actionpack 5.2.3

Sign up to get free protection for your applications and to get access to all the features.

Potentially problematic release.


This version of actionpack might be problematic. Click here for more details.

Files changed (170) hide show
  1. checksums.yaml +7 -0
  2. data/CHANGELOG.md +429 -0
  3. data/MIT-LICENSE +21 -0
  4. data/README.rdoc +57 -0
  5. data/lib/abstract_controller.rb +27 -0
  6. data/lib/abstract_controller/asset_paths.rb +12 -0
  7. data/lib/abstract_controller/base.rb +265 -0
  8. data/lib/abstract_controller/caching.rb +66 -0
  9. data/lib/abstract_controller/caching/fragments.rb +166 -0
  10. data/lib/abstract_controller/callbacks.rb +212 -0
  11. data/lib/abstract_controller/collector.rb +43 -0
  12. data/lib/abstract_controller/error.rb +6 -0
  13. data/lib/abstract_controller/helpers.rb +194 -0
  14. data/lib/abstract_controller/logger.rb +14 -0
  15. data/lib/abstract_controller/railties/routes_helpers.rb +20 -0
  16. data/lib/abstract_controller/rendering.rb +127 -0
  17. data/lib/abstract_controller/translation.rb +31 -0
  18. data/lib/abstract_controller/url_for.rb +35 -0
  19. data/lib/action_controller.rb +66 -0
  20. data/lib/action_controller/api.rb +149 -0
  21. data/lib/action_controller/api/api_rendering.rb +16 -0
  22. data/lib/action_controller/base.rb +276 -0
  23. data/lib/action_controller/caching.rb +46 -0
  24. data/lib/action_controller/form_builder.rb +50 -0
  25. data/lib/action_controller/log_subscriber.rb +78 -0
  26. data/lib/action_controller/metal.rb +256 -0
  27. data/lib/action_controller/metal/basic_implicit_render.rb +13 -0
  28. data/lib/action_controller/metal/conditional_get.rb +274 -0
  29. data/lib/action_controller/metal/content_security_policy.rb +52 -0
  30. data/lib/action_controller/metal/cookies.rb +16 -0
  31. data/lib/action_controller/metal/data_streaming.rb +152 -0
  32. data/lib/action_controller/metal/etag_with_flash.rb +18 -0
  33. data/lib/action_controller/metal/etag_with_template_digest.rb +57 -0
  34. data/lib/action_controller/metal/exceptions.rb +53 -0
  35. data/lib/action_controller/metal/flash.rb +61 -0
  36. data/lib/action_controller/metal/force_ssl.rb +99 -0
  37. data/lib/action_controller/metal/head.rb +60 -0
  38. data/lib/action_controller/metal/helpers.rb +123 -0
  39. data/lib/action_controller/metal/http_authentication.rb +519 -0
  40. data/lib/action_controller/metal/implicit_render.rb +73 -0
  41. data/lib/action_controller/metal/instrumentation.rb +107 -0
  42. data/lib/action_controller/metal/live.rb +312 -0
  43. data/lib/action_controller/metal/mime_responds.rb +313 -0
  44. data/lib/action_controller/metal/parameter_encoding.rb +51 -0
  45. data/lib/action_controller/metal/params_wrapper.rb +293 -0
  46. data/lib/action_controller/metal/redirecting.rb +133 -0
  47. data/lib/action_controller/metal/renderers.rb +181 -0
  48. data/lib/action_controller/metal/rendering.rb +122 -0
  49. data/lib/action_controller/metal/request_forgery_protection.rb +445 -0
  50. data/lib/action_controller/metal/rescue.rb +28 -0
  51. data/lib/action_controller/metal/streaming.rb +223 -0
