actionview 5.1.7 → 5.2.8.1
Sign up to get free protection for your applications and to get access to all the features.
Potentially problematic release.
This version of actionview might be problematic. Click here for more details.
- checksums.yaml +4 -4
- data/CHANGELOG.md +119 -178
- data/MIT-LICENSE +1 -1
- data/README.rdoc +4 -4
- data/lib/action_view/base.rb +8 -10
- data/lib/action_view/buffers.rb +2 -0
- data/lib/action_view/context.rb +2 -2
- data/lib/action_view/dependency_tracker.rb +2 -0
- data/lib/action_view/digestor.rb +7 -7
- data/lib/action_view/flows.rb +2 -0
- data/lib/action_view/gem_version.rb +5 -3
- data/lib/action_view/helpers/active_model_helper.rb +9 -3
- data/lib/action_view/helpers/asset_tag_helper.rb +180 -34
- data/lib/action_view/helpers/asset_url_helper.rb +19 -17
- data/lib/action_view/helpers/atom_feed_helper.rb +3 -1
- data/lib/action_view/helpers/cache_helper.rb +24 -14
- data/lib/action_view/helpers/capture_helper.rb +9 -7
- data/lib/action_view/helpers/controller_helper.rb +3 -1
- data/lib/action_view/helpers/csp_helper.rb +24 -0
- data/lib/action_view/helpers/csrf_helper.rb +4 -2
- data/lib/action_view/helpers/date_helper.rb +7 -5
- data/lib/action_view/helpers/debug_helper.rb +4 -2
- data/lib/action_view/helpers/form_helper.rb +53 -70
- data/lib/action_view/helpers/form_options_helper.rb +23 -17
- data/lib/action_view/helpers/form_tag_helper.rb +23 -11
- data/lib/action_view/helpers/javascript_helper.rb +20 -5
- data/lib/action_view/helpers/number_helper.rb +2 -0
- data/lib/action_view/helpers/output_safety_helper.rb +2 -0
- data/lib/action_view/helpers/record_tag_helper.rb +3 -1
- data/lib/action_view/helpers/rendering_helper.rb +3 -1
- data/lib/action_view/helpers/sanitize_helper.rb +3 -1
- data/lib/action_view/helpers/tag_helper.rb +39 -8
- data/lib/action_view/helpers/tags/base.rb +12 -10
- data/lib/action_view/helpers/tags/check_box.rb +3 -1
- data/lib/action_view/helpers/tags/checkable.rb +4 -2
- data/lib/action_view/helpers/tags/collection_check_boxes.rb +2 -0
- data/lib/action_view/helpers/tags/collection_helpers.rb +2 -0
- data/lib/action_view/helpers/tags/collection_radio_buttons.rb +2 -0
- data/lib/action_view/helpers/tags/collection_select.rb +3 -1
- data/lib/action_view/helpers/tags/color_field.rb +3 -1
- data/lib/action_view/helpers/tags/date_field.rb +2 -0
- data/lib/action_view/helpers/tags/date_select.rb +3 -1
- data/lib/action_view/helpers/tags/datetime_field.rb +3 -1
- data/lib/action_view/helpers/tags/datetime_local_field.rb +2 -0
- data/lib/action_view/helpers/tags/datetime_select.rb +2 -0
- data/lib/action_view/helpers/tags/email_field.rb +2 -0
- data/lib/action_view/helpers/tags/file_field.rb +2 -0
- data/lib/action_view/helpers/tags/grouped_collection_select.rb +3 -1
- data/lib/action_view/helpers/tags/hidden_field.rb +2 -0
- data/lib/action_view/helpers/tags/label.rb +2 -4
- data/lib/action_view/helpers/tags/month_field.rb +2 -0
- data/lib/action_view/helpers/tags/number_field.rb +2 -0
- data/lib/action_view/helpers/tags/password_field.rb +2 -0
- data/lib/action_view/helpers/tags/placeholderable.rb +2 -0
- data/lib/action_view/helpers/tags/radio_button.rb +3 -1
- data/lib/action_view/helpers/tags/range_field.rb +2 -0
- data/lib/action_view/helpers/tags/search_field.rb +2 -0
- data/lib/action_view/helpers/tags/select.rb +4 -2
- data/lib/action_view/helpers/tags/tel_field.rb +2 -0
- data/lib/action_view/helpers/tags/text_area.rb +3 -1
