested attributes by adding them to attr_accessible.
+*   `ActionView::Helpers::TextHelper#highlight` now defaults to the
+    HTML5 `mark` element. *Brian Cardarella*
 
-Please check [3-1-stable](https://github.com/rails/rails/blob/3-1-stable/actionpack/CHANGELOG.md) for previous changes.
+Please check [3-2-stable](https://github.com/rails/rails/blob/3-2-stable/actionpack/CHANGELOG.md) for previous changes.