actionpack 5.2.4.rc1 → 6.0.0.beta1

Sign up to get free protection for your applications and to get access to all the features.

Potentially problematic release.


This version of actionpack might be problematic. Click here for more details.

Files changed (105) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +120 -366
  3. data/MIT-LICENSE +1 -1
  4. data/README.rdoc +1 -1
  5. data/lib/abstract_controller/base.rb +4 -2
  6. data/lib/abstract_controller/caching/fragments.rb +6 -21
  7. data/lib/abstract_controller/callbacks.rb +12 -0
  8. data/lib/abstract_controller/collector.rb +1 -1
  9. data/lib/abstract_controller/helpers.rb +2 -2
  10. data/lib/abstract_controller/railties/routes_helpers.rb +1 -1
  11. data/lib/action_controller.rb +1 -0
  12. data/lib/action_controller/api.rb +2 -1
  13. data/lib/action_controller/base.rb +2 -7
  14. data/lib/action_controller/caching.rb +1 -1
  15. data/lib/action_controller/log_subscriber.rb +8 -5
  16. data/lib/action_controller/metal.rb +2 -2
  17. data/lib/action_controller/metal/conditional_get.rb +9 -3
  18. data/lib/action_controller/metal/data_streaming.rb +5 -6
  19. data/lib/action_controller/metal/default_headers.rb +17 -0
  20. data/lib/action_controller/metal/exceptions.rb +22 -1
  21. data/lib/action_controller/metal/flash.rb +5 -5
  22. data/lib/action_controller/metal/force_ssl.rb +17 -57
  23. data/lib/action_controller/metal/head.rb +1 -1
  24. data/lib/action_controller/metal/helpers.rb +1 -2
  25. data/lib/action_controller/metal/http_authentication.rb +20 -21
  26. data/lib/action_controller/metal/implicit_render.rb +2 -12
  27. data/lib/action_controller/metal/instrumentation.rb +3 -5
  28. data/lib/action_controller/metal/live.rb +28 -26
  29. data/lib/action_controller/metal/mime_responds.rb +13 -2
  30. data/lib/action_controller/metal/params_wrapper.rb +18 -14
  31. data/lib/action_controller/metal/redirecting.rb +32 -11
  32. data/lib/action_controller/metal/rendering.rb +1 -1
  33. data/lib/action_controller/metal/request_forgery_protection.rb +22 -11
  34. data/lib/action_controller/metal/strong_parameters.rb +57 -32
  35. data/lib/action_controller/metal/url_for.rb +1 -1
  36. data/lib/action_controller/railties/helpers.rb +1 -1
  37. data/lib/action_controller/renderer.rb +15 -2
  38. data/lib/action_controller/test_case.rb +3 -7
  39. data/lib/action_dispatch.rb +3 -1
  40. data/lib/action_dispatch/http/cache.rb +14 -10
  41. data/lib/action_dispatch/http/content_disposition.rb +45 -0
  42. data/lib/action_dispatch/http/content_security_policy.rb +9 -8
  43. data/lib/action_dispatch/http/filter_parameters.rb +8 -6
  44. data/lib/action_dispatch/http/filter_redirect.rb +1 -1
  45. data/lib/action_dispatch/http/headers.rb +1 -1
  46. data/lib/action_dispatch/http/mime_negotiation.rb +7 -10
  47. data/lib/action_dispatch/http/mime_type.rb +1 -5
  48. data/lib/action_dispatch/http/parameter_filter.rb +5 -79
  49. data/lib/action_dispatch/http/parameters.rb +13 -3
  50. data/lib/action_dispatch/http/request.rb +10 -13
  51. data/lib/action_dispatch/http/response.rb +14 -14
  52. data/lib/action_dispatch/http/upload.rb +5 -0
  53. data/lib/action_dispatch/http/url.rb +81 -81
  54. data/lib/action_dispatch/journey/formatter.rb +1 -1
  55. data/lib/action_dispatch/journey/nfa/simulator.rb +0 -2
  56. data/lib/action_dispatch/journey/nodes/node.rb +9 -8
  57. data/lib/action_dispatch/journey/path/pattern.rb +3 -4
  58. data/lib/action_dispatch/journey/router.rb +0 -3
  59. data/lib/action_dispatch/journey/router/utils.rb +10 -10
  60. data/lib/action_dispatch/journey/scanner.rb +11 -4
  61. data/lib/action_dispatch/journey/visitors.rb +1 -1
  62. data/lib/action_dispatch/middleware/callbacks.rb +2 -4
  63. data/lib/action_dispatch/middleware/cookies.rb +49 -70
  64. data/lib/action_dispatch/middleware/debug_exceptions.rb +32 -58
  65. data/lib/action_dispatch/middleware/debug_locks.rb +5 -5
  66. data/lib/action_dispatch/middleware/debug_view.rb +50 -0
  67. data/lib/action_dispatch/middleware/exception_wrapper.rb +36 -7
  68. data/lib/action_dispatch/middleware/flash.rb +1 -1
  69. data/lib/action_dispatch/middleware/host_authorization.rb +103 -0
  70. data/lib/action_dispatch/middleware/remote_ip.rb +6 -8
  71. data/lib/action_dispatch/middleware/request_id.rb +2 -2
  72. data/lib/action_dispatch/middleware/session/cookie_store.rb +4 -10
  73. data/lib/action_dispatch/middleware/ssl.rb +8 -8
  74. data/lib/action_dispatch/middleware/stack.rb +2 -2
  75. data/lib/action_dispatch/middleware/static.rb +5 -6
  76. data/lib/action_dispatch/middleware/templates/rescues/_source.html.erb +4 -2
  77. data/lib/action_dispatch/middleware/templates/rescues/_trace.html.erb +45 -35
  78. data/lib/action_dispatch/middleware/templates/rescues/blocked_host.html.erb +7 -0
  79. data/lib/action_dispatch/middleware/templates/rescues/blocked_host.text.erb +5 -0
  80. data/lib/action_dispatch/middleware/templates/rescues/diagnostics.html.erb +20 -2
  81. data/lib/action_dispatch/middleware/templates/rescues/invalid_statement.html.erb +4 -4
  82. data/lib/action_dispatch/middleware/templates/rescues/invalid_statement.text.erb +2 -2
  83. data/lib/action_dispatch/middleware/templates/rescues/missing_exact_template.html.erb +19 -0
  84. data/lib/action_dispatch/middleware/templates/rescues/missing_exact_template.text.erb +3 -0
  85. data/lib/action_dispatch/middleware/templates/rescues/missing_template.html.erb +2 -2
  86. data/lib/action_dispatch/middleware/templates/rescues/routing_error.html.erb +1 -1
  87. data/lib/action_dispatch/middleware/templates/rescues/template_error.html.erb +2 -2
  88. data/lib/action_dispatch/middleware/templates/routes/_table.html.erb +3 -0
  89. data/lib/action_dispatch/railtie.rb +1 -0
  90. data/lib/action_dispatch/request/session.rb +8 -0
  91. data/lib/action_dispatch/routing.rb +3 -2
  92. data/lib/action_dispatch/routing/inspector.rb +99 -50
  93. data/lib/action_dispatch/routing/mapper.rb +36 -29
  94. data/lib/action_dispatch/routing/polymorphic_routes.rb +3 -4
  95. data/lib/action_dispatch/routing/route_set.rb +11 -12
  96. data/lib/action_dispatch/routing/url_for.rb +1 -0
  97. data/lib/action_dispatch/system_testing/test_helpers/screenshot_helper.rb +3 -3
  98. data/lib/action_dispatch/testing/assertions/response.rb +2 -3
  99. data/lib/action_dispatch/testing/assertions/routing.rb +7 -2
  100. data/lib/action_dispatch/testing/integration.rb +11 -4
  101. data/lib/action_dispatch/testing/test_process.rb +2 -2
  102. data/lib/action_dispatch/testing/test_response.rb +4 -32
  103. data/lib/action_pack.rb +1 -1
  104. data/lib/action_pack/gem_version.rb +4 -4
  105. metadata +20 -12
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 3679931508ff00406357c690c6bc03d08966109a5af4ea64042e0186b0772f96
4
- data.tar.gz: e8da8f7149e84a388350f037eda5cb7729b8edeb778195be79e7f1273d2cc0a6
3
+ metadata.gz: df5b083c08009f1025bfbf541400a4819b5620f5bb49aa3d4bbe0c056eae44b3
4
+ data.tar.gz: '0374579e1273c1d727e0bc94d7a73b3933d8c0f54e7196beedc61ea30d88209f'
5
5
  SHA512:
6
- metadata.gz: 20695595eef6511baae42535270e30053369304a6629e521afea29f9758eae2b7e7f018e8b263055ba61a88c4a8e543ed1dab320449982c8ff1314b3ae27dcbd
7
- data.tar.gz: 337e059cb93403ba173424a8516cc6c24b393a2cb602e6c8f71cd0db37d6aa7ec8b9a06cd2eb21874eff968adfd0db1dde5e6676783783a3399834ce610fcf98
6
+ metadata.gz: cb0e467dc8c10baa42df2d08d79b2f5caedad996d247523abf54713a542f6d49a01f120ca0b0faa6930ea89592bfe074979201adec97d33135a5877391a5d4bb
7
+ data.tar.gz: dee5cf35ce9af7e795d65bb2a44d5edb229439f5fbde0dde1c35e8d3cf2564c49ddf929a9d5499b3aa6248c42cf6f61ca2c75c85a623ba51f1dd6106750d3267
@@ -1,31 +1,66 @@
1
- ## Rails 5.2.4.rc1 (November 22, 2019) ##
1
+ ## Rails 6.0.0.beta1 (January 18, 2019) ##
2
2
 
3
- * No changes.
3
+ * Remove deprecated `fragment_cache_key` helper in favor of `combined_fragment_cache_key`.
4
4
 
5
+ *Rafael Mendonça França*
6
+
7
+ * Remove deprecated methods in `ActionDispatch::TestResponse`.
8
+
9
+ `#success?`, `missing?` and `error?` were deprecated in Rails 5.2 in favor of
10
+ `#successful?`, `not_found?` and `server_error?`.
11
+
12
+ *Rafael Mendonça França*
5
13
 
6
- ## Rails 5.2.3 (March 27, 2019) ##
14
+ * Ensure external redirects are explicitly allowed
7
15
 
8
- * Allow using `public` and `no-cache` together in the the Cache Control header.
16
+ Add `fallback_location` and `allow_other_host` options to `redirect_to`.
9
17
 
10
- Before this change, even if `public` was specified in the Cache Control header,
11
- it was excluded when `no-cache` was included. This change preserves the
12
- `public` value as is.
18
+ *Gannon McGibbon*
13
19
 
14
- Fixes #34780.
20
+ * Introduce ActionDispatch::HostAuthorization
15
21
 
16
- *Yuji Yaginuma*
22
+ This is a new middleware that guards against DNS rebinding attacks by
23
+ white-listing the allowed hosts a request can be made to.
17
24
 
18
- * Allow `nil` params for `ActionController::TestCase`.
25
+ Each host is checked with the case operator (`#===`) to support `RegExp`,
26
+ `Proc`, `IPAddr` and custom objects as host allowances.
19
27
 
20
- *Ryo Nakamura*
28
+ *Genadi Samokovarov*
29
+
30
+ * Allow using `parsed_body` in `ActionController::TestCase`.
31
+
32
+ In addition to `ActionDispatch::IntegrationTest`, allow using
33
+ `parsed_body` in `ActionController::TestCase`:
34
+
35
+ ```
36
+ class SomeControllerTest < ActionController::TestCase
37
+ def test_some_action
38
+ post :action, body: { foo: 'bar' }
39
+ assert_equal({ "foo" => "bar" }, response.parsed_body)
40
+ end
41
+ end
42
+ ```
21
43
 
44
+ Fixes #34676.
22
45
 
23
- ## Rails 5.2.2.1 (March 11, 2019) ##
46
+ *Tobias Bühlmann*
24
47
 
25
- * No changes.
48
+ * Raise an error on root route naming conflicts.
26
49
 
50
+ Raises an ArgumentError when multiple root routes are defined in the
51
+ same context instead of assigning nil names to subsequent roots.
27
52
 
28
- ## Rails 5.2.2 (December 04, 2018) ##
53
+ *Gannon McGibbon*
54
+
55
+ * Allow rescue from parameter parse errors:
56
+
57
+ ```
58
+ rescue_from ActionDispatch::Http::Parameters::ParseError do
59
+ head :unauthorized
60
+ end
61
+ ```
62
+
63
+ *Gannon McGibbon*, *Josh Cheek*
29
64
 
30
65
  * Reset Capybara sessions if failed system test screenshot raising an exception.
31
66
 
@@ -61,402 +96,121 @@
61
96
 
62
97
  *Andrew White*
63
98
 
64
- * Fix `rails routes -c` for controller name consists of multiple word.
65
-
66
- *Yoshiyuki Kinjo*
67
-
68
- * Call the `#redirect_to` block in controller context.
69
-
70
- *Steven Peckins*
99
+ * Add `ActionController::Parameters#each_value`.
71
100
 
101
+ *Lukáš Zapletal*
72
102
 
73
- ## Rails 5.2.1.1 (November 27, 2018) ##
103
+ * Deprecate `ActionDispatch::Http::ParameterFilter` in favor of `ActiveSupport::ParameterFilter`.
74
104
 
75
- * No changes.
76
-
77
-
78
- ## Rails 5.2.1 (August 07, 2018) ##
79
-
80
- * Prevent `?null=` being passed on JSON encoded test requests.
81
-
82
- `RequestEncoder#encode_params` won't attempt to parse params if
83
- there are none.
84
-
85
- So call like this will no longer append a `?null=` query param.
86
-
87
- get foos_url, as: :json
88
-
89
- *Alireza Bashiri*
90
-
91
- * Ensure `ActionController::Parameters#transform_values` and
92
- `ActionController::Parameters#transform_values!` converts hashes into
93
- parameters.
94
-
95
- *Kevin Sjöberg*
96
-
97
- * Fix strong parameters `permit!` with nested arrays.
98
-
99
- Given:
100
- ```
101
- params = ActionController::Parameters.new(nested_arrays: [[{ x: 2, y: 3 }, { x: 21, y: 42 }]])
102
- params.permit!
103
- ```
104
-
105
- `params[:nested_arrays][0][0].permitted?` will now return `true` instead of `false`.
106
-
107
- *Steve Hull*
108
-
109
- * Reset `RAW_POST_DATA` and `CONTENT_LENGTH` request environment between test requests in
110
- `ActionController::TestCase` subclasses.
111
-
112
- *Eugene Kenny*
113
-
114
- * Output only one Content-Security-Policy nonce header value per request.
115
-
116
- Fixes #32597.
117
-
118
- *Andrey Novikov*, *Andrew White*
119
-
120
- * Only disable GPUs for headless Chrome on Windows.
121
-
122
- It is not necessary anymore for Linux and macOS machines.
123
-
124
- https://bugs.chromium.org/p/chromium/issues/detail?id=737678#c1
125
-
126
- *Stefan Wrobel*
127
-
128
- * Fix system tests transactions not closed between examples.
129
-
130
- *Sergey Tarasov*
131
-
132
-
133
- ## Rails 5.2.0 (April 09, 2018) ##
134
-
135
- * Check exclude before flagging cookies as secure.
136
-
137
- *Catherine Khuu*
138
-
139
- * Always yield a CSP policy instance from `content_security_policy`
140
-
141
- This allows a controller action to enable the policy individually
142
- for a controller and/or specific actions.
143
-
144
- *Andrew White*
145
-
146
- * Add the ability to disable the global CSP in a controller, e.g:
147
-
148
- class LegacyPagesController < ApplicationController
149
- content_security_policy false, only: :index
150
- end
151
-
152
- *Andrew White*
153
-
154
- * Add alias method `to_hash` to `to_h` for `cookies`.
155
- Add alias method `to_h` to `to_hash` for `session`.
156
-
157
- *Igor Kasyanchuk*
158
-
159
- * Update the default HSTS max-age value to 31536000 seconds (1 year)
160
- to meet the minimum max-age requirement for https://hstspreload.org/.
161
-
162
- *Grant Bourque*
163
-
164
- * Add support for automatic nonce generation for Rails UJS.
165
-
166
- Because the UJS library creates a script tag to process responses it
167
- normally requires the script-src attribute of the content security
168
- policy to include 'unsafe-inline'.
105
+ *Yoshiyuki Kinjo*
169
106
 
170
- To work around this we generate a per-request nonce value that is
171
- embedded in a meta tag in a similar fashion to how CSRF protection
172
- embeds its token in a meta tag. The UJS library can then read the
173
- nonce value and set it on the dynamically generated script tag to
174
- enable it to execute without needing 'unsafe-inline' enabled.
107
+ * Encode Content-Disposition filenames on `send_data` and `send_file`.
108
+ Previously, `send_data 'data', filename: "\u{3042}.txt"` sends
109
+ `"filename=\"\u{3042}.txt\""` as Content-Disposition and it can be
110
+ garbled.
111
+ Now it follows [RFC 2231](https://tools.ietf.org/html/rfc2231) and
112
+ [RFC 5987](https://tools.ietf.org/html/rfc5987) and sends
113
+ `"filename=\"%3F.txt\"; filename*=UTF-8''%E3%81%82.txt"`.
114
+ Most browsers can find filename correctly and old browsers fallback to ASCII
115
+ converted name.
175
116
 
176
- Nonce generation isn't 100% safe - if your script tag is including
177
- user generated content in someway then it may be possible to exploit
178
- an XSS vulnerability which can take advantage of the nonce. It is
179
- however an improvement on a blanket permission for inline scripts.
117
+ *Fumiaki Matsushima*
180
118
 
181
- It is also possible to use the nonce within your own script tags by
182
- using `nonce: true` to set the nonce value on the tag, e.g
119
+ * Expose `ActionController::Parameters#each_key` which allows iterating over
120
+ keys without allocating an array.
183
121
 
184
- <%= javascript_tag nonce: true do %>
185
- alert('Hello, World!');
186
- <% end %>
122
+ *Richard Schneeman*
187
123
 
188
- Fixes #31689.
124
+ * Purpose metadata for signed/encrypted cookies.
189
125
 
190
- *Andrew White*
126
+ Rails can now thwart attacks that attempt to copy signed/encrypted value
127
+ of a cookie and use it as the value of another cookie.
191
128
 
192
- * Matches behavior of `Hash#each` in `ActionController::Parameters#each`.
129
+ It does so by stashing the cookie-name in the purpose field which is
130
+ then signed/encrypted along with the cookie value. Then, on a server-side
131
+ read, we verify the cookie-names and discard any attacked cookies.
193
132
 
194
- Rails 5.0 introduced a bug when looping through controller params using `each`. Only the keys of params hash were passed to the block, e.g.
133
+ Enable `action_dispatch.use_cookies_with_metadata` to use this feature, which
134
+ writes cookies with the new purpose and expiry metadata embedded.
195
135
 
196
- # Parameters: {"param"=>"1", "param_two"=>"2"}
197
- def index
198
- params.each do |name|
199
- puts name
200
- end
201
- end
202
-
203
- # Prints
204
- # param
205
- # param_two
136
+ *Assain Jaleel*
206
137
 
207
- In Rails 5.2 the bug has been fixed and name will be an array (which was the behavior for all versions prior to 5.0), instead of a string.
138
+ * Raises `ActionController::RespondToMismatchError` with confliciting `respond_to` invocations.
208
139
 
209
- To fix the code above simply change as per example below:
140
+ `respond_to` can match multiple types and lead to undefined behavior when
141
+ multiple invocations are made and the types do not match:
210
142
 
211
- # Parameters: {"param"=>"1", "param_two"=>"2"}
212
- def index
213
- params.each do |name, value|
214
- puts name
143
+ respond_to do |outer_type|
144
+ outer_type.js do
145
+ respond_to do |inner_type|
146
+ inner_type.html { render body: "HTML" }
147
+ end
215
148
  end
216
149
  end
217
150
 
218
- # Prints
219
- # param
220
- # param_two
221
-
222
- *Dominic Cleal*
223
-
224
- * Add `Referrer-Policy` header to default headers set.
151
+ *Patrick Toomey*
225
152
 
226
- *Guillermo Iguaran*
153
+ * `ActionDispatch::Http::UploadedFile` now delegates `to_path` to its tempfile.
227
154
 
228
- * Changed the system tests to set Puma as default server only when the
229
- user haven't specified manually another server.
155
+ This allows uploaded file objects to be passed directly to `File.read`
156
+ without raising a `TypeError`:
230
157
 
231
- *Guillermo Iguaran*
158
+ uploaded_file = ActionDispatch::Http::UploadedFile.new(tempfile: tmp_file)
159
+ File.read(uploaded_file)
232
160
 
233
- * Add secure `X-Download-Options` and `X-Permitted-Cross-Domain-Policies` to
234
- default headers set.
161
+ *Aaron Kromer*
235
162
 
236
- *Guillermo Iguaran*
163
+ * Pass along arguments to underlying `get` method in `follow_redirect!`.
237
164
 
238
- * Add headless firefox support to System Tests.
165
+ Now all arguments passed to `follow_redirect!` are passed to the underlying
166
+ `get` method. This for example allows to set custom headers for the
167
+ redirection request to the server.
239
168
 
240
- *bogdanvlviv*
169
+ follow_redirect!(params: { foo: :bar })
241
170
 
242
- * Changed the default system test screenshot output from `inline` to `simple`.
171
+ *Remo Fritzsche*
243
172
 
244
- `inline` works well for iTerm2 but not everyone uses iTerm2. Some terminals like
245
- Terminal.app ignore the `inline` and output the path to the file since it can't
246
- render the image. Other terminals, like those on Ubuntu, cannot handle the image
247
- inline, but also don't handle it gracefully and instead of outputting the file
248
- path, it dumps binary into the terminal.
173
+ * Introduce a new error page to when the implicit render page is accessed in the browser.
249
174
 
250
- Commit 9d6e28 fixes this by changing the default for screenshot to be `simple`.
175
+ Now instead of showing an error page that with exception and backtraces we now show only
176
+ one informative page.
251
177
 
252
- *Eileen M. Uchitelle*
178
+ *Vinicius Stock*
253
179
 
254
- * Register most popular audio/video/font mime types supported by modern browsers.
180
+ * Introduce `ActionDispatch::DebugExceptions.register_interceptor`.
255
181
 
256
- *Guillermo Iguaran*
182
+ Exception aware plugin authors can use the newly introduced
183
+ `.register_interceptor` method to get the processed exception, instead of
184
+ monkey patching DebugExceptions.
257
185
 
258
- * Fix optimized url helpers when using relative url root.
259
-
260
- Fixes #31220.
261
-
262
- *Andrew White*
263
-
264
- * Add DSL for configuring Content-Security-Policy header.
265
-
266
- The DSL allows you to configure a global Content-Security-Policy
267
- header and then override within a controller. For more information
268
- about the Content-Security-Policy header see MDN:
269
-
270
- https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
271
-
272
- Example global policy:
273
-
274
- # config/initializers/content_security_policy.rb
275
- Rails.application.config.content_security_policy do |p|
276
- p.default_src :self, :https
277
- p.font_src :self, :https, :data
278
- p.img_src :self, :https, :data
279
- p.object_src :none
280
- p.script_src :self, :https
281
- p.style_src :self, :https, :unsafe_inline
282
- end
283
-
284
- Example controller overrides:
285
-
286
- # Override policy inline
287
- class PostsController < ApplicationController
288
- content_security_policy do |p|
289
- p.upgrade_insecure_requests true
290
- end
291
- end
292
-
293
- # Using literal values
294
- class PostsController < ApplicationController
295
- content_security_policy do |p|
296
- p.base_uri "https://www.example.com"
297
- end
298
- end
299
-
300
- # Using mixed static and dynamic values
301
- class PostsController < ApplicationController
302
- content_security_policy do |p|
303
- p.base_uri :self, -> { "https://#{current_user.domain}.example.com" }
304
- end
305
- end
306
-
307
- Allows you to also only report content violations for migrating
308
- legacy content using the `content_security_policy_report_only`
309
- configuration attribute, e.g;
310
-
311
- # config/initializers/content_security_policy.rb
312
- Rails.application.config.content_security_policy_report_only = true
313
-
314
- # controller override
315
- class PostsController < ApplicationController
316
- content_security_policy_report_only only: :index
186
+ ActionDispatch::DebugExceptions.register_interceptor do |request, exception|
187
+ HypoteticalPlugin.capture_exception(request, exception)
317
188
  end
318
189
 
319
- Note that this feature does not validate the header for performance
320
- reasons since the header is calculated at runtime.
321
-
322
- *Andrew White*
323
-
324
- * Make `assert_recognizes` to traverse mounted engines.
325
-
326
- *Yuichiro Kaneko*
327
-
328
- * Remove deprecated `ActionController::ParamsParser::ParseError`.
329
-
330
- *Rafael Mendonça França*
331
-
332
- * Add `:allow_other_host` option to `redirect_back` method.
333
-
334
- When `allow_other_host` is set to `false`, the `redirect_back` will not allow redirecting from a
335
- different host. `allow_other_host` is `true` by default.
336
-
337
- *Tim Masliuchenko*
338
-
339
- * Add headless chrome support to System Tests.
340
-
341
- *Yuji Yaginuma*
342
-
343
- * Add ability to enable Early Hints for HTTP/2
344
-
345
- If supported by the server, and enabled in Puma this allows H2 Early Hints to be used.
346
-
347
- The `javascript_include_tag` and the `stylesheet_link_tag` automatically add Early Hints if requested.
348
-
349
- *Eileen M. Uchitelle*, *Aaron Patterson*
190
+ *Genadi Samokovarov*
350
191
 
351
- * Simplify cookies middleware with key rotation support
352
-
353
- Use the `rotate` method for both `MessageEncryptor` and
354
- `MessageVerifier` to add key rotation support for encrypted and
355
- signed cookies. This also helps simplify support for legacy cookie
356
- security.
357
-
358
- *Michael J Coyne*
359
-
360
- * Use Capybara registered `:puma` server config.
361
-
362
- The Capybara registered `:puma` server ensures the puma server is run in process so
363
- connection sharing and open request detection work correctly by default.
364
-
365
- *Thomas Walpole*
366
-
367
- * Cookies `:expires` option supports `ActiveSupport::Duration` object.
368
-
369
- cookies[:user_name] = { value: "assain", expires: 1.hour }
370
- cookies[:key] = { value: "a yummy cookie", expires: 6.months }
371
-
372
- Pull Request: #30121
373
-
374
- *Assain Jaleel*
375
-
376
- * Enforce signed/encrypted cookie expiry server side.
377
-
378
- Rails can thwart attacks by malicious clients that don't honor a cookie's expiry.
379
-
380
- It does so by stashing the expiry within the written cookie and relying on the
381
- signing/encrypting to vouch that it hasn't been tampered with. Then on a
382
- server-side read, the expiry is verified and any expired cookie is discarded.
383
-
384
- Pull Request: #30121
385
-
386
- *Assain Jaleel*
387
-
388
- * Make `take_failed_screenshot` work within engine.
389
-
390
- Fixes #30405.
391
-
392
- *Yuji Yaginuma*
393
-
394
- * Deprecate `ActionDispatch::TestResponse` response aliases.
395
-
396
- `#success?`, `#missing?` & `#error?` are not supported by the actual
397
- `ActionDispatch::Response` object and can produce false-positives. Instead,
398
- use the response helpers provided by `Rack::Response`.
399
-
400
- *Trevor Wistaff*
401
-
402
- * Protect from forgery by default
403
-
404
- Rather than protecting from forgery in the generated `ApplicationController`,
405
- add it to `ActionController::Base` depending on
406
- `config.action_controller.default_protect_from_forgery`. This configuration
407
- defaults to false to support older versions which have removed it from their
408
- `ApplicationController`, but is set to true for Rails 5.2.
409
-
410
- *Lisa Ugray*
411
-
412
- * Fallback `ActionController::Parameters#to_s` to `Hash#to_s`.
413
-
414
- *Kir Shatrov*
415
-
416
- * `driven_by` now registers poltergeist and capybara-webkit.
417
-
418
- If poltergeist or capybara-webkit are set as drivers is set for System Tests,
419
- `driven_by` will register the driver and set additional options passed via
420
- the `:options` parameter.
421
-
422
- Refer to the respective driver's documentation to see what options can be passed.
423
-
424
- *Mario Chavez*
425
-
426
- * AEAD encrypted cookies and sessions with GCM.
427
-
428
- Encrypted cookies now use AES-GCM which couples authentication and
429
- encryption in one faster step and produces shorter ciphertexts. Cookies
430
- encrypted using AES in CBC HMAC mode will be seamlessly upgraded when
431
- this new mode is enabled via the
432
- `action_dispatch.use_authenticated_cookie_encryption` configuration value.
433
-
434
- *Michael J Coyne*
192
+ * Output only one Content-Security-Policy nonce header value per request.
435
193
 
436
- * Change the cache key format for fragments to make it easier to debug key churn. The new format is:
194
+ Fixes #32597.
437
195
 
438
- views/template/action.html.erb:7a1156131a6928cb0026877f8b749ac9/projects/123
439
- ^template path ^template tree digest ^class ^id
196
+ *Andrey Novikov*, *Andrew White*
440
197
 
441
- *DHH*
198
+ * Move default headers configuration into their own module that can be included in controllers.
442
199
 
443
- * Add support for recyclable cache keys with fragment caching. This uses the new versioned entries in the
444
- `ActiveSupport::Cache` stores and relies on the fact that Active Record has split `#cache_key` and `#cache_version`
445
- to support it.
200
+ *Kevin Deisz*
446
201
 
447
- *DHH*
202
+ * Add method `dig` to `session`.
448
203
 
449
- * Add `action_controller_api` and `action_controller_base` load hooks to be called in `ActiveSupport.on_load`
204
+ *claudiob*, *Takumi Shotoku*
450
205
 
451
- `ActionController::Base` and `ActionController::API` have differing implementations. This means that
452
- the one umbrella hook `action_controller` is not able to address certain situations where a method
453
- may not exist in a certain implementation.
206
+ * Controller level `force_ssl` has been deprecated in favor of
207
+ `config.force_ssl`.
454
208
 
455
- This is fixed by adding two new hooks so you can target `ActionController::Base` vs `ActionController::API`
209
+ *Derek Prior*
456
210
 
457
- Fixes #27013.
211
+ * Rails 6 requires Ruby 2.5.0 or newer.
458
212
 
459
- *Julian Nadeau*
213
+ *Jeremy Daer*, *Kasper Timm Hansen*
460
214
 
461
215
 
462
- Please check [5-1-stable](https://github.com/rails/rails/blob/5-1-stable/actionpack/CHANGELOG.md) for previous changes.
216
+ Please check [5-2-stable](https://github.com/rails/rails/blob/5-2-stable/actionpack/CHANGELOG.md) for previous changes.