RubyGems - actionpack - Versions diffs - 3.2.22.5 → 4.0.0.beta1 - Mend

actionpack 3.2.22.5 → 4.0.0.beta1

Potentially problematic release.

This version of actionpack might be problematic. Click here for more details.

Files changed (265) hide show

checksums.yaml +4 -4
data/CHANGELOG.md +641 -418
data/MIT-LICENSE +1 -1
data/README.rdoc +5 -288
data/lib/abstract_controller.rb +1 -8
data/lib/abstract_controller/asset_paths.rb +2 -2
data/lib/abstract_controller/base.rb +39 -37
data/lib/abstract_controller/callbacks.rb +101 -82
data/lib/abstract_controller/collector.rb +7 -3
data/lib/abstract_controller/helpers.rb +23 -11
data/lib/abstract_controller/layouts.rb +68 -73
data/lib/abstract_controller/logger.rb +1 -2
data/lib/abstract_controller/rendering.rb +22 -13
data/lib/abstract_controller/translation.rb +16 -1
data/lib/abstract_controller/url_for.rb +6 -6
data/lib/abstract_controller/view_paths.rb +1 -1
data/lib/action_controller.rb +15 -6
data/lib/action_controller/base.rb +46 -22
data/lib/action_controller/caching.rb +46 -33
data/lib/action_controller/caching/fragments.rb +23 -53
data/lib/action_controller/deprecated.rb +5 -1
data/lib/action_controller/deprecated/integration_test.rb +3 -0
data/lib/action_controller/log_subscriber.rb +11 -8
data/lib/action_controller/metal.rb +16 -30
data/lib/action_controller/metal/conditional_get.rb +76 -32
data/lib/action_controller/metal/data_streaming.rb +20 -26
data/lib/action_controller/metal/exceptions.rb +19 -6
data/lib/action_controller/metal/flash.rb +24 -9
data/lib/action_controller/metal/force_ssl.rb +32 -9
data/lib/action_controller/metal/head.rb +25 -4
data/lib/action_controller/metal/helpers.rb +6 -9
data/lib/action_controller/metal/hide_actions.rb +1 -2
data/lib/action_controller/metal/http_authentication.rb +105 -87
data/lib/action_controller/metal/implicit_render.rb +1 -1
data/lib/action_controller/metal/instrumentation.rb +2 -1
data/lib/action_controller/metal/live.rb +141 -0
data/lib/action_controller/metal/mime_responds.rb +161 -47
data/lib/action_controller/metal/params_wrapper.rb +112 -74
data/lib/action_controller/metal/rack_delegation.rb +9 -3
data/lib/action_controller/metal/redirecting.rb +15 -20
data/lib/action_controller/metal/renderers.rb +11 -9
data/lib/action_controller/metal/rendering.rb +8 -0
data/lib/action_controller/metal/request_forgery_protection.rb +112 -19
data/lib/action_controller/metal/responder.rb +20 -19
data/lib/action_controller/metal/streaming.rb +12 -18
data/lib/action_controller/metal/strong_parameters.rb +516 -0
data/lib/action_controller/metal/testing.rb +13 -18
data/lib/action_controller/metal/url_for.rb +27 -25
data/lib/action_controller/model_naming.rb +12 -0
data/lib/action_controller/railtie.rb +33 -17
data/lib/action_controller/railties/helpers.rb +22 -0
data/lib/action_controller/record_identifier.rb +18 -72
data/lib/action_controller/test_case.rb +215 -123
data/lib/action_controller/vendor/html-scanner.rb +4 -19
data/lib/action_dispatch.rb +27 -19
data/lib/action_dispatch/http/cache.rb +63 -11
data/lib/action_dispatch/http/filter_parameters.rb +18 -8
data/lib/action_dispatch/http/filter_redirect.rb +37 -0
data/lib/action_dispatch/http/headers.rb +27 -19
data/lib/action_dispatch/http/mime_negotiation.rb +25 -2
data/lib/action_dispatch/http/mime_type.rb +145 -113
data/lib/action_dispatch/http/mime_types.rb +1 -1
data/lib/action_dispatch/http/parameter_filter.rb +44 -46
data/lib/action_dispatch/http/parameters.rb +12 -5
data/lib/action_dispatch/http/rack_cache.rb +2 -3
data/lib/action_dispatch/http/request.rb +49 -18
data/lib/action_dispatch/http/response.rb +129 -35
data/lib/action_dispatch/http/upload.rb +60 -17