  52. data/lib/action_controller/metal/strong_parameters.rb +1086 -0
  53. data/lib/action_controller/metal/testing.rb +16 -0
  54. data/lib/action_controller/metal/url_for.rb +58 -0
  55. data/lib/action_controller/railtie.rb +89 -0
  56. data/lib/action_controller/railties/helpers.rb +24 -0
  57. data/lib/action_controller/renderer.rb +117 -0
  58. data/lib/action_controller/template_assertions.rb +11 -0
  59. data/lib/action_controller/test_case.rb +629 -0
  60. data/lib/action_dispatch.rb +112 -0
  61. data/lib/action_dispatch/http/cache.rb +222 -0
  62. data/lib/action_dispatch/http/content_security_policy.rb +272 -0
  63. data/lib/action_dispatch/http/filter_parameters.rb +84 -0
  64. data/lib/action_dispatch/http/filter_redirect.rb +37 -0
  65. data/lib/action_dispatch/http/headers.rb +132 -0
  66. data/lib/action_dispatch/http/mime_negotiation.rb +175 -0
  67. data/lib/action_dispatch/http/mime_type.rb +342 -0
  68. data/lib/action_dispatch/http/mime_types.rb +50 -0
  69. data/lib/action_dispatch/http/parameter_filter.rb +86 -0
  70. data/lib/action_dispatch/http/parameters.rb +126 -0
  71. data/lib/action_dispatch/http/rack_cache.rb +63 -0
  72. data/lib/action_dispatch/http/request.rb +430 -0
  73. data/lib/action_dispatch/http/response.rb +519 -0
  74. data/lib/action_dispatch/http/upload.rb +84 -0
  75. data/lib/action_dispatch/http/url.rb +350 -0
  76. data/lib/action_dispatch/journey.rb +7 -0
  77. data/lib/action_dispatch/journey/formatter.rb +189 -0
  78. data/lib/action_dispatch/journey/gtg/builder.rb +164 -0
  79. data/lib/action_dispatch/journey/gtg/simulator.rb +41 -0
  80. data/lib/action_dispatch/journey/gtg/transition_table.rb +158 -0
  81. data/lib/action_dispatch/journey/nfa/builder.rb +78 -0
  82. data/lib/action_dispatch/journey/nfa/dot.rb +36 -0
  83. data/lib/action_dispatch/journey/nfa/simulator.rb +49 -0
  84. data/lib/action_dispatch/journey/nfa/transition_table.rb +120 -0
  85. data/lib/action_dispatch/journey/nodes/node.rb +140 -0
  86. data/lib/action_dispatch/journey/parser.rb +199 -0
  87. data/lib/action_dispatch/journey/parser.y +50 -0
  88. data/lib/action_dispatch/journey/parser_extras.rb +31 -0
  89. data/lib/action_dispatch/journey/path/pattern.rb +198 -0
  90. data/lib/action_dispatch/journey/route.rb +203 -0
  91. data/lib/action_dispatch/journey/router.rb +156 -0
  92. data/lib/action_dispatch/journey/router/utils.rb +102 -0
  93. data/lib/action_dispatch/journey/routes.rb +82 -0
  94. data/lib/action_dispatch/journey/scanner.rb +64 -0
  95. data/lib/action_dispatch/journey/visitors.rb +268 -0
  96. data/lib/action_dispatch/journey/visualizer/fsm.css +30 -0
  97. data/lib/action_dispatch/journey/visualizer/fsm.js +134 -0
  98. data/lib/action_dispatch/journey/visualizer/index.html.erb +52 -0
  99. data/lib/action_dispatch/middleware/callbacks.rb +36 -0
  100. data/lib/action_dispatch/middleware/cookies.rb +685 -0
  101. data/lib/action_dispatch/middleware/debug_exceptions.rb +205 -0
  102. data/lib/action_dispatch/middleware/debug_locks.rb +124 -0
  103. data/lib/action_dispatch/middleware/exception_wrapper.rb +147 -0
  104. data/lib/action_dispatch/middleware/executor.rb +21 -0
