actionpack 6.1.7.7 → 7.0.0.alpha1
Sign up to get free protection for your applications and to get access to all the features.
Potentially problematic release.
This version of actionpack might be problematic. Click here for more details.
- checksums.yaml +4 -4
- data/CHANGELOG.md +99 -589
- data/MIT-LICENSE +2 -1
- data/README.rdoc +2 -3
- data/lib/abstract_controller/asset_paths.rb +1 -1
- data/lib/abstract_controller/base.rb +7 -21
- data/lib/abstract_controller/caching/fragments.rb +2 -2
- data/lib/abstract_controller/caching.rb +1 -1
- data/lib/abstract_controller/callbacks.rb +9 -8
- data/lib/abstract_controller/collector.rb +2 -2
- data/lib/abstract_controller/error.rb +1 -1
- data/lib/abstract_controller/helpers.rb +3 -2
- data/lib/abstract_controller/logger.rb +1 -1
- data/lib/abstract_controller/railties/routes_helpers.rb +2 -0
- data/lib/abstract_controller/translation.rb +0 -2
- data/lib/abstract_controller/url_for.rb +4 -6
- data/lib/action_controller/api.rb +1 -1
- data/lib/action_controller/log_subscriber.rb +3 -1
- data/lib/action_controller/metal/conditional_get.rb +38 -1
- data/lib/action_controller/metal/content_security_policy.rb +1 -1
- data/lib/action_controller/metal/cookies.rb +1 -1
- data/lib/action_controller/metal/data_streaming.rb +5 -13
- data/lib/action_controller/metal/exceptions.rb +19 -30
- data/lib/action_controller/metal/flash.rb +6 -2
- data/lib/action_controller/metal/http_authentication.rb +15 -16
- data/lib/action_controller/metal/instrumentation.rb +55 -52
- data/lib/action_controller/metal/live.rb +42 -2
- data/lib/action_controller/metal/mime_responds.rb +3 -3
- data/lib/action_controller/metal/params_wrapper.rb +7 -7
- data/lib/action_controller/metal/permissions_policy.rb +1 -1
- data/lib/action_controller/metal/query_tags.rb +16 -0
- data/lib/action_controller/metal/redirecting.rb +49 -34
- data/lib/action_controller/metal/rendering.rb +9 -9
- data/lib/action_controller/metal/request_forgery_protection.rb +64 -20
- data/lib/action_controller/metal/rescue.rb +1 -1
- data/lib/action_controller/metal/streaming.rb +1 -3
- data/lib/action_controller/metal/strong_parameters.rb +25 -29
- data/lib/action_controller/metal/testing.rb +0 -2
- data/lib/action_controller/metal.rb +7 -10
- data/lib/action_controller/railtie.rb +42 -5
- data/lib/action_controller/test_case.rb +6 -2
- data/lib/action_controller.rb +2 -5
- data/lib/action_dispatch/http/cache.rb +14 -7
- data/lib/action_dispatch/http/content_security_policy.rb +47 -37
- data/lib/action_dispatch/http/filter_parameters.rb +5 -0
- data/lib/action_dispatch/http/mime_negotiation.rb +13 -3
- data/lib/action_dispatch/http/mime_type.rb +9 -11
- data/lib/action_dispatch/http/parameters.rb +4 -4
- data/lib/action_dispatch/http/permissions_policy.rb +1 -1
- data/lib/action_dispatch/http/request.rb +10 -19
- data/lib/action_dispatch/http/response.rb +3 -3
- data/lib/action_dispatch/http/url.rb +9 -10
- data/lib/action_dispatch/journey/gtg/builder.rb +11 -12
- data/lib/action_dispatch/journey/gtg/simulator.rb +10 -4
- data/lib/action_dispatch/journey/gtg/transition_table.rb +77 -21
- data/lib/action_dispatch/journey/nodes/node.rb +70 -5
- data/lib/action_dispatch/journey/path/pattern.rb +22 -13
- data/lib/action_dispatch/journey/route.rb +5 -12
- data/lib/action_dispatch/journey/router/utils.rb +2 -2
- data/lib/action_dispatch/journey/router.rb +1 -1
- data/lib/action_dispatch/journey/routes.rb +3 -3
- data/lib/action_dispatch/journey/visualizer/fsm.js +49 -24
- data/lib/action_dispatch/journey/visualizer/index.html.erb +1 -1
- data/lib/action_dispatch/middleware/actionable_exceptions.rb +0 -1
- data/lib/action_dispatch/middleware/cookies.rb +27 -31
- data/lib/action_dispatch/middleware/debug_exceptions.rb +6 -4
- data/lib/action_dispatch/middleware/debug_locks.rb +3 -3
- data/lib/action_dispatch/middleware/exception_wrapper.rb +4 -0
- data/lib/action_dispatch/middleware/executor.rb +1 -1
- data/lib/action_dispatch/middleware/flash.rb +9 -11
- data/lib/action_dispatch/middleware/host_authorization.rb +25 -73
- data/lib/action_dispatch/middleware/remote_ip.rb +16 -4
- data/lib/action_dispatch/middleware/session/abstract_store.rb +1 -1
- data/lib/action_dispatch/middleware/show_exceptions.rb +6 -18
