actionpack 4.0.3 → 4.0.4.rc1

Sign up to get free protection for your applications and to get access to all the features.

Potentially problematic release.


This version of actionpack might be problematic. Click here for more details.

Files changed (41) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +178 -0
  3. data/lib/action_controller/base.rb +1 -1
  4. data/lib/action_controller/metal/params_wrapper.rb +11 -4
  5. data/lib/action_controller/metal/redirecting.rb +1 -1
  6. data/lib/action_controller/metal/request_forgery_protection.rb +3 -0
  7. data/lib/action_controller/metal/responder.rb +1 -1
  8. data/lib/action_controller/metal/strong_parameters.rb +27 -8
  9. data/lib/action_controller/test_case.rb +3 -0
  10. data/lib/action_dispatch.rb +0 -1
  11. data/lib/action_dispatch/http/mime_negotiation.rb +1 -1
  12. data/lib/action_dispatch/http/mime_type.rb +4 -1
  13. data/lib/action_dispatch/journey/formatter.rb +2 -2
  14. data/lib/action_dispatch/journey/visitors.rb +24 -4
  15. data/lib/action_dispatch/middleware/cookies.rb +7 -7
  16. data/lib/action_dispatch/middleware/exception_wrapper.rb +1 -1
  17. data/lib/action_dispatch/middleware/session/cookie_store.rb +2 -2
  18. data/lib/action_dispatch/middleware/static.rb +3 -3
  19. data/lib/action_dispatch/routing/inspector.rb +6 -5
  20. data/lib/action_dispatch/routing/mapper.rb +57 -33
  21. data/lib/action_dispatch/routing/redirection.rb +18 -8
  22. data/lib/action_dispatch/routing/route_set.rb +26 -32
  23. data/lib/action_pack/version.rb +1 -1
  24. data/lib/action_view/helpers/asset_tag_helper.rb +2 -2
  25. data/lib/action_view/helpers/atom_feed_helper.rb +1 -1
  26. data/lib/action_view/helpers/csrf_helper.rb +4 -2
  27. data/lib/action_view/helpers/date_helper.rb +7 -3
  28. data/lib/action_view/helpers/form_helper.rb +2 -2
  29. data/lib/action_view/helpers/form_options_helper.rb +1 -1
  30. data/lib/action_view/helpers/form_tag_helper.rb +1 -1
  31. data/lib/action_view/helpers/number_helper.rb +4 -4
  32. data/lib/action_view/helpers/tag_helper.rb +1 -1
  33. data/lib/action_view/helpers/tags/collection_helpers.rb +1 -1
  34. data/lib/action_view/helpers/tags/label.rb +1 -2
  35. data/lib/action_view/helpers/text_helper.rb +6 -1
  36. data/lib/action_view/helpers/translation_helper.rb +9 -1
  37. data/lib/action_view/helpers/url_helper.rb +1 -1
  38. data/lib/action_view/template.rb +2 -2
  39. data/lib/action_view/template/error.rb +2 -2
  40. data/lib/action_view/template/text.rb +1 -1
  41. metadata +9 -9
@@ -154,14 +154,14 @@ module ActionView
154
154
  #
155
155
  # ==== Examples
156
156
  #
157
- # favicon_link_tag '/myicon.ico'
157
+ # favicon_link_tag 'myicon.ico'
158
158
  # # => <link href="/assets/favicon.ico" rel="shortcut icon" type="image/vnd.microsoft.icon" />
159
159
  #
160
160
  # Mobile Safari looks for a different <link> tag, pointing to an image that
161
161
  # will be used if you add the page to the home screen of an iPod Touch, iPhone, or iPad.
162
162
  # The following call would generate such a tag:
163
163
  #
164
- # favicon_link_tag '/mb-icon.png', rel: 'apple-touch-icon', type: 'image/png'
164
