actionview 5.1.7 → 5.2.8.1

Sign up to get free protection for your applications and to get access to all the features.

Potentially problematic release.


This version of actionview might be problematic. Click here for more details.

Files changed (109) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +119 -178
  3. data/MIT-LICENSE +1 -1
  4. data/README.rdoc +4 -4
  5. data/lib/action_view/base.rb +8 -10
  6. data/lib/action_view/buffers.rb +2 -0
  7. data/lib/action_view/context.rb +2 -2
  8. data/lib/action_view/dependency_tracker.rb +2 -0
  9. data/lib/action_view/digestor.rb +7 -7
  10. data/lib/action_view/flows.rb +2 -0
  11. data/lib/action_view/gem_version.rb +5 -3
  12. data/lib/action_view/helpers/active_model_helper.rb +9 -3
  13. data/lib/action_view/helpers/asset_tag_helper.rb +180 -34
  14. data/lib/action_view/helpers/asset_url_helper.rb +19 -17
  15. data/lib/action_view/helpers/atom_feed_helper.rb +3 -1
  16. data/lib/action_view/helpers/cache_helper.rb +24 -14
  17. data/lib/action_view/helpers/capture_helper.rb +9 -7
  18. data/lib/action_view/helpers/controller_helper.rb +3 -1
  19. data/lib/action_view/helpers/csp_helper.rb +24 -0
  20. data/lib/action_view/helpers/csrf_helper.rb +4 -2
  21. data/lib/action_view/helpers/date_helper.rb +7 -5
  22. data/lib/action_view/helpers/debug_helper.rb +4 -2
  23. data/lib/action_view/helpers/form_helper.rb +53 -70
  24. data/lib/action_view/helpers/form_options_helper.rb +23 -17
  25. data/lib/action_view/helpers/form_tag_helper.rb +23 -11
  26. data/lib/action_view/helpers/javascript_helper.rb +20 -5
  27. data/lib/action_view/helpers/number_helper.rb +2 -0
  28. data/lib/action_view/helpers/output_safety_helper.rb +2 -0
  29. data/lib/action_view/helpers/record_tag_helper.rb +3 -1
  30. data/lib/action_view/helpers/rendering_helper.rb +3 -1
  31. data/lib/action_view/helpers/sanitize_helper.rb +3 -1
  32. data/lib/action_view/helpers/tag_helper.rb +39 -8
  33. data/lib/action_view/helpers/tags/base.rb +12 -10
  34. data/lib/action_view/helpers/tags/check_box.rb +3 -1
  35. data/lib/action_view/helpers/tags/checkable.rb +4 -2
  36. data/lib/action_view/helpers/tags/collection_check_boxes.rb +2 -0
  37. data/lib/action_view/helpers/tags/collection_helpers.rb +2 -0
  38. data/lib/action_view/helpers/tags/collection_radio_buttons.rb +2 -0
  39. data/lib/action_view/helpers/tags/collection_select.rb +3 -1
  40. data/lib/action_view/helpers/tags/color_field.rb +3 -1
  41. data/lib/action_view/helpers/tags/date_field.rb +2 -0
  42. data/lib/action_view/helpers/tags/date_select.rb +3 -1
  43. data/lib/action_view/helpers/tags/datetime_field.rb +3 -1
  44. data/lib/action_view/helpers/tags/datetime_local_field.rb +2 -0
  45. data/lib/action_view/helpers/tags/datetime_select.rb +2 -0
  46. data/lib/action_view/helpers/tags/email_field.rb +2 -0
  47. data/lib/action_view/helpers/tags/file_field.rb +2 -0
  48. data/lib/action_view/helpers/tags/grouped_collection_select.rb +3 -1
  49. data/lib/action_view/helpers/tags/hidden_field.rb +2 -0
  50. data/lib/action_view/helpers/tags/label.rb +2 -4
  51. data/lib/action_view/helpers/tags/month_field.rb +2 -0
  52. data/lib/action_view/helpers/tags/number_field.rb +2 -0
  53. data/lib/action_view/helpers/tags/password_field.rb +2 -0
  54. data/lib/action_view/helpers/tags/placeholderable.rb +2 -0
