actionview 4.2.5.1 → 4.2.5.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: f94cd4ae116eb1df1a7c8ea64184ac6c65f14040
-  data.tar.gz: 404b5622ddd7f59c6143ed73ffdaa03ec7e7c4a9
+  metadata.gz: c1c1ffcc325396c04316a0d309fcb858f9eec5b1
+  data.tar.gz: 3030d020724c256777659f2c9a7dfa445cb84360
 SHA512:
-  metadata.gz: 3c1510d4ab8e62ba7792ccc289cb298709604884b34db1c296b8bf7752c4c87123308b9fa33c0de99fd7b68aa9073804d70149812406261d423e8a9032748027
-  data.tar.gz: a66bb7bc49a2e4786329172b9749d7476ca75d3d0bfde1a55f8f48c60e914befccbe031de605cec14c320c5adf3b6f66a264eccf80c45bd708b7facbaa238ec2
+  metadata.gz: 9012619bedc05a4ba84268291dabd997dc238c9a629820b5d5cdd14906851c9c02b34b117e49efdf7d92389b4824a26f3c5c05c91f173f819ded1518325eb7d6
+  data.tar.gz: 6c02cdae8743cfec0ef44d7e27fac8d182e934406094e90cde3dc245d605f59a3202e154486c2782cf28b9d7433ceb1375a9e85757d77b9162484f395f1ef35c

data/CHANGELOG.md

@@ -1,3 +1,20 @@
+## Rails 4.2.5.2 (February 26, 2016) ##
+
+*   Do not allow render with unpermitted parameter.
+
+    Fixes CVE-2016-2098.
+
+    *Arthur Neves*
+
+
+## Rails 4.2.5.1 (January 25, 2015) ##
+
+*   Adds boolean argument outside_app_allowed to `ActionView::Resolver#find_templates`
+    method.
+
+    *Aaron Patterson*
+
+
 ## Rails 4.2.5 (November 12, 2015) ##
 
 *   Fix `mail_to` when called with `nil` as argument.

data/lib/action_view/gem_version.rb

@@ -8,7 +8,7 @@ module ActionView
     MAJOR = 4
     MINOR = 2
     TINY  = 5
-    PRE   = "1"
+    PRE   = "2"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

data/lib/action_view/renderer/renderer.rb

@@ -17,6 +17,10 @@ module ActionView
 
     # Main render entry point shared by AV and AC.
     def render(context, options)
+      if options.respond_to?(:permitted?) && !options.permitted?
+        raise ArgumentError, "render parameters are not permitted"
+      end
+
       if options.key?(:partial)
         render_partial(context, options)
       else

data/lib/action_view/template/resolver.rb

@@ -130,8 +130,8 @@ module ActionView
     # This is what child classes implement. No defaults are needed
     # because Resolver guarantees that the arguments are present and
     # normalized.
-    def find_templates(name, prefix, partial, details)
-      raise NotImplementedError, "Subclasses must implement a find_templates(name, prefix, partial, details) method"
+    def find_templates(name, prefix, partial, details, outside_app_allowed)
+      raise NotImplementedError, "Subclasses must implement a find_templates(name, prefix, partial, details, outside_app_allowed) method"
     end
 
     # Helpers that builds a path. Useful for building virtual paths.

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: actionview
 version: !ruby/object:Gem::Version
-  version: 4.2.5.1
+  version: 4.2.5.2
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-01-25 00:00:00.000000000 Z
+date: 2016-02-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.2.5.1
+        version: 4.2.5.2
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.2.5.1
+        version: 4.2.5.2
 - !ruby/object:Gem::Dependency
   name: builder
   requirement: !ruby/object:Gem::Requirement
@@ -98,28 +98,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.2.5.1
+        version: 4.2.5.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.2.5.1
+        version: 4.2.5.2
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.2.5.1
+        version: 4.2.5.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.2.5.1
+        version: 4.2.5.2
 description: Simple, battle-tested conventions and helpers for building web pages.
 email: david@loudthinking.com
 executables: []