+ # favicon_link_tag 'mb-icon.png', rel: 'apple-touch-icon', type: 'image/png'
165
165
  # # => <link href="/assets/mb-icon.png" rel="apple-touch-icon" type="image/png" />
166
166
  def favicon_link_tag(source='favicon.ico', options={})
167
167
  tag('link', {
@@ -64,7 +64,7 @@ module ActionView
64
64
  # 'xmlns:openSearch' => 'http://a9.com/-/spec/opensearch/1.1/'}) do |feed|
65
65
  # feed.title("My great blog!")
66
66
  # feed.updated((@posts.first.created_at))
67
- # feed.tag!(openSearch:totalResults, 10)
67
+ # feed.tag!('openSearch:totalResults', 10)
68
68
  #
69
69
  # @posts.each do |post|
70
70
  # feed.entry(post) do |entry|
@@ -12,8 +12,10 @@ module ActionView
12
12
  # These are used to generate the dynamic forms that implement non-remote links with
13
13
  # <tt>:method</tt>.
14
14
  #
15
- # Note that regular forms generate hidden fields, and that Ajax calls are whitelisted,
16
- # so they do not use these tags.
15
+ # You don't need to use these tags for regular forms as they generate their own hidden fields.
16
+ #
17
+ # For AJAX requests other than GETs, extract the "csrf-token" from the meta-tag and send as the
18
+ # "X-CSRF-Token" HTTP header. If you are using jQuery with jquery-rails this happens automatically.
17
19
  def csrf_meta_tags
18
20
  if protect_against_forgery?
19
21
  [
@@ -178,8 +178,12 @@ module ActionView
178
178
  # * <tt>:use_month_names</tt> - Set to an array with 12 month names if you want to customize month names.
179
179
  # Note: You can also use Rails' i18n functionality for this.
180
180
  # * <tt>:date_separator</tt> - Specifies a string to separate the date fields. Default is "" (i.e. nothing).
181
- # * <tt>:start_year</tt> - Set the start year for the year select. Default is <tt>Time.now.year - 5</tt>.
182
- # * <tt>:end_year</tt> - Set the end year for the year select. Default is <tt>Time.now.year + 5</tt>.
181
+ # * <tt>:start_year</tt> - Set the start year for the year select. Default is <tt>Date.today.year - 5</tt>if
182
+ # you are creating new record. While editing existing record, <tt>:start_year</tt> defaults to
183
+ # current selected year minus 5.
184
+ # * <tt>:end_year</tt> - Set the end year for the year select. Default is <tt>Date.today.year + 5</tt> if
185
+ # you are creating new record. While editing existing record, <tt>:end_year</tt> defaults to
186
+ # current selected year plus 5.
183
187
  # * <tt>:discard_day</tt> - Set to true if you don't want to show a day select. This includes the day
184
188
  # as a hidden field instead of showing a select field. Also note that this implicitly sets the day to be the
185
189
  # first of the given month in order to not create invalid dates like 31 February.
@@ -1070,7 +1074,7 @@ module ActionView
1070
1074
  # Wraps ActionView::Helpers::DateHelper#datetime_select for form builders:
1071
1075
  #
1072
1076
  # <%= form_for @person do |f| %>
1073
- # <%= f.time_select :last_request_at %>
1077
+ # <%= f.datetime_select :last_request_at %>
1074
1078
  # <%= f.submit %>
1075
1079
  # <% end %>
1076
1080
  #
@@ -692,7 +692,7 @@ module ActionView
692
692
  #
693
693
  # Note that fields_for will automatically generate a hidden field
694
694