  55. data/lib/action_view/helpers/tags/radio_button.rb +3 -1
  56. data/lib/action_view/helpers/tags/range_field.rb +2 -0
  57. data/lib/action_view/helpers/tags/search_field.rb +2 -0
  58. data/lib/action_view/helpers/tags/select.rb +4 -2
  59. data/lib/action_view/helpers/tags/tel_field.rb +2 -0
  60. data/lib/action_view/helpers/tags/text_area.rb +3 -1
  61. data/lib/action_view/helpers/tags/text_field.rb +3 -1
  62. data/lib/action_view/helpers/tags/time_field.rb +2 -0
  63. data/lib/action_view/helpers/tags/time_select.rb +2 -0
  64. data/lib/action_view/helpers/tags/time_zone_select.rb +3 -1
  65. data/lib/action_view/helpers/tags/translator.rb +2 -0
  66. data/lib/action_view/helpers/tags/url_field.rb +2 -0
  67. data/lib/action_view/helpers/tags/week_field.rb +2 -0
  68. data/lib/action_view/helpers/tags.rb +3 -1
  69. data/lib/action_view/helpers/text_helper.rb +9 -7
  70. data/lib/action_view/helpers/translation_helper.rb +17 -5
  71. data/lib/action_view/helpers/url_helper.rb +28 -4
  72. data/lib/action_view/helpers.rb +4 -0
  73. data/lib/action_view/layouts.rb +7 -5
  74. data/lib/action_view/log_subscriber.rb +5 -3
  75. data/lib/action_view/lookup_context.rb +4 -4
  76. data/lib/action_view/model_naming.rb +2 -0
  77. data/lib/action_view/path_set.rb +2 -0
  78. data/lib/action_view/railtie.rb +11 -2
  79. data/lib/action_view/record_identifier.rb +2 -0
  80. data/lib/action_view/renderer/abstract_renderer.rb +2 -0
  81. data/lib/action_view/renderer/partial_renderer/collection_caching.rb +4 -2
  82. data/lib/action_view/renderer/partial_renderer.rb +13 -11
  83. data/lib/action_view/renderer/renderer.rb +2 -0
  84. data/lib/action_view/renderer/streaming_template_renderer.rb +5 -1
  85. data/lib/action_view/renderer/template_renderer.rb +2 -0
  86. data/lib/action_view/rendering.rb +3 -5
  87. data/lib/action_view/routing_url_for.rb +2 -0
  88. data/lib/action_view/tasks/cache_digests.rake +2 -0
  89. data/lib/action_view/template/error.rb +2 -3
  90. data/lib/action_view/template/handlers/builder.rb +3 -4
  91. data/lib/action_view/template/handlers/erb/erubi.rb +2 -0
  92. data/lib/action_view/template/handlers/erb.rb +5 -9
  93. data/lib/action_view/template/handlers/html.rb +2 -0
  94. data/lib/action_view/template/handlers/raw.rb +2 -0
  95. data/lib/action_view/template/handlers.rb +3 -1
  96. data/lib/action_view/template/html.rb +3 -1
  97. data/lib/action_view/template/resolver.rb +7 -6
  98. data/lib/action_view/template/text.rb +3 -1
  99. data/lib/action_view/template/types.rb +3 -1
  100. data/lib/action_view/template.rb +6 -4
  101. data/lib/action_view/test_case.rb +21 -5
  102. data/lib/action_view/testing/resolvers.rb +3 -1
  103. data/lib/action_view/version.rb +2 -0
  104. data/lib/action_view/view_paths.rb +3 -3
  105. data/lib/action_view.rb +4 -3
  106. data/lib/assets/compiled/rails-ujs.js +52 -15
  107. metadata +15 -16
  108. data/lib/action_view/template/handlers/erb/deprecated_erubis.rb +0 -9
  109. data/lib/action_view/template/handlers/erb/erubis.rb +0 -81
@@ -1,9 +1,9 @@
1
+ # frozen_string_literal: true
2
+
1
3
  module ActionView
2
4
  module Template::Handlers
3
5
  class Builder
4
- # Default format used by Builder.
5
- class_attribute :default_format
6
- self.default_format = :xml
6
+ class_attribute :default_format, default: :xml
7
7
 