data/lib/action_dispatch/http/url.rb +53 -31
data/lib/action_dispatch/journey.rb +5 -0
data/lib/action_dispatch/journey/backwards.rb +5 -0
data/lib/action_dispatch/journey/formatter.rb +146 -0
data/lib/action_dispatch/journey/gtg/builder.rb +162 -0
data/lib/action_dispatch/journey/gtg/simulator.rb +44 -0
data/lib/action_dispatch/journey/gtg/transition_table.rb +156 -0
data/lib/action_dispatch/journey/nfa/builder.rb +76 -0
data/lib/action_dispatch/journey/nfa/dot.rb +36 -0
data/lib/action_dispatch/journey/nfa/simulator.rb +47 -0
data/lib/action_dispatch/journey/nfa/transition_table.rb +163 -0
data/lib/action_dispatch/journey/nodes/node.rb +124 -0
data/lib/action_dispatch/journey/parser.rb +206 -0
data/lib/action_dispatch/journey/parser.y +47 -0
data/lib/action_dispatch/journey/parser_extras.rb +23 -0
data/lib/action_dispatch/journey/path/pattern.rb +196 -0
data/lib/action_dispatch/journey/route.rb +116 -0
data/lib/action_dispatch/journey/router.rb +164 -0
data/lib/action_dispatch/journey/router/strexp.rb +24 -0
data/lib/action_dispatch/journey/router/utils.rb +54 -0
data/lib/action_dispatch/journey/routes.rb +75 -0
data/lib/action_dispatch/journey/scanner.rb +61 -0
data/lib/action_dispatch/journey/visitors.rb +189 -0
data/lib/action_dispatch/journey/visualizer/fsm.css +34 -0
data/lib/action_dispatch/journey/visualizer/fsm.js +134 -0
data/lib/action_dispatch/journey/visualizer/index.html.erb +52 -0
data/lib/action_dispatch/middleware/callbacks.rb +9 -4
data/lib/action_dispatch/middleware/cookies.rb +168 -57
data/lib/action_dispatch/middleware/debug_exceptions.rb +26 -17
data/lib/action_dispatch/middleware/exception_wrapper.rb +27 -3
data/lib/action_dispatch/middleware/flash.rb +58 -58
data/lib/action_dispatch/middleware/params_parser.rb +14 -29
data/lib/action_dispatch/middleware/public_exceptions.rb +31 -14
data/lib/action_dispatch/middleware/reloader.rb +6 -6
data/lib/action_dispatch/middleware/remote_ip.rb +145 -39
data/lib/action_dispatch/middleware/request_id.rb +2 -6
data/lib/action_dispatch/middleware/session/abstract_store.rb +22 -20
data/lib/action_dispatch/middleware/session/cache_store.rb +3 -3
data/lib/action_dispatch/middleware/session/cookie_store.rb +81 -7
data/lib/action_dispatch/middleware/session/mem_cache_store.rb +8 -3
data/lib/action_dispatch/middleware/show_exceptions.rb +12 -45
data/lib/action_dispatch/middleware/ssl.rb +70 -0
data/lib/action_dispatch/middleware/stack.rb +6 -1
data/lib/action_dispatch/middleware/static.rb +5 -24
data/lib/action_dispatch/middleware/templates/rescues/_request_and_response.erb +14 -11
data/lib/action_dispatch/middleware/templates/rescues/_source.erb +25 -0
data/lib/action_dispatch/middleware/templates/rescues/_trace.erb +3 -3
data/lib/action_dispatch/middleware/templates/rescues/diagnostics.erb +15 -9
data/lib/action_dispatch/middleware/templates/rescues/layout.erb +121 -5
data/lib/action_dispatch/middleware/templates/rescues/missing_template.erb +7 -2
data/lib/action_dispatch/middleware/templates/rescues/routing_error.erb +30 -15
data/lib/action_dispatch/middleware/templates/rescues/template_error.erb +39 -13
data/lib/action_dispatch/middleware/templates/rescues/unknown_action.erb +6 -2
data/lib/action_dispatch/middleware/templates/routes/_route.html.erb +16 -0
data/lib/action_dispatch/middleware/templates/routes/_table.html.erb +144 -0
data/lib/action_dispatch/railtie.rb +16 -6
data/lib/action_dispatch/request/session.rb +181 -0
data/lib/action_dispatch/routing.rb +41 -40
data/lib/action_dispatch/routing/inspector.rb +240 -0
data/lib/action_dispatch/routing/mapper.rb +501 -273
data/lib/action_dispatch/routing/polymorphic_routes.rb +16 -20
data/lib/action_dispatch/routing/redirection.rb +46 -29