  # to store the ID of the record. There are circumstances where this
695
- # hidden field is not needed and you can pass <tt>hidden_field_id: false</tt>
695
+ # hidden field is not needed and you can pass <tt>include_id: false</tt>
696
696
  # to prevent fields_for from rendering it automatically.
697
697
  def fields_for(record_name, record_object = nil, options = {}, &block)
698
698
  builder = instantiate_builder(record_name, record_object, options)
@@ -1507,7 +1507,7 @@ module ActionView
1507
1507
  #
1508
1508
  # Note that fields_for will automatically generate a hidden field
1509
1509
  # to store the ID of the record. There are circumstances where this
1510
- # hidden field is not needed and you can pass <tt>hidden_field_id: false</tt>
1510
+ # hidden field is not needed and you can pass <tt>include_id: false</tt>
1511
1511
  # to prevent fields_for from rendering it automatically.
1512
1512
  def fields_for(record_name, record_object = nil, fields_options = {}, &block)
1513
1513
  fields_options, record_object = record_object, nil if record_object.is_a?(Hash) && record_object.extractable_options?
@@ -765,7 +765,7 @@ module ActionView
765
765
  # Wraps ActionView::Helpers::FormOptionsHelper#select for form builders:
766
766
  #
767
767
  # <%= form_for @post do |f| %>
768
- # <%= f.select :person_id, Person.all.collect {|p| [ p.name, p.id ] }, { include_blank: true }) %>
768
+ # <%= f.select :person_id, Person.all.collect {|p| [ p.name, p.id ] }, { include_blank: true } %>
769
769
  # <%= f.submit %>
770
770
  # <% end %>
771
771
  #
@@ -480,7 +480,7 @@ module ActionView
480
480
  # # <strong>Ask me!</strong>
481
481
  # # </button>
482
482
  #
483
- # button_tag "Checkout", data: { disable_with => "Please wait..." }
483
+ # button_tag "Checkout", data: { :disable_with => "Please wait..." }
484
484
  # # => <button data-disable-with="Please wait..." name="button" type="submit">Checkout</button>
485
485
  #
486
486
  def button_tag(content_or_options = nil, options = nil, &block)
@@ -100,10 +100,10 @@ module ActionView
100
100
  #
101
101
  # number_to_currency(-1234567890.50, negative_format: "(%u%n)")
102
102
  # # => ($1,234,567,890.50)
103
- # number_to_currency(1234567890.50, unit: "&pound;", separator: ",", delimiter: "")
104
- # # => &pound;1234567890,50
105
- # number_to_currency(1234567890.50, unit: "&pound;", separator: ",", delimiter: "", format: "%n %u")
106
- # # => 1234567890,50 &pound;
103
+ # number_to_currency(1234567890.50, unit: "R$", separator: ",", delimiter: "")
104
+ # # => R$1234567890,50
105
+ # number_to_currency(1234567890.50, unit: "R$", separator: ",", delimiter: "", format: "%n %u")
106
+ # # => 1234567890,50 R$
107
107
  def number_to_currency(number, options = {})
108
108
  return unless number
109
109
  options = escape_unsafe_options(options.symbolize_keys)
@@ -111,7 +111,7 @@ module ActionView
111
111
  # cdata_section("hello]]>world")
112
112
  # # => <![CDATA[hello]]]]><![CDATA[>world]]>
113
113
  def cdata_section(content)
114
- splitted = content.gsub(']]>', ']]]]><![CDATA[>')
114
+ splitted = content.to_s.gsub(']]>', ']]]]><![CDATA[>')
115
115
  "<![CDATA[#{splitted}]]>".html_safe
116
116
  end
117
117
 