8
8
  def call(template)
9
9
  require_engine
@@ -14,7 +14,6 @@ module ActionView
14
14
  end
15
15
 
16
16
  private
17
-
18
17
  def require_engine # :doc:
19
18
  @required ||= begin
20
19
  require "builder"
@@ -1,3 +1,5 @@
1
+ # frozen_string_literal: true
2
+
1
3
  require "erubi"
2
4
 
3
5
  module ActionView
@@ -1,24 +1,20 @@
1
+ # frozen_string_literal: true
2
+
1
3
  module ActionView
2
4
  class Template
3
5
  module Handlers
4
- autoload :Erubis, "action_view/template/handlers/erb/deprecated_erubis"
5
-
6
6
  class ERB
7
7
  autoload :Erubi, "action_view/template/handlers/erb/erubi"
8
- autoload :Erubis, "action_view/template/handlers/erb/erubis"
9
8
 
10
9
  # Specify trim mode for the ERB compiler. Defaults to '-'.
11
10
  # See ERB documentation for suitable values.
12
- class_attribute :erb_trim_mode
13
- self.erb_trim_mode = "-"
11
+ class_attribute :erb_trim_mode, default: "-"
14
12
 
15
13
  # Default implementation used.
16
- class_attribute :erb_implementation
17
- self.erb_implementation = Erubi
14
+ class_attribute :erb_implementation, default: Erubi
18
15
 
19
16
  # Do not escape templates of these mime types.
20
- class_attribute :escape_whitelist
21
- self.escape_whitelist = ["text/plain"]
17
+ class_attribute :escape_whitelist, default: ["text/plain"]
22
18
 
23
19
  ENCODING_TAG = Regexp.new("\\A(<%#{ENCODING_FLAG}-?%>)[ \\t]*")
24
20
 
@@ -1,3 +1,5 @@
1
+ # frozen_string_literal: true
2
+
1
3
  module ActionView
2
4
  module Template::Handlers
3
5
  class Html < Raw
@@ -1,3 +1,5 @@
1
+ # frozen_string_literal: true
2
+
1
3
  module ActionView
2
4
  module Template::Handlers
3
5
  class Raw
@@ -1,6 +1,8 @@
1
+ # frozen_string_literal: true
2
+
1
3
  module ActionView #:nodoc:
2
4
  # = Action View Template Handlers
3
- class Template
5
+ class Template #:nodoc:
4
6
  module Handlers #:nodoc:
5
7
  autoload :Raw, "action_view/template/handlers/raw"
6
8
  autoload :ERB, "action_view/template/handlers/erb"
@@ -1,6 +1,8 @@
1
+ # frozen_string_literal: true
2
+
1
3
  module ActionView #:nodoc:
2
4
  # = Action View HTML Template
3
- class Template
5
+ class Template #:nodoc:
4
6
  class HTML #:nodoc:
5
7
  attr_accessor :type
6
8
 
@@ -1,3 +1,5 @@
1
+ # frozen_string_literal: true
2
+
1
3
  require "pathname"
2
4
  require "active_support/core_ext/class"
3
5
  require "active_support/core_ext/module/attribute_accessors"
@@ -14,7 +16,7 @@ module ActionView
14
16
  alias_method :partial?, :partial
15
17
 
16
18
  def self.build(name, prefix, partial)
17
- virtual = ""
19
+ virtual = "".dup
18
20
  virtual << "#{prefix}/" unless prefix.empty?
19
21
  virtual << (partial ? "_#{name}" : name)
20
22
  new name, prefix, partial, virtual
@@ -125,8 +127,7 @@ module ActionView
125
127
  end
126
128
  end
127
129
 
128
- cattr_accessor :caching
129
- self.caching = true
130
+ cattr_accessor :caching, default: true
130
131
 
131
132
  class << self
132
133
  alias :caching? :caching
@@ -309,13 +310,13 @@ module ActionView
309
310
  # ==== Examples
310
311
  #
311
312
  # Default pattern, loads views the same way as previous versions of rails, eg. when you're
312
- # looking for `users/new` it will produce query glob: `users/new{.{en},}{.{html,js},}{.{erb,haml},}`
313
+ # looking for <tt>users/new</tt> it will produce query glob: <tt>users/new{.{en},}{.{html,js},}{.{erb,haml},}</tt>
313
314
  #
314
315
  # FileSystemResolver.new("/path/to/views", ":prefix/:action{.:locale,}{.:formats,}{+:variants,}{.:handlers,}")
315
316
  #
316
317
  # This one allows you to keep files with different formats in separate subdirectories,
317
- # eg. `users/new.html` will be loaded from `users/html/new.erb` or `users/new.html.erb`,
318
- # `users/new.js` from `users/js/new.erb` or `users/new.js.erb`, etc.
318
+ # eg. <tt>users/new.html</tt> will be loaded from <tt>users/html/new.erb</tt> or <tt>users/new.html.erb</tt>,
319
+ # <tt>users/new.js</tt> from <tt>users/js/new.erb</tt> or <tt>users/new.js.erb</tt>, etc.
319
320
  #
320
321
  # FileSystemResolver.new("/path/to/views", ":prefix/{:formats/,}:action{.:locale,}{.:formats,}{+:variants,}{.:handlers,}")
321
322
  #
@@ -1,6 +1,8 @@
1
+ # frozen_string_literal: true
2
+
1
3
  module ActionView #:nodoc:
2
4
  # = Action View Text Template
3
- class Template
5
+ class Template #:nodoc:
4
6
  class Text #:nodoc:
5
7
  attr_accessor :type
6
8
 
