actionpack 5.2.6 → 6.0.0.beta1
Sign up to get free protection for your applications and to get access to all the features.
Potentially problematic release.
This version of actionpack might be problematic. Click here for more details.
- checksums.yaml +4 -4
- data/CHANGELOG.md +110 -444
- data/MIT-LICENSE +1 -1
- data/README.rdoc +1 -1
- data/lib/abstract_controller/base.rb +4 -2
- data/lib/abstract_controller/caching/fragments.rb +6 -21
- data/lib/abstract_controller/callbacks.rb +12 -0
- data/lib/abstract_controller/collector.rb +1 -1
- data/lib/abstract_controller/helpers.rb +2 -2
- data/lib/abstract_controller/railties/routes_helpers.rb +1 -1
- data/lib/action_controller.rb +1 -0
- data/lib/action_controller/api.rb +2 -1
- data/lib/action_controller/base.rb +2 -7
- data/lib/action_controller/caching.rb +1 -1
- data/lib/action_controller/log_subscriber.rb +8 -5
- data/lib/action_controller/metal.rb +2 -2
- data/lib/action_controller/metal/conditional_get.rb +9 -3
- data/lib/action_controller/metal/data_streaming.rb +5 -6
- data/lib/action_controller/metal/default_headers.rb +17 -0
- data/lib/action_controller/metal/exceptions.rb +22 -1
- data/lib/action_controller/metal/flash.rb +5 -5
- data/lib/action_controller/metal/force_ssl.rb +17 -57
- data/lib/action_controller/metal/head.rb +1 -1
- data/lib/action_controller/metal/helpers.rb +1 -2
- data/lib/action_controller/metal/http_authentication.rb +21 -22
- data/lib/action_controller/metal/implicit_render.rb +2 -12
- data/lib/action_controller/metal/instrumentation.rb +3 -5
- data/lib/action_controller/metal/live.rb +28 -26
- data/lib/action_controller/metal/mime_responds.rb +13 -2
- data/lib/action_controller/metal/params_wrapper.rb +18 -14
- data/lib/action_controller/metal/redirecting.rb +32 -11
- data/lib/action_controller/metal/rendering.rb +1 -1
- data/lib/action_controller/metal/request_forgery_protection.rb +32 -97
- data/lib/action_controller/metal/strong_parameters.rb +57 -34
- data/lib/action_controller/metal/url_for.rb +1 -1
- data/lib/action_controller/railties/helpers.rb +1 -1
- data/lib/action_controller/renderer.rb +15 -2
- data/lib/action_controller/test_case.rb +5 -9
- data/lib/action_dispatch.rb +7 -6
- data/lib/action_dispatch/http/cache.rb +14 -10
- data/lib/action_dispatch/http/content_disposition.rb +45 -0
- data/lib/action_dispatch/http/content_security_policy.rb +9 -8
- data/lib/action_dispatch/http/filter_parameters.rb +8 -6
- data/lib/action_dispatch/http/filter_redirect.rb +1 -1
- data/lib/action_dispatch/http/headers.rb +1 -1
- data/lib/action_dispatch/http/mime_negotiation.rb +7 -10
- data/lib/action_dispatch/http/mime_type.rb +1 -5
- data/lib/action_dispatch/http/parameter_filter.rb +5 -79
- data/lib/action_dispatch/http/parameters.rb +13 -3
- data/lib/action_dispatch/http/request.rb +10 -13
- data/lib/action_dispatch/http/response.rb +14 -14
- data/lib/action_dispatch/http/upload.rb +5 -0
- data/lib/action_dispatch/http/url.rb +81 -81
- data/lib/action_dispatch/journey/formatter.rb +1 -1
- data/lib/action_dispatch/journey/nfa/simulator.rb +0 -2
- data/lib/action_dispatch/journey/nodes/node.rb +9 -8
- data/lib/action_dispatch/journey/path/pattern.rb +3 -4
- data/lib/action_dispatch/journey/router.rb +0 -3
- data/lib/action_dispatch/journey/router/utils.rb +10 -10
- data/lib/action_dispatch/journey/scanner.rb +11 -4
- data/lib/action_dispatch/journey/visitors.rb +1 -1
- data/lib/action_dispatch/middleware/callbacks.rb +2 -4
- data/lib/action_dispatch/middleware/cookies.rb +49 -70
- data/lib/action_dispatch/middleware/debug_exceptions.rb +32 -58
- data/lib/action_dispatch/middleware/debug_locks.rb +5 -5
- data/lib/action_dispatch/middleware/debug_view.rb +50 -0