@@ -18,7 +18,7 @@ module ActionView
18
18
  end
19
19
 
20
20
  def label(label_html_options={}, &block)
21
- html_options = label_html_options.merge(@input_html_options)
21
+ html_options = @input_html_options.slice(:index, :namespace).merge(label_html_options)
22
22
  @template_object.label(@object_name, @sanitized_attribute_name, @text, html_options, &block)
23
23
  end
24
24
  end
@@ -30,14 +30,13 @@ module ActionView
30
30
  add_default_name_and_id_for_value(tag_value, name_and_id)
31
31
  options.delete("index")
32
32
  options.delete("namespace")
33
- options.delete("multiple")
34
33
  options["for"] = name_and_id["id"] unless options.key?("for")
35
34
 
36
35
  if block_given?
37
36
  content = @template_object.capture(&block)
38
37
  else
39
38
  content = if @content.blank?
40
- @object_name.gsub!(/\[(.*)_attributes\]\[\d\]/, '.\1')
39
+ @object_name.gsub!(/\[(.*)_attributes\]\[\d+\]/, '.\1')
41
40
  method_and_value = tag_value.present? ? "#{@method_name}.#{tag_value}" : @method_name
42
41
 
43
42
  if object.respond_to?(:to_model)
@@ -31,6 +31,8 @@ module ActionView
31
31
 
32
32
  include SanitizeHelper
33
33
  include TagHelper
34
+ include OutputSafetyHelper
35
+
34
36
  # The preferred method of outputting text in your views is to use the
35
37
  # <%= "text" %> eRuby syntax. The regular _puts_ and _print_ methods
36
38
  # do not operate as expected in an eRuby code block. If you absolutely must
@@ -80,6 +82,9 @@ module ActionView
80
82
  # # => "And they f... (continued)"
81
83
  #
82
84
  # truncate("<p>Once upon a time in a world far far away</p>")
85
+ # # => "&lt;p&gt;Once upon a time in a wo..."
86
+ #
87
+ # truncate("<p>Once upon a time in a world far far away</p>", escape: false)
83
88
  # # => "<p>Once upon a time in a wo..."
84
89
  #
85
90
  # truncate("Once upon a time in a world far far away") { link_to "Continue", "#" }
@@ -255,7 +260,7 @@ module ActionView
255
260
  # # => "<p>Unblinkable.</p>"
256
261
  #
257
262
  # simple_format("<blink>Blinkable!</blink> It's true.", {}, sanitize: false)
258
- # # => "<p><blink>Blinkable!</span> It's true.</p>"
263
+ # # => "<p><blink>Blinkable!</blink> It's true.</p>"
259
264
  def simple_format(text, html_options = {}, options = {})
260
265
  wrapper_tag = options.fetch(:wrapper_tag, :p)
261
266
 
@@ -38,7 +38,13 @@ module ActionView
38
38
 
39
39
  # If the user has specified rescue_format then pass it all through, otherwise use
40
40
  # raise and do the work ourselves
41
- options[:raise] = true unless options.key?(:raise) || options.key?(:rescue_format)
41
+ if options.key?(:raise) || options.key?(:rescue_format)
42
+ raise_error = options[:raise] || options[:rescue_format]
43
+ else
44
+ raise_error = false
45
+ options[:raise] = true
46
+ end
47
+
42
48
  if html_safe_translation_key?(key)
43
49
  html_safe_options = options.dup
44
50
  options.except(*I18n::RESERVED_KEYS).each do |name, value|
@@ -53,6 +59,8 @@ module ActionView
53
59
  I18n.translate(scope_key_by_partial(key), options)
54
60
  end
55
61
  rescue I18n::MissingTranslationData => e
62
+ raise e if raise_error
63
+
56
64
  keys = I18n.normalize_keys(e.locale, e.key, e.options[:scope])
57
65
  content_tag('span', keys.last.to_s.titleize, :class => 'translation_missing', :title => "translation missing: #{keys.join('.')}")
58
66
  end
@@ -82,7 +82,7 @@ module ActionView
82
82
  # to using GET. If <tt>href: '#'</tt> is used and the user has JavaScript
83
83
  # disabled clicking the link will have no effect. If you are relying on the
84
84
  # POST behavior, you should check for it in your controller's action by using
85
- # the request object's methods for <tt>post?</tt>, <tt>delete?</tt>, <tt>:patch</tt>, or <tt>put?</tt>.
85
+ # the request object's methods for <tt>post?</tt>, <tt>delete?</tt>, <tt>patch?</tt>, or <tt>put?</tt>.
86
86
  # * <tt>remote: true</tt> - This will allow the unobtrusive JavaScript
87
87
  # driver to make an Ajax request to the URL in question instead of following
88
88
  # the link. The drivers each provide mechanisms for listening for the
@@ -142,7 +142,7 @@ module ActionView
142
142
  compile!(view)
143
143
  view.send(method_name, locals, buffer, &block)
144
144
  end
145
- rescue Exception => e
145
+ rescue => e
146
146
  handle_render_error(view, e)
147
147
  end
148
148
 