data/lib/action_dispatch/routing/route_set.rb +203 -164
data/lib/action_dispatch/routing/routes_proxy.rb +2 -0
data/lib/action_dispatch/routing/url_for.rb +48 -33
data/lib/action_dispatch/testing/assertions/dom.rb +3 -13
data/lib/action_dispatch/testing/assertions/response.rb +32 -40
data/lib/action_dispatch/testing/assertions/routing.rb +40 -39
data/lib/action_dispatch/testing/assertions/selector.rb +15 -20
data/lib/action_dispatch/testing/assertions/tag.rb +20 -23
data/lib/action_dispatch/testing/integration.rb +41 -22
data/lib/action_dispatch/testing/test_process.rb +9 -6
data/lib/action_dispatch/testing/test_request.rb +7 -3
data/lib/action_pack.rb +1 -1
data/lib/action_pack/version.rb +4 -4
data/lib/action_view.rb +17 -8
data/lib/action_view/base.rb +15 -34
data/lib/action_view/buffers.rb +1 -1
data/lib/action_view/context.rb +4 -4
data/lib/action_view/dependency_tracker.rb +91 -0
data/lib/action_view/digestor.rb +85 -0
data/lib/action_view/flows.rb +1 -4
data/lib/action_view/helpers.rb +2 -4
data/lib/action_view/helpers/active_model_helper.rb +3 -4
data/lib/action_view/helpers/asset_tag_helper.rb +211 -353
data/lib/action_view/helpers/asset_url_helper.rb +354 -0
data/lib/action_view/helpers/atom_feed_helper.rb +13 -10
data/lib/action_view/helpers/cache_helper.rb +150 -18
data/lib/action_view/helpers/capture_helper.rb +42 -29
data/lib/action_view/helpers/csrf_helper.rb +0 -2
data/lib/action_view/helpers/date_helper.rb +268 -247
data/lib/action_view/helpers/debug_helper.rb +10 -11
data/lib/action_view/helpers/form_helper.rb +904 -547
data/lib/action_view/helpers/form_options_helper.rb +341 -166
data/lib/action_view/helpers/form_tag_helper.rb +188 -88
data/lib/action_view/helpers/javascript_helper.rb +23 -16
data/lib/action_view/helpers/number_helper.rb +148 -354
data/lib/action_view/helpers/output_safety_helper.rb +3 -3
data/lib/action_view/helpers/record_tag_helper.rb +17 -22
data/lib/action_view/helpers/rendering_helper.rb +2 -4
data/lib/action_view/helpers/sanitize_helper.rb +3 -6
data/lib/action_view/helpers/tag_helper.rb +43 -37
data/lib/action_view/helpers/tags.rb +39 -0
data/lib/action_view/helpers/tags/base.rb +148 -0
data/lib/action_view/helpers/tags/check_box.rb +64 -0
data/lib/action_view/helpers/tags/checkable.rb +16 -0
data/lib/action_view/helpers/tags/collection_check_boxes.rb +43 -0
data/lib/action_view/helpers/tags/collection_helpers.rb +83 -0
data/lib/action_view/helpers/tags/collection_radio_buttons.rb +36 -0
data/lib/action_view/helpers/tags/collection_select.rb +28 -0
data/lib/action_view/helpers/tags/color_field.rb +25 -0
data/lib/action_view/helpers/tags/date_field.rb +13 -0
data/lib/action_view/helpers/tags/date_select.rb +72 -0
data/lib/action_view/helpers/tags/datetime_field.rb +22 -0
data/lib/action_view/helpers/tags/datetime_local_field.rb +19 -0
data/lib/action_view/helpers/tags/datetime_select.rb +8 -0
data/lib/action_view/helpers/tags/email_field.rb +8 -0
data/lib/action_view/helpers/tags/file_field.rb +8 -0
data/lib/action_view/helpers/tags/grouped_collection_select.rb +29 -0
data/lib/action_view/helpers/tags/hidden_field.rb +8 -0
data/lib/action_view/helpers/tags/label.rb +65 -0
data/lib/action_view/helpers/tags/month_field.rb +13 -0
data/lib/action_view/helpers/tags/number_field.rb +18 -0
data/lib/action_view/helpers/tags/password_field.rb +12 -0
data/lib/action_view/helpers/tags/radio_button.rb +31 -0
data/lib/action_view/helpers/tags/range_field.rb +8 -0
data/lib/action_view/helpers/tags/search_field.rb +24 -0
data/lib/action_view/helpers/tags/select.rb +41 -0
data/lib/action_view/helpers/tags/tel_field.rb +8 -0
data/lib/action_view/helpers/tags/text_area.rb +18 -0
data/lib/action_view/helpers/tags/text_field.rb +29 -0
data/lib/action_view/helpers/tags/time_field.rb +13 -0
data/lib/action_view/helpers/tags/time_select.rb +8 -0
data/lib/action_view/helpers/tags/time_zone_select.rb +20 -0
data/lib/action_view/helpers/tags/url_field.rb +8 -0
data/lib/action_view/helpers/tags/week_field.rb +13 -0
data/lib/action_view/helpers/text_helper.rb +126 -113
data/lib/action_view/helpers/translation_helper.rb +32 -16
data/lib/action_view/helpers/url_helper.rb +200 -271
data/lib/action_view/locale/en.yml +1 -105
data/lib/action_view/log_subscriber.rb +6 -4
data/lib/action_view/lookup_context.rb +15 -39
data/lib/action_view/model_naming.rb +12 -0
data/lib/action_view/path_set.rb +9 -39
data/lib/action_view/railtie.rb +6 -22
data/lib/action_view/record_identifier.rb +84 -0
data/lib/action_view/renderer/abstract_renderer.rb +10 -19
data/lib/action_view/renderer/partial_renderer.rb +144 -81
data/lib/action_view/renderer/renderer.rb +2 -19
data/lib/action_view/renderer/streaming_template_renderer.rb +2 -5
data/lib/action_view/renderer/template_renderer.rb +14 -13
data/lib/action_view/routing_url_for.rb +107 -0
data/lib/action_view/template.rb +22 -21
data/lib/action_view/template/error.rb +22 -12
data/lib/action_view/template/handlers.rb +12 -9
data/lib/action_view/template/handlers/builder.rb +1 -1
data/lib/action_view/template/handlers/erb.rb +11 -16
data/lib/action_view/template/handlers/raw.rb +11 -0
data/lib/action_view/template/resolver.rb +111 -83
data/lib/action_view/template/text.rb +12 -8
data/lib/action_view/template/types.rb +57 -0
data/lib/action_view/test_case.rb +66 -43
data/lib/action_view/testing/resolvers.rb +3 -2
data/lib/action_view/vendor/html-scanner.rb +20 -0
data/lib/{action_controller → action_view}/vendor/html-scanner/html/document.rb +0 -0
data/lib/{action_controller → action_view}/vendor/html-scanner/html/node.rb +12 -12
data/lib/{action_controller → action_view}/vendor/html-scanner/html/sanitizer.rb +18 -7
data/lib/{action_controller → action_view}/vendor/html-scanner/html/selector.rb +1 -1
data/lib/{action_controller → action_view}/vendor/html-scanner/html/tokenizer.rb +1 -1
data/lib/{action_controller → action_view}/vendor/html-scanner/html/version.rb +0 -0
metadata +135 -125
data/lib/action_controller/caching/actions.rb +0 -185
data/lib/action_controller/caching/pages.rb +0 -187
data/lib/action_controller/caching/sweeping.rb +0 -97
data/lib/action_controller/deprecated/performance_test.rb +0 -1
data/lib/action_controller/metal/compatibility.rb +0 -65
data/lib/action_controller/metal/session_management.rb +0 -14
data/lib/action_controller/railties/paths.rb +0 -25
data/lib/action_dispatch/middleware/best_standards_support.rb +0 -30
data/lib/action_dispatch/middleware/body_proxy.rb +0 -30
data/lib/action_dispatch/middleware/head.rb +0 -18
data/lib/action_dispatch/middleware/rescue.rb +0 -26
data/lib/action_dispatch/testing/performance_test.rb +0 -10
data/lib/action_view/asset_paths.rb +0 -142
data/lib/action_view/helpers/asset_paths.rb +0 -7
data/lib/action_view/helpers/asset_tag_helpers/asset_include_tag.rb +0 -146
data/lib/action_view/helpers/asset_tag_helpers/asset_paths.rb +0 -93
data/lib/action_view/helpers/asset_tag_helpers/javascript_tag_helpers.rb +0 -193
data/lib/action_view/helpers/asset_tag_helpers/stylesheet_tag_helpers.rb +0 -148
data/lib/sprockets/assets.rake +0 -99
data/lib/sprockets/bootstrap.rb +0 -37
data/lib/sprockets/compressors.rb +0 -83
data/lib/sprockets/helpers.rb +0 -6
data/lib/sprockets/helpers/isolated_helper.rb +0 -13
data/lib/sprockets/helpers/rails_helper.rb +0 -182
data/lib/sprockets/railtie.rb +0 -62
data/lib/sprockets/static_compiler.rb +0 -56