- data/lib/action_view/helpers/tags/text_field.rb +3 -1
- data/lib/action_view/helpers/tags/time_field.rb +2 -0
- data/lib/action_view/helpers/tags/time_select.rb +2 -0
- data/lib/action_view/helpers/tags/time_zone_select.rb +3 -1
- data/lib/action_view/helpers/tags/translator.rb +2 -0
- data/lib/action_view/helpers/tags/url_field.rb +2 -0
- data/lib/action_view/helpers/tags/week_field.rb +2 -0
- data/lib/action_view/helpers/tags.rb +3 -1
- data/lib/action_view/helpers/text_helper.rb +9 -7
- data/lib/action_view/helpers/translation_helper.rb +17 -5
- data/lib/action_view/helpers/url_helper.rb +28 -4
- data/lib/action_view/helpers.rb +4 -0
- data/lib/action_view/layouts.rb +7 -5
- data/lib/action_view/log_subscriber.rb +5 -3
- data/lib/action_view/lookup_context.rb +4 -4
- data/lib/action_view/model_naming.rb +2 -0
- data/lib/action_view/path_set.rb +2 -0
- data/lib/action_view/railtie.rb +11 -2
- data/lib/action_view/record_identifier.rb +2 -0
- data/lib/action_view/renderer/abstract_renderer.rb +2 -0
- data/lib/action_view/renderer/partial_renderer/collection_caching.rb +4 -2
- data/lib/action_view/renderer/partial_renderer.rb +13 -11
- data/lib/action_view/renderer/renderer.rb +2 -0
- data/lib/action_view/renderer/streaming_template_renderer.rb +5 -1
- data/lib/action_view/renderer/template_renderer.rb +2 -0
- data/lib/action_view/rendering.rb +3 -5
- data/lib/action_view/routing_url_for.rb +2 -0
- data/lib/action_view/tasks/cache_digests.rake +2 -0
- data/lib/action_view/template/error.rb +2 -3
- data/lib/action_view/template/handlers/builder.rb +3 -4
- data/lib/action_view/template/handlers/erb/erubi.rb +2 -0
- data/lib/action_view/template/handlers/erb.rb +5 -9
- data/lib/action_view/template/handlers/html.rb +2 -0
- data/lib/action_view/template/handlers/raw.rb +2 -0
- data/lib/action_view/template/handlers.rb +3 -1
- data/lib/action_view/template/html.rb +3 -1
- data/lib/action_view/template/resolver.rb +7 -6
- data/lib/action_view/template/text.rb +3 -1
- data/lib/action_view/template/types.rb +3 -1
- data/lib/action_view/template.rb +6 -4
- data/lib/action_view/test_case.rb +21 -5
- data/lib/action_view/testing/resolvers.rb +3 -1
- data/lib/action_view/version.rb +2 -0
- data/lib/action_view/view_paths.rb +3 -3
- data/lib/action_view.rb +4 -3
- data/lib/assets/compiled/rails-ujs.js +52 -15
- metadata +15 -16
- data/lib/action_view/template/handlers/erb/deprecated_erubis.rb +0 -9
- data/lib/action_view/template/handlers/erb/erubis.rb +0 -81
@@ -1,9 +1,9 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
1
3
|
module ActionView
|
2
4
|
module Template::Handlers
|
3
5
|
class Builder
|
4
|
-
|
5
|
-
class_attribute :default_format
|
6
|
-
self.default_format = :xml
|
6
|
+
class_attribute :default_format, default: :xml
|
7
7
|
|
8
8
|
def call(template)
|
9
9
|
require_engine
|
@@ -14,7 +14,6 @@ module ActionView
|
|
14
14
|
end
|
15
15
|
|
16
16
|
private
|
17
|
-
|
18
17
|
def require_engine # :doc:
|
19
18
|
@required ||= begin
|
20
19
|
require "builder"
|
@@ -1,24 +1,20 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
1
3
|
module ActionView
|
2
4
|
class Template
|
3
5
|
module Handlers
|
4
|
-
autoload :Erubis, "action_view/template/handlers/erb/deprecated_erubis"
|
5
|
-
|
6
6
|
class ERB
|
7
7
|
autoload :Erubi, "action_view/template/handlers/erb/erubi"
|
8
|
-
autoload :Erubis, "action_view/template/handlers/erb/erubis"
|
9
8
|
|
10
9
|
# Specify trim mode for the ERB compiler. Defaults to '-'.
|
11
10
|
# See ERB documentation for suitable values.
|
12
|
-
class_attribute :erb_trim_mode
|
13
|
-
self.erb_trim_mode = "-"
|
11
|
+
class_attribute :erb_trim_mode, default: "-"
|
14
12
|
|
15
13
|
# Default implementation used.
|
16
|
-
class_attribute :erb_implementation
|
17
|
-
self.erb_implementation = Erubi
|
14
|
+
class_attribute :erb_implementation, default: Erubi
|
18
15
|
|
19
16
|
# Do not escape templates of these mime types.
|
20
|
-
class_attribute :escape_whitelist
|
21
|
-
self.escape_whitelist = ["text/plain"]
|
17
|
+
class_attribute :escape_whitelist, default: ["text/plain"]
|
22
18
|
|
23
19
|
ENCODING_TAG = Regexp.new("\\A(<%#{ENCODING_FLAG}-?%>)[ \\t]*")
|
24
20
|
|
@@ -1,6 +1,8 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
1
3
|
module ActionView #:nodoc:
|
2
4
|
# = Action View Template Handlers
|
3
|
-
class Template
|
5
|
+
class Template #:nodoc:
|
4
6
|
module Handlers #:nodoc:
|
5
7
|
autoload :Raw, "action_view/template/handlers/raw"
|
6
8
|
autoload :ERB, "action_view/template/handlers/erb"
|
@@ -1,3 +1,5 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
1
3
|
require "pathname"
|
2
4
|
require "active_support/core_ext/class"
|
3
5
|
require "active_support/core_ext/module/attribute_accessors"
|
@@ -14,7 +16,7 @@ module ActionView
|
|
14
16
|
alias_method :partial?, :partial
|
15
17
|
|
16
18
|
def self.build(name, prefix, partial)
|
17
|
-
virtual = ""
|
19
|
+
virtual = "".dup
|
18
20
|
virtual << "#{prefix}/" unless prefix.empty?
|
19
21
|
virtual << (partial ? "_#{name}" : name)
|
20
22
|
new name, prefix, partial, virtual
|
@@ -125,8 +127,7 @@ module ActionView
|
|
125
127
|
end
|
126
128
|
end
|
127
129
|
|
128
|
-
cattr_accessor :caching
|
129
|
-
self.caching = true
|
130
|
+
cattr_accessor :caching, default: true
|
130
131
|
|
131
132
|
class << self
|
132
133
|
alias :caching? :caching
|
@@ -309,13 +310,13 @@ module ActionView
|
|
309
310
|
# ==== Examples
|
310
311
|
#
|
311
312
|
# Default pattern, loads views the same way as previous versions of rails, eg. when you're
|
312
|
-
# looking for
|
313
|
+
# looking for <tt>users/new</tt> it will produce query glob: <tt>users/new{.{en},}{.{html,js},}{.{erb,haml},}</tt>
|
313
314
|
#
|
314
315
|
# FileSystemResolver.new("/path/to/views", ":prefix/:action{.:locale,}{.:formats,}{+:variants,}{.:handlers,}")
|
315
316
|
#
|
316
317
|
# This one allows you to keep files with different formats in separate subdirectories,
|
317
|
-
# eg.
|
318
|
-
#
|
318
|
+
# eg. <tt>users/new.html</tt> will be loaded from <tt>users/html/new.erb</tt> or <tt>users/new.html.erb</tt>,
|
319
|
+
# <tt>users/new.js</tt> from <tt>users/js/new.erb</tt> or <tt>users/new.js.erb</tt>, etc.
|
319
320
|
#
|
320
321
|
# FileSystemResolver.new("/path/to/views", ":prefix/{:formats/,}:action{.:locale,}{.:formats,}{+:variants,}{.:handlers,}")
|
321
322
|
#
|
data/lib/action_view/template.rb
CHANGED
@@ -1,3 +1,5 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
1
3
|
require "active_support/core_ext/object/try"
|
2
4
|
require "active_support/core_ext/kernel/singleton_class"
|
3
5
|
require "thread"
|
@@ -282,7 +284,7 @@ module ActionView
|
|
282
284
|
|
283
285
|
# Make sure that the resulting String to be eval'd is in the
|
284
286
|
# encoding of the code
|
285
|
-
source = <<-end_src
|
287
|
+
source = <<-end_src.dup
|
286
288
|
def #{method_name}(local_assigns, output_buffer)
|
287
289
|
_old_virtual_path, @virtual_path = @virtual_path, #{@virtual_path.inspect};_old_output_buffer = @output_buffer;#{locals_code};#{code}
|
288
290
|
ensure
|
@@ -328,13 +330,13 @@ module ActionView
|
|
328
330
|
locals = @locals - Module::RUBY_RESERVED_KEYWORDS
|
329
331
|
locals = locals.grep(/\A@?(?![A-Z0-9])(?:[[:alnum:]_]|[^\0-\177])+\z/)
|
330
332
|
|
331
|
-
#
|
332
|
-
locals.each_with_object("") { |key, code| code << "#{key} = #{key} =
|
333
|
+
# Assign for the same variable is to suppress unused variable warning
|
334
|
+
locals.each_with_object("".dup) { |key, code| code << "#{key} = local_assigns[:#{key}]; #{key} = #{key};" }
|
333
335
|
end
|
334
336
|
|
335
337
|
def method_name
|
336
338
|
@method_name ||= begin
|
337
|
-
m = "_#{identifier_method_name}__#{@identifier.hash}_#{__id__}"
|
339
|
+
m = "_#{identifier_method_name}__#{@identifier.hash}_#{__id__}".dup
|
338
340
|
m.tr!("-".freeze, "_".freeze)
|
339
341
|
m
|
340
342
|
end
|
@@ -1,4 +1,6 @@
|
|
1
|
-
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
3
|
+
require "active_support/core_ext/module/redefine_method"
|
2
4
|
require "action_controller"
|
3
5
|
require "action_controller/test_case"
|
4
6
|
require "action_view"
|
@@ -71,7 +73,7 @@ module ActionView
|
|
71
73
|
def helper_method(*methods)
|
72
74
|
# Almost a duplicate from ActionController::Helpers
|
73
75
|
methods.flatten.each do |method|
|
74
|
-
_helpers.module_eval <<-end_eval
|
76
|
+
_helpers.module_eval <<-end_eval, __FILE__, __LINE__ + 1
|
75
77
|
def #{method}(*args, &block) # def current_user(*args, &block)
|
76
78
|
_test_case.send(%(#{method}), *args, &block) # _test_case.send(%(current_user), *args, &block)
|
77
79
|
end # end
|
@@ -101,10 +103,11 @@ module ActionView
|
|
101
103
|
def setup_with_controller
|
102
104
|
@controller = ActionView::TestCase::TestController.new
|
103
105
|
@request = @controller.request
|
106
|
+
@view_flow = ActionView::OutputFlow.new
|
104
107
|
# empty string ensures buffer has UTF-8 encoding as
|
105
108
|
# new without arguments returns ASCII-8BIT encoded buffer like String#new
|
106
109
|
@output_buffer = ActiveSupport::SafeBuffer.new ""
|
107
|
-
@rendered = ""
|
110
|
+
@rendered = "".dup
|
108
111
|
|
109
112
|
make_test_case_available_to_view!
|
110
113
|
say_no_to_protect_against_forgery!
|
@@ -168,7 +171,7 @@ module ActionView
|
|
168
171
|
|
169
172
|
def say_no_to_protect_against_forgery!
|
170
173
|
_helpers.module_eval do
|
171
|
-
|
174
|
+
silence_redefinition_of_method :protect_against_forgery?
|
172
175
|
def protect_against_forgery?
|
173
176
|
false
|
174
177
|
end
|
@@ -244,6 +247,7 @@ module ActionView
|
|
244
247
|
:@test_passed,
|
245
248
|
:@view,
|
246
249
|
:@view_context_class,
|
250
|
+
:@view_flow,
|
247
251
|
:@_subscribers,
|
248
252
|
:@html_document
|
249
253
|
]
|
@@ -266,7 +270,7 @@ module ActionView
|
|
266
270
|
begin
|
267
271
|
routes = @controller.respond_to?(:_routes) && @controller._routes
|
268
272
|
rescue
|
269
|
-
#
|
273
|
+
# Don't call routes, if there is an error on _routes call
|
270
274
|
end
|
271
275
|
|
272
276
|
if routes &&
|
@@ -277,6 +281,18 @@ module ActionView
|
|
277
281
|
super
|
278
282
|
end
|
279
283
|
end
|
284
|
+
|
285
|
+
def respond_to_missing?(name, include_private = false)
|
286
|
+
begin
|
287
|
+
routes = @controller.respond_to?(:_routes) && @controller._routes
|
288
|
+
rescue
|
289
|
+
# Don't call routes, if there is an error on _routes call
|
290
|
+
end
|
291
|
+
|
292
|
+
routes &&
|
293
|
+
(routes.named_routes.route_defined?(name) ||
|
294
|
+
routes.mounted_helpers.method_defined?(name))
|
295
|
+
end
|
280
296
|
end
|
281
297
|
|
282
298
|
include Behavior
|
@@ -1,3 +1,5 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
1
3
|
require "action_view/template/resolver"
|
2
4
|
|
3
5
|
module ActionView #:nodoc:
|
@@ -20,7 +22,7 @@ module ActionView #:nodoc:
|
|
20
22
|
private
|
21
23
|
|
22
24
|
def query(path, exts, _, _)
|
23
|
-
query = ""
|
25
|
+
query = "".dup
|
24
26
|
EXTENSIONS.each_key do |ext|
|
25
27
|
query << "(" << exts[ext].map { |e| e && Regexp.escape(".#{e}") }.join("|") << "|)"
|
26
28
|
end
|
data/lib/action_view/version.rb
CHANGED
@@ -1,11 +1,11 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
1
3
|
module ActionView
|
2
4
|
module ViewPaths
|
3
5
|
extend ActiveSupport::Concern
|
4
6
|
|
5
7
|
included do
|
6
|
-
class_attribute :_view_paths
|
7
|
-
self._view_paths = ActionView::PathSet.new
|
8
|
-
_view_paths.freeze
|
8
|
+
class_attribute :_view_paths, default: ActionView::PathSet.new.freeze
|
9
9
|
end
|
10
10
|
|
11
11
|
delegate :template_exists?, :any_templates?, :view_paths, :formats, :formats=,
|
data/lib/action_view.rb
CHANGED
@@ -1,5 +1,7 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
1
3
|
#--
|
2
|
-
# Copyright (c) 2004-
|
4
|
+
# Copyright (c) 2004-2018 David Heinemeier Hansson
|
3
5
|
#
|
4
6
|
# Permission is hereby granted, free of charge, to any person obtaining
|
5
7
|
# a copy of this software and associated documentation files (the
|
@@ -74,7 +76,6 @@ module ActionView
|
|
74
76
|
autoload :MissingTemplate
|
75
77
|
autoload :ActionViewError
|
76
78
|
autoload :EncodingError
|
77
|
-
autoload :MissingRequestError
|
78
79
|
autoload :TemplateError
|
79
80
|
autoload :WrongEncodingError
|
80
81
|
end
|
@@ -92,5 +93,5 @@ end
|
|
92
93
|
require "active_support/core_ext/string/output_safety"
|
93
94
|
|
94
95
|
ActiveSupport.on_load(:i18n) do
|
95
|
-
I18n.load_path <<
|
96
|
+
I18n.load_path << File.expand_path("action_view/locale/en.yml", __dir__)
|
96
97
|
end
|
@@ -2,7 +2,7 @@
|
|
2
2
|
Unobtrusive JavaScript
|
3
3
|
https://github.com/rails/rails/blob/master/actionview/app/assets/javascripts
|
4
4
|
Released under the MIT license
|
5
|
-
|
5
|
+
*/;
|
6
6
|
|
7
7
|
(function() {
|
8
8
|
var context = this;
|
@@ -31,6 +31,21 @@ Released under the MIT license
|
|
31
31
|
var Rails = context.Rails;
|
32
32
|
|
33
33
|
(function() {
|
34
|
+
(function() {
|
35
|
+
var nonce;
|
36
|
+
|
37
|
+
nonce = null;
|
38
|
+
|
39
|
+
Rails.loadCSPNonce = function() {
|
40
|
+
var ref;
|
41
|
+
return nonce = (ref = document.querySelector("meta[name=csp-nonce]")) != null ? ref.content : void 0;
|
42
|
+
};
|
43
|
+
|
44
|
+
Rails.cspNonce = function() {
|
45
|
+
return nonce != null ? nonce : Rails.loadCSPNonce();
|
46
|
+
};
|
47
|
+
|
48
|
+
}).call(this);
|
34
49
|
(function() {
|
35
50
|
var expando, m;
|
36
51
|
|
@@ -101,7 +116,7 @@ Released under the MIT license
|
|
101
116
|
|
102
117
|
}).call(this);
|
103
118
|
(function() {
|
104
|
-
var CustomEvent, fire, matches;
|
119
|
+
var CustomEvent, fire, matches, preventDefault;
|
105
120
|
|
106
121
|
matches = Rails.matches;
|
107
122
|
|
@@ -115,6 +130,19 @@ Released under the MIT license
|
|
115
130
|
return evt;
|
116
131
|
};
|
117
132
|
CustomEvent.prototype = window.Event.prototype;
|
133
|
+
preventDefault = CustomEvent.prototype.preventDefault;
|
134
|
+
CustomEvent.prototype.preventDefault = function() {
|
135
|
+
var result;
|
136
|
+
result = preventDefault.call(this);
|
137
|
+
if (this.cancelable && !this.defaultPrevented) {
|
138
|
+
Object.defineProperty(this, 'defaultPrevented', {
|
139
|
+
get: function() {
|
140
|
+
return true;
|
141
|
+
}
|
142
|
+
});
|
143
|
+
}
|
144
|
+
return result;
|
145
|
+
};
|
118
146
|
}
|
119
147
|
|
120
148
|
fire = Rails.fire = function(obj, name, data) {
|
@@ -151,9 +179,9 @@ Released under the MIT license
|
|
151
179
|
|
152
180
|
}).call(this);
|
153
181
|
(function() {
|
154
|
-
var AcceptHeaders, CSRFProtection, createXHR, fire, prepareOptions, processResponse;
|
182
|
+
var AcceptHeaders, CSRFProtection, createXHR, cspNonce, fire, prepareOptions, processResponse;
|
155
183
|
|
156
|
-
CSRFProtection = Rails.CSRFProtection, fire = Rails.fire;
|
184
|
+
cspNonce = Rails.cspNonce, CSRFProtection = Rails.CSRFProtection, fire = Rails.fire;
|
157
185
|
|
158
186
|
AcceptHeaders = {
|
159
187
|
'*': '*/*',
|
@@ -168,8 +196,8 @@ Released under the MIT license
|
|
168
196
|
var xhr;
|
169
197
|
options = prepareOptions(options);
|
170
198
|
xhr = createXHR(options, function() {
|
171
|
-
var response;
|
172
|
-
response = processResponse(xhr.response, xhr.getResponseHeader('Content-Type'));
|
199
|
+
var ref, response;
|
200
|
+
response = processResponse((ref = xhr.response) != null ? ref : xhr.responseText, xhr.getResponseHeader('Content-Type'));
|
173
201
|
if (Math.floor(xhr.status / 100) === 2) {
|
174
202
|
if (typeof options.success === "function") {
|
175
203
|
options.success(response, xhr.statusText, xhr);
|
@@ -181,7 +209,7 @@ Released under the MIT license
|
|
181
209
|
}
|
182
210
|
return typeof options.complete === "function" ? options.complete(xhr, xhr.statusText) : void 0;
|
183
211
|
});
|
184
|
-
if (
|
212
|
+
if ((options.beforeSend != null) && !options.beforeSend(xhr, options)) {
|
185
213
|
return false;
|
186
214
|
}
|
187
215
|
if (xhr.readyState === XMLHttpRequest.OPENED) {
|
@@ -219,8 +247,8 @@ Released under the MIT license
|
|
219
247
|
}
|
220
248
|
if (!options.crossDomain) {
|
221
249
|
xhr.setRequestHeader('X-Requested-With', 'XMLHttpRequest');
|
250
|
+
CSRFProtection(xhr);
|
222
251
|
}
|
223
|
-
CSRFProtection(xhr);
|
224
252
|
xhr.withCredentials = !!options.withCredentials;
|
225
253
|
xhr.onreadystatechange = function() {
|
226
254
|
if (xhr.readyState === XMLHttpRequest.DONE) {
|
@@ -239,6 +267,7 @@ Released under the MIT license
|
|
239
267
|
} catch (error) {}
|
240
268
|
} else if (type.match(/\b(?:java|ecma)script\b/)) {
|
241
269
|
script = document.createElement('script');
|
270
|
+
script.setAttribute('nonce', cspNonce());
|
242
271
|
script.text = response;
|
243
272
|
document.head.appendChild(script).parentNode.removeChild(script);
|
244
273
|
} else if (type.match(/\b(xml|html|svg)\b/)) {
|
@@ -592,24 +621,29 @@ Released under the MIT license
|
|
592
621
|
return setData(form, 'ujs:submit-button-formmethod', button.getAttribute('formmethod'));
|
593
622
|
};
|
594
623
|
|
595
|
-
Rails.
|
596
|
-
var data, link, metaClick, method;
|
624
|
+
Rails.preventInsignificantClick = function(e) {
|
625
|
+
var data, insignificantMetaClick, link, metaClick, method, nonPrimaryMouseClick;
|
597
626
|
link = this;
|
598
627
|
method = (link.getAttribute('data-method') || 'GET').toUpperCase();
|
599
628
|
data = link.getAttribute('data-params');
|
600
629
|
metaClick = e.metaKey || e.ctrlKey;
|
601
|
-
|
630
|
+
insignificantMetaClick = metaClick && method === 'GET' && !data;
|
631
|
+
nonPrimaryMouseClick = (e.button != null) && e.button !== 0;
|
632
|
+
if (nonPrimaryMouseClick || insignificantMetaClick) {
|
602
633
|
return e.stopImmediatePropagation();
|
603
634
|
}
|
604
635
|
};
|
605
636
|
|
606
637
|
}).call(this);
|
607
638
|
(function() {
|
608
|
-
var $, CSRFProtection, delegate, disableElement, enableElement, fire, formSubmitButtonClick, getData, handleConfirm, handleDisabledElement,
|
639
|
+
var $, CSRFProtection, delegate, disableElement, enableElement, fire, formSubmitButtonClick, getData, handleConfirm, handleDisabledElement, handleMethod, handleRemote, loadCSPNonce, preventInsignificantClick, refreshCSRFTokens;
|
609
640
|
|
610
|
-
fire = Rails.fire, delegate = Rails.delegate, getData = Rails.getData, $ = Rails.$, refreshCSRFTokens = Rails.refreshCSRFTokens, CSRFProtection = Rails.CSRFProtection, enableElement = Rails.enableElement, disableElement = Rails.disableElement, handleDisabledElement = Rails.handleDisabledElement, handleConfirm = Rails.handleConfirm,
|
641
|
+
fire = Rails.fire, delegate = Rails.delegate, getData = Rails.getData, $ = Rails.$, refreshCSRFTokens = Rails.refreshCSRFTokens, CSRFProtection = Rails.CSRFProtection, loadCSPNonce = Rails.loadCSPNonce, enableElement = Rails.enableElement, disableElement = Rails.disableElement, handleDisabledElement = Rails.handleDisabledElement, handleConfirm = Rails.handleConfirm, preventInsignificantClick = Rails.preventInsignificantClick, handleRemote = Rails.handleRemote, formSubmitButtonClick = Rails.formSubmitButtonClick, handleMