actionview 5.0.7.2 → 5.1.7

data/lib/action_view/helpers/url_helper.rb

@@ -1,7 +1,7 @@
-require 'action_view/helpers/javascript_helper'
-require 'active_support/core_ext/array/access'
-require 'active_support/core_ext/hash/keys'
-require 'active_support/core_ext/string/output_safety'
+require "action_view/helpers/javascript_helper"
+require "active_support/core_ext/array/access"
+require "active_support/core_ext/hash/keys"
+require "active_support/core_ext/string/output_safety"
 
 module ActionView
   # = Action View URL Helpers
@@ -35,20 +35,20 @@ module ActionView
         when :back
           _back_url
         else
-          raise ArgumentError, "arguments passed to url_for can't be handled. Please require " +
+          raise ArgumentError, "arguments passed to url_for can't be handled. Please require " \
                                "routes or provide your own implementation"
         end
       end
 
       def _back_url # :nodoc:
-        _filtered_referrer || 'javascript:history.back()'
+        _filtered_referrer || "javascript:history.back()"
       end
       protected :_back_url
 
       def _filtered_referrer # :nodoc:
         if controller.respond_to?(:request)
           referrer = controller.request.env["HTTP_REFERER"]
-          if referrer && URI(referrer).scheme != 'javascript'
+          if referrer && URI(referrer).scheme != "javascript"
             referrer
           end
         end
@@ -105,10 +105,9 @@ module ActionView
       #   driver to prompt with the question specified (in this case, the
       #   resulting text would be <tt>question?</tt>. If the user accepts, the
       #   link is processed normally, otherwise no action is taken.
-      # * <tt>:disable_with</tt> - Value of this parameter will be
-      #   used as the value for a disabled version of the submit
-      #   button when the form is submitted. This feature is provided
-      #   by the unobtrusive JavaScript driver.
+      # * <tt>:disable_with</tt> - Value of this parameter will be used as the
+      #   name for a disabled version of the link. This feature is provided by
+      #   the unobtrusive JavaScript driver.
       #
       # ==== Examples
       # Because it relies on +url_for+, +link_to+ supports both older-style controller/action/id arguments
@@ -298,34 +297,34 @@ module ActionView
         html_options = html_options.stringify_keys
 
         url    = options.is_a?(String) ? options : url_for(options)
-        remote = html_options.delete('remote')
-        params = html_options.delete('params')
+        remote = html_options.delete("remote")
+        params = html_options.delete("params")
 
-        method     = html_options.delete('method').to_s
-        method_tag = BUTTON_TAG_METHOD_VERBS.include?(method) ? method_tag(method) : ''.freeze.html_safe
+        method     = html_options.delete("method").to_s
+        method_tag = BUTTON_TAG_METHOD_VERBS.include?(method) ? method_tag(method) : "".freeze.html_safe
 
-        form_method  = method == 'get' ? 'get' : 'post'
-        form_options = html_options.delete('form') || {}
-        form_options[:class] ||= html_options.delete('form_class') || 'button_to'
+        form_method  = method == "get" ? "get" : "post"
+        form_options = html_options.delete("form") || {}
+        form_options[:class] ||= html_options.delete("form_class") || "button_to"
         form_options[:method] = form_method
         form_options[:action] = url
         form_options[:'data-remote'] = true if remote
 
-        request_token_tag = if form_method == 'post'
-          request_method = method.empty? ? 'post' : method
+        request_token_tag = if form_method == "post"
+          request_method = method.empty? ? "post" : method
           token_tag(nil, form_options: { action: url, method: request_method })
         else
-          ''.freeze
+          "".freeze
         end
 
         html_options = convert_options_to_data_attributes(options, html_options)
-        html_options['type'] = 'submit'
+        html_options["type"] = "submit"
 
         button = if block_given?
-          content_tag('button', html_options, &block)
+          content_tag("button", html_options, &block)
         else
-          html_options['value'] = name || url
-          tag('input', html_options)
+          html_options["value"] = name || url
+          tag("input", html_options)
         end
 
         inner_tags = method_tag.safe_concat(button).safe_concat(request_token_tag)
@@ -334,7 +333,7 @@ module ActionView
             inner_tags.safe_concat tag(:input, type: "hidden", name: param[:name], value: param[:value])
           end
         end
-        content_tag('form', inner_tags, form_options)
+        content_tag("form", inner_tags, form_options)
       end
 