  105. data/lib/action_dispatch/middleware/flash.rb +300 -0
  106. data/lib/action_dispatch/middleware/public_exceptions.rb +57 -0
  107. data/lib/action_dispatch/middleware/reloader.rb +12 -0
  108. data/lib/action_dispatch/middleware/remote_ip.rb +183 -0
  109. data/lib/action_dispatch/middleware/request_id.rb +43 -0
  110. data/lib/action_dispatch/middleware/session/abstract_store.rb +92 -0
  111. data/lib/action_dispatch/middleware/session/cache_store.rb +54 -0
  112. data/lib/action_dispatch/middleware/session/cookie_store.rb +118 -0
  113. data/lib/action_dispatch/middleware/session/mem_cache_store.rb +28 -0
  114. data/lib/action_dispatch/middleware/show_exceptions.rb +62 -0
  115. data/lib/action_dispatch/middleware/ssl.rb +150 -0
  116. data/lib/action_dispatch/middleware/stack.rb +116 -0
  117. data/lib/action_dispatch/middleware/static.rb +130 -0
  118. data/lib/action_dispatch/middleware/templates/rescues/_request_and_response.html.erb +22 -0
  119. data/lib/action_dispatch/middleware/templates/rescues/_request_and_response.text.erb +23 -0
  120. data/lib/action_dispatch/middleware/templates/rescues/_source.html.erb +27 -0
  121. data/lib/action_dispatch/middleware/templates/rescues/_source.text.erb +8 -0
  122. data/lib/action_dispatch/middleware/templates/rescues/_trace.html.erb +52 -0
  123. data/lib/action_dispatch/middleware/templates/rescues/_trace.text.erb +9 -0
  124. data/lib/action_dispatch/middleware/templates/rescues/diagnostics.html.erb +16 -0
  125. data/lib/action_dispatch/middleware/templates/rescues/diagnostics.text.erb +9 -0
  126. data/lib/action_dispatch/middleware/templates/rescues/invalid_statement.html.erb +21 -0
  127. data/lib/action_dispatch/middleware/templates/rescues/invalid_statement.text.erb +13 -0
  128. data/lib/action_dispatch/middleware/templates/rescues/layout.erb +161 -0
  129. data/lib/action_dispatch/middleware/templates/rescues/missing_template.html.erb +11 -0
  130. data/lib/action_dispatch/middleware/templates/rescues/missing_template.text.erb +3 -0
  131. data/lib/action_dispatch/middleware/templates/rescues/routing_error.html.erb +32 -0
  132. data/lib/action_dispatch/middleware/templates/rescues/routing_error.text.erb +11 -0
  133. data/lib/action_dispatch/middleware/templates/rescues/template_error.html.erb +20 -0
  134. data/lib/action_dispatch/middleware/templates/rescues/template_error.text.erb +7 -0
  135. data/lib/action_dispatch/middleware/templates/rescues/unknown_action.html.erb +6 -0
  136. data/lib/action_dispatch/middleware/templates/rescues/unknown_action.text.erb +3 -0
  137. data/lib/action_dispatch/middleware/templates/routes/_route.html.erb +16 -0
  138. data/lib/action_dispatch/middleware/templates/routes/_table.html.erb +200 -0
  139. data/lib/action_dispatch/railtie.rb +55 -0
  140. data/lib/action_dispatch/request/session.rb +234 -0
  141. data/lib/action_dispatch/request/utils.rb +78 -0
  142. data/lib/action_dispatch/routing.rb +260 -0
  143. data/lib/action_dispatch/routing/endpoint.rb +17 -0
  144. data/lib/action_dispatch/routing/inspector.rb +225 -0
  145. data/lib/action_dispatch/routing/mapper.rb +2267 -0