@@ -1,7 +1,9 @@
1
+ # frozen_string_literal: true
2
+
1
3
  require "active_support/core_ext/module/attribute_accessors"
2
4
 
3
5
  module ActionView
4
- class Template
6
+ class Template #:nodoc:
5
7
  class Types
6
8
  class Type
7
9
  SET = Struct.new(:symbols).new([ :html, :text, :js, :css, :xml, :json ])
@@ -1,3 +1,5 @@
1
+ # frozen_string_literal: true
2
+
1
3
  require "active_support/core_ext/object/try"
2
4
  require "active_support/core_ext/kernel/singleton_class"
3
5
  require "thread"
@@ -282,7 +284,7 @@ module ActionView
282
284
 
283
285
  # Make sure that the resulting String to be eval'd is in the
284
286
  # encoding of the code
285
- source = <<-end_src
287
+ source = <<-end_src.dup
286
288
  def #{method_name}(local_assigns, output_buffer)
287
289
  _old_virtual_path, @virtual_path = @virtual_path, #{@virtual_path.inspect};_old_output_buffer = @output_buffer;#{locals_code};#{code}
288
290
  ensure
@@ -328,13 +330,13 @@ module ActionView
328
330
  locals = @locals - Module::RUBY_RESERVED_KEYWORDS
329
331
  locals = locals.grep(/\A@?(?![A-Z0-9])(?:[[:alnum:]_]|[^\0-\177])+\z/)
330
332
 
331
- # Double assign to suppress the dreaded 'assigned but unused variable' warning
332
- locals.each_with_object("") { |key, code| code << "#{key} = #{key} = local_assigns[:#{key}];" }
333
+ # Assign for the same variable is to suppress unused variable warning
334
+ locals.each_with_object("".dup) { |key, code| code << "#{key} = local_assigns[:#{key}]; #{key} = #{key};" }
333
335
  end
334
336
 
335
337
  def method_name
336
338
  @method_name ||= begin
337
- m = "_#{identifier_method_name}__#{@identifier.hash}_#{__id__}"
339
+ m = "_#{identifier_method_name}__#{@identifier.hash}_#{__id__}".dup
338
340
  m.tr!("-".freeze, "_".freeze)
339
341
  m
340
342
  end
@@ -1,4 +1,6 @@
1
- require "active_support/core_ext/module/remove_method"
1
+ # frozen_string_literal: true
2
+
3
+ require "active_support/core_ext/module/redefine_method"
2
4
  require "action_controller"
3
5
  require "action_controller/test_case"
4
6
  require "action_view"
@@ -71,7 +73,7 @@ module ActionView
71
73
  def helper_method(*methods)
72
74
  # Almost a duplicate from ActionController::Helpers
73
75
  methods.flatten.each do |method|
74
- _helpers.module_eval <<-end_eval
76
+ _helpers.module_eval <<-end_eval, __FILE__, __LINE__ + 1
75
77
  def #{method}(*args, &block) # def current_user(*args, &block)
76
78
  _test_case.send(%(#{method}), *args, &block) # _test_case.send(%(current_user), *args, &block)
77
79
  end # end
@@ -101,10 +103,11 @@ module ActionView
101
103
  def setup_with_controller
102
104
  @controller = ActionView::TestCase::TestController.new
103
105
  @request = @controller.request
106
+ @view_flow = ActionView::OutputFlow.new
104
107
  # empty string ensures buffer has UTF-8 encoding as
105
108
  # new without arguments returns ASCII-8BIT encoded buffer like String#new
106
109
  @output_buffer = ActiveSupport::SafeBuffer.new ""
107
- @rendered = ""
110
+ @rendered = "".dup
108
111
 
109
112
  make_test_case_available_to_view!
110
113
  say_no_to_protect_against_forgery!
@@ -168,7 +171,7 @@ module ActionView
168
171
 
169
172
  def say_no_to_protect_against_forgery!
170
173
  _helpers.module_eval do
171
- remove_possible_method :protect_against_forgery?
174
+ silence_redefinition_of_method :protect_against_forgery?
172
175
  def protect_against_forgery?
173
176
  false
174
177
  end
@@ -244,6 +247,7 @@ module ActionView
244
247
  :@test_passed,
245
248
  :@view,
246
249
  :@view_context_class,
250
+ :@view_flow,
247
251
  :@_subscribers,
248
252
  :@html_document
249
253
  ]
@@ -266,7 +270,7 @@ module ActionView
266
270
  begin
267
271
  routes = @controller.respond_to?(:_routes) && @controller._routes
268
272
  rescue
269
- # Dont call routes, if there is an error on _routes call
273
+ # Don't call routes, if there is an error on _routes call
270
274
  end
271
275
 
