actionpack 4.1.14.1 → 4.1.14.2

Sign up to get free protection for your applications and to get access to all the features.

Potentially problematic release.

This version of actionpack might be problematic. Click here for more details.

Files changed (5) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +14 -0
  3. data/lib/abstract_controller/rendering.rb +5 -5
  4. data/lib/action_pack/gem_version.rb +1 -1
  5. metadata +8 -8
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA1:
3
- metadata.gz: 5b640d7f98307eb1b7a059c99c9dce9b7739adee
4
- data.tar.gz: 3c9170fe7b6551a9a9754eec569e2066a38b05b4
3
+ metadata.gz: 8b48de0dcb0b60febd912f8d0b016bfcf75348c6
4
+ data.tar.gz: 9598423c008d62382d358d2e29ff910e402db2aa
5
5
  SHA512:
6
- metadata.gz: e0a9862c2f96e3764c694d0eb6e09f086e0f73ec5908fd46ae01981e75247cd530adb241234eb8e73a29fd3adde949e601f27cdd8bc225ab6c9e232e21a0910b
7
- data.tar.gz: 2cd2ba5527130b8859e6f4a349dd4993da8d6c155d82a2418fb69bf1c6fccecf55ffd49a57f52d0bc00d5a91c2be9585db4fd84e49aaa64aa60a76173456ee83
6
+ metadata.gz: a7f4c59c40888c916e8b8f3d2079ea9be6ea6563a7a7e3ae05084ffe94413eb875de1129ca61fa7b300b00187f37d83b9371df7238acf60a66f5aacb4685e55c
7
+ data.tar.gz: de6fe9288fc725fb27cc2eac2ca27ce6f3319b7da40846d186a69e50995420cf0d6b981cf53eb2ac7062c19b3a806b14c42932c40b4a2fa4b91846ebfe8fd41f
data/CHANGELOG.md CHANGED
@@ -1,3 +1,17 @@
1
+ ## Rails 4.1.14.2 (February 26, 2016) ##
2
+
3
+ * Do not allow render with unpermitted parameter.
4
+
5
+ Fixes CVE-2016-2098.
6
+
7
+ *Arthur Neves*
8
+
9
+
10
+ ## Rails 4.1.14.1 (January 25, 2015) ##
11
+
12
+ * No changes.
13
+
14
+
1
15
  ## Rails 4.1.14 (November 12, 2015) ##
2
16
 
3
17
  * No changes.
data/lib/abstract_controller/rendering.rb CHANGED
@@ -77,13 +77,13 @@ module AbstractController
77
77
  # render "foo/bar" to render :file => "foo/bar".
78
78
  # :api: plugin
79
79
  def _normalize_args(action=nil, options={})
80
- case action
81
- when ActionController::Parameters
82
- unless action.permitted?
80
+ if action.respond_to?(:permitted?)
81
+ if action.permitted?
82
+ action
83
+ else
83
84
  raise ArgumentError, "render parameters are not permitted"
84
85
  end
85
- action
86
- when Hash
86
+ elsif action.is_a?(Hash)
87
87
  action
88
88
  else
89
89
  options
data/lib/action_pack/gem_version.rb CHANGED
@@ -8,7 +8,7 @@ module ActionPack
8
8
  MAJOR = 4
9
9
  MINOR = 1
10
10
  TINY = 14
11
- PRE = "1"
11
+ PRE = "2"
12
12
 
13
13
  STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
14
14
  end
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: actionpack
3
3
  version: !ruby/object:Gem::Version
4
- version: 4.1.14.1
4
+ version: 4.1.14.2
5
5
  platform: ruby
6
6
  authors:
7
7
  - David Heinemeier Hansson
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2016-01-25 00:00:00.000000000 Z
11
+ date: 2016-02-29 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: activesupport
@@ -16,14 +16,14 @@ dependencies:
16
16
  requirements:
17
17
  - - '='
18
18
  - !ruby/object:Gem::Version
19
- version: 4.1.14.1
19
+ version: 4.1.14.2
20
20
  type: :runtime
21
21
  prerelease: false
22
22
  version_requirements: !ruby/object:Gem::Requirement
23
23
  requirements:
24
24
  - - '='
25
25
  - !ruby/object:Gem::Version
26
- version: 4.1.14.1
26
+ version: 4.1.14.2
27
27
  - !ruby/object:Gem::Dependency
28
28
  name: rack
29
29
  requirement: !ruby/object:Gem::Requirement
@@ -58,28 +58,28 @@ dependencies:
58
58
  requirements:
59
59
  - - '='
60
60
  - !ruby/object:Gem::Version
61
- version: 4.1.14.1
61
+ version: 4.1.14.2
62
62
  type: :runtime
63
63
  prerelease: false
64
64
  version_requirements: !ruby/object:Gem::Requirement
65
65
  requirements:
66
66
  - - '='
67
67
  - !ruby/object:Gem::Version
68
- version: 4.1.14.1
68
+ version: 4.1.14.2
69
69
  - !ruby/object:Gem::Dependency
70
70
  name: activemodel
71
71
  requirement: !ruby/object:Gem::Requirement
72
72
  requirements:
73
73
  - - '='
74
74
  - !ruby/object:Gem::Version
75
- version: 4.1.14.1
75
+ version: 4.1.14.2
76
76
  type: :development
77
77
  prerelease: false
78
78
  version_requirements: !ruby/object:Gem::Requirement
79
79
  requirements:
80
80
  - - '='
81
81
  - !ruby/object:Gem::Version
82
- version: 4.1.14.1
82
+ version: 4.1.14.2
83
83
  description: Web apps on Rails. Simple, battle-tested conventions for building and
84
84
  testing MVC web applications. Works with any Rack-compatible server.
85
85
  email: david@loudthinking.com