  146. data/lib/action_dispatch/routing/polymorphic_routes.rb +352 -0
  147. data/lib/action_dispatch/routing/redirection.rb +201 -0
  148. data/lib/action_dispatch/routing/route_set.rb +890 -0
  149. data/lib/action_dispatch/routing/routes_proxy.rb +69 -0
  150. data/lib/action_dispatch/routing/url_for.rb +236 -0
  151. data/lib/action_dispatch/system_test_case.rb +147 -0
  152. data/lib/action_dispatch/system_testing/browser.rb +49 -0
  153. data/lib/action_dispatch/system_testing/driver.rb +59 -0
  154. data/lib/action_dispatch/system_testing/server.rb +31 -0
  155. data/lib/action_dispatch/system_testing/test_helpers/screenshot_helper.rb +96 -0
  156. data/lib/action_dispatch/system_testing/test_helpers/setup_and_teardown.rb +31 -0
  157. data/lib/action_dispatch/system_testing/test_helpers/undef_methods.rb +26 -0
  158. data/lib/action_dispatch/testing/assertion_response.rb +47 -0
  159. data/lib/action_dispatch/testing/assertions.rb +24 -0
  160. data/lib/action_dispatch/testing/assertions/response.rb +107 -0
  161. data/lib/action_dispatch/testing/assertions/routing.rb +222 -0
  162. data/lib/action_dispatch/testing/integration.rb +652 -0
  163. data/lib/action_dispatch/testing/request_encoder.rb +55 -0
  164. data/lib/action_dispatch/testing/test_process.rb +50 -0
  165. data/lib/action_dispatch/testing/test_request.rb +71 -0
  166. data/lib/action_dispatch/testing/test_response.rb +53 -0
  167. data/lib/action_pack.rb +26 -0
  168. data/lib/action_pack/gem_version.rb +17 -0
  169. data/lib/action_pack/version.rb +10 -0
  170. metadata +318 -0
@@ -0,0 +1,7 @@
1
+ ---
2
+ SHA256:
3
+ metadata.gz: fdbc11b76565d6d325a51b67c7a598b0a70c33e3e26c849dc57733e3fa7c0833
4
+ data.tar.gz: 3afcd1526eb36e16fd199bb242fb232ddc3c01125e0d1306c94d31b315e93039
5
+ SHA512:
6
+ metadata.gz: 3122260924160e941c750fba0e3a671b2b2f40723c9c6766fae0f3987ac9521332d3a4128959fa61b993d72bd0539b7925ebb785b50d9b9811514897a2d5bf9e
7
+ data.tar.gz: 4be02fcd7f87d2b725ba823274bc2c40eb367a2a26d7b1b53da8e4df699eae389fec796ff5164c7cb721426fa6cdf8f8b5ae5b6d74a712e5631e5e1ded283717
@@ -0,0 +1,429 @@
1
+ ## Rails 5.2.3 (March 27, 2019) ##
2
+
3
+ * Allow using combine the Cache Control `public` and `no-cache` headers.
4
+
5
+ Before this change, even if `public` was specified for Cache Control header,
6
+ it was excluded when `no-cache` was included. This fixed to keep `public`
7
+ header as is.
8
+
9
+ Fixes #34780.
10
+
11
+ *Yuji Yaginuma*
12
+
13
+ * Allow `nil` params for `ActionController::TestCase`.
14
+
15
+ *Ryo Nakamura*
16
+
17
+
18
+ ## Rails 5.2.2.1 (March 11, 2019) ##
19
+
20
+ * No changes.
21
+
22
+
23
+ ## Rails 5.2.2 (December 04, 2018) ##
24
+
25
+ * Reset Capybara sessions if failed system test screenshot raising an exception.
26
+
27
+ Reset Capybara sessions if `take_failed_screenshot` raise exception
28
+ in system test `after_teardown`.
29
+
30
+ *Maxim Perepelitsa*
31
+
32
+ * Use request object for context if there's no controller
33
+
34
+ There is no controller instance when using a redirect route or a
35
+ mounted rack application so pass the request object as the context
36
+ when resolving dynamic CSP sources in this scenario.