data/lib/action_dispatch/middleware/session/mem_cache_store.rb CHANGED

@@ -1,14 +1,19 @@
 require 'action_dispatch/middleware/session/abstract_store'
-require 'rack/session/memcache'
+begin
+  require 'rack/session/dalli'
+rescue LoadError => e
+  $stderr.puts "You don't have dalli installed in your application. Please add it to your Gemfile and run bundle install"
+  raise e
+end
 module ActionDispatch
   module Session
-    class MemCacheStore < Rack::Session::Memcache
+    class MemCacheStore < Rack::Session::Dalli
       include Compatibility
       include StaleSessionCheck
+      include SessionObject
       def initialize(app, options = {})
-        require 'memcache'
         options[:expire_after] ||= options[:expires]
         super
       end

data/lib/action_dispatch/middleware/show_exceptions.rb CHANGED

@@ -1,73 +1,40 @@
 require 'action_dispatch/http/request'
 require 'action_dispatch/middleware/exception_wrapper'
-require 'active_support/deprecation'
 module ActionDispatch
   # This middleware rescues any exception returned by the application
   # and calls an exceptions app that will wrap it in a format for the end user.
   #
   # The exceptions app should be passed as parameter on initialization
-  # of ShowExceptions. Everytime there is an exception, ShowExceptions will
+  # of ShowExceptions. Every time there is an exception, ShowExceptions will
   # store the exception in env["action_dispatch.exception"], rewrite the
   # PATH_INFO to the exception status code and call the rack app.
-  #
+  #
   # If the application returns a "X-Cascade" pass response, this middleware
   # will send an empty response as result with the correct status code.
   # If any exception happens inside the exceptions app, this middleware
   # catches the exceptions and returns a FAILSAFE_RESPONSE.
   class ShowExceptions
-    FAILSAFE_RESPONSE = [500, {'Content-Type' => 'text/html'},
-      ["<html><body><h1>500 Internal Server Error</h1>" <<
-       "If you are the administrator of this website, then please read this web " <<
-       "application's log file and/or the web server's log file to find out what " <<
-       "went wrong.</body></html>"]]
-    class << self
-      def rescue_responses
-        ActiveSupport::Deprecation.warn "ActionDispatch::ShowExceptions.rescue_responses is deprecated. " \
-          "Please configure your exceptions using a railtie or in your application config instead."
-        ExceptionWrapper.rescue_responses
-      end
-      def rescue_templates
-        ActiveSupport::Deprecation.warn "ActionDispatch::ShowExceptions.rescue_templates is deprecated. " \
-          "Please configure your exceptions using a railtie or in your application config instead."
-        ExceptionWrapper.rescue_templates
-      end
-    end
-    def initialize(app, exceptions_app = nil)
-      if [true, false].include?(exceptions_app)
-        ActiveSupport::Deprecation.warn "Passing consider_all_requests_local option to ActionDispatch::ShowExceptions middleware no longer works"
-        exceptions_app = nil
-      end
-      if exceptions_app.nil?
-        raise ArgumentError, "You need to pass an exceptions_app when initializing ActionDispatch::ShowExceptions. " \
-          "In case you want to render pages from a public path, you can use ActionDispatch::PublicExceptions.new('path/to/public')"
-      end
+    FAILSAFE_RESPONSE = [500, { 'Content-Type' => 'text/plain' },
+      ["500 Internal Server Error\n" \
+       "If you are the administrator of this website, then please read this web " \
+       "application's log file and/or the web server's log file to find out what " \
+       "went wrong."]]
+    def initialize(app, exceptions_app)
       @app = app
       @exceptions_app = exceptions_app
     end
     def call(env)
-      begin
-        response  = @app.call(env)
-      rescue Exception => exception
-        raise exception if env['action_dispatch.show_exceptions'] == false
-      end
-      response || render_exception(env, exception)
+      @app.call(env)
+    rescue Exception => exception
+      raise exception if env['action_dispatch.show_exceptions'] == false
+      render_exception(env, exception)
     end
     private
-    # Define this method because some plugins were monkey patching it.
-    # Remove this after 3.2 is out with the other deprecations in this class.
-    def status_code(*)
-    end
     def render_exception(env, exception)
       wrapper = ExceptionWrapper.new(env, exception)
       status  = wrapper.status_code