- data/lib/action_dispatch/middleware/stack.rb +50 -9
- data/lib/action_dispatch/middleware/static.rb +2 -5
- data/lib/action_dispatch/middleware/templates/rescues/_message_and_suggestions.html.erb +1 -1
- data/lib/action_dispatch/middleware/templates/rescues/_request_and_response.html.erb +4 -11
- data/lib/action_dispatch/middleware/templates/rescues/_trace.html.erb +2 -2
- data/lib/action_dispatch/middleware/templates/rescues/blocked_host.html.erb +2 -2
- data/lib/action_dispatch/middleware/templates/rescues/diagnostics.html.erb +4 -4
- data/lib/action_dispatch/middleware/templates/rescues/invalid_statement.html.erb +3 -3
- data/lib/action_dispatch/middleware/templates/rescues/layout.erb +28 -18
- data/lib/action_dispatch/middleware/templates/rescues/missing_exact_template.html.erb +3 -3
- data/lib/action_dispatch/middleware/templates/rescues/missing_template.html.erb +3 -3
- data/lib/action_dispatch/middleware/templates/rescues/routing_error.html.erb +3 -3
- data/lib/action_dispatch/middleware/templates/rescues/template_error.html.erb +3 -3
- data/lib/action_dispatch/middleware/templates/rescues/unknown_action.html.erb +3 -3
- data/lib/action_dispatch/middleware/templates/routes/_table.html.erb +5 -14
- data/lib/action_dispatch/railtie.rb +8 -2
- data/lib/action_dispatch/request/session.rb +43 -13
- data/lib/action_dispatch/routing/mapper.rb +44 -72
- data/lib/action_dispatch/routing/redirection.rb +0 -2
- data/lib/action_dispatch/routing/route_set.rb +7 -4
- data/lib/action_dispatch/routing/routes_proxy.rb +1 -1
- data/lib/action_dispatch/routing/url_for.rb +1 -2
- data/lib/action_dispatch/routing.rb +2 -2
- data/lib/action_dispatch/system_test_case.rb +6 -12
- data/lib/action_dispatch/system_testing/driver.rb +24 -4
- data/lib/action_dispatch/system_testing/test_helpers/screenshot_helper.rb +10 -6
- data/lib/action_dispatch/testing/assertions.rb +2 -5
- data/lib/action_dispatch/testing/integration.rb +6 -8
- data/lib/action_dispatch/testing/test_process.rb +2 -2
- data/lib/action_dispatch.rb +1 -1
- data/lib/action_pack/gem_version.rb +4 -4
- data/lib/action_pack.rb +1 -1
- metadata +21 -21
data/CHANGELOG.md
CHANGED
@@ -1,169 +1,69 @@
|
|
1
|
-
## Rails
|
1
|
+
## Rails 7.0.0.alpha1 (September 15, 2021) ##
|
2
2
|
|
3
|
-
*
|
3
|
+
* Use a static error message when raising `ActionDispatch::Http::Parameters::ParseError`
|
4
|
+
to avoid inadvertently logging the HTTP request body at the `fatal` level when it contains
|
5
|
+
malformed JSON.
|
4
6
|
|
7
|
+
Fixes #41145
|
5
8
|
|
6
|
-
|
9
|
+
*Aaron Lahey*
|
7
10
|
|
8
|
-
*
|
11
|
+
* Add `Middleware#delete!` to delete middleware or raise if not found.
|
9
12
|
|
13
|
+
`Middleware#delete!` works just like `Middleware#delete` but will
|
14
|
+
raise an error if the middleware isn't found.
|
10
15
|
|
11
|
-
|
16
|
+
*Alex Ghiculescu*, *Petrik de Heus*, *Junichi Sato*
|
12
17
|
|
13
|
-
*
|
18
|
+
* Raise error on unpermitted open redirects.
|
14
19
|
|
20
|
+
Add `allow_other_host` options to `redirect_to`.
|
21
|
+
Opt in to this behaviour with `ActionController::Base.raise_on_open_redirects = true`.
|
15
22
|
|
16
|
-
|
17
|
-
|
18
|
-
* Raise an exception if illegal characters are provide to redirect_to
|
19
|
-
[CVE-2023-28362]
|
20
|
-
|
21
|
-
*Zack Deveau*
|
22
|
-
|
23
|
-
## Rails 6.1.7.3 (March 13, 2023) ##
|
24
|
-
|
25
|
-
* No changes.
|
26
|
-
|
27
|
-
|
28
|
-
## Rails 6.1.7.2 (January 24, 2023) ##
|
29
|
-
|
30
|
-
* Fix `domain: :all` for two letter TLD
|
31
|
-
|
32
|
-
This fixes a compatibility issue introduced in our previous security
|
33
|
-
release when using `domain: :all` with a two letter but single level top
|
34
|
-
level domain domain (like `.ca`, rather than `.co.uk`).
|
35
|
-
|
36
|
-
|
37
|
-
## Rails 6.1.7.1 (January 17, 2023) ##
|
38
|
-
|
39
|
-
* Avoid regex backtracking on If-None-Match header
|
40
|
-
|
41
|
-
[CVE-2023-22795]
|
42
|
-
|
43
|
-
* Use string#split instead of regex for domain parts
|
44
|
-
|
45
|
-
[CVE-2023-22792]
|
46
|
-
|
47
|
-
|
48
|
-
## Rails 6.1.7 (September 09, 2022) ##
|
49
|
-
|
50
|
-
* No changes.
|
51
|
-
|
52
|
-
|
53
|
-
## Rails 6.1.6.1 (July 12, 2022) ##
|
54
|
-
|
55
|
-
* No changes.
|
56
|
-
|
57
|
-
|
58
|
-
## Rails 6.1.6 (May 09, 2022) ##
|
59
|
-
|
60
|
-
* No changes.
|
61
|
-
|
62
|
-
|
63
|
-
## Rails 6.1.5.1 (April 26, 2022) ##
|
64
|
-
|
65
|
-
* Allow Content Security Policy DSL to generate for API responses.
|
66
|
-
|
67
|
-
*Tim Wade*
|
68
|
-
|
69
|
-
## Rails 6.1.5 (March 09, 2022) ##
|
70
|
-
|
71
|
-
* Fix `content_security_policy` returning invalid directives.
|
72
|
-
|
73
|
-
Directives such as `self`, `unsafe-eval` and few others were not
|
74
|
-
single quoted when the directive was the result of calling a lambda
|
75
|
-
returning an array.
|
76
|
-
|
77
|
-
```ruby
|
78
|
-
content_security_policy do |policy|
|
79
|
-
policy.frame_ancestors lambda { [:self, "https://example.com"] }
|
80
|
-
end
|
81
|
-
```
|
82
|
-
|
83
|
-
With this fix the policy generated from above will now be valid.
|
84
|
-
|
85
|
-
*Edouard Chin*
|
86
|
-
|
87
|
-
* Update `HostAuthorization` middleware to render debug info only
|
88
|
-
when `config.consider_all_requests_local` is set to true.
|
89
|
-
|
90
|
-
Also, blocked host info is always logged with level `error`.
|
91
|
-
|
92
|
-
Fixes #42813.
|
93
|
-
|
94
|
-
*Nikita Vyrko*
|
95
|
-
|
96
|
-
* Dup arrays that get "converted".
|
97
|
-
|
98
|
-
Fixes #43681.
|
99
|
-
|
100
|
-
*Aaron Patterson*
|
101
|
-
|
102
|
-
* Don't show deprecation warning for equal paths.
|
103
|
-
|
104
|
-
*Anton Rieder*
|
105
|
-
|
106
|
-
* Fix crash in `ActionController::Instrumentation` with invalid HTTP formats.
|
107
|
-
|
108
|
-
Fixes #43094.
|
109
|
-
|
110
|
-
*Alex Ghiculescu*
|
111
|
-
|
112
|
-
* Add fallback host for SystemTestCase driven by RackTest.
|
113
|
-
|
114
|
-
Fixes #42780.
|
115
|
-
|
116
|
-
*Petrik de Heus*
|
117
|
-
|
118
|
-
* Add more detail about what hosts are allowed.
|
119
|
-
|
120
|
-
*Alex Ghiculescu*
|
121
|
-
|
122
|
-
|
123
|
-
## Rails 6.1.4.7 (March 08, 2022) ##
|
124
|
-
|
125
|
-
* No changes.
|
126
|
-
|
127
|
-
|
128
|
-
## Rails 6.1.4.6 (February 11, 2022) ##
|
129
|
-
|
130
|
-
* No changes.
|
23
|
+
*Gannon McGibbon*
|
131
24
|
|
25
|
+
* Deprecate `poltergeist` and `webkit` (capybara-webkit) driver registration for system testing (they will be removed in Rails 7.1). Add `cuprite` instead.
|
132
26
|
|
133
|
-
|
27
|
+
[Poltergeist](https://github.com/teampoltergeist/poltergeist) and [capybara-webkit](https://github.com/thoughtbot/capybara-webkit) are already not maintained. These usage in Rails are removed for avoiding confusing users.
|
134
28
|
|
135
|
-
|
136
|
-
response body has been fully closed which result in request state not
|
137
|
-
being fully reset before the next request
|
29
|
+
[Cuprite](https://github.com/rubycdp/cuprite) is a good alternative to Poltergeist. Some guide descriptions are replaced from Poltergeist to Cuprite.
|
138
30
|
|
139
|
-
|
31
|
+
*Yusuke Iwaki*
|
140
32
|
|
33
|
+
* Exclude additional flash types from `ActionController::Base.action_methods`.
|
141
34
|
|
142
|
-
|
35
|
+
Ensures that additional flash types defined on ActionController::Base subclasses
|
36
|
+
are not listed as actions on that controller.
|
143
37
|
|
144
|
-
|
38
|
+
class MyController < ApplicationController
|
39
|
+
add_flash_types :hype
|
40
|
+
end
|
145
41
|
|
42
|
+
MyController.action_methods.include?('hype') # => false
|
146
43
|
|
147
|
-
|
44
|
+
*Gavin Morrice*
|
148
45
|
|
149
|
-
*
|
46
|
+
* OpenSSL constants are now used for Digest computations.
|
150
47
|
|
48
|
+
*Dirkjan Bussink*
|
151
49
|
|
152
|
-
|
50
|
+
* Remove IE6-7-8 file download related hack/fix from ActionController::DataStreaming module.
|
153
51
|
|
154
|
-
|
52
|
+
Due to the age of those versions of IE this fix is no longer relevant, more importantly it creates an edge-case for unexpected Cache-Control headers.
|
155
53
|
|
156
|
-
|
54
|
+
*Tadas Sasnauskas*
|
157
55
|
|
158
|
-
*
|
56
|
+
* Configuration setting to skip logging an uncaught exception backtrace when the exception is
|
57
|
+
present in `rescued_responses`.
|
159
58
|
|
160
|
-
|
161
|
-
|
162
|
-
|
59
|
+
It may be too noisy to get all backtraces logged for applications that manage uncaught
|
60
|
+
exceptions via `rescued_responses` and `exceptions_app`.
|
61
|
+
`config.action_dispatch.log_rescued_responses` (defaults to `true`) can be set to `false` in
|
62
|
+
this case, so that only exceptions not found in `rescued_responses` will be logged.
|
163
63
|
|
164
|
-
|
64
|
+
*Alexander Azarov*, *Mike Dalessio*
|
165
65
|
|
166
|
-
* Ignore file fixtures on `db:fixtures:load
|
66
|
+
* Ignore file fixtures on `db:fixtures:load`.
|
167
67
|
|
168
68
|
*Kevin Sjöberg*
|
169
69
|
|
@@ -171,513 +71,123 @@
|
|
171
71
|
|
172
72
|
*Dylan Thacker-Smith*
|
173
73
|
|
174
|
-
*
|
175
|
-
|
176
|
-
Previously, if you specify a url parameter that is part of the path as false it would include that part
|
177
|
-
of the path as parameter for example:
|
178
|
-
|
179
|
-
```
|
180
|
-
get "(/optional/:optional_id)/things" => "foo#foo", as: :things
|
181
|
-
things_path(optional_id: false) # => /things?optional_id=false
|
182
|
-
```
|
183
|
-
|
184
|
-
After this change, true and false will be treated the same when used as optional path parameters. Meaning now:
|
185
|
-
|
186
|
-
```
|
187
|
-
get '(this/:my_bool)/that' as: :that
|
188
|
-
|
189
|
-
that_path(my_bool: true) # => `/this/true/that`
|
190
|
-
that_path(my_bool: false) # => `/this/false/that`
|
191
|
-
```
|
192
|
-
|
193
|
-
*Adam Hess*
|
194
|
-
|
195
|
-
* Add support for 'private, no-store' Cache-Control headers.
|
196
|
-
|
197
|
-
Previously, 'no-store' was exclusive; no other directives could be specified.
|
198
|
-
|
199
|
-
*Alex Smith*
|
200
|
-
|
201
|
-
|
202
|
-
## Rails 6.1.3.2 (May 05, 2021) ##
|
203
|
-
|
204
|
-
* Prevent open redirects by correctly escaping the host allow list
|
205
|
-
CVE-2021-22903
|
206
|
-
|
207
|
-
* Prevent catastrophic backtracking during mime parsing
|
208
|
-
CVE-2021-22902
|
209
|
-
|
210
|
-
* Prevent regex DoS in HTTP token authentication
|
211
|
-
CVE-2021-22904
|
212
|
-
|
213
|
-
* Prevent string polymorphic route arguments.
|
214
|
-
|
215
|
-
`url_for` supports building polymorphic URLs via an array
|
216
|
-
of arguments (usually symbols and records). If a developer passes a
|
217
|
-
user input array, strings can result in unwanted route helper calls.
|
218
|
-
|
219
|
-
CVE-2021-22885
|
220
|
-
|
221
|
-
*Gannon McGibbon*
|
222
|
-
|
223
|
-
## Rails 6.1.3.1 (March 26, 2021) ##
|
224
|
-
|
225
|
-
* No changes.
|
226
|
-
|
227
|
-
|
228
|
-
## Rails 6.1.3 (February 17, 2021) ##
|
229
|
-
|
230
|
-
* Re-define routes when not set correctly via inheritance.
|
231
|
-
|
232
|
-
*John Hawthorn*
|
233
|
-
|
234
|
-
|
235
|
-
## Rails 6.1.2.1 (February 10, 2021) ##
|
236
|
-
|
237
|
-
* Prevent open redirect when allowed host starts with a dot
|
238
|
-
|
239
|
-
[CVE-2021-22881]
|
240
|
-
|
241
|
-
Thanks to @tktech (https://hackerone.com/tktech) for reporting this
|
242
|
-
issue and the patch!
|
243
|
-
|
244
|
-
*Aaron Patterson*
|
245
|
-
|
246
|
-
|
247
|
-
## Rails 6.1.2 (February 09, 2021) ##
|
248
|
-
|
249
|
-
* Fix error in `ActionController::LogSubscriber` that would happen when throwing inside a controller action.
|
250
|
-
|
251
|
-
*Janko Marohnić*
|
252
|
-
|
253
|
-
* Fix `fixture_file_upload` deprecation when `file_fixture_path` is a relative path.
|
254
|
-
|
255
|
-
*Eugene Kenny*
|
256
|
-
|
257
|
-
|
258
|
-
## Rails 6.1.1 (January 07, 2021) ##
|
259
|
-
|
260
|
-
* Fix nil translation key lookup in controllers/
|
261
|
-
|
262
|
-
*Jan Klimo*
|
263
|
-
|
264
|
-
* Quietly handle unknown HTTP methods in Action Dispatch SSL middleware.
|
265
|
-
|
266
|
-
*Alex Robbin*
|
267
|
-
|
268
|
-
* Change the request method to a `GET` when passing failed requests down to `config.exceptions_app`.
|
269
|
-
|
270
|
-
*Alex Robbin*
|
271
|
-
|
272
|
-
|
273
|
-
## Rails 6.1.0 (December 09, 2020) ##
|
274
|
-
|
275
|
-
* Support for the HTTP header `Feature-Policy` has been revised to reflect
|
276
|
-
its [rename](https://github.com/w3c/webappsec-permissions-policy/pull/379) to [`Permissions-Policy`](https://w3c.github.io/webappsec-permissions-policy/#permissions-policy-http-header-field).
|
277
|
-
|
278
|
-
```ruby
|
279
|
-
Rails.application.config.permissions_policy do |p|
|
280
|
-
p.camera :none
|
281
|
-
p.gyroscope :none
|
282
|
-
p.microphone :none
|
283
|
-
p.usb :none
|
284
|
-
p.fullscreen :self
|
285
|
-
p.payment :self, "https://secure-example.com"
|
286
|
-
end
|
287
|
-
```
|
288
|
-
|
289
|
-
*Julien Grillot*
|
290
|
-
|
291
|
-
* Allow `ActionDispatch::HostAuthorization` to exclude specific requests.
|
292
|
-
|
293
|
-
Host Authorization checks can be skipped for specific requests. This allows for health check requests to be permitted for requests with missing or non-matching host headers.
|
294
|
-
|
295
|
-
*Chris Bisnett*
|
296
|
-
|
297
|
-
* Add `config.action_dispatch.request_id_header` to allow changing the name of
|
298
|
-
the unique X-Request-Id header
|
299
|
-
|
300
|
-
*Arlston Fernandes*
|
301
|
-
|
302
|
-
* Deprecate `config.action_dispatch.return_only_media_type_on_content_type`.
|
303
|
-
|
304
|
-
*Rafael Mendonça França*
|
305
|
-
|
306
|
-
* Change `ActionDispatch::Response#content_type` to return the full Content-Type header.
|
307
|
-
|
308
|
-
*Rafael Mendonça França*
|
309
|
-
|
310
|
-
* Remove deprecated `ActionDispatch::Http::ParameterFilter`.
|
311
|
-
|
312
|
-
*Rafael Mendonça França*
|
313
|
-
|
314
|
-
* Added support for exclusive no-store Cache-Control header.
|
74
|
+
* New `ActionController::ConditionalGet#no_store` method to set HTTP cache control `no-store` directive.
|
315
75
|
|
316
|
-
|
76
|
+
*Tadas Sasnauskas*
|
317
77
|
|
318
|
-
|
78
|
+
* Drop support for the `SERVER_ADDR` header.
|
319
79
|
|
320
|
-
|
80
|
+
Following up https://github.com/rack/rack/pull/1573 and https://github.com/rails/rails/pull/42349.
|
321
81
|
|
322
|
-
|
323
|
-
`ActionDispatch::Http::Request#POST` prior to validating encoding.
|
82
|
+
*Ricardo Díaz*
|
324
83
|
|
325
|
-
|
326
|
-
|
327
|
-
* Allow `assert_recognizes` routing assertions to work on mounted root routes.
|
84
|
+
* Set session options when initializing a basic session.
|
328
85
|
|
329
86
|
*Gannon McGibbon*
|
330
87
|
|
331
|
-
*
|
332
|
-
|
333
|
-
*Alan Tan*, *Oz Ben-David*
|
334
|
-
|
335
|
-
* Fix `follow_redirect!` to follow redirection with same HTTP verb when following
|
336
|
-
a 308 redirection.
|
337
|
-
|
338
|
-
*Alan Tan*
|
339
|
-
|
340
|
-
* When multiple domains are specified for a cookie, a domain will now be
|
341
|
-
chosen only if it is equal to or is a superdomain of the request host.
|
342
|
-
|
343
|
-
*Jonathan Hefner*
|
344
|
-
|
345
|
-
* `ActionDispatch::Static` handles precompiled Brotli (.br) files.
|
346
|
-
|
347
|
-
Adds to existing support for precompiled gzip (.gz) files.
|
348
|
-
Brotli files are preferred due to much better compression.
|
349
|
-
|
350
|
-
When the browser requests /some.js with `Accept-Encoding: br`,
|
351
|
-
we check for public/some.js.br and serve that file, if present, with
|
352
|
-
`Content-Encoding: br` and `Vary: Accept-Encoding` headers.
|
353
|
-
|
354
|
-
*Ryan Edward Hall*, *Jeremy Daer*
|
355
|
-
|
356
|
-
* Add raise_on_missing_translations support for controllers.
|
357
|
-
|
358
|
-
This configuration determines whether an error should be raised for missing translations.
|
359
|
-
It can be enabled through `config.i18n.raise_on_missing_translations`. Note that described
|
360
|
-
configuration also affects raising error for missing translations in views.
|
361
|
-
|
362
|
-
*fatkodima*
|
363
|
-
|
364
|
-
* Added `compact` and `compact!` to `ActionController::Parameters`.
|
365
|
-
|
366
|
-
*Eugene Kenny*
|
367
|
-
|
368
|
-
* Calling `each_pair` or `each_value` on an `ActionController::Parameters`
|
369
|
-
without passing a block now returns an enumerator.
|
370
|
-
|
371
|
-
*Eugene Kenny*
|
372
|
-
|
373
|
-
* `fixture_file_upload` now uses path relative to `file_fixture_path`
|
374
|
-
|
375
|
-
Previously the path had to be relative to `fixture_path`.
|
376
|
-
You can change your existing code as follow:
|
377
|
-
|
378
|
-
```ruby
|
379
|
-
# Before
|
380
|
-
fixture_file_upload('files/dog.png')
|
381
|
-
|
382
|
-
# After
|
383
|
-
fixture_file_upload('dog.png')
|
384
|
-
```
|
385
|
-
|
386
|
-
*Edouard Chin*
|
387
|
-
|
388
|
-
* Remove deprecated `force_ssl` at the controller level.
|
389
|
-
|
390
|
-
*Rafael Mendonça França*
|
391
|
-
|
392
|
-
* The +helper+ class method for controllers loads helper modules specified as
|
393
|
-
strings/symbols with `String#constantize` instead of `require_dependency`.
|
394
|
-
|
395
|
-
Remember that support for strings/symbols is only a convenient API. You can
|
396
|
-
always pass a module object:
|
397
|
-
|
398
|
-
```ruby
|
399
|
-
helper UtilsHelper
|
400
|
-
```
|
401
|
-
|
402
|
-
which is recommended because it is simple and direct. When a string/symbol
|
403
|
-
is received, `helper` just manipulates and inflects the argument to obtain
|
404
|
-
that same module object.
|
405
|
-
|
406
|
-
*Xavier Noria*, *Jean Boussier*
|
407
|
-
|
408
|
-
* Correctly identify the entire localhost IPv4 range as trusted proxy.
|
409
|
-
|
410
|
-
*Nick Soracco*
|
411
|
-
|
412
|
-
* `url_for` will now use "https://" as the default protocol when
|
413
|
-
`Rails.application.config.force_ssl` is set to true.
|
414
|
-
|
415
|
-
*Jonathan Hefner*
|
416
|
-
|
417
|
-
* Accept and default to base64_urlsafe CSRF tokens.
|
418
|
-
|
419
|
-
Base64 strict-encoded CSRF tokens are not inherently websafe, which makes
|
420
|
-
them difficult to deal with. For example, the common practice of sending
|
421
|
-
the CSRF token to a browser in a client-readable cookie does not work properly
|
422
|
-
out of the box: the value has to be url-encoded and decoded to survive transport.
|
423
|
-
|
424
|
-
Now, we generate Base64 urlsafe-encoded CSRF tokens, which are inherently safe
|
425
|
-
to transport. Validation accepts both urlsafe tokens, and strict-encoded tokens
|
426
|
-
for backwards compatibility.
|
427
|
-
|
428
|
-
*Scott Blum*
|
429
|
-
|
430
|
-
* Support rolling deploys for cookie serialization/encryption changes.
|
431
|
-
|
432
|
-
In a distributed configuration like rolling update, users may observe
|
433
|
-
both old and new instances during deployment. Users may be served by a
|
434
|
-
new instance and then by an old instance.
|
435
|
-
|
436
|
-
That means when the server changes `cookies_serializer` from `:marshal`
|
437
|
-
to `:hybrid` or the server changes `use_authenticated_cookie_encryption`
|
438
|
-
from `false` to `true`, users may lose their sessions if they access the
|
439
|
-
server during deployment.
|
440
|
-
|
441
|
-
We added fallbacks to downgrade the cookie format when necessary during
|
442
|
-
deployment, ensuring compatibility on both old and new instances.
|
443
|
-
|
444
|
-
*Masaki Hara*
|
88
|
+
* Add `cache_control: {}` option to `fresh_when` and `stale?`.
|
445
89
|
|
446
|
-
|
90
|
+
Works as a shortcut to set `response.cache_control` with the above methods.
|
447
91
|
|
448
|
-
|
449
|
-
Now, the furthest proxy site is used. e.g.: It now gives an ip address when using curl from the load balancer.
|
92
|
+
*Jacopo Beschi*
|
450
93
|
|
451
|
-
|
94
|
+
* Writing into a disabled session will now raise an error.
|
452
95
|
|
453
|
-
|
96
|
+
Previously when no session store was set, writing into the session would silently fail.
|
454
97
|
|
455
|
-
|
456
|
-
gem dalli to be updated as well.
|
98
|
+
*Jean Boussier*
|
457
99
|
|
458
|
-
|
100
|
+
* Add support for 'require-trusted-types-for' and 'trusted-types' headers.
|
459
101
|
|
460
|
-
|
102
|
+
Fixes #42034.
|
461
103
|
|
462
|
-
|
463
|
-
meant it had its own copy of `@assertions`. This prevented the assertions
|
464
|
-
from being correctly counted and reported.
|
104
|
+
*lfalcao*
|
465
105
|
|
466
|
-
|
467
|
-
root session.
|
106
|
+
* Remove inline styles and address basic accessibility issues on rescue templates.
|
468
107
|
|
469
|
-
|
108
|
+
*Jacob Herrington*
|
470
109
|
|
471
|
-
|
472
|
-
|
473
|
-
* Add SameSite protection to every written cookie.
|
474
|
-
|
475
|
-
Enabling `SameSite` cookie protection is an addition to CSRF protection,
|
476
|
-
where cookies won't be sent by browsers in cross-site POST requests when set to `:lax`.
|
477
|
-
|
478
|
-
`:strict` disables cookies being sent in cross-site GET or POST requests.
|
479
|
-
|
480
|
-
Passing `:none` disables this protection and is the same as previous versions albeit a `; SameSite=None` is appended to the cookie.
|
481
|
-
|
482
|
-
See upgrade instructions in config/initializers/new_framework_defaults_6_1.rb.
|
110
|
+
* Add support for 'private, no-store' Cache-Control headers.
|
483
111
|
|
484
|
-
|
112
|
+
Previously, 'no-store' was exclusive; no other directives could be specified.
|
485
113
|
|
486
|
-
|
114
|
+
*Alex Smith*
|
487
115
|
|
488
|
-
|
116
|
+
* Expand payload of `unpermitted_parameters.action_controller` instrumentation to allow subscribers to
|
117
|
+
know which controller action received unpermitted parameters.
|
489
118
|
|
490
|
-
*
|
119
|
+
*bbuchalter*
|
491
120
|
|
492
|
-
|
493
|
-
https://github.com/rails/routing_concerns was a better approach. Turned out
|
494
|
-
that this wasn't fully the case and loading external route files from the router
|
495
|
-
can be helpful for applications with a really large set of routes.
|
496
|
-
Without this feature, application needs to implement routes reloading
|
497
|
-
themselves and it's not straightforward.
|
121
|
+
* Add `ActionController::Live#send_stream` that makes it more convenient to send generated streams:
|
498
122
|
|
499
123
|
```ruby
|
500
|
-
|
501
|
-
|
502
|
-
Rails.application.routes.draw do
|
503
|
-
draw(:admin)
|
504
|
-
end
|
505
|
-
|
506
|
-
# config/routes/admin.rb
|
507
|
-
|
508
|
-
get :foo, to: 'foo#bar'
|
509
|
-
```
|
510
|
-
|
511
|
-
*Yehuda Katz*, *Edouard Chin*
|
512
|
-
|
513
|
-
* Fix system test driver option initialization for non-headless browsers.
|
514
|
-
|
515
|
-
*glaszig*
|
124
|
+
send_stream(filename: "subscribers.csv") do |stream|
|
125
|
+
stream.writeln "email_address,updated_at"
|
516
126
|
|
517
|
-
|
518
|
-
|
519
|
-
|
520
|
-
*Austin Story*
|
521
|
-
|
522
|
-
* `respond_to#any` no longer returns a response's Content-Type based on the
|
523
|
-
request format but based on the block given.
|
524
|
-
|
525
|
-
Example:
|
526
|
-
|
527
|
-
```ruby
|
528
|
-
def my_action
|
529
|
-
respond_to do |format|
|
530
|
-
format.any { render(json: { foo: 'bar' }) }
|
531
|
-
end
|
127
|
+
@subscribers.find_each do |subscriber|
|
128
|
+
stream.writeln [ subscriber.email_address, subscriber.updated_at ].join(",")
|
532
129
|
end
|
533
|
-
|
534
|
-
get('my_action.csv')
|
535
|
-
```
|
536
|
-
|
537
|
-
The previous behaviour was to respond with a `text/csv` Content-Type which
|
538
|
-
is inaccurate since a JSON response is being rendered.
|
539
|
-
|
540
|
-
Now it correctly returns a `application/json` Content-Type.
|
541
|
-
|
542
|
-
*Edouard Chin*
|
543
|
-
|
544
|
-
* Replaces (back)slashes in failure screenshot image paths with dashes.
|
545
|
-
|
546
|
-
If a failed test case contained a slash or a backslash, a screenshot would be created in a
|
547
|
-
nested directory, causing issues with `tmp:clear`.
|
548
|
-
|
549
|
-
*Damir Zekic*
|
550
|
-
|
551
|
-
* Add `params.member?` to mimic Hash behavior.
|
552
|
-
|
553
|
-
*Younes Serraj*
|
554
|
-
|
555
|
-
* `process_action.action_controller` notifications now include the following in their payloads:
|
556
|
-
|
557
|
-
* `:request` - the `ActionDispatch::Request`
|
558
|
-
* `:response` - the `ActionDispatch::Response`
|
559
|
-
|
560
|
-
*George Claghorn*
|
561
|
-
|
562
|
-
* Updated `ActionDispatch::Request.remote_ip` setter to clear set the instance
|
563
|
-
`remote_ip` to `nil` before setting the header that the value is derived
|
564
|
-
from.
|
565
|
-
|
566
|
-
Fixes #37383.
|
567
|
-
|
568
|
-
*Norm Provost*
|
569
|
-
|
570
|
-
* `ActionController::Base.log_at` allows setting a different log level per request.
|
571
|
-
|
572
|
-
```ruby
|
573
|
-
# Use the debug level if a particular cookie is set.
|
574
|
-
class ApplicationController < ActionController::Base
|
575
|
-
log_at :debug, if: -> { cookies[:debug] }
|
576
130
|
end
|
577
131
|
```
|
578
132
|
|
579
|
-
*
|
580
|
-
|
581
|
-
* Allow system test screen shots to be taken more than once in
|
582
|
-
a test by prefixing the file name with an incrementing counter.
|
583
|
-
|
584
|
-
Add an environment variable `RAILS_SYSTEM_TESTING_SCREENSHOT_HTML` to
|
585
|
-
enable saving of HTML during a screenshot in addition to the image.
|
586
|
-
This uses the same image name, with the extension replaced with `.html`
|
587
|
-
|
588
|
-
*Tom Fakes*
|
589
|
-
|
590
|
-
* Add `Vary: Accept` header when using `Accept` header for response.
|
591
|
-
|
592
|
-
For some requests like `/users/1`, Rails uses requests' `Accept`
|
593
|
-
header to determine what to return. And if we don't add `Vary`
|
594
|
-
in the response header, browsers might accidentally cache different
|
595
|
-
types of content, which would cause issues: e.g. javascript got displayed
|
596
|
-
instead of html content. This PR fixes these issues by adding `Vary: Accept`
|
597
|
-
in these types of requests. For more detailed problem description, please read:
|
598
|
-
|
599
|
-
https://github.com/rails/rails/pull/36213
|
133
|
+
*DHH*
|
600
134
|
|
601
|
-
|
135
|
+
* Add `ActionController::Live::Buffer#writeln` to write a line to the stream with a newline included.
|
602
136
|
|
603
|
-
*
|
137
|
+
*DHH*
|
604
138
|
|
605
|
-
*
|
606
|
-
a 307 redirection.
|
139
|
+
* `ActionDispatch::Request#content_type` now returned Content-Type header as it is.
|
607
140
|
|
608
|
-
|
141
|
+
Previously, `ActionDispatch::Request#content_type` returned value does NOT contain charset part.
|
142
|
+
This behavior changed to returned Content-Type header containing charset part as it is.
|
609
143
|
|
610
|
-
|
144
|
+
If you want just MIME type, please use `ActionDispatch::Request#media_type` instead.
|
611
145
|
|
612
|
-
|
613
|
-
|
614
|
-
* Reduced log noise handling ActionController::RoutingErrors.
|
615
|
-
|
616
|
-
*Alberto Fernández-Capel*
|
617
|
-
|
618
|
-
* Add DSL for configuring HTTP Feature Policy.
|
619
|
-
|
620
|
-
This new DSL provides a way to configure an HTTP Feature Policy at a
|
621
|
-
global or per-controller level. Full details of HTTP Feature Policy
|
622
|
-
specification and guidelines can be found at MDN:
|
623
|
-
|
624
|
-
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy
|
625
|
-
|
626
|
-
Example global policy:
|
146
|
+
Before:
|
627
147
|
|
628
148
|
```ruby
|
629
|
-
|
630
|
-
|
631
|
-
f.gyroscope :none
|
632
|
-
f.microphone :none
|
633
|
-
f.usb :none
|
634
|
-
f.fullscreen :self
|
635
|
-
f.payment :self, "https://secure.example.com"
|
636
|
-
end
|
149
|
+
request = ActionDispatch::Request.new("CONTENT_TYPE" => "text/csv; header=present; charset=utf-16", "REQUEST_METHOD" => "GET")
|
150
|
+
request.content_type #=> "text/csv"
|
637
151
|
```
|
638
152
|
|
639
|
-
|
153
|
+
After:
|
640
154
|
|
641
155
|
```ruby
|
642
|
-
|
643
|
-
|
644
|
-
|
645
|
-
end
|
646
|
-
end
|
156
|
+
request = ActionDispatch::Request.new("Content-Type" => "text/csv; header=present; charset=utf-16", "REQUEST_METHOD" => "GET")
|
157
|
+
request.content_type #=> "text/csv; header=present; charset=utf-16"
|
158
|
+
request.media_type #=> "text/csv"
|
647
159
|
```
|
648
160
|
|
649
|
-
*
|
161
|
+
*Rafael Mendonça França*
|
650
162
|
|
651
|
-
*
|
163
|
+
* Change `ActionDispatch::Request#media_type` to return `nil` when the request don't have a `Content-Type` header.
|
652
164
|
|
653
|
-
|
165
|
+
*Rafael Mendonça França*
|
654
166
|
|
655
|
-
|
167
|
+
* Fix error in `ActionController::LogSubscriber` that would happen when throwing inside a controller action.
|
656
168
|
|
657
|
-
*
|
169
|
+
*Janko Marohnić*
|
658
170
|
|
659
|
-
|
660
|
-
take parameters the scope was lost when using path helpers. This commit
|
661
|
-
ensures scope is kept both when the route takes parameters or when it
|
662
|
-
doesn't.
|
171
|
+
* Allow anything with `#to_str` (like `Addressable::URI`) as a `redirect_to` location.
|
663
172
|
|
664
|
-
|
173
|
+
*ojab*
|
665
174
|
|
666
|
-
|
175
|
+
* Change the request method to a `GET` when passing failed requests down to `config.exceptions_app`.
|
667
176
|
|
668
|
-
*
|
177
|
+
*Alex Robbin*
|
669
178
|
|
670
|
-
|
179
|
+
* Deprecate the ability to assign a single value to `config.action_dispatch.trusted_proxies`
|
180
|
+
as `RemoteIp` middleware behaves inconsistently depending on whether this is configured
|
181
|
+
with a single value or an enumerable.
|
671
182
|
|
672
|
-
|
673
|
-
an enumerator for the parameters instead of the underlying hash.
|
183
|
+
Fixes #40772.
|
674
184
|
|
675
|
-
*
|
185
|
+
*Christian Sutter*
|
676
186
|
|
677
|
-
*
|
678
|
-
|
187
|
+
* Add `redirect_back_or_to(fallback_location, **)` as a more aesthetically pleasing version of `redirect_back fallback_location:, **`.
|
188
|
+
The old method name is retained without explicit deprecation.
|
679
189
|
|
680
|
-
*
|
190
|
+
*DHH*
|
681
191
|
|
682
192
|
|
683
|
-
Please check [6-
|
193
|
+
Please check [6-1-stable](https://github.com/rails/rails/blob/6-1-stable/actionpack/CHANGELOG.md) for previous changes.
|