37
+
38
+ Fixes #34200.
39
+
40
+ *Andrew White*
41
+
42
+ * Apply mapping to symbols returned from dynamic CSP sources
43
+
44
+ Previously if a dynamic source returned a symbol such as :self it
45
+ would be converted to a string implicity, e.g:
46
+
47
+ policy.default_src -> { :self }
48
+
49
+ would generate the header:
50
+
51
+ Content-Security-Policy: default-src self
52
+
53
+ and now it generates:
54
+
55
+ Content-Security-Policy: default-src 'self'
56
+
57
+ *Andrew White*
58
+
59
+ * Fix `rails routes -c` for controller name consists of multiple word.
60
+
61
+ *Yoshiyuki Kinjo*
62
+
63
+ * Call the `#redirect_to` block in controller context.
64
+
65
+ *Steven Peckins*
66
+
67
+
68
+ ## Rails 5.2.1.1 (November 27, 2018) ##
69
+
70
+ * No changes.
71
+
72
+
73
+ ## Rails 5.2.1 (August 07, 2018) ##
74
+
75
+ * Prevent `?null=` being passed on JSON encoded test requests.
76
+
77
+ `RequestEncoder#encode_params` won't attempt to parse params if
78
+ there are none.
79
+
80
+ So call like this will no longer append a `?null=` query param.
81
+
82
+ get foos_url, as: :json
83
+
84
+ *Alireza Bashiri*
85
+
86
+ * Ensure `ActionController::Parameters#transform_values` and
87
+ `ActionController::Parameters#transform_values!` converts hashes into
88
+ parameters.
89
+
90
+ *Kevin Sjöberg*
91
+
92
+ * Fix strong parameters `permit!` with nested arrays.
93
+
94
+ Given:
95
+ ```
96
+ params = ActionController::Parameters.new(nested_arrays: [[{ x: 2, y: 3 }, { x: 21, y: 42 }]])
97
+ params.permit!
98
+ ```
99
+
100
+ `params[:nested_arrays][0][0].permitted?` will now return `true` instead of `false`.
101
+
102
+ *Steve Hull*
103
+
104
+ * Reset `RAW_POST_DATA` and `CONTENT_LENGTH` request environment between test requests in
105
+ `ActionController::TestCase` subclasses.
106
+
107
+ *Eugene Kenny*
108
+
109
+ * Output only one Content-Security-Policy nonce header value per request.
110
+
111
+ Fixes #32597.
112
+
113
+ *Andrey Novikov*, *Andrew White*
114
+
115
+ * Only disable GPUs for headless Chrome on Windows.
116
+
117
+ It is not necessary anymore for Linux and macOS machines.
118
+
119
+ https://bugs.chromium.org/p/chromium/issues/detail?id=737678#c1
120
+
121
+ *Stefan Wrobel*
122
+
123
+ * Fix system tests transactions not closed between examples.
124
+
125
+ *Sergey Tarasov*
126
+
127
+
128
+ ## Rails 5.2.0 (April 09, 2018) ##
129
+
130
+ * Check exclude before flagging cookies as secure.
131
+
132
+ *Catherine Khuu*
133
+
134
+ * Always yield a CSP policy instance from `content_security_policy`
135
+
136
+ This allows a controller action to enable the policy individually
137
+ for a controller and/or specific actions.
138
+
139
+ *Andrew White*
140
+
141
+ * Add the ability to disable the global CSP in a controller, e.g:
142
+
143
+ class LegacyPagesController < ApplicationController
144
+ content_security_policy false, only: :index
145
+ end
146
+
147
+ *Andrew White*
148
+
149
+ * Add alias method `to_hash` to `to_h` for `cookies`.
150
+ Add alias method `to_h` to `to_hash` for `session`.