data/lib/action_dispatch/middleware/ssl.rb ADDED

@@ -0,0 +1,70 @@
+module ActionDispatch
+  class SSL
+    YEAR = 31536000
+    def self.default_hsts_options
+      { :expires => YEAR, :subdomains => false }
+    end
+    def initialize(app, options = {})
+      @app = app
+      @hsts = options.fetch(:hsts, {})
+      @hsts = {} if @hsts == true
+      @hsts = self.class.default_hsts_options.merge(@hsts) if @hsts
+      @host    = options[:host]
+      @port    = options[:port]
+    end
+    def call(env)
+      request = Request.new(env)
+      if request.ssl?
+        status, headers, body = @app.call(env)
+        headers = hsts_headers.merge(headers)
+        flag_cookies_as_secure!(headers)
+        [status, headers, body]
+      else
+        redirect_to_https(request)
+      end
+    end
+    private
+      def redirect_to_https(request)
+        url        = URI(request.url)
+        url.scheme = "https"
+        url.host   = @host if @host
+        url.port   = @port if @port
+        headers    = hsts_headers.merge('Content-Type' => 'text/html',
+                                        'Location'     => url.to_s)
+        [301, headers, []]
+      end
+      # http://tools.ietf.org/html/draft-hodges-strict-transport-sec-02
+      def hsts_headers
+        if @hsts
+          value = "max-age=#{@hsts[:expires].to_i}"
+          value += "; includeSubDomains" if @hsts[:subdomains]
+          { 'Strict-Transport-Security' => value }
+        else
+          {}
+        end
+      end
+      def flag_cookies_as_secure!(headers)
+        if cookies = headers['Set-Cookie']
+          cookies = cookies.split("\n")
+          headers['Set-Cookie'] = cookies.map { |cookie|
+            if cookie !~ /;\s+secure(;|$)/
+              "#{cookie}; secure"
+            else
+              cookie
+            end
+          }.join("\n")
+        end
+      end
+  end
+end

data/lib/action_dispatch/middleware/stack.rb CHANGED

@@ -75,6 +75,11 @@ module ActionDispatch
       middlewares[i]
     end
+    def unshift(*args, &block)
+      middleware = self.class::Middleware.new(*args, &block)
+      middlewares.unshift(middleware)
+    end
     def initialize_copy(other)
       self.middlewares = other.middlewares.dup
     end
@@ -110,7 +115,7 @@ module ActionDispatch
     def build(app = nil, &block)
       app ||= block
       raise "MiddlewareStack#build requires an app" unless app
-      middlewares.reverse.inject(app) { |a, e| e.build(a) }
+      middlewares.freeze.reverse.inject(app) { |a, e| e.build(a) }
     end
   protected

data/lib/action_dispatch/middleware/static.rb CHANGED

@@ -1,4 +1,5 @@
 require 'rack/utils'
+require 'active_support/core_ext/uri'
 module ActionDispatch
   class FileHandler
@@ -12,11 +13,11 @@ module ActionDispatch
     def match?(path)
       path = path.dup
-      full_path = path.empty? ? @root : File.join(@root, escape_glob_chars(clean_path_info(unescape_path(path))))
+      full_path = path.empty? ? @root : File.join(@root, escape_glob_chars(unescape_path(path)))
       paths = "#{full_path}#{ext}"
       matches = Dir[paths]
-      match = matches.detect { |m| File.file?(m) && File.readable?(m) }
+      match = matches.detect { |m| File.file?(m) }
       if match
         match.sub!(@compiled_root, '')
         ::Rack::Utils.escape(match)
@@ -29,7 +30,7 @@ module ActionDispatch
     def ext
       @ext ||= begin
-        ext = ::ActionController::Base.page_cache_extension
+        ext = ::ActionController::Base.default_static_extension
         "{,#{ext},/index#{ext}}"
       end
     end
@@ -40,27 +41,7 @@ module ActionDispatch
     def escape_glob_chars(path)
       path.force_encoding('binary') if path.respond_to? :force_encoding
-      path.gsub(/[*?{}\[\]\\]/, "\\\\\\&")
-    end
-    private
-    PATH_SEPS = Regexp.union(*[::File::SEPARATOR, ::File::ALT_SEPARATOR].compact)
-    def clean_path_info(path_info)
-      path_info.force_encoding('binary') if path_info.respond_to? :force_encoding
-      parts = path_info.split PATH_SEPS
-      clean = []
-      parts.each do |part|
-        next if part.empty? || part == '.'
-        part == '..' ? clean.pop : clean << part
-      end
-      clean.unshift '/' if parts.empty? || parts.first.empty?
-      ::File.join(*clean)
+      path.gsub(/[*?{}\[\]]/, "\\\\\\&")
     end
   end

data/lib/action_dispatch/middleware/templates/rescues/_request_and_response.erb CHANGED

