actionpack 2.3.18 → 3.0.0.beta

data/CHANGELOG

@@ -1,32 +1,4 @@
-*2.3.11 (February 9, 2011)*
-
-* Two security fixes. CVE-2011-0446, CVE-2011-0447
-
-*2.3.10 (October 15, 2010)*
-
-*2.3.9 (September 4, 2010)*
-
-* Version bump.
-
-
-*2.3.8 (May 24, 2010)*
-
-* HTML safety: fix compatibility *without* the optional rails_xss plugin.
-
-
-*2.3.7 (May 24, 2010)*
-
-* HTML safety: fix compatibility with the optional rails_xss plugin.  [Nathan Weizenbaum, Santiago Pastorino]
-
-
-*2.3.6 (May 23, 2010)*
-
-* JSON: set Base.include_root_in_json = true to include a root value in the JSON: {"post": {"title": ...}}. Mirrors the Active Record option.  #2584 [Matthew Moore, Joe Martinez, Elad Meidar, Santiago Pastorino]
-
-* Ruby 1.9: ERB template encoding using a magic comment at the top of the file.  [Jeremy Kemper]
-    <%# encoding: utf-8 %>
-
-* Fixed that default locale templates should be used if the current locale template is missing [DHH]
+*Edge*
 
 * Fixed that PrototypeHelper#update_page should return html_safe [DHH]
 
@@ -34,7 +6,9 @@
 
 * Fixed that fragment caching should return a cache hit as html_safe (or it would all just get escaped) [DHH]
 
-* Introduce String#html_safe for rails_xss plugin and forward-compatibility with Rails 3.  [Michael Koziarski, Santiago Pastorino, José Ignacio Costa]
+* Added that ActionController::Base now does helper :all instead of relying on the default ApplicationController in Rails to do it [DHH]
+
+* Added ActionDispatch::Request#authorization to access the http authentication header regardless of its proxy hiding [DHH]
 
 * Added :alert, :notice, and :flash as options to ActionController::Base#redirect_to that'll automatically set the proper flash before the redirection [DHH]. Examples:
 
@@ -47,45 +21,22 @@
 
 * Added ActionController::Base#notice/= and ActionController::Base#alert/= as a convenience accessors in both the controller and the view for flash[:notice]/= and flash[:alert]/= [DHH]
 
-* Added cookies.permanent, cookies.signed, and cookies.permanent.signed accessor for common cookie actions [DHH]. Examples:
 
-    cookies.permanent[:prefers_open_id] = true
-    # => Set-Cookie: prefers_open_id=true; path=/; expires=Sun, 16-Dec-2029 03:24:16 GMT
-
-    cookies.signed[:discount] = 45
-    # => Set-Cookie: discount=BAhpMg==--2c1c6906c90a3bc4fd54a51ffb41dffa4bf6b5f7; path=/
-
-    cookies.signed[:discount]
-    # => 45 (if the cookie was changed, you'll get a InvalidSignature exception)
-
-    cookies.permanent.signed[:remember_me] = current_user.id
-    # => Set-Cookie: discount=BAhU--848956038e692d7046deab32b7131856ab20e14e; path=/; expires=Sun, 16-Dec-2029 03:24:16 GMT
-    
-  ...to use the signed cookies, you need to set a secret to ActionController::Base.cookie_verifier_secret (automatically done in config/initializers/cookie_verification_secret.rb for new Rails applications).
-
-
-*2.3.5 (November 25, 2009)*
-
-* Minor Bug Fixes and deprecation warnings
-
-* Ruby 1.9 Support
-
-* Fix filtering parameters when there are Fixnum or other un-dupable values.
-
-* Improvements to ActionView::TestCase
-
-* Compatiblity with the rails_xss plugin 
+* Introduce grouped_collection_select helper.  #1249 [Dan Codeape, Erik Ostrom]
 
-*2.3.4 (September 4, 2009)*
+* Make sure javascript_include_tag/stylesheet_link_tag does not append ".js" or ".css" onto external urls. #1664 [Matthew Rudy Jacobs]
 
-* Sanitize multibyte strings before escaping them with escape_once. CVE-2009-3009
+* Ruby 1.9: fix Content-Length for multibyte send_data streaming.  #2661 [Sava Chankov]
 
-* Introduce grouped_collection_select helper.  #1249 [Dan Codeape, Erik Ostrom]
+* Ruby 1.9: ERB template encoding using a magic comment at the top of the file.  [Jeremy Kemper]
+    <%# encoding: utf-8 %>
 
-* Ruby 1.9: fix Content-Length for multibyte send_data streaming.  #2661 [Sava Chankov]
+* Change integration test helpers to accept Rack environment instead of just HTTP Headers [Pratik Naik]
 
+  Before :  get '/path', {}, 'Accept' => 'text/javascript'
+  After  :  get '/path', {}, 'HTTP_ACCEPT' => 'text/javascript'
 
-*2.3.3 (July 12, 2009)*
+* Instead of checking Rails.env.test? in Failsafe middleware, check env["rails.raise_exceptions"] [Bryan Helmkamp]
 
 * Fixed that TestResponse.cookies was returning cookies unescaped #1867 [Doug McInnes]
 
@@ -1935,7 +1886,7 @@ superclass' view_paths.  [Rick Olson]
 
 * Update documentation for erb trim syntax. #5651 [matt@mattmargolis.net]
 
-* Pass :id => nil or :class => nil to error_messages_for to supress that html attribute. #3586 [olivier_ansaldi@yahoo.com]
+* Pass :id => nil or :class => nil to error_messages_for to supress that html attribute. #3586 [olivier_ansaldi@yahoo.com, sebastien@goetzilla.info]
 
 * Reset @html_document between requests so assert_tag works. #4810 [Jarkko Laine, easleydp@gmail.com]
 
@@ -2532,7 +2483,7 @@ superclass' view_paths.  [Rick Olson]
 
 * Provide support for decimal columns to form helpers. Closes #5672. [Dave Thomas]
 
-* Pass :id => nil or :class => nil to error_messages_for to supress that html attribute. #3586 [olivier_ansaldi@yahoo.com]
+* Pass :id => nil or :class => nil to error_messages_for to supress that html attribute. #3586 [olivier_ansaldi@yahoo.com, sebastien@goetzilla.info]
 
 * Reset @html_document between requests so assert_tag works. #4810 [Jarkko Laine, easleydp@gmail.com]
 

data/README

@@ -37,15 +37,15 @@ A short rundown of the major features:
       def show
         @customer = find_customer
       end
-      
+
       def update
         @customer = find_customer
         @customer.attributes = params[:customer]
-        @customer.save ? 
+        @customer.save ?
           redirect_to(:action => "show") :
           render(:action => "edit")
       end
-      
+
       private
         def find_customer() Customer.find(params[:id]) end
     end
@@ -64,7 +64,7 @@ A short rundown of the major features:
     <% unless @person.is_client? %>
       Not for clients to see...
     <% end %>
-  
+
   {Learn more}[link:classes/ActionView.html]
 
 
@@ -99,24 +99,24 @@ A short rundown of the major features:
       before_filter :authenticate, :cache, :audit
       after_filter { |c| c.response.body = Gzip::compress(c.response.body) }
       after_filter LocalizeFilter
-      
+
       def index
         # Before this action is run, the user will be authenticated, the cache
         # will be examined to see if a valid copy of the results already
         # exists, and the action will be logged for auditing.
-        
-        # After this action has run, the output will first be localized then 
+
+        # After this action has run, the output will first be localized then
         # compressed to minimize bandwidth usage
       end
-      
+
       private
         def authenticate
           # Implement the filter with full access to both request and response
         end
     end
-  
+
   {Learn more}[link:classes/ActionController/Filters/ClassMethods.html]
-  
+
 
 * Helpers for forms, dates, action links, and text
 
@@ -124,26 +124,26 @@ A short rundown of the major features:
     <%= html_date_select(Date.today) %>
     <%= link_to "New post", :controller => "post", :action => "new" %>
     <%= truncate(post.title, :length => 25) %>
- 
+
   {Learn more}[link:classes/ActionView/Helpers.html]
 
 
-* Layout sharing for template reuse (think simple version of Struts 
+* Layout sharing for template reuse (think simple version of Struts
   Tiles[http://jakarta.apache.org/struts/userGuide/dev_tiles.html])
 
     class WeblogController < ActionController::Base
       layout "weblog_layout"
-      
+
       def hello_world
       end
     end
 
     Layout file (called weblog_layout):
       <html><body><%= yield %></body></html>
-    
+
     Template for hello_world action:
       <h1>Hello world</h1>
-    
+
     Result of running hello_world action:
       <html><body><h1>Hello world</h1></body></html>
 
@@ -155,26 +155,17 @@ A short rundown of the major features:
     map.connect 'clients/:client_name/:project_name/:controller/:action'
 
     Accessing /clients/37signals/basecamp/project/dash calls ProjectController#dash with
-    { "client_name" => "37signals", "project_name" => "basecamp" }.
-    
-    From that URL you can redirect providing new parameters in a number of ways:
-    
-    redirect_to :action => "edit"
-    # /clients/37signals/basecamp/project/edit
-
-    redirect_to :client_name => "nextangle", :project_name => "rails"
-    # /clients/nextangle/rails/project/dash
+    { "client_name" => "37signals", "project_name" => "basecamp" } in params[:params]
 
-  {Learn more}[link:classes/ActionController/Base.html]
+    From that URL, you can rewrite the redirect in a number of ways:
 
+    redirect_to(:action => "edit") =>
+      /clients/37signals/basecamp/project/dash
 
-* JavaScript and Ajax integration
+    redirect_to(:client_name => "nextangle", :project_name => "rails") =>
+      /clients/nextangle/rails/project/dash
 
-    link_to_function "Greeting", "alert('Hello world!')"
-    link_to_remote "Delete this post", :update => "posts", 
-                   :url => { :action => "destroy", :id => post.id }
-  
-  {Learn more}[link:classes/ActionView/Helpers/JavaScriptHelper.html]
+  {Learn more}[link:classes/ActionController/Base.html]
 
 
 * Easy testing of both controller and rendered template through ActionController::TestCase
@@ -218,18 +209,18 @@ A short rundown of the major features:
     class WeblogController < ActionController::Base
       caches_page :show
       caches_action :account
-      
+
       def show
-        # the output of the method will be cached as 
+        # the output of the method will be cached as
         # ActionController::Base.page_cache_directory + "/weblog/show/n.html"
         # and the web server will pick it up without even hitting Rails
       end
-      
+
       def account
         # the output of the method will be cached in the fragment store
         # but Rails is hit to retrieve it, so filters are run
       end
-      
+
       def update
         List.update(params[:list][:id], params[:list])
         expire_page   :action => "show", :id => params[:list][:id]
@@ -256,26 +247,26 @@ A short rundown of the major features:
     class AccountController < ActionController::Base
       scaffold :account
     end
-    
+
     The AccountController now has the full CRUD range of actions and default
     templates: list, show, destroy, new, create, edit, update
-    
+
   {Learn more}[link:classes/ActionController/Scaffolding/ClassMethods.html]
 
 
 * Form building for Active Record model objects
 
-    The post object has a title (varchar), content (text), and 
+    The post object has a title (varchar), content (text), and
     written_on (date)
 
     <%= form "post" %>
-    
+
     ...will generate something like (the selects will have more options, of
     course):
-    
+
     <form action="create" method="POST">
       <p>
-        <b>Title:</b><br/> 
+        <b>Title:</b><br/>
         <input type="text" name="post[title]" value="<%= @post.title %>" />
       </p>
       <p>
@@ -293,7 +284,7 @@ A short rundown of the major features:
     </form>
 
     This form generates a params[:post] array that can be used directly in a save action:
-    
+
     class WeblogController < ActionController::Base
       def create
         post = Post.create(params[:post])
@@ -318,19 +309,19 @@ methods:
 
   class WeblogController < ActionController::Base
     layout "weblog/layout"
-  
+
     def index
       @posts = Post.find(:all)
     end
-    
+
     def show
       @post = Post.find(params[:id])
     end
-    
+
     def new
       @post = Post.new
     end
-    
+
     def create
       @post = Post.create(params[:post])
       redirect_to :action => "show", :id => @post.id
@@ -364,7 +355,7 @@ And the templates look like this:
 
   weblog/new.html.erb:
     <%= form "post" %>
-  
+
 This simple setup will list all the posts in the system on the index page,
 which is called by accessing /weblog/. It uses the form builder for the Active
 Record model to make the new screen, which in turn hands everything over to
@@ -379,7 +370,7 @@ The latest version of Action Pack can be found at
 
 * http://rubyforge.org/project/showfiles.php?group_id=249
 
-Documentation can be found at 
+Documentation can be found at
 
 * http://api.rubyonrails.com
 

data/lib/abstract_controller.rb

@@ -0,0 +1,22 @@
+activesupport_path = File.expand_path('../../../activesupport/lib', __FILE__)
+$:.unshift(activesupport_path) if File.directory?(activesupport_path) && !$:.include?(activesupport_path)
+
+require 'active_support/ruby/shim'
+require 'active_support/dependencies/autoload'
+require 'active_support/core_ext/module/attr_internal'
+require 'active_support/core_ext/module/delegation'
+
+module AbstractController
+  extend ActiveSupport::Autoload
+
+  autoload :Base
+  autoload :Callbacks
+  autoload :Collector
+  autoload :Compatibility
+  autoload :Helpers
+  autoload :Layouts
+  autoload :LocalizedCache
+  autoload :Logger
+  autoload :Rendering
+  autoload :Translation
+end

data/lib/abstract_controller/base.rb

@@ -0,0 +1,191 @@
+module AbstractController
+  class Error < StandardError; end
+  class ActionNotFound < StandardError; end
+
+  class Base
+    attr_internal :response_body
+    attr_internal :action_name
+    attr_internal :formats
+
+    class << self
+      attr_reader :abstract
+      alias_method :abstract?, :abstract
+
+      # Define a controller as abstract. See internal_methods for more
+      # details.
+      def abstract!
+        @abstract = true
+      end
+
+      def inherited(klass)
+        ::AbstractController::Base.descendants << klass.to_s
+        super
+      end
+
+      # A list of all descendents of AbstractController::Base. This is
+      # useful for initializers which need to add behavior to all controllers.
+      def descendants
+        @descendants ||= []
+      end
+
+      # A list of all internal methods for a controller. This finds the first
+      # abstract superclass of a controller, and gets a list of all public
+      # instance methods on that abstract class. Public instance methods of
+      # a controller would normally be considered action methods, so we
+      # are removing those methods on classes declared as abstract
+      # (ActionController::Metal and ActionController::Base are defined
+      # as abstract)
+      def internal_methods
+        controller = self
+        controller = controller.superclass until controller.abstract?
+        controller.public_instance_methods(true)
+      end
+
+      # The list of hidden actions to an empty Array. Defaults to an
+      # empty Array. This can be modified by other modules or subclasses
+      # to specify particular actions as hidden.
+      #
+      # ==== Returns
+      # Array[String]:: An array of method names that should not be
+      #                 considered actions.
+      def hidden_actions
+        []
+      end
+
+      # A list of method names that should be considered actions. This
+      # includes all public instance methods on a controller, less
+      # any internal methods (see #internal_methods), adding back in
+      # any methods that are internal, but still exist on the class
+      # itself. Finally, #hidden_actions are removed.
+      #
+      # ==== Returns
+      # Array[String]:: A list of all methods that should be considered
+      #                 actions.
+      def action_methods
+        @action_methods ||= begin
+          # All public instance methods of this class, including ancestors
+          methods = public_instance_methods(true).map { |m| m.to_s }.to_set -
+            # Except for public instance methods of Base and its ancestors
+            internal_methods.map { |m| m.to_s } +
+            # Be sure to include shadowed public instance methods of this class
+            public_instance_methods(false).map { |m| m.to_s } -
+            # And always exclude explicitly hidden actions
+            hidden_actions
+
+          # Clear out AS callback method pollution
+          methods.reject { |method| method =~ /_one_time_conditions/ }
+        end
+      end
+
+      # Returns the full controller name, underscored, without the ending Controller.
+      # For instance, MyApp::MyPostsController would return "my_app/my_posts" for
+      # controller_name.
+      #
+      # ==== Returns
+      # String
+      def controller_path
+        @controller_path ||= name && name.sub(/Controller$/, '').underscore
+      end
+    end
+
+    abstract!
+
+    # Initialize controller with nil formats.
+    def initialize #:nodoc:
+      @_formats = nil
+    end
+
+    # Calls the action going through the entire action dispatch stack.
+    #
+    # The actual method that is called is determined by calling
+    # #method_for_action. If no method can handle the action, then an
+    # ActionNotFound error is raised.
+    #
+    # ==== Returns
+    # self
+    def process(action, *args)
+      @_action_name = action_name = action.to_s
+
+      unless action_name = method_for_action(action_name)
+        raise ActionNotFound, "The action '#{action}' could not be found"
+      end
+
+      @_response_body = nil
+
+      process_action(action_name, *args)
+    end
+
+    # Delegates to the class' #controller_path
+    def controller_path
+      self.class.controller_path
+    end
+
+    def action_methods
+      self.class.action_methods
+    end
+
+    private
+      # Returns true if the name can be considered an action. This can
+      # be overridden in subclasses to modify the semantics of what
+      # can be considered an action.
+      #
+      # ==== Parameters
+      # name<String>:: The name of an action to be tested
+      #
+      # ==== Returns
+      # TrueClass, FalseClass
+      def action_method?(name)
+        self.class.action_methods.include?(name)
+      end
+
+      # Call the action. Override this in a subclass to modify the
+      # behavior around processing an action. This, and not #process,
+      # is the intended way to override action dispatching.
+      def process_action(method_name, *args)
+        send_action(method_name, *args)
+      end
+
+      # Actually call the method associated with the action. Override
+      # this method if you wish to change how action methods are called,
+      # not to add additional behavior around it. For example, you would
+      # override #send_action if you want to inject arguments into the
+      # method.
+      alias send_action send
+
+      # If the action name was not found, but a method called "action_missing"
+      # was found, #method_for_action will return "_handle_action_missing".
+      # This method calls #action_missing with the current action name.
+      def _handle_action_missing
+        action_missing(@_action_name)
+      end
+
+      # Takes an action name and returns the name of the method that will
+      # handle the action. In normal cases, this method returns the same
+      # name as it receives. By default, if #method_for_action receives
+      # a name that is not an action, it will look for an #action_missing
+      # method and return "_handle_action_missing" if one is found.
+      #
+      # Subclasses may override this method to add additional conditions
+      # that should be considered an action. For instance, an HTTP controller
+      # with a template matching the action name is considered to exist.
+      #
+      # If you override this method to handle additional cases, you may
+      # also provide a method (like _handle_method_missing) to handle
+      # the case.
+      #
+      # If none of these conditions are true, and method_for_action
+      # returns nil, an ActionNotFound exception will be raised.
+      #
+      # ==== Parameters
+      # action_name<String>:: An action name to find a method name for
+      #
+      # ==== Returns
+      # String:: The name of the method that handles the action
+      # nil::    No method name could be found. Raise ActionNotFound.
+      def method_for_action(action_name)
+        if action_method?(action_name) then action_name
+        elsif respond_to?(:action_missing, true) then "_handle_action_missing"
+        end
+      end
+  end
+end