151
+
152
+ *Igor Kasyanchuk*
153
+
154
+ * Update the default HSTS max-age value to 31536000 seconds (1 year)
155
+ to meet the minimum max-age requirement for https://hstspreload.org/.
156
+
157
+ *Grant Bourque*
158
+
159
+ * Add support for automatic nonce generation for Rails UJS.
160
+
161
+ Because the UJS library creates a script tag to process responses it
162
+ normally requires the script-src attribute of the content security
163
+ policy to include 'unsafe-inline'.
164
+
165
+ To work around this we generate a per-request nonce value that is
166
+ embedded in a meta tag in a similar fashion to how CSRF protection
167
+ embeds its token in a meta tag. The UJS library can then read the
168
+ nonce value and set it on the dynamically generated script tag to
169
+ enable it to execute without needing 'unsafe-inline' enabled.
170
+
171
+ Nonce generation isn't 100% safe - if your script tag is including
172
+ user generated content in someway then it may be possible to exploit
173
+ an XSS vulnerability which can take advantage of the nonce. It is
174
+ however an improvement on a blanket permission for inline scripts.
175
+
176
+ It is also possible to use the nonce within your own script tags by
177
+ using `nonce: true` to set the nonce value on the tag, e.g
178
+
179
+ <%= javascript_tag nonce: true do %>
180
+ alert('Hello, World!');
181
+ <% end %>
182
+
183
+ Fixes #31689.
184
+
185
+ *Andrew White*
186
+
187
+ * Matches behavior of `Hash#each` in `ActionController::Parameters#each`.
188
+
189
+ *Dominic Cleal*
190
+
191
+ * Add `Referrer-Policy` header to default headers set.
192
+
193
+ *Guillermo Iguaran*
194
+
195
+ * Changed the system tests to set Puma as default server only when the
196
+ user haven't specified manually another server.
197
+
198
+ *Guillermo Iguaran*
199
+
200
+ * Add secure `X-Download-Options` and `X-Permitted-Cross-Domain-Policies` to
201
+ default headers set.
202
+
203
+ *Guillermo Iguaran*
204
+
205
+ * Add headless firefox support to System Tests.
206
+
207
+ *bogdanvlviv*
208
+
209
+ * Changed the default system test screenshot output from `inline` to `simple`.
210
+
211
+ `inline` works well for iTerm2 but not everyone uses iTerm2. Some terminals like
212
+ Terminal.app ignore the `inline` and output the path to the file since it can't
213
+ render the image. Other terminals, like those on Ubuntu, cannot handle the image
214
+ inline, but also don't handle it gracefully and instead of outputting the file
215
+ path, it dumps binary into the terminal.
216
+
217
+ Commit 9d6e28 fixes this by changing the default for screenshot to be `simple`.
218
+
219
+ *Eileen M. Uchitelle*
220
+
221
+ * Register most popular audio/video/font mime types supported by modern browsers.
222
+
223
+ *Guillermo Iguaran*
224
+
225
+ * Fix optimized url helpers when using relative url root.
226
+
227
+ Fixes #31220.
228
+
229
+ *Andrew White*
230
+
231
+ * Add DSL for configuring Content-Security-Policy header.