       # Creates a link tag of the given +name+ using a URL created by the set of
@@ -481,7 +480,7 @@ module ActionView
           option = html_options.delete(item).presence || next
           "#{item.dasherize}=#{ERB::Util.url_encode(option)}"
         }.compact
-        extras = extras.empty? ? ''.freeze : '?' + extras.join('&')
+        extras = extras.empty? ? "".freeze : "?" + extras.join("&")
 
         encoded_email_address = ERB::Util.url_encode(email_address).gsub("%40", "@")
         html_options["href"] = "mailto:#{encoded_email_address}#{extras}"
@@ -518,6 +517,9 @@ module ActionView
       #   current_page?('http://www.example.com/shop/checkout')
       #   # => true
       #
+      #   current_page?('http://www.example.com/shop/checkout', check_parameters: true)
+      #   # => false
+      #
       #   current_page?('/shop/checkout')
       #   # => true
       #
@@ -531,7 +533,7 @@ module ActionView
       #
       # We can also pass in the symbol arguments instead of strings.
       #
-      def current_page?(options)
+      def current_page?(options, check_parameters: false)
         unless request
           raise "You cannot use helpers that need to determine the current " \
                 "page unless your view context provides a Request object " \
@@ -540,17 +542,22 @@ module ActionView
 
         return false unless request.get? || request.head?
 
+        check_parameters ||= options.is_a?(Hash) && options.delete(:check_parameters)
         url_string = URI.parser.unescape(url_for(options)).force_encoding(Encoding::BINARY)
 
         # We ignore any extra parameters in the request_uri if the
         # submitted url doesn't have any either. This lets the function
         # work with things like ?order=asc
-        request_uri = url_string.index("?") ? request.fullpath : request.path
+        # the behaviour can be disabled with check_parameters: true
+        request_uri = url_string.index("?") || check_parameters ? request.fullpath : request.path
         request_uri = URI.parser.unescape(request_uri).force_encoding(Encoding::BINARY)
 
-        url_string.chomp!("/") if url_string.start_with?("/") && url_string != "/"
+        if url_string.start_with?("/") && url_string != "/"
+          url_string.chomp!("/")
+          request_uri.chomp!("/")
+        end
 
-        if url_string =~ /^\w+:\/\//
+        if %r{^\w+://}.match?(url_string)
           url_string == "#{request.protocol}#{request.host_with_port}#{request_uri}"
         else
           url_string == request_uri
@@ -561,21 +568,21 @@ module ActionView
         def convert_options_to_data_attributes(options, html_options)
           if html_options
             html_options = html_options.stringify_keys
-            html_options['data-remote'] = 'true'.freeze if link_to_remote_options?(options) || link_to_remote_options?(html_options)
+            html_options["data-remote"] = "true".freeze if link_to_remote_options?(options) || link_to_remote_options?(html_options)
 
-            method  = html_options.delete('method'.freeze)
+            method = html_options.delete("method".freeze)
 
             add_method_to_attributes!(html_options, method) if method
 
             html_options
           else
-            link_to_remote_options?(options) ? {'data-remote' => 'true'.freeze} : {}
+            link_to_remote_options?(options) ? { "data-remote" => "true".freeze } : {}
           end
         end
 
         def link_to_remote_options?(options)
           if options.is_a?(Hash)
-            options.delete('remote'.freeze) || options.delete(:remote)
+            options.delete("remote".freeze) || options.delete(:remote)
           end
         end
 
@@ -586,24 +593,24 @@ module ActionView
           html_options["data-method".freeze] = method
         end
 