@@ -298,7 +298,7 @@ module ActionView
298
298
  begin
299
299
  mod.module_eval(source, identifier, 0)
300
300
  ObjectSpace.define_finalizer(self, Finalizer[method_name, mod])
301
- rescue Exception => e # errors from template code
301
+ rescue => e # errors from template code
302
302
  if logger = (view && view.logger)
303
303
  logger.debug "ERROR: compiling #{method_name} RAISED #{e}"
304
304
  logger.debug "Function body: #{source}"
@@ -56,13 +56,13 @@ module ActionView
56
56
  class Error < ActionViewError #:nodoc:
57
57
  SOURCE_CODE_RADIUS = 3
58
58
 
59
- attr_reader :original_exception, :backtrace
59
+ attr_reader :original_exception
60
60
 
61
61
  def initialize(template, original_exception)
62
62
  super(original_exception.message)
63
63
  @template, @original_exception = template, original_exception
64
64
  @sub_templates = nil
65
- @backtrace = original_exception.backtrace
65
+ set_backtrace(original_exception.backtrace)
66
66
  end
67
67
 
68
68
  def file_name
@@ -27,7 +27,7 @@ module ActionView #:nodoc:
27
27
  end
28
28
 
29
29
  def formats
30
- [@type.to_sym]
30
+ [@type.respond_to?(:ref) ? @type.ref : @type.to_s]
31
31
  end
32
32
  end
33
33
  end
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: actionpack
3
3
  version: !ruby/object:Gem::Version
4
- version: 4.0.3
4
+ version: 4.0.4.rc1
5
5
  platform: ruby
6
6
  authors:
7
7
  - David Heinemeier Hansson
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2014-02-18 00:00:00.000000000 Z
11
+ date: 2014-03-11 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: activesupport
@@ -16,14 +16,14 @@ dependencies:
16
16
  requirements:
17
17
  - - '='
18
18
  - !ruby/object:Gem::Version
19
- version: 4.0.3
19
+ version: 4.0.4.rc1
20
20
  type: :runtime
21
21
  prerelease: false
22
22
  version_requirements: !ruby/object:Gem::Requirement
23
23
  requirements:
24
24
  - - '='
25
25
  - !ruby/object:Gem::Version
26
- version: 4.0.3
26
+ version: 4.0.4.rc1
27
27
  - !ruby/object:Gem::Dependency
28
28
  name: builder
29
29
  requirement: !ruby/object:Gem::Requirement
@@ -86,14 +86,14 @@ dependencies:
86
86
  requirements:
87
87
  - - '='
88
88
  - !ruby/object:Gem::Version
89
- version: 4.0.3
89
+ version: 4.0.4.rc1
90
90
  type: :development
91
91
  prerelease: false
92
92
  version_requirements: !ruby/object:Gem::Requirement
93
93
  requirements:
94
94
  - - '='
95
95
  - !ruby/object:Gem::Version
96
- version: 4.0.3
96
+ version: 4.0.4.rc1
97
97
  - !ruby/object:Gem::Dependency
98
98
  name: tzinfo
99
99
  requirement: !ruby/object:Gem::Requirement
@@ -375,13 +375,13 @@ required_ruby_version: !ruby/object:Gem::Requirement
375
375
  version: 1.9.3
376
376
  required_rubygems_version: !ruby/object:Gem::Requirement
377
377
  requirements:
378
- - - ">="
378
+ - - ">"
379
379
  - !ruby/object:Gem::Version
380
- version: '0'
380
+ version: 1.3.1
381
381
  requirements:
382
382
  - none
383
383
  rubyforge_project:
384
- rubygems_version: 2.2.0
384
+ rubygems_version: 2.2.2
385
385
  signing_key:
386
386
  specification_version: 4
387
387
  summary: Web-flow and rendering framework putting the VC in MVC (part of Rails).