@@ -1,8 +1,8 @@
 <% unless @exception.blamed_files.blank? %>
   <% if (hide = @exception.blamed_files.length > 8) %>
-    <a href="#" onclick="document.getElementById('blame_trace').style.display='block'; return false;">Show blamed files</a>
+    <a href="#" onclick="return toggleTrace()">Toggle blamed files</a>
   <% end %>
-  <pre id="blame_trace" <%='style="display:none"' if hide %>><code><%=h @exception.describe_blame %></code></pre>
+  <pre id="blame_trace" <%='style="display:none"' if hide %>><code><%= @exception.describe_blame %></code></pre>
 <% end %>
 <%
@@ -12,20 +12,23 @@
   request_dump = clean_params.empty? ? 'None' : clean_params.inspect.gsub(',', ",\n")
-  def debug_hash(hash)
-    hash.sort_by { |k, v| k.to_s }.map { |k, v| "#{k}: #{v.inspect rescue $!.message}" }.join("\n")
+  def debug_hash(object)
+    object.to_hash.sort_by { |k, v| k.to_s }.map { |k, v| "#{k}: #{v.inspect rescue $!.message}" }.join("\n")
   end unless self.class.method_defined?(:debug_hash)
 %>
 <h2 style="margin-top: 30px">Request</h2>
-<p><b>Parameters</b>: <pre><%=h request_dump %></pre></p>
+<p><b>Parameters</b>:</p> <pre><%= request_dump %></pre>
-<p><a href="#" onclick="document.getElementById('session_dump').style.display='block'; return false;">Show session dump</a></p>
-<div id="session_dump" style="display:none"><pre><%= debug_hash @request.session %></pre></div>
-<p><a href="#" onclick="document.getElementById('env_dump').style.display='block'; return false;">Show env dump</a></p>
-<div id="env_dump" style="display:none"><pre><%= debug_hash @request.env.slice(*@request.class::ENV_METHODS) %></pre></div>
+<div class="details">
+  <div class="summary"><a href="#" onclick="return toggleSessionDump()">Toggle session dump</a></div>
+  <div id="session_dump" style="display:none"><pre><%= debug_hash @request.session %></pre></div>
+</div>
+<div class="details">
+  <div class="summary"><a href="#" onclick="return toggleEnvDump()">Toggle env dump</a></div>
+  <div id="env_dump" style="display:none"><pre><%= debug_hash @request.env.slice(*@request.class::ENV_METHODS) %></pre></div>
+</div>
 <h2 style="margin-top: 30px">Response</h2>
-<p><b>Headers</b>: <pre><%=h defined?(@response) ? @response.headers.inspect.gsub(',', ",\n") : 'None' %></pre></p>
+<p><b>Headers</b>:</p> <pre><%= defined?(@response) ? @response.headers.inspect.gsub(',', ",\n") : 'None' %></pre>

data/lib/action_dispatch/middleware/templates/rescues/_source.erb ADDED

@@ -0,0 +1,25 @@
+<% if @source_extract %>
+<div class="source">
+<div class="info">
+  Extracted source (around line <strong>#<%= @line_number %></strong>):
+</div>
+<div class="data">
+  <table cellpadding="0" cellspacing="0" class="lines">
+      <tr>
+        <td>
+          <pre class="line_numbers">
+            <% @source_extract.keys.each do |line_number| %>
+<span><%= line_number -%></span>
+            <% end %>
+          </pre>
+        </td>
+<td width="100%">
+<pre>
+<% @source_extract.each do |line, source| -%><div class="line<%= " active" if line == @line_number -%>"><%= source -%></div><% end -%>
+</pre>
+</td>
+    </tr>
+  </table>
+</div>
+</div>
+<% end %>

data/lib/action_dispatch/middleware/templates/rescues/_trace.erb CHANGED

@@ -12,15 +12,15 @@
 <div id="traces">
   <% names.each do |name| %>
     <%
-      show = "document.getElementById('#{name.gsub(/\s/, '-')}').style.display='block';"
-      hide = (names - [name]).collect {|hide_name| "document.getElementById('#{hide_name.gsub(/\s/, '-')}').style.display='none';"}
+      show = "show('#{name.gsub(/\s/, '-')}');"
+      hide = (names - [name]).collect {|hide_name| "hide('#{hide_name.gsub(/\s/, '-')}');"}
     %>
     <a href="#" onclick="<%= hide.join %><%= show %>; return false;"><%= name %></a> <%= '|' unless names.last == name %>
   <% end %>
   <% traces.each do |name, trace| %>
     <div id="<%= name.gsub(/\s/, '-') %>" style="display: <%= (name == "Application Trace") ? 'block' : 'none' %>;">
-      <pre><code><%=h trace.join "\n" %></code></pre>
+      <pre><code><%= trace.join "\n" %></code></pre>
     </div>
   <% end %>
 </div>

