actionpack 6.1.7.7 → 6.1.7.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 205004120a6da1bd9f41fd3214ae124b861c46d02efa302ad5cd6e76ae8a7f54
-  data.tar.gz: fd92a15b1a7beed26910076fcec04a9e28143e96e6016b7f4cfd18654c85aa12
+  metadata.gz: 17584c20c784e0606e3937eddab9fabb4a5f55fd9d84ab642eae24bbc177c4e3
+  data.tar.gz: 8a113cee87d7d51be4a47ae65e723a73f5ba7cdfc73b98971b347f6661214ee4
 SHA512:
-  metadata.gz: 10e83333b2ee3da5b0210b6cd45e5e4520177e333e61b3e465301ad4e327baaa859b4462415b898ee76f42d5adc4815788d23d7c8d3b2aa5e104c7c74680cc97
-  data.tar.gz: 69dfca4a29df0b5b666cd7f918e672901a668f2a662f83aa38d60d3c11ce44cae4329e22c353958f4ab1bf511a0fdf03631fb20300d4717a5a66945519d2021a
+  metadata.gz: 25325ea54a87cdbe34ed8b666108fd41041009e85f442add0b3e661f71a58b2eab5bce5e804a23f35c3e7378940eaf37475d2d1f5f71496b44df10a66b9f565d
+  data.tar.gz: 39564370b55e81c747a96a6a9f212b301d5ca3ed04f8d1aad662455fecd4d5fb85a71869b0d99769d81d240cca4c3ee06846d4a17422c8c9d32eb5037fce89ae

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+## Rails 6.1.7.8 (June 04, 2024) ##
+
+*   Include the HTTP Permissions-Policy on non-HTML Content-Types
+    [CVE-2024-28103]
+
+
 ## Rails 6.1.7.7 (February 21, 2024) ##
 
 *   No changes.

data/lib/action_dispatch/http/permissions_policy.rb

@@ -21,7 +21,6 @@ module ActionDispatch #:nodoc:
         request = ActionDispatch::Request.new(env)
         _, headers, _ = response = @app.call(env)
 
-        return response unless html_response?(headers)
         return response if policy_present?(headers)
 
         if policy = request.permissions_policy
@@ -36,12 +35,6 @@ module ActionDispatch #:nodoc:
       end
 
       private
-        def html_response?(headers)
-          if content_type = headers[CONTENT_TYPE]
-            /html/.match?(content_type)
-          end
-        end
-
         def policy_present?(headers)
           headers[POLICY]
         end

data/lib/action_pack/gem_version.rb

@@ -10,7 +10,7 @@ module ActionPack
     MAJOR = 6
     MINOR = 1
     TINY  = 7
-    PRE   = "7"
+    PRE   = "8"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: actionpack
 version: !ruby/object:Gem::Version
-  version: 6.1.7.7
+  version: 6.1.7.8
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2024-02-21 00:00:00.000000000 Z
+date: 2024-06-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.7.7
+        version: 6.1.7.8
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.7.7
+        version: 6.1.7.8
 - !ruby/object:Gem::Dependency
   name: rack
   requirement: !ruby/object:Gem::Requirement
@@ -98,28 +98,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.7.7
+        version: 6.1.7.8
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.7.7
+        version: 6.1.7.8
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.7.7
+        version: 6.1.7.8
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.1.7.7
+        version: 6.1.7.8
 description: Web apps on Rails. Simple, battle-tested conventions for building and
   testing MVC web applications. Works with any Rack-compatible server.
 email: david@loudthinking.com
@@ -309,10 +309,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v6.1.7.7/actionpack/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v6.1.7.7/
+  changelog_uri: https://github.com/rails/rails/blob/v6.1.7.8/actionpack/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v6.1.7.8/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v6.1.7.7/actionpack
+  source_code_uri: https://github.com/rails/rails/tree/v6.1.7.8/actionpack
   rubygems_mfa_required: 'true'
 post_install_message:
 rdoc_options: []
@@ -330,7 +330,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements:
 - none
-rubygems_version: 3.2.22
+rubygems_version: 3.3.27
 signing_key:
 specification_version: 4
 summary: Web-flow and rendering framework putting the VC in MVC (part of Rails).