272
276
  if routes &&
@@ -277,6 +281,18 @@ module ActionView
277
281
  super
278
282
  end
279
283
  end
284
+
285
+ def respond_to_missing?(name, include_private = false)
286
+ begin
287
+ routes = @controller.respond_to?(:_routes) && @controller._routes
288
+ rescue
289
+ # Don't call routes, if there is an error on _routes call
290
+ end
291
+
292
+ routes &&
293
+ (routes.named_routes.route_defined?(name) ||
294
+ routes.mounted_helpers.method_defined?(name))
295
+ end
280
296
  end
281
297
 
282
298
  include Behavior
@@ -1,3 +1,5 @@
1
+ # frozen_string_literal: true
2
+
1
3
  require "action_view/template/resolver"
2
4
 
3
5
  module ActionView #:nodoc:
@@ -20,7 +22,7 @@ module ActionView #:nodoc:
20
22
  private
21
23
 
22
24
  def query(path, exts, _, _)
23
- query = ""
25
+ query = "".dup
24
26
  EXTENSIONS.each_key do |ext|
25
27
  query << "(" << exts[ext].map { |e| e && Regexp.escape(".#{e}") }.join("|") << "|)"
26
28
  end
@@ -1,3 +1,5 @@
1
+ # frozen_string_literal: true
2
+
1
3
  require_relative "gem_version"
2
4
 
3
5
  module ActionView
@@ -1,11 +1,11 @@
1
+ # frozen_string_literal: true
2
+
1
3
  module ActionView
2
4
  module ViewPaths
3
5
  extend ActiveSupport::Concern
4
6
 
5
7
  included do
6
- class_attribute :_view_paths
7
- self._view_paths = ActionView::PathSet.new
8
- _view_paths.freeze
8
+ class_attribute :_view_paths, default: ActionView::PathSet.new.freeze
9
9
  end
10
10
 
11
11
  delegate :template_exists?, :any_templates?, :view_paths, :formats, :formats=,
data/lib/action_view.rb CHANGED
@@ -1,5 +1,7 @@
1
+ # frozen_string_literal: true
2
+
1
3
  #--
2
- # Copyright (c) 2004-2017 David Heinemeier Hansson
4
+ # Copyright (c) 2004-2018 David Heinemeier Hansson
3
5
  #
4
6
  # Permission is hereby granted, free of charge, to any person obtaining
5
7
  # a copy of this software and associated documentation files (the
@@ -74,7 +76,6 @@ module ActionView
74
76
  autoload :MissingTemplate
75
77
  autoload :ActionViewError
76
78
  autoload :EncodingError
77
- autoload :MissingRequestError
78
79
  autoload :TemplateError
79
80
  autoload :WrongEncodingError
80
81
  end
@@ -92,5 +93,5 @@ end
92
93
  require "active_support/core_ext/string/output_safety"
93
94
 
94
95
  ActiveSupport.on_load(:i18n) do
95
- I18n.load_path << "#{File.dirname(__FILE__)}/action_view/locale/en.yml"
96
+ I18n.load_path << File.expand_path("action_view/locale/en.yml", __dir__)
96
97
  end
@@ -2,7 +2,7 @@
2
2
  Unobtrusive JavaScript
3
3
  https://github.com/rails/rails/blob/master/actionview/app/assets/javascripts
4
4
  Released under the MIT license
5
- */
5
+ */;
6
6
 
7
7
  (function() {
8
8
  var context = this;
@@ -31,6 +31,21 @@ Released under the MIT license
31
31
  var Rails = context.Rails;
32
32
 
33
33
  (function() {
34
+ (function() {
35
+ var nonce;
36
+
37
+ nonce = null;
38
+
39
+ Rails.loadCSPNonce = function() {
40
+ var ref;
41
+ return nonce = (ref = document.querySelector("meta[name=csp-nonce]")) != null ? ref.content : void 0;
42
+ };
43
+
44
+ Rails.cspNonce = function() {
45
+ return nonce != null ? nonce : Rails.loadCSPNonce();
46
+ };
47
+
48
+ }).call(this);
34
49
  (function() {
35
50
  var expando, m;
36
51
 
@@ -101,7 +116,7 @@ Released under the MIT license
101
116
 
102
117
  }).call(this);
103
118
  (function() {
104
- var CustomEvent, fire, matches;
119
+ var CustomEvent, fire, matches, preventDefault;
105
120
 
106
121
  matches = Rails.matches;
107
122
 
@@ -115,6 +130,19 @@ Released under the MIT license
115
130
  return evt;
116
131
  };
117
132
  CustomEvent.prototype = window.Event.prototype;
133
+ preventDefault = CustomEvent.prototype.preventDefault;
134
+ CustomEvent.prototype.preventDefault = function() {
135
+ var result;
136
+ result = preventDefault.call(this);
137
+ if (this.cancelable && !this.defaultPrevented) {
138
+ Object.defineProperty(this, 'defaultPrevented', {
139
+ get: function() {
140
+ return true;
141
+ }
142
+ });
143
+ }
144
+ return result;
145
+ };
118
146
  }
119
147
 
120
148
  fire = Rails.fire = function(obj, name, data) {
@@ -151,9 +179,9 @@ Released under the MIT license
151
179
 
152
180
  }).call(this);
153
181
  (function() {
154
- var AcceptHeaders, CSRFProtection, createXHR, fire, prepareOptions, processResponse;
182
+ var AcceptHeaders, CSRFProtection, createXHR, cspNonce, fire, prepareOptions, processResponse;
155
183
 
156
- CSRFProtection = Rails.CSRFProtection, fire = Rails.fire;
184
+ cspNonce = Rails.cspNonce, CSRFProtection = Rails.CSRFProtection, fire = Rails.fire;
157
185
 
158
186
  AcceptHeaders = {
159
187
  '*': '*/*',
@@ -168,8 +196,8 @@ Released under the MIT license
168
196
  var xhr;
169
197
  options = prepareOptions(options);
170
198
  xhr = createXHR(options, function() {
171
- var response;
172
- response = processResponse(xhr.response, xhr.getResponseHeader('Content-Type'));
199
+ var ref, response;
200
+ response = processResponse((ref = xhr.response) != null ? ref : xhr.responseText, xhr.getResponseHeader('Content-Type'));
173
201
  if (Math.floor(xhr.status / 100) === 2) {
174
202
  if (typeof options.success === "function") {
175
203
  options.success(response, xhr.statusText, xhr);
@@ -181,7 +209,7 @@ Released under the MIT license
181
209
  }
182
210
  return typeof options.complete === "function" ? options.complete(xhr, xhr.statusText) : void 0;
183
211
  });
184
- if (!(typeof options.beforeSend === "function" ? options.beforeSend(xhr, options) : void 0)) {
212
+ if ((options.beforeSend != null) && !options.beforeSend(xhr, options)) {
185
213
  return false;
186
214
  }
187
215
  if (xhr.readyState === XMLHttpRequest.OPENED) {
@@ -219,8 +247,8 @@ Released under the MIT license
219
247
  }
220
248
  if (!options.crossDomain) {
221
249
  xhr.setRequestHeader('X-Requested-With', 'XMLHttpRequest');
250
+ CSRFProtection(xhr);
222
251
  }
223
- CSRFProtection(xhr);
224
252
  xhr.withCredentials = !!options.withCredentials;
225
253
  xhr.onreadystatechange = function() {
226
254
  if (xhr.readyState === XMLHttpRequest.DONE) {
@@ -239,6 +267,7 @@ Released under the MIT license
239
267
  } catch (error) {}
240
268
  } else if (type.match(/\b(?:java|ecma)script\b/)) {
241
269
  script = document.createElement('script');
270
+ script.setAttribute('nonce', cspNonce());
242
271
  script.text = response;
243
272
  document.head.appendChild(script).parentNode.removeChild(script);
244
273
  } else if (type.match(/\b(xml|html|svg)\b/)) {
@@ -592,24 +621,29 @@ Released under the MIT license
592
621
  return setData(form, 'ujs:submit-button-formmethod', button.getAttribute('formmethod'));
593
622
  };
594
623
 
595
- Rails.handleMetaClick = function(e) {
596
- var data, link, metaClick, method;
624
+ Rails.preventInsignificantClick = function(e) {
625
+ var data, insignificantMetaClick, link, metaClick, method, nonPrimaryMouseClick;
597
626
  link = this;
598
627
  method = (link.getAttribute('data-method') || 'GET').toUpperCase();
599
628
  data = link.getAttribute('data-params');
600
629
  metaClick = e.metaKey || e.ctrlKey;
601
- if (metaClick && method === 'GET' && !data) {
630
+ insignificantMetaClick = metaClick && method === 'GET' && !data;
631
+ nonPrimaryMouseClick = (e.button != null) && e.button !== 0;
632
+ if (nonPrimaryMouseClick || insignificantMetaClick) {
602
633
  return e.stopImmediatePropagation();
603
634
  }
604
635
  };
605
636
 
606
637
  }).call(this);
607
638
  (function() {
608
- var $, CSRFProtection, delegate, disableElement, enableElement, fire, formSubmitButtonClick, getData, handleConfirm, handleDisabledElement, handleMetaClick, handleMethod, handleRemote, refreshCSRFTokens;
639
+ var $, CSRFProtection, delegate, disableElement, enableElement, fire, formSubmitButtonClick, getData, handleConfirm, handleDisabledElement, handleMethod, handleRemote, loadCSPNonce, preventInsignificantClick, refreshCSRFTokens;
609
640
 
610
- fire = Rails.fire, delegate = Rails.delegate, getData = Rails.getData, $ = Rails.$, refreshCSRFTokens = Rails.refreshCSRFTokens, CSRFProtection = Rails.CSRFProtection, enableElement = Rails.enableElement, disableElement = Rails.disableElement, handleDisabledElement = Rails.handleDisabledElement, handleConfirm = Rails.handleConfirm, handleRemote = Rails.handleRemote, formSubmitButtonClick = Rails.formSubmitButtonClick, handleMetaClick = Rails.handleMetaClick, handleMethod = Rails.handleMethod;
641
+ fire = Rails.fire, delegate = Rails.delegate, getData = Rails.getData, $ = Rails.$, refreshCSRFTokens = Rails.refreshCSRFTokens, CSRFProtection = Rails.CSRFProtection, loadCSPNonce = Rails.loadCSPNonce, enableElement = Rails.enableElement, disableElement = Rails.disableElement, handleDisabledElement = Rails.handleDisabledElement, handleConfirm = Rails.handleConfirm, preventInsignificantClick = Rails.preventInsignificantClick, handleRemote = Rails.handleRemote, formSubmitButtonClick = Rails.formSubmitButtonClick, handleMethod = Rails.handleMethod;
611
642
 
612
- if ((typeof jQuery !== "undefined" && jQuery !== null) && (jQuery.ajax != null) && !jQuery.rails) {
643
+ if ((typeof jQuery !== "undefined" && jQuery !== null) && (jQuery.ajax != null)) {
644
+ if (jQuery.rails) {
645
+ throw new Error('If you load both jquery_ujs and rails-ujs, use rails-ujs only.');
646
+ }
613
647
  jQuery.rails = Rails;
614
648
  jQuery.ajaxPrefilter(function(options, originalOptions, xhr) {
615
649
  if (!options.crossDomain) {
@@ -638,12 +672,13 @@ Released under the MIT license
638
672
  delegate(document, Rails.linkDisableSelector, 'ajax:stopped', enableElement);
639
673
  delegate(document, Rails.buttonDisableSelector, 'ajax:complete', enableElement);
640
674
  delegate(document, Rails.buttonDisableSelector, 'ajax:stopped', enableElement);
675
+ delegate(document, Rails.linkClickSelector, 'click', preventInsignificantClick);
641
676
  delegate(document, Rails.linkClickSelector, 'click', handleDisabledElement);
642
677
  delegate(document, Rails.linkClickSelector, 'click', handleConfirm);
643
- delegate(document, Rails.linkClickSelector, 'click', handleMetaClick);
644
678
  delegate(document, Rails.linkClickSelector, 'click', disableElement);
645
679
  delegate(document, Rails.linkClickSelector, 'click', handleRemote);
646
680
  delegate(document, Rails.linkClickSelector, 'click', handleMethod);
681
+ delegate(document, Rails.buttonClickSelector, 'click', preventInsignificantClick);
647
682
  delegate(document, Rails.buttonClickSelector, 'click', handleDisabledElement);
648
683
  delegate(document, Rails.buttonClickSelector, 'click', handleConfirm);
649
684
  delegate(document, Rails.buttonClickSelector, 'click', disableElement);
@@ -661,10 +696,12 @@ Released under the MIT license
661
696
  });
662
697
  delegate(document, Rails.formSubmitSelector, 'ajax:send', disableElement);
663
698
  delegate(document, Rails.formSubmitSelector, 'ajax:complete', enableElement);
699
+ delegate(document, Rails.formInputClickSelector, 'click', preventInsignificantClick);
664
700
  delegate(document, Rails.formInputClickSelector, 'click', handleDisabledElement);
665
701
  delegate(document, Rails.formInputClickSelector, 'click', handleConfirm);
666
702
  delegate(document, Rails.formInputClickSelector, 'click', formSubmitButtonClick);
667
703
  document.addEventListener('DOMContentLoaded', refreshCSRFTokens);
704
+ document.addEventListener('DOMContentLoaded', loadCSPNonce);
668
705
  return window._rails_loaded = true;
669
706
  };
670
707
 