-        def token_tag(token=nil, form_options: {})
+        def token_tag(token = nil, form_options: {})
           if token != false && protect_against_forgery?
             token ||= form_authenticity_token(form_options: form_options)
             tag(:input, type: "hidden", name: request_forgery_protection_token.to_s, value: token)
           else
-            ''.freeze
+            "".freeze
           end
         end
 
         def method_tag(method)
-          tag('input', type: 'hidden', name: '_method', value: method.to_s)
+          tag("input", type: "hidden", name: "_method", value: method.to_s)
         end
 
         # Returns an array of hashes each containing :name and :value keys
         # suitable for use as the names and values of form input fields:
         #
         #   to_form_params(name: 'David', nationality: 'Danish')
-        #   # => [{name: :name, value: 'David'}, {name: 'nationality', value: 'Danish'}]
+        #   # => [{name: 'name', value: 'David'}, {name: 'nationality', value: 'Danish'}]
         #
         #   to_form_params(country: {name: 'Denmark'})
         #   # => [{name: 'country[name]', value: 'Denmark'}]
@@ -615,13 +622,8 @@ module ActionView
         #
         #   to_form_params({ name: 'Denmark' }, 'country')
         #   # => [{name: 'country[name]', value: 'Denmark'}]
-        def to_form_params(attribute, namespace = nil) # :nodoc:
+        def to_form_params(attribute, namespace = nil)
           attribute = if attribute.respond_to?(:permitted?)
-            unless attribute.permitted?
-              raise ArgumentError, "Attempting to generate a buttom from non-sanitized request parameters!" \
-                " Whitelist and sanitize passed parameters to be secure."
-            end
-
             attribute.to_h
           else
             attribute
@@ -640,7 +642,7 @@ module ActionView
               params.push(*to_form_params(value, array_prefix))
             end
           else
-            params << { name: namespace, value: attribute.to_param }
+            params << { name: namespace.to_s, value: attribute.to_param }
           end
 
           params.sort_by { |pair| pair[:name] }

data/lib/action_view/helpers.rb

@@ -1,4 +1,4 @@
-require 'active_support/benchmarkable'
+require "active_support/benchmarkable"
 
 module ActionView #:nodoc:
   module Helpers #:nodoc:

data/lib/action_view/layouts.rb

@@ -91,16 +91,16 @@ module ActionView
   #     layout false
   #
   # In these examples, we have three implicit lookup scenarios:
-  # * The BankController uses the "bank" layout.
-  # * The ExchangeController uses the "exchange" layout.
-  # * The CurrencyController inherits the layout from BankController.
+  # * The +BankController+ uses the "bank" layout.
+  # * The +ExchangeController+ uses the "exchange" layout.
+  # * The +CurrencyController+ inherits the layout from BankController.
   #
   # However, when a layout is explicitly set, the explicitly set layout wins:
-  # * The InformationController uses the "information" layout, explicitly set.
-  # * The TellerController also uses the "information" layout, because the parent explicitly set it.
-  # * The EmployeeController uses the "employee" layout, because it set the layout to nil, resetting the parent configuration.
-  # * The VaultController chooses a layout dynamically by calling the <tt>access_level_layout</tt> method.
-  # * The TillController does not use a layout at all.
+  # * The +InformationController+ uses the "information" layout, explicitly set.
+  # * The +TellerController+ also uses the "information" layout, because the parent explicitly set it.
+  # * The +EmployeeController+ uses the "employee" layout, because it set the layout to +nil+, resetting the parent configuration.
+  # * The +VaultController+ chooses a layout dynamically by calling the <tt>access_level_layout</tt> method.
+  # * The +TillController+ does not use a layout at all.
   #
   # == Types of layouts
   #
@@ -148,8 +148,8 @@ module ActionView
   # The template will be looked always in <tt>app/views/layouts/</tt> folder. But you can point
   # <tt>layouts</tt> folder direct also. <tt>layout "layouts/demo"</tt> is the same as <tt>layout "demo"</tt>.
   #
-  # Setting the layout to nil forces it to be looked up in the filesystem and fallbacks to the parent behavior if none exists.
-  # Setting it to nil is useful to re-enable template lookup overriding a previous configuration set in the parent:
+  # Setting the layout to +nil+ forces it to be looked up in the filesystem and fallbacks to the parent behavior if none exists.
+  # Setting it to +nil+ is useful to re-enable template lookup overriding a previous configuration set in the parent:
   #
   #     class ApplicationController < ActionController::Base
   #       layout "application"
@@ -204,7 +204,7 @@ module ActionView
     include ActionView::Rendering
 