232
+
233
+ The DSL allows you to configure a global Content-Security-Policy
234
+ header and then override within a controller. For more information
235
+ about the Content-Security-Policy header see MDN:
236
+
237
+ https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
238
+
239
+ Example global policy:
240
+
241
+ # config/initializers/content_security_policy.rb
242
+ Rails.application.config.content_security_policy do |p|
243
+ p.default_src :self, :https
244
+ p.font_src :self, :https, :data
245
+ p.img_src :self, :https, :data
246
+ p.object_src :none
247
+ p.script_src :self, :https
248
+ p.style_src :self, :https, :unsafe_inline
249
+ end
250
+
251
+ Example controller overrides:
252
+
253
+ # Override policy inline
254
+ class PostsController < ApplicationController
255
+ content_security_policy do |p|
256
+ p.upgrade_insecure_requests true
257
+ end
258
+ end
259
+
260
+ # Using literal values
261
+ class PostsController < ApplicationController
262
+ content_security_policy do |p|
263
+ p.base_uri "https://www.example.com"
264
+ end
265
+ end
266
+
267
+ # Using mixed static and dynamic values
268
+ class PostsController < ApplicationController
269
+ content_security_policy do |p|
270
+ p.base_uri :self, -> { "https://#{current_user.domain}.example.com" }
271
+ end
272
+ end
273
+
274
+ Allows you to also only report content violations for migrating
275
+ legacy content using the `content_security_policy_report_only`
276
+ configuration attribute, e.g;
277
+
278
+ # config/initializers/content_security_policy.rb
279
+ Rails.application.config.content_security_policy_report_only = true
280
+
281
+ # controller override
282
+ class PostsController < ApplicationController
283
+ content_security_policy_report_only only: :index
284
+ end
285
+
286
+ Note that this feature does not validate the header for performance
287
+ reasons since the header is calculated at runtime.
288
+
289
+ *Andrew White*
290
+
291
+ * Make `assert_recognizes` to traverse mounted engines.
292
+
293
+ *Yuichiro Kaneko*
294
+
295
+ * Remove deprecated `ActionController::ParamsParser::ParseError`.
296
+
297
+ *Rafael Mendonça França*
298
+
299
+ * Add `:allow_other_host` option to `redirect_back` method.
300
+
301
+ When `allow_other_host` is set to `false`, the `redirect_back` will not allow redirecting from a
302
+ different host. `allow_other_host` is `true` by default.
303
+
304
+ *Tim Masliuchenko*
305
+
306
+ * Add headless chrome support to System Tests.
307
+
308
+ *Yuji Yaginuma*
309
+
310
+ * Add ability to enable Early Hints for HTTP/2
311
+
312
+ If supported by the server, and enabled in Puma this allows H2 Early Hints to be used.
313
+
314
+ The `javascript_include_tag` and the `stylesheet_link_tag` automatically add Early Hints if requested.
315
+
316
+ *Eileen M. Uchitelle*, *Aaron Patterson*
317
+
318
+ * Simplify cookies middleware with key rotation support
319
+
320
+ Use the `rotate` method for both `MessageEncryptor` and
321
+ `MessageVerifier` to add key rotation support for encrypted and
322
+ signed cookies. This also helps simplify support for legacy cookie
323
+ security.
324
+
325
+ *Michael J Coyne*
326
+
327
+ * Use Capybara registered `:puma` server config.
328
+
329
+ The Capybara registered `:puma` server ensures the puma server is run in process so
330
+ connection sharing and open request detection work correctly by default.
331
+
332
+ *Thomas Walpole*
333
+
334
+ * Cookies `:expires` option supports `ActiveSupport::Duration` object.
335
+
336
+ cookies[:user_name] = { value: "assain", expires: 1.hour }
337
+ cookies[:key] = { value: "a yummy cookie", expires: 6.months }
338
+
339
+ Pull Request: #30121
340
+
341
+ *Assain Jaleel*
342
+
343
+ * Enforce signed/encrypted cookie expiry server side.
344
+
345
+ Rails can thwart attacks by malicious clients that don't honor a cookie's expiry.
346
+
347
+ It does so by stashing the expiry within the written cookie and relying on the
348
+ signing/encrypting to vouch that it hasn't been tampered with. Then on a
349
+ server-side read, the expiry is verified and any expired cookie is discarded.
350
+
351
+ Pull Request: #30121
352
+
353
+ *Assain Jaleel*
354
+
355
+ * Make `take_failed_screenshot` work within engine.
356
+
357
+ Fixes #30405.
358
+
359
+ *Yuji Yaginuma*
360
+
361
+ * Deprecate `ActionDispatch::TestResponse` response aliases.
362
+
363
+ `#success?`, `#missing?` & `#error?` are not supported by the actual
364
+ `ActionDispatch::Response` object and can produce false-positives. Instead,
365
+ use the response helpers provided by `Rack::Response`.
366
+
367
+ *Trevor Wistaff*
368
+
369
+ * Protect from forgery by default
370
+
371
+ Rather than protecting from forgery in the generated `ApplicationController`,
372
+ add it to `ActionController::Base` depending on
373
+ `config.action_controller.default_protect_from_forgery`. This configuration
374
+ defaults to false to support older versions which have removed it from their
375
+ `ApplicationController`, but is set to true for Rails 5.2.
376
+
377
+ *Lisa Ugray*
378
+
379
+ * Fallback `ActionController::Parameters#to_s` to `Hash#to_s`.
380
+
381
+ *Kir Shatrov*
382
+
383
+ * `driven_by` now registers poltergeist and capybara-webkit.
384
+
385
+ If poltergeist or capybara-webkit are set as drivers is set for System Tests,
386
+ `driven_by` will register the driver and set additional options passed via
387
+ the `:options` parameter.
388
+
389
+ Refer to the respective driver's documentation to see what options can be passed.
390
+
391
+ *Mario Chavez*
392
+
393
+ * AEAD encrypted cookies and sessions with GCM.
394
+
395
+ Encrypted cookies now use AES-GCM which couples authentication and
396
+ encryption in one faster step and produces shorter ciphertexts. Cookies
397
+ encrypted using AES in CBC HMAC mode will be seamlessly upgraded when
398
+ this new mode is enabled via the
399
+ `action_dispatch.use_authenticated_cookie_encryption` configuration value.
400
+
401
+ *Michael J Coyne*
402
+
403
+ * Change the cache key format for fragments to make it easier to debug key churn. The new format is:
404
+
405
+ views/template/action.html.erb:7a1156131a6928cb0026877f8b749ac9/projects/123
406
+ ^template path ^template tree digest ^class ^id
407
+
408
+ *DHH*
409
+
410
+ * Add support for recyclable cache keys with fragment caching. This uses the new versioned entries in the
411
+ `ActiveSupport::Cache` stores and relies on the fact that Active Record has split `#cache_key` and `#cache_version`
412
+ to support it.
413
+
414
+ *DHH*
415
+
416
+ * Add `action_controller_api` and `action_controller_base` load hooks to be called in `ActiveSupport.on_load`
417
+
418
+ `ActionController::Base` and `ActionController::API` have differing implementations. This means that
419
+ the one umbrella hook `action_controller` is not able to address certain situations where a method
420
+ may not exist in a certain implementation.
421
+
422
+ This is fixed by adding two new hooks so you can target `ActionController::Base` vs `ActionController::API`
423
+
424
+ Fixes #27013.
425
+
426
+ *Julian Nadeau*
427
+
428
+
429
+ Please check [5-1-stable](https://github.com/rails/rails/blob/5-1-stable/actionpack/CHANGELOG.md) for previous changes.
@@ -0,0 +1,21 @@
1
+ Copyright (c) 2004-2018 David Heinemeier Hansson
2
+
3
+ Permission is hereby granted, free of charge, to any person obtaining
4
+ a copy of this software and associated documentation files (the
5
+ "Software"), to deal in the Software without restriction, including
6
+ without limitation the rights to use, copy, modify, merge, publish,
7
+ distribute, sublicense, and/or sell copies of the Software, and to
8
+ permit persons to whom the Software is furnished to do so, subject to
9
+ the following conditions:
10
+
11
+ The above copyright notice and this permission notice shall be
12
+ included in all copies or substantial portions of the Software.
13
+
14
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
15
+ EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
16
+ MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
17
+ NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
18
+ LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
19
+ OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
20
+ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
21
+