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: actionview
3
3
  version: !ruby/object:Gem::Version
4
- version: 5.1.7
4
+ version: 5.2.8.1
5
5
  platform: ruby
6
6
  authors:
7
7
  - David Heinemeier Hansson
8
- autorequire:
8
+ autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2019-03-28 00:00:00.000000000 Z
11
+ date: 2022-07-12 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: activesupport
@@ -16,14 +16,14 @@ dependencies:
16
16
  requirements:
17
17
  - - '='
18
18
  - !ruby/object:Gem::Version
19
- version: 5.1.7
19
+ version: 5.2.8.1
20
20
  type: :runtime
21
21
  prerelease: false
22
22
  version_requirements: !ruby/object:Gem::Requirement
23
23
  requirements:
24
24
  - - '='
25
25
  - !ruby/object:Gem::Version
26
- version: 5.1.7
26
+ version: 5.2.8.1
27
27
  - !ruby/object:Gem::Dependency
28
28
  name: builder
29
29
  requirement: !ruby/object:Gem::Requirement
@@ -92,28 +92,28 @@ dependencies:
92
92
  requirements:
93
93
  - - '='
94
94
  - !ruby/object:Gem::Version
95
- version: 5.1.7
95
+ version: 5.2.8.1
96
96
  type: :development
97
97
  prerelease: false
98
98
  version_requirements: !ruby/object:Gem::Requirement
99
99
  requirements:
100
100
  - - '='
101
101
  - !ruby/object:Gem::Version
102
- version: 5.1.7
102
+ version: 5.2.8.1
103
103
  - !ruby/object:Gem::Dependency
104
104
  name: activemodel
105
105
  requirement: !ruby/object:Gem::Requirement
106
106
  requirements:
107
107
  - - '='
108
108
  - !ruby/object:Gem::Version
109
- version: 5.1.7
109
+ version: 5.2.8.1
110
110
  type: :development
111
111
  prerelease: false
112
112
  version_requirements: !ruby/object:Gem::Requirement
113
113
  requirements:
114
114
  - - '='
115
115
  - !ruby/object:Gem::Version
116
- version: 5.1.7
116
+ version: 5.2.8.1
117
117
  description: Simple, battle-tested conventions and helpers for building web pages.
118
118
  email: david@loudthinking.com
119
119
  executables: []
@@ -139,6 +139,7 @@ files:
139
139
  - lib/action_view/helpers/cache_helper.rb
140
140
  - lib/action_view/helpers/capture_helper.rb
141
141
  - lib/action_view/helpers/controller_helper.rb
142
+ - lib/action_view/helpers/csp_helper.rb
142
143
  - lib/action_view/helpers/csrf_helper.rb
143
144
  - lib/action_view/helpers/date_helper.rb
144
145
  - lib/action_view/helpers/debug_helper.rb
@@ -213,9 +214,7 @@ files:
213
214
  - lib/action_view/template/handlers.rb
214
215
  - lib/action_view/template/handlers/builder.rb
215
216
  - lib/action_view/template/handlers/erb.rb
216
- - lib/action_view/template/handlers/erb/deprecated_erubis.rb
217
217
  - lib/action_view/template/handlers/erb/erubi.rb
218
- - lib/action_view/template/handlers/erb/erubis.rb
219
218
  - lib/action_view/template/handlers/html.rb
220
219
  - lib/action_view/template/handlers/raw.rb
221
220
  - lib/action_view/template/html.rb
@@ -231,9 +230,9 @@ homepage: http://rubyonrails.org
231
230
  licenses:
232
231
  - MIT
233
232
  metadata:
234
- source_code_uri: https://github.com/rails/rails/tree/v5.1.7/actionview
235
- changelog_uri: https://github.com/rails/rails/blob/v5.1.7/actionview/CHANGELOG.md
236
- post_install_message:
233
+ source_code_uri: https://github.com/rails/rails/tree/v5.2.8.1/actionview
234
+ changelog_uri: https://github.com/rails/rails/blob/v5.2.8.1/actionview/CHANGELOG.md
235
+ post_install_message:
237
236
  rdoc_options: []
238
237
  require_paths:
239
238
  - lib
@@ -249,8 +248,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
249
248
  version: '0'
250
249
  requirements:
251
250
  - none
252
- rubygems_version: 3.0.1
253
- signing_key:
251
+ rubygems_version: 3.3.3
252
+ signing_key:
254
253
  specification_version: 4
255
254
  summary: Rendering framework putting the V in MVC (part of Rails).
256
255
  test_files: []
@@ -1,9 +0,0 @@
1
- ::ActiveSupport::Deprecation.warn("ActionView::Template::Handlers::Erubis is deprecated and will be removed from Rails 5.2. Switch to ActionView::Template::Handlers::ERB::Erubi instead.")
2
-
3
- module ActionView
4
- class Template
5
- module Handlers
6
- Erubis = ERB::Erubis
7
- end
8
- end
9
- end