     included do
-      class_attribute :_layout, :_layout_conditions, :instance_accessor => false
+      class_attribute :_layout, :_layout_conditions, instance_accessor: false
       self._layout = nil
       self._layout_conditions = {}
       _write_layout_method
@@ -223,36 +223,39 @@ module ActionView
       module LayoutConditions # :nodoc:
         private
 
-        # Determines whether the current action has a layout definition by
-        # checking the action name against the :only and :except conditions
-        # set by the <tt>layout</tt> method.
-        #
-        # ==== Returns
-        # * <tt>Boolean</tt> - True if the action has a layout definition, false otherwise.
-        def _conditional_layout?
-          return unless super
-
-          conditions = _layout_conditions
-
-          if only = conditions[:only]
-            only.include?(action_name)
-          elsif except = conditions[:except]
-            !except.include?(action_name)
-          else
-            true
+          # Determines whether the current action has a layout definition by
+          # checking the action name against the :only and :except conditions
+          # set by the <tt>layout</tt> method.
+          #
+          # ==== Returns
+          # * <tt>Boolean</tt> - True if the action has a layout definition, false otherwise.
+          def _conditional_layout?
+            return unless super
+
+            conditions = _layout_conditions
+
+            if only = conditions[:only]
+              only.include?(action_name)
+            elsif except = conditions[:except]
+              !except.include?(action_name)
+            else
+              true
+            end
           end
-        end
       end
 
       # Specify the layout to use for this class.
       #
       # If the specified layout is a:
       # String:: the String is the template name
-      # Symbol:: call the method specified by the symbol, which will return the template name
+      # Symbol:: call the method specified by the symbol
+      # Proc::   call the passed Proc
       # false::  There is no layout
       # true::   raise an ArgumentError
       # nil::    Force default layout behavior with inheritance
       #
+      # Return value of +Proc+ and +Symbol+ arguments should be +String+, +false+, +true+ or +nil+
+      # with the same meaning as described above.
       # ==== Parameters
       # * <tt>layout</tt> - The layout to use.
       #
@@ -262,7 +265,7 @@ module ActionView
       def layout(layout, conditions = {})
         include LayoutConditions unless conditions.empty?
 
-        conditions.each {|k, v| conditions[k] = Array(v).map(&:to_s) }
+        conditions.each { |k, v| conditions[k] = Array(v).map(&:to_s) }
         self._layout_conditions = conditions
 
         self._layout = layout
@@ -276,7 +279,7 @@ module ActionView
       def _write_layout_method # :nodoc:
         remove_possible_method(:_layout)
 
-        prefixes    = _implied_layout_name =~ /\blayouts/ ? [] : ["layouts"]
+        prefixes = /\blayouts/.match?(_implied_layout_name) ? [] : ["layouts"]
         default_behavior = "lookup_context.find_all('#{_implied_layout_name}', #{prefixes.inspect}, false, [], { formats: formats }).first || super"
         name_clause = if name
           default_behavior
@@ -286,7 +289,8 @@ module ActionView
           RUBY
         end
 
-        layout_definition = case _layout
+        layout_definition = \
+          case _layout
           when String
             _layout.inspect
           when Symbol
@@ -313,9 +317,9 @@ module ActionView
             raise ArgumentError, "Layouts must be specified as a String, Symbol, Proc, false, or nil"
           when nil
             name_clause
-        end
+          end
 
-        self.class_eval <<-RUBY, __FILE__, __LINE__ + 1
+        class_eval <<-RUBY, __FILE__, __LINE__ + 1
           def _layout(formats)
             if _conditional_layout?
               #{layout_definition}
@@ -329,14 +333,14 @@ module ActionView
 
       private
 
-      # If no layout is supplied, look for a template named the return
-      # value of this method.
-      #
-      # ==== Returns
-      # * <tt>String</tt> - A template name
-      def _implied_layout_name # :nodoc:
-        controller_path
-      end
+        # If no layout is supplied, look for a template named the return
+        # value of this method.
+        #
+        # ==== Returns
+        # * <tt>String</tt> - A template name
+        def _implied_layout_name
+          controller_path
+        end
     end
 
     def _normalize_options(options) # :nodoc:
@@ -400,11 +404,11 @@ module ActionView
     #
     # ==== Parameters
     # * <tt>formats</tt> - The formats accepted to this layout
-    # * <tt>require_layout</tt> - If set to true and layout is not found,
-    #   an +ArgumentError+ exception is raised (defaults to false)
+    # * <tt>require_layout</tt> - If set to +true+ and layout is not found,
+    #   an +ArgumentError+ exception is raised (defaults to +false+)
     #
     # ==== Returns
-    # * <tt>template</tt> - The template object for the default layout (or nil)
+    # * <tt>template</tt> - The template object for the default layout (or +nil+)
     def _default_layout(formats, require_layout = false)
       begin
         value = _layout(formats) if action_has_layout?
@@ -421,7 +425,7 @@ module ActionView
     end
 
     def _include_layout?(options)
-      (options.keys & [:body, :text, :plain, :html, :inline, :partial]).empty? || options.key?(:layout)
+      (options.keys & [:body, :plain, :html, :inline, :partial]).empty? || options.key?(:layout)
     end
   end
 end

data/lib/action_view/log_subscriber.rb

@@ -1,4 +1,4 @@
-require 'active_support/log_subscriber'
+require "active_support/log_subscriber"
 
 module ActionView
   # = Action View Log Subscriber
@@ -19,10 +19,19 @@ module ActionView
         message << " (#{event.duration.round(1)}ms)"
       end
     end
-    alias :render_partial :render_template
+
+    def render_partial(event)
+      info do
+        message = "  Rendered #{from_rails_root(event.payload[:identifier])}"
+        message << " within #{from_rails_root(event.payload[:layout])}" if event.payload[:layout]
+        message << " (#{event.duration.round(1)}ms)"
+        message << " #{cache_message(event.payload)}" unless event.payload[:cache_hit].nil?
+        message
+      end
+    end
 
     def render_collection(event)
-      identifier = event.payload[:identifier] || 'templates'
+      identifier = event.payload[:identifier] || "templates"
 
       info do
         "  Rendered collection of #{from_rails_root(identifier)}" \
@@ -42,20 +51,20 @@ module ActionView
       ActionView::Base.logger
     end
 
-  protected
+  private
 
-    EMPTY = ''
-    def from_rails_root(string)
+    EMPTY = ""
+    def from_rails_root(string) # :doc:
       string = string.sub(rails_root, EMPTY)
       string.sub!(VIEWS_PATTERN, EMPTY)
       string
     end
 
-    def rails_root
+    def rails_root # :doc:
       @root ||= "#{Rails.root}/"
     end
 
-    def render_count(payload)
+    def render_count(payload) # :doc:
       if payload[:cache_hits]
         "[#{payload[:cache_hits]} / #{payload[:count]} cache hits]"
       else
@@ -63,7 +72,14 @@ module ActionView
       end
     end
 
-  private
+    def cache_message(payload) # :doc:
+      case payload[:cache_hit]
+      when :hit
+        "[cache hit]"
+      when :miss
+        "[cache miss]"
+      end
+    end
 
     def log_rendering_start(payload)
       info do

data/lib/action_view/lookup_context.rb

@@ -1,7 +1,7 @@
-require 'concurrent/map'
-require 'active_support/core_ext/module/remove_method'
-require 'active_support/core_ext/module/attribute_accessors'
-require 'action_view/template/resolver'
+require "concurrent/map"
+require "active_support/core_ext/module/remove_method"
+require "active_support/core_ext/module/attribute_accessors"
+require "action_view/template/resolver"
 
 module ActionView
   # = Action View Lookup Context
@@ -21,7 +21,7 @@ module ActionView
     self.registered_details = []
 
     def self.register_detail(name, &block)
-      self.registered_details << name
+      registered_details << name
       Accessors::DEFAULT_PROCS[name] = block
 
       Accessors.send :define_method, :"default_#{name}", &block
@@ -63,7 +63,7 @@ module ActionView
           details = details.dup
           details[:formats] &= Template::Types.symbols
         end
-        @details_keys[details] ||= new
+        @details_keys[details] ||= Concurrent::Map.new
       end
 
       def self.clear
@@ -71,13 +71,7 @@ module ActionView
       end
 
       def self.digest_caches
-        @details_keys.values.map(&:digest_cache)
-      end
-
-      attr_reader :digest_cache
-
-      def initialize
-        @digest_cache = Concurrent::Map.new
+        @details_keys.values
       end
     end
 
@@ -99,9 +93,9 @@ module ActionView
         @cache = old_value
       end
 
-    protected
+    private
 
-      def _set_detail(key, value)
+      def _set_detail(key, value) # :doc:
         @details = @details.dup if @details_key
         @details_key = nil
         @details[key] = value
@@ -155,16 +149,16 @@ module ActionView
         added_resolvers.times { view_paths.pop }
       end
 
-    protected
+    private
 
-      def args_for_lookup(name, prefixes, partial, keys, details_options) #:nodoc:
+      def args_for_lookup(name, prefixes, partial, keys, details_options)
         name, prefixes = normalize_name(name, prefixes)
         details, details_key = detail_args_for(details_options)
         [name, prefixes, partial || false, details, details_key, keys]
       end
 
       # Compute details hash and key according to user options (e.g. passed from #render).
-      def detail_args_for(options)
+      def detail_args_for(options) # :doc:
         return @details, details_key if options.empty? # most common path.
         user_details = @details.merge(options)
 
@@ -177,13 +171,13 @@ module ActionView
         [user_details, details_key]
       end
 
-      def args_for_any(name, prefixes, partial) # :nodoc:
+      def args_for_any(name, prefixes, partial)
         name, prefixes = normalize_name(name, prefixes)
         details, details_key = detail_args_for_any
         [name, prefixes, partial || false, details, details_key]
       end
 
-      def detail_args_for_any # :nodoc:
+      def detail_args_for_any
         @detail_args_for_any ||= begin
           details = {}
 
@@ -206,15 +200,15 @@ module ActionView
       # Support legacy foo.erb names even though we now ignore .erb
       # as well as incorrectly putting part of the path in the template
       # name instead of the prefix.
-      def normalize_name(name, prefixes) #:nodoc:
+      def normalize_name(name, prefixes)
         prefixes = prefixes.presence
-        parts    = name.to_s.split('/'.freeze)
+        parts    = name.to_s.split("/".freeze)
         parts.shift if parts.first.empty?
-        name     = parts.pop
+        name = parts.pop
 
         return name, prefixes || [""] if parts.empty?
 
-        parts    = parts.join('/'.freeze)
+        parts    = parts.join("/".freeze)
         prefixes = prefixes ? prefixes.map { |p| "#{p}/#{parts}" } : [parts]
 
         return name, prefixes
@@ -236,7 +230,7 @@ module ActionView
     end
 
     def digest_cache
-      details_key.digest_cache
+      details_key
     end
 
     def initialize_details(target, details)