- data/lib/action_dispatch/middleware/exception_wrapper.rb +36 -7
- data/lib/action_dispatch/middleware/flash.rb +1 -1
- data/lib/action_dispatch/middleware/host_authorization.rb +103 -0
- data/lib/action_dispatch/middleware/remote_ip.rb +6 -8
- data/lib/action_dispatch/middleware/request_id.rb +2 -2
- data/lib/action_dispatch/middleware/session/abstract_store.rb +0 -14
- data/lib/action_dispatch/middleware/session/cache_store.rb +6 -11
- data/lib/action_dispatch/middleware/session/cookie_store.rb +11 -27
- data/lib/action_dispatch/middleware/ssl.rb +8 -8
- data/lib/action_dispatch/middleware/stack.rb +2 -2
- data/lib/action_dispatch/middleware/static.rb +5 -6
- data/lib/action_dispatch/middleware/templates/rescues/_source.html.erb +4 -2
- data/lib/action_dispatch/middleware/templates/rescues/_trace.html.erb +45 -35
- data/lib/action_dispatch/middleware/templates/rescues/blocked_host.html.erb +7 -0
- data/lib/action_dispatch/middleware/templates/rescues/blocked_host.text.erb +5 -0
- data/lib/action_dispatch/middleware/templates/rescues/diagnostics.html.erb +20 -2
- data/lib/action_dispatch/middleware/templates/rescues/invalid_statement.html.erb +4 -4
- data/lib/action_dispatch/middleware/templates/rescues/invalid_statement.text.erb +2 -2
- data/lib/action_dispatch/middleware/templates/rescues/missing_exact_template.html.erb +19 -0
- data/lib/action_dispatch/middleware/templates/rescues/missing_exact_template.text.erb +3 -0
- data/lib/action_dispatch/middleware/templates/rescues/missing_template.html.erb +2 -2
- data/lib/action_dispatch/middleware/templates/rescues/routing_error.html.erb +1 -1
- data/lib/action_dispatch/middleware/templates/rescues/template_error.html.erb +2 -2
- data/lib/action_dispatch/middleware/templates/routes/_table.html.erb +3 -0
- data/lib/action_dispatch/railtie.rb +1 -0
- data/lib/action_dispatch/request/session.rb +8 -6
- data/lib/action_dispatch/routing.rb +3 -2
- data/lib/action_dispatch/routing/inspector.rb +99 -50
- data/lib/action_dispatch/routing/mapper.rb +36 -29
- data/lib/action_dispatch/routing/polymorphic_routes.rb +7 -12
- data/lib/action_dispatch/routing/route_set.rb +11 -12
- data/lib/action_dispatch/routing/url_for.rb +1 -0
- data/lib/action_dispatch/system_testing/test_helpers/screenshot_helper.rb +3 -3
- data/lib/action_dispatch/testing/assertions/response.rb +2 -3
- data/lib/action_dispatch/testing/assertions/routing.rb +7 -2
- data/lib/action_dispatch/testing/integration.rb +11 -5
- data/lib/action_dispatch/testing/test_process.rb +2 -2
- data/lib/action_dispatch/testing/test_response.rb +4 -32
- data/lib/action_pack.rb +1 -1
- data/lib/action_pack/gem_version.rb +4 -4
- metadata +22 -20
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: df5b083c08009f1025bfbf541400a4819b5620f5bb49aa3d4bbe0c056eae44b3
|
4
|
+
data.tar.gz: '0374579e1273c1d727e0bc94d7a73b3933d8c0f54e7196beedc61ea30d88209f'
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: cb0e467dc8c10baa42df2d08d79b2f5caedad996d247523abf54713a542f6d49a01f120ca0b0faa6930ea89592bfe074979201adec97d33135a5877391a5d4bb
|
7
|
+
data.tar.gz: dee5cf35ce9af7e795d65bb2a44d5edb229439f5fbde0dde1c35e8d3cf2564c49ddf929a9d5499b3aa6248c42cf6f61ca2c75c85a623ba51f1dd6106750d3267
|
data/CHANGELOG.md
CHANGED
@@ -1,119 +1,66 @@
|
|
1
|
-
## Rails
|
1
|
+
## Rails 6.0.0.beta1 (January 18, 2019) ##
|
2
2
|
|
3
|
-
*
|
4
|
-
|
5
|
-
Base64 strict-encoded CSRF tokens are not inherently websafe, which makes
|
6
|
-
them difficult to deal with. For example, the common practice of sending
|
7
|
-
the CSRF token to a browser in a client-readable cookie does not work properly
|
8
|
-
out of the box: the value has to be url-encoded and decoded to survive transport.
