actionpack 3.0.19 → 3.0.20

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-!binary "U0hBMQ==":
-  metadata.gz: 0a7e9ae651abc0a3754a626d318b31c2b803d595
-  data.tar.gz: 73f5d21b129de3cddf43e3f392b79c444ced9996
-!binary "U0hBNTEy":
-  metadata.gz: e60a6daeae274813b631e95716981782f699fd2e73e86f89e2a89cfdd6c780f76b5ae809a593895b315a88a4c76304e3b06a8be7c29fd1d4f603c693ab4eabb2
-  data.tar.gz: 83a4577c0c9d8fdefa4c5f05e2724462e13d75dcd6f1ef40671a949d9a38139755f72776006794cfe3024176c15062db95e8b8227e0cad92a93dcfbf66806bc9
+SHA1:
+  metadata.gz: 1233f96f807c0dc8b447b84b7b7d031267147203
+  data.tar.gz: d1a329c22c422cf76385feda31f9200f4afe1b10
+SHA512:
+  metadata.gz: c9a95139477e0cfa773bb32f27e18588d79580402313f865f5193a308c8d422dced7e957e4e46422501f7020d5a957ec0f5996a910b7f240314353b82fbbc462
+  data.tar.gz: 232a6d69810531cb7496203f04a304f6b9cab4c5180bf2c34ddfc29775d375dae3e5d7da3782497888692aaf007fdf1aac8e0e42885f68cbc875e4d5e615adbf

data/CHANGELOG

@@ -1,8 +1,14 @@
-## Rails 3.0.19
+## Rails 3.0.20 (unreleased)
+
+* Fixed JSON params parsing regression for non-object JSON content.
+
+## Rails 3.0.19 (Jan 8, 2013)
 
 * Strip nils from collections on JSON and XML posts. [CVE-2013-0155]
 
-## Rails 3.0.18
+## Rails 3.0.18 (Jan 2, 2013)
+
+* No changes.
 
 ## Rails 3.0.17 (Aug 9, 2012)
 
@@ -13,9 +19,9 @@
 
   *Marek from Nethemba (www.nethemba.com) & Santiago Pastorino*
 
-* When a "prompt" value is supplied to the `select_tag` helper, the "prompt" value is not escaped.  If untrusted data is not escaped, and is supplied as the prompt value, there is a potential for XSS attacks.
+* When an "include_blank" value is supplied to the `select_tag` helper, the "include_blank" value is not escaped.  If untrusted data is not escaped, and is supplied as the prompt value, there is a potential for XSS attacks.
   Vulnerable code will look something like this:
-    select_tag("name", options, :prompt => UNTRUSTED_INPUT)
+    select_tag("name", options, :include_blank => UNTRUSTED_INPUT)
 
   *Santiago Pastorino*
 

data/lib/action_dispatch/http/filter_parameters.rb

@@ -26,8 +26,6 @@ module ActionDispatch
     module FilterParameters
       extend ActiveSupport::Concern
 
-      @@parameter_filter_for  = {}
-
       # Return a hash of parameters with all sensitive data replaced.
       def filtered_parameters
         @filtered_parameters ||= parameter_filter.filter(parameters)
@@ -54,7 +52,7 @@ module ActionDispatch
       end
 
       def parameter_filter_for(filters)
-        @@parameter_filter_for[filters] ||= ParameterFilter.new(filters)
+        ParameterFilter.new(filters)
       end
 
       KV_RE   = '[^&;=]+'

data/lib/action_dispatch/middleware/params_parser.rb

@@ -44,10 +44,10 @@ module ActionDispatch
         when :yaml
           YAML.load(request.raw_post)
         when :json
-          data = request.deep_munge ActiveSupport::JSON.decode(request.body)
+          data = ActiveSupport::JSON.decode(request.body)
           request.body.rewind if request.body.respond_to?(:rewind)
           data = {:_json => data} unless data.is_a?(Hash)
-          data.with_indifferent_access
+          request.deep_munge(data).with_indifferent_access
         else
           false
         end

data/lib/action_pack/version.rb

@@ -2,7 +2,7 @@ module ActionPack
   module VERSION #:nodoc:
     MAJOR = 3
     MINOR = 0
-    TINY  = 19
+    TINY  = 20
     PRE   = nil
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.')

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: actionpack
 version: !ruby/object:Gem::Version
-  version: 3.0.19
+  version: 3.0.20
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-01-08 00:00:00.000000000 Z
+date: 2013-01-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,28 +16,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.0.19
+        version: 3.0.20
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.0.19
+        version: 3.0.20
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.0.19
+        version: 3.0.20
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.0.19
+        version: 3.0.20
 - !ruby/object:Gem::Dependency
   name: builder
   requirement: !ruby/object:Gem::Requirement
@@ -327,7 +327,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements:
 - none
 rubyforge_project: actionpack
-rubygems_version: 2.0.0.preview3
+rubygems_version: 2.0.0.preview3.1
 signing_key: 
 specification_version: 4
 summary: Web-flow and rendering framework putting the VC in MVC (part of Rails).