data/lib/action_dispatch/middleware/templates/rescues/diagnostics.erb CHANGED

@@ -1,10 +1,16 @@
-<h1>
-  <%=h @exception.class.to_s %>
-  <% if @request.parameters['controller'] %>
-    in <%=h @request.parameters['controller'].camelize %>Controller<% if @request.parameters['action'] %>#<%=h @request.parameters['action'] %><% end %>
-  <% end %>
-</h1>
-<pre><%=h @exception.message %></pre>
+<header>
+  <h1>
+    <%= @exception.class.to_s %>
+    <% if @request.parameters['controller'] %>
+      in <%= @request.parameters['controller'].camelize %>Controller<% if @request.parameters['action'] %>#<%= @request.parameters['action'] %><% end %>
+    <% end %>
+  </h1>
+</header>
-<%= render :template => "rescues/_trace" %>
-<%= render :template => "rescues/_request_and_response" %>
+<div id="container">
+  <h2><%= @exception.message %></h2>
+  <%= render template: "rescues/_source" %>
+  <%= render template: "rescues/_trace" %>
+  <%= render template: "rescues/_request_and_response" %>
+</div>

data/lib/action_dispatch/middleware/templates/rescues/layout.erb CHANGED

@@ -4,7 +4,11 @@
   <meta charset="utf-8" />
   <title>Action Controller: Exception caught</title>
   <style>
-    body { background-color: #fff; color: #333; }
+    body {
+      background-color: #FAFAFA;
+      color: #333;
+      margin: 0px;
+    }
     body, p, ol, ul, td {
       font-family: helvetica, verdana, arial, sans-serif;
@@ -13,16 +17,128 @@
     }
     pre {
-      background-color: #eee;
-      padding: 10px;
       font-size: 11px;
       white-space: pre-wrap;
     }
-    a { color: #000; }
+    pre.box {
+      border: 1px solid #EEE;
+      padding: 10px;
+      margin: 0px;
+      width: 958px;
+    }
+    header {
+      color: #F0F0F0;
+      background: #C52F24;
+      padding: 0.5em 1.5em;
+    }
+    h2 {
+      color: #C52F24;
+      line-height: 25px;
+    }
+    .details {
+      border: 1px solid #D0D0D0;
+      border-radius: 4px;
+      margin: 1em 0px;
+      display: block;
+      width: 978px;
+    }
+    .summary {
+      padding: 8px 15px;
+      border-bottom: 1px solid #D0D0D0;
+      display: block;
+    }
+    .details pre {
+      margin: 5px;
+      border: none;
+    }
+    #container {
+      box-sizing: border-box;
+      width: 100%;
+      padding: 0 1.5em;
+    }
+    .source * {
+      margin: 0px;
+      padding: 0px;
+    }
+    .source {
+      border: 1px solid #D9D9D9;
+      background: #ECECEC;
+      width: 978px;
+    }
+    .source pre {
+      padding: 10px 0px;
+      border: none;
+    }
+    .source .data {
+      font-size: 80%;
+      overflow: auto;
+      background-color: #FFF;
+    }
+    .info {
+      padding: 0.5em;
+    }
+    .source .data .line_numbers {
+      background-color: #ECECEC;
+      color: #AAA;
+      padding: 1em .5em;
+      border-right: 1px solid #DDD;
+      text-align: right;
+    }
+    .line {
+      padding-left: 10px;
+    }
+    .line:hover {
+      background-color: #F6F6F6;
+    }
+    .line.active {
+      background-color: #FFCCCC;
+    }
+    a { color: #980905; }
     a:visited { color: #666; }
-    a:hover { color: #fff; background-color:#000; }
+    a:hover { color: #C52F24; }
+    <%= yield :style %>
   </style>
+  <script>
+    var toggle = function(id) {
+      var s = document.getElementById(id).style;
+      s.display = s.display == 'none' ? 'block' : 'none';
+      return false;
+    }
+    var show = function(id) {
+      document.getElementById(id).style.display = 'block';
+    }
+    var hide = function(id) {
+      document.getElementById(id).style.display = 'none';
+    }
+    var toggleTrace = function() {
+      return toggle('blame_trace');
+    }
+    var toggleSessionDump = function() {
+      return toggle('session_dump');
+    }
+    var toggleEnvDump = function() {
+      return toggle('env_dump');
+    }
+  </script>
 </head>
 <body>