|
9
|
-
|
10
|
-
In this version, we generate Base64 urlsafe-encoded CSRF tokens, which are inherently
|
11
|
-
safe to transport. Validation accepts both urlsafe tokens, and strict-encoded
|
12
|
-
tokens for backwards compatibility.
|
13
|
-
|
14
|
-
How the tokes are encoded is controllr by the `action_controller.urlsafe_csrf_tokens`
|
15
|
-
config.
|
16
|
-
|
17
|
-
In Rails 5.2.5, the CSRF token format was accidentally changed to urlsafe-encoded.
|
18
|
-
|
19
|
-
**Atention**: If you already upgraded your application to 5.2.5, set the config
|
20
|
-
`urlsafe_csrf_tokens` to `true`, otherwise your form submission will start to fail
|
21
|
-
during the deploy of this new version.
|
22
|
-
|
23
|
-
```ruby
|
24
|
-
Rails.application.config.action_controller.urlsafe_csrf_tokens = true
|
25
|
-
```
|
26
|
-
|
27
|
-
If you are upgrading from 5.2.4.x, you don't need to change this configuration.
|
28
|
-
|
29
|
-
*Scott Blum*, *Étienne Barrié*
|
30
|
-
|
31
|
-
|
32
|
-
## Rails 5.2.5 (March 26, 2021) ##
|
33
|
-
|
34
|
-
* No changes.
|
3
|
+
* Remove deprecated `fragment_cache_key` helper in favor of `combined_fragment_cache_key`.
|
35
4
|
|
5
|
+
*Rafael Mendonça França*
|
36
6
|
|
37
|
-
|
7
|
+
* Remove deprecated methods in `ActionDispatch::TestResponse`.
|
38
8
|
|
39
|
-
|
40
|
-
|
9
|
+
`#success?`, `missing?` and `error?` were deprecated in Rails 5.2 in favor of
|
10
|
+
`#successful?`, `not_found?` and `server_error?`.
|
41
11
|
|
42
|
-
*
|
12
|
+
*Rafael Mendonça França*
|
43
13
|
|
44
|
-
|
45
|
-
of arguments (usually symbols and records). If a developer passes a
|
46
|
-
user input array, strings can result in unwanted route helper calls.
|
14
|
+
* Ensure external redirects are explicitly allowed
|
47
15
|
|
48
|
-
|
16
|
+
Add `fallback_location` and `allow_other_host` options to `redirect_to`.
|
49
17
|
|
50
18
|
*Gannon McGibbon*
|
51
19
|
|
52
|
-
|
53
|
-
|
54
|
-
* No changes.
|
55
|
-
|
56
|
-
|
57
|
-
## Rails 5.2.4.4 (September 09, 2020) ##
|
58
|
-
|
59
|
-
* No changes.
|
60
|
-
|
61
|
-
|
62
|
-
## Rails 5.2.4.3 (May 18, 2020) ##
|
63
|
-
|
64
|
-
* [CVE-2020-8166] HMAC raw CSRF token before masking it, so it cannot be used to reconstruct a per-form token
|
65
|
-
|
66
|
-
* [CVE-2020-8164] Return self when calling #each, #each_pair, and #each_value instead of the raw @parameters hash
|
20
|
+
* Introduce ActionDispatch::HostAuthorization
|
67
21
|
|
22
|
+
This is a new middleware that guards against DNS rebinding attacks by
|
23
|
+
white-listing the allowed hosts a request can be made to.
|
68
24
|
|
69
|
-
|
25
|
+
Each host is checked with the case operator (`#===`) to support `RegExp`,
|
26
|
+
`Proc`, `IPAddr` and custom objects as host allowances.
|
70
27
|
|
71
|
-
*
|
28
|
+
*Genadi Samokovarov*
|
72
29
|
|
30
|
+
* Allow using `parsed_body` in `ActionController::TestCase`.
|
73
31
|
|
74
|
-
|
32
|
+
In addition to `ActionDispatch::IntegrationTest`, allow using
|
33
|
+
`parsed_body` in `ActionController::TestCase`:
|
75
34
|
|
76
|
-
|
77
|
-
|
78
|
-
|
79
|
-
|
80
|
-
|
81
|
-
|
82
|
-
|
83
|
-
|
84
|
-
ruby 2.2 (see https://github.com/rails/rails/commit/2a52a38cb51b65d71cf91fc960777213cf96f962#commitcomment-37929811)
|
85
|
-
|
86
|
-
CVE-2019-16782.
|
87
|
-
|
88
|
-
|
89
|
-
## Rails 5.2.4 (November 27, 2019) ##
|
90
|
-
|
91
|
-
* No changes.
|
92
|
-
|
93
|
-
|
94
|
-
## Rails 5.2.3 (March 27, 2019) ##
|
95
|
-
|
96
|
-
* Allow using `public` and `no-cache` together in the the Cache Control header.
|
97
|
-
|
98
|
-
Before this change, even if `public` was specified in the Cache Control header,
|
99
|
-
it was excluded when `no-cache` was included. This change preserves the
|
100
|
-
`public` value as is.
|
101
|
-
|
102
|
-
Fixes #34780.
|
35
|
+
```
|
36
|
+
class SomeControllerTest < ActionController::TestCase
|
37
|
+
def test_some_action
|
38
|
+
post :action, body: { foo: 'bar' }
|
39
|
+
assert_equal({ "foo" => "bar" }, response.parsed_body)
|
40
|
+
end
|
41
|
+
end
|
42
|
+
```
|
103
43
|
|
104
|
-
|
44
|
+
Fixes #34676.
|
105
45
|
|
106
|
-
*
|
46
|
+
*Tobias Bühlmann*
|
107
47
|
|
108
|
-
|
48
|
+
* Raise an error on root route naming conflicts.
|
109
49
|
|
50
|
+
Raises an ArgumentError when multiple root routes are defined in the
|
51
|
+
same context instead of assigning nil names to subsequent roots.
|
110
52
|
|
111
|
-
|
53
|
+
*Gannon McGibbon*
|
112
54
|
|
113
|
-
*
|
55
|
+
* Allow rescue from parameter parse errors:
|
114
56
|
|
57
|
+
```
|
58
|
+
rescue_from ActionDispatch::Http::Parameters::ParseError do
|
59
|
+
head :unauthorized
|
60
|
+
end
|
61
|
+
```
|
115
62
|
|
116
|
-
|
63
|
+
*Gannon McGibbon*, *Josh Cheek*
|
117
64
|
|
118
65
|
* Reset Capybara sessions if failed system test screenshot raising an exception.
|
119
66
|
|
@@ -149,402 +96,121 @@
|
|
149
96
|
|
150
97
|
*Andrew White*
|
151
98
|
|
152
|
-
*
|
153
|
-
|
154
|
-
*Yoshiyuki Kinjo*
|
155
|
-
|
156
|
-
* Call the `#redirect_to` block in controller context.
|
157
|
-
|
158
|
-
*Steven Peckins*
|
159
|
-
|
160
|
-
|
161
|
-
## Rails 5.2.1.1 (November 27, 2018) ##
|
162
|
-
|
163
|
-
* No changes.
|
164
|
-
|
165
|
-
|
166
|
-
## Rails 5.2.1 (August 07, 2018) ##
|
167
|
-
|
168
|
-
* Prevent `?null=` being passed on JSON encoded test requests.
|
169
|
-
|
170
|
-
`RequestEncoder#encode_params` won't attempt to parse params if
|
171
|
-
there are none.
|
172
|
-
|
173
|
-
So call like this will no longer append a `?null=` query param.
|
174
|
-
|
175
|
-
get foos_url, as: :json
|
176
|
-
|
177
|
-
*Alireza Bashiri*
|
178
|
-
|
179
|
-
* Ensure `ActionController::Parameters#transform_values` and
|
180
|
-
`ActionController::Parameters#transform_values!` converts hashes into
|
181
|
-
parameters.
|
182
|
-
|
183
|
-
*Kevin Sjöberg*
|
184
|
-
|
185
|
-
* Fix strong parameters `permit!` with nested arrays.
|
186
|
-
|
187
|
-
Given:
|
188
|
-
```
|
189
|
-
params = ActionController::Parameters.new(nested_arrays: [[{ x: 2, y: 3 }, { x: 21, y: 42 }]])
|
190
|
-
params.permit!
|
191
|
-
```
|
192
|
-
|
193
|
-
`params[:nested_arrays][0][0].permitted?` will now return `true` instead of `false`.
|
194
|
-
|
195
|
-
*Steve Hull*
|
196
|
-
|
197
|
-
* Reset `RAW_POST_DATA` and `CONTENT_LENGTH` request environment between test requests in
|
198
|
-
`ActionController::TestCase` subclasses.
|
199
|
-
|
200
|
-
*Eugene Kenny*
|
201
|
-
|
202
|
-
* Output only one Content-Security-Policy nonce header value per request.
|
203
|
-
|
204
|
-
Fixes #32597.
|
205
|
-
|
206
|
-
*Andrey Novikov*, *Andrew White*
|
207
|
-
|
208
|
-
* Only disable GPUs for headless Chrome on Windows.
|
209
|
-
|
210
|
-
It is not necessary anymore for Linux and macOS machines.
|
211
|
-
|
212
|
-
https://bugs.chromium.org/p/chromium/issues/detail?id=737678#c1
|
213
|
-
|
214
|
-
*Stefan Wrobel*
|
215
|
-
|
216
|
-
* Fix system tests transactions not closed between examples.
|
217
|
-
|
218
|
-
*Sergey Tarasov*
|
219
|
-
|
220
|
-
|
221
|
-
## Rails 5.2.0 (April 09, 2018) ##
|
222
|
-
|
223
|
-
* Check exclude before flagging cookies as secure.
|
224
|
-
|
225
|
-
*Catherine Khuu*
|
226
|
-
|
227
|
-
* Always yield a CSP policy instance from `content_security_policy`
|
228
|
-
|
229
|
-
This allows a controller action to enable the policy individually
|
230
|
-
for a controller and/or specific actions.
|
231
|
-
|
232
|
-
*Andrew White*
|
233
|
-
|
234
|
-
* Add the ability to disable the global CSP in a controller, e.g:
|
235
|
-
|
236
|
-
class LegacyPagesController < ApplicationController
|
237
|
-
content_security_policy false, only: :index
|
238
|
-
end
|
239
|
-
|
240
|
-
*Andrew White*
|
99
|
+
* Add `ActionController::Parameters#each_value`.
|
241
100
|
|
242
|
-
*
|
243
|
-
Add alias method `to_h` to `to_hash` for `session`.
|
101
|
+
*Lukáš Zapletal*
|
244
102
|
|
245
|
-
|
103
|
+
* Deprecate `ActionDispatch::Http::ParameterFilter` in favor of `ActiveSupport::ParameterFilter`.
|
246
104
|
|
247
|
-
*
|
248
|
-
to meet the minimum max-age requirement for https://hstspreload.org/.
|
249
|
-
|
250
|
-
*Grant Bourque*
|
251
|
-
|
252
|
-
* Add support for automatic nonce generation for Rails UJS.
|
253
|
-
|
254
|
-
Because the UJS library creates a script tag to process responses it
|
255
|
-
normally requires the script-src attribute of the content security
|
256
|
-
policy to include 'unsafe-inline'.
|
105
|
+
*Yoshiyuki Kinjo*
|
257
106
|
|
258
|
-
|
259
|
-
|
260
|
-
|
261
|
-
|
262
|
-
|
107
|
+
* Encode Content-Disposition filenames on `send_data` and `send_file`.
|
108
|
+
Previously, `send_data 'data', filename: "\u{3042}.txt"` sends
|
109
|
+
`"filename=\"\u{3042}.txt\""` as Content-Disposition and it can be
|
110
|
+
garbled.
|
111
|
+
Now it follows [RFC 2231](https://tools.ietf.org/html/rfc2231) and
|
112
|
+
[RFC 5987](https://tools.ietf.org/html/rfc5987) and sends
|
113
|
+
`"filename=\"%3F.txt\"; filename*=UTF-8''%E3%81%82.txt"`.
|
114
|
+
Most browsers can find filename correctly and old browsers fallback to ASCII
|
115
|
+
converted name.
|
263
116
|
|
264
|
-
|
265
|
-
user generated content in someway then it may be possible to exploit
|
266
|
-
an XSS vulnerability which can take advantage of the nonce. It is
|
267
|
-
however an improvement on a blanket permission for inline scripts.
|
117
|
+
*Fumiaki Matsushima*
|
268
118
|
|
269
|
-
|
270
|
-
|
119
|
+
* Expose `ActionController::Parameters#each_key` which allows iterating over
|
120
|
+
keys without allocating an array.
|
271
121
|
|
272
|
-
|
273
|
-
alert('Hello, World!');
|
274
|
-
<% end %>
|
122
|
+
*Richard Schneeman*
|
275
123
|
|
276
|
-
|
124
|
+
* Purpose metadata for signed/encrypted cookies.
|
277
125
|
|
278
|
-
|
126
|
+
Rails can now thwart attacks that attempt to copy signed/encrypted value
|
127
|
+
of a cookie and use it as the value of another cookie.
|
279
128
|
|
280
|
-
|
129
|
+
It does so by stashing the cookie-name in the purpose field which is
|
130
|
+
then signed/encrypted along with the cookie value. Then, on a server-side
|
131
|
+
read, we verify the cookie-names and discard any attacked cookies.
|
281
132
|
|
282
|
-
|
133
|
+
Enable `action_dispatch.use_cookies_with_metadata` to use this feature, which
|
134
|
+
writes cookies with the new purpose and expiry metadata embedded.
|
283
135
|
|
284
|
-
|
285
|
-
def index
|
286
|
-
params.each do |name|
|
287
|
-
puts name
|
288
|
-
end
|
289
|
-
end
|
290
|
-
|
291
|
-
# Prints
|
292
|
-
# param
|
293
|
-
# param_two
|
136
|
+
*Assain Jaleel*
|
294
137
|
|
295
|
-
|
138
|
+
* Raises `ActionController::RespondToMismatchError` with confliciting `respond_to` invocations.
|
296
139
|
|
297
|
-
|
140
|
+
`respond_to` can match multiple types and lead to undefined behavior when
|
141
|
+
multiple invocations are made and the types do not match:
|
298
142
|
|
299
|
-
|
300
|
-
|
301
|
-
|
302
|
-
|
143
|
+
respond_to do |outer_type|
|
144
|
+
outer_type.js do
|
145
|
+
respond_to do |inner_type|
|
146
|
+
inner_type.html { render body: "HTML" }
|
147
|
+
end
|
303
148
|
end
|
304
149
|
end
|
305
150
|
|
306
|
-
|
307
|
-
# param
|
308
|
-
# param_two
|
309
|
-
|
310
|
-
*Dominic Cleal*
|
311
|
-
|
312
|
-
* Add `Referrer-Policy` header to default headers set.
|
151
|
+
*Patrick Toomey*
|
313
152
|
|
314
|
-
|
153
|
+
* `ActionDispatch::Http::UploadedFile` now delegates `to_path` to its tempfile.
|
315
154
|
|
316
|
-
|
317
|
-
|
155
|
+
This allows uploaded file objects to be passed directly to `File.read`
|
156
|
+
without raising a `TypeError`:
|
318
157
|
|
319
|
-
|
158
|
+
uploaded_file = ActionDispatch::Http::UploadedFile.new(tempfile: tmp_file)
|
159
|
+
File.read(uploaded_file)
|
320
160
|
|
321
|
-
*
|
322
|
-
default headers set.
|
161
|
+
*Aaron Kromer*
|
323
162
|
|
324
|
-
|
163
|
+
* Pass along arguments to underlying `get` method in `follow_redirect!`.
|
325
164
|
|
326
|
-
|
165
|
+
Now all arguments passed to `follow_redirect!` are passed to the underlying
|
166
|
+
`get` method. This for example allows to set custom headers for the
|
167
|
+
redirection request to the server.
|
327
168
|
|
328
|
-
|
169
|
+
follow_redirect!(params: { foo: :bar })
|
329
170
|
|
330
|
-
*
|
171
|
+
*Remo Fritzsche*
|
331
172
|
|
332
|
-
|
333
|
-
Terminal.app ignore the `inline` and output the path to the file since it can't
|
334
|
-
render the image. Other terminals, like those on Ubuntu, cannot handle the image
|
335
|
-
inline, but also don't handle it gracefully and instead of outputting the file
|
336
|
-
path, it dumps binary into the terminal.
|
173
|
+
* Introduce a new error page to when the implicit render page is accessed in the browser.
|
337
174
|
|
338
|
-
|
175
|
+
Now instead of showing an error page that with exception and backtraces we now show only
|
176
|
+
one informative page.
|
339
177
|
|
340
|
-
*
|
178
|
+
*Vinicius Stock*
|
341
179
|
|
342
|
-
*
|
180
|
+
* Introduce `ActionDispatch::DebugExceptions.register_interceptor`.
|
343
181
|
|
344
|
-
|
182
|
+
Exception aware plugin authors can use the newly introduced
|
183
|
+
`.register_interceptor` method to get the processed exception, instead of
|
184
|
+
monkey patching DebugExceptions.
|
345
185
|
|
346
|
-
|
347
|
-
|
348
|
-
Fixes #31220.
|
349
|
-
|
350
|
-
*Andrew White*
|
351
|
-
|
352
|
-
* Add DSL for configuring Content-Security-Policy header.
|
353
|
-
|
354
|
-
The DSL allows you to configure a global Content-Security-Policy
|
355
|
-
header and then override within a controller. For more information
|
356
|
-
about the Content-Security-Policy header see MDN:
|
357
|
-
|
358
|
-
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
|
359
|
-
|
360
|
-
Example global policy:
|
361
|
-
|
362
|
-
# config/initializers/content_security_policy.rb
|
363
|
-
Rails.application.config.content_security_policy do |p|
|
364
|
-
p.default_src :self, :https
|
365
|
-
p.font_src :self, :https, :data
|
366
|
-
p.img_src :self, :https, :data
|
367
|
-
p.object_src :none
|
368
|
-
p.script_src :self, :https
|
369
|
-
p.style_src :self, :https, :unsafe_inline
|
186
|
+
ActionDispatch::DebugExceptions.register_interceptor do |request, exception|
|
187
|
+
HypoteticalPlugin.capture_exception(request, exception)
|
370
188
|
end
|
371
189
|
|
372
|
-
|
373
|
-
|
374
|
-
# Override policy inline
|
375
|
-
class PostsController < ApplicationController
|
376
|
-
content_security_policy do |p|
|
377
|
-
p.upgrade_insecure_requests true
|
378
|
-
end
|
379
|
-
end
|
380
|
-
|
381
|
-
# Using literal values
|
382
|
-
class PostsController < ApplicationController
|
383
|
-
content_security_policy do |p|
|
384
|
-
p.base_uri "https://www.example.com"
|
385
|
-
end
|
386
|
-
end
|
387
|
-
|
388
|
-
# Using mixed static and dynamic values
|
389
|
-
class PostsController < ApplicationController
|
390
|
-
content_security_policy do |p|
|
391
|
-
p.base_uri :self, -> { "https://#{current_user.domain}.example.com" }
|
392
|
-
end
|
393
|
-
end
|
394
|
-
|
395
|
-
Allows you to also only report content violations for migrating
|
396
|
-
legacy content using the `content_security_policy_report_only`
|
397
|
-
configuration attribute, e.g;
|
398
|
-
|
399
|
-
# config/initializers/content_security_policy.rb
|
400
|
-
Rails.application.config.content_security_policy_report_only = true
|
401
|
-
|
402
|
-
# controller override
|
403
|
-
class PostsController < ApplicationController
|
404
|
-
content_security_policy_report_only only: :index
|
405
|
-
end
|
406
|
-
|
407
|
-
Note that this feature does not validate the header for performance
|
408
|
-
reasons since the header is calculated at runtime.
|
409
|
-
|
410
|
-
*Andrew White*
|
411
|
-
|
412
|
-
* Make `assert_recognizes` to traverse mounted engines.
|
413
|
-
|
414
|
-
*Yuichiro Kaneko*
|
415
|
-
|
416
|
-
* Remove deprecated `ActionController::ParamsParser::ParseError`.
|
417
|
-
|
418
|
-
*Rafael Mendonça França*
|
419
|
-
|
420
|
-
* Add `:allow_other_host` option to `redirect_back` method.
|
421
|
-
|
422
|
-
When `allow_other_host` is set to `false`, the `redirect_back` will not allow redirecting from a
|
423
|
-
different host. `allow_other_host` is `true` by default.
|
424
|
-
|
425
|
-
*Tim Masliuchenko*
|
190
|
+
*Genadi Samokovarov*
|
426
191
|
|
427
|
-
*
|
428
|
-
|
429
|
-
*Yuji Yaginuma*
|
430
|
-
|
431
|
-
* Add ability to enable Early Hints for HTTP/2
|
432
|
-
|
433
|
-
If supported by the server, and enabled in Puma this allows H2 Early Hints to be used.
|
434
|
-
|
435
|
-
The `javascript_include_tag` and the `stylesheet_link_tag` automatically add Early Hints if requested.
|
436
|
-
|
437
|
-
*Eileen M. Uchitelle*, *Aaron Patterson*
|
438
|
-
|
439
|
-
* Simplify cookies middleware with key rotation support
|
440
|
-
|
441
|
-
Use the `rotate` method for both `MessageEncryptor` and
|
442
|
-
`MessageVerifier` to add key rotation support for encrypted and
|
443
|
-
signed cookies. This also helps simplify support for legacy cookie
|
444
|
-
security.
|
445
|
-
|
446
|
-
*Michael J Coyne*
|
447
|
-
|
448
|
-
* Use Capybara registered `:puma` server config.
|
449
|
-
|
450
|
-
The Capybara registered `:puma` server ensures the puma server is run in process so
|
451
|
-
connection sharing and open request detection work correctly by default.
|
452
|
-
|
453
|
-
*Thomas Walpole*
|
454
|
-
|
455
|
-
* Cookies `:expires` option supports `ActiveSupport::Duration` object.
|
456
|
-
|
457
|
-
cookies[:user_name] = { value: "assain", expires: 1.hour }
|
458
|
-
cookies[:key] = { value: "a yummy cookie", expires: 6.months }
|
459
|
-
|
460
|
-
Pull Request: #30121
|
461
|
-
|
462
|
-
*Assain Jaleel*
|
463
|
-
|
464
|
-
* Enforce signed/encrypted cookie expiry server side.
|
465
|
-
|
466
|
-
Rails can thwart attacks by malicious clients that don't honor a cookie's expiry.
|
467
|
-
|
468
|
-
It does so by stashing the expiry within the written cookie and relying on the
|
469
|
-
signing/encrypting to vouch that it hasn't been tampered with. Then on a
|
470
|
-
server-side read, the expiry is verified and any expired cookie is discarded.
|
471
|
-
|
472
|
-
Pull Request: #30121
|
473
|
-
|
474
|
-
*Assain Jaleel*
|
475
|
-
|
476
|
-
* Make `take_failed_screenshot` work within engine.
|
477
|
-
|
478
|
-
Fixes #30405.
|
479
|
-
|
480
|
-
*Yuji Yaginuma*
|
481
|
-
|
482
|
-
* Deprecate `ActionDispatch::TestResponse` response aliases.
|
483
|
-
|
484
|
-
`#success?`, `#missing?` & `#error?` are not supported by the actual
|
485
|
-
`ActionDispatch::Response` object and can produce false-positives. Instead,
|
486
|
-
use the response helpers provided by `Rack::Response`.
|
487
|
-
|
488
|
-
*Trevor Wistaff*
|
489
|
-
|
490
|
-
* Protect from forgery by default
|
491
|
-
|
492
|
-
Rather than protecting from forgery in the generated `ApplicationController`,
|
493
|
-
add it to `ActionController::Base` depending on
|
494
|
-
`config.action_controller.default_protect_from_forgery`. This configuration
|
495
|
-
defaults to false to support older versions which have removed it from their
|
496
|
-
`ApplicationController`, but is set to true for Rails 5.2.
|
497
|
-
|
498
|
-
*Lisa Ugray*
|
499
|
-
|
500
|
-
* Fallback `ActionController::Parameters#to_s` to `Hash#to_s`.
|
501
|
-
|
502
|
-
*Kir Shatrov*
|
503
|
-
|
504
|
-
* `driven_by` now registers poltergeist and capybara-webkit.
|
505
|
-
|
506
|
-
If poltergeist or capybara-webkit are set as drivers is set for System Tests,
|
507
|
-
`driven_by` will register the driver and set additional options passed via
|
508
|
-
the `:options` parameter.
|
509
|
-
|
510
|
-
Refer to the respective driver's documentation to see what options can be passed.
|
511
|
-
|
512
|
-
*Mario Chavez*
|
513
|
-
|
514
|
-
* AEAD encrypted cookies and sessions with GCM.
|
515
|
-
|
516
|
-
Encrypted cookies now use AES-GCM which couples authentication and
|
517
|
-
encryption in one faster step and produces shorter ciphertexts. Cookies
|
518
|
-
encrypted using AES in CBC HMAC mode will be seamlessly upgraded when
|
519
|
-
this new mode is enabled via the
|
520
|
-
`action_dispatch.use_authenticated_cookie_encryption` configuration value.
|
521
|
-
|
522
|
-
*Michael J Coyne*
|
192
|
+
* Output only one Content-Security-Policy nonce header value per request.
|
523
193
|
|
524
|
-
|
194
|
+
Fixes #32597.
|
525
195
|
|
526
|
-
|
527
|
-
^template path ^template tree digest ^class ^id
|
196
|
+
*Andrey Novikov*, *Andrew White*
|
528
197
|
|
529
|
-
|
198
|
+
* Move default headers configuration into their own module that can be included in controllers.
|
530
199
|
|
531
|
-
*
|
532
|
-
`ActiveSupport::Cache` stores and relies on the fact that Active Record has split `#cache_key` and `#cache_version`
|
533
|
-
to support it.
|
200
|
+
*Kevin Deisz*
|
534
201
|
|
535
|
-
|
202
|
+
* Add method `dig` to `session`.
|
536
203
|
|
537
|
-
*
|
204
|
+
*claudiob*, *Takumi Shotoku*
|
538
205
|
|
539
|
-
|
540
|
-
|
541
|
-
may not exist in a certain implementation.
|
206
|
+
* Controller level `force_ssl` has been deprecated in favor of
|
207
|
+
`config.force_ssl`.
|
542
208
|
|
543
|
-
|
209
|
+
*Derek Prior*
|
544
210
|
|
545
|
-
|
211
|
+
* Rails 6 requires Ruby 2.5.0 or newer.
|
546
212
|
|
547
|
-
*
|
213
|
+
*Jeremy Daer*, *Kasper Timm Hansen*
|
548
214
|
|
549
215
|
|
550
|
-
Please check [5-
|
216
|
+
Please check [5-2-stable](https://github.com/rails/rails/blob/5-2-stable/actionpack/CHANGELOG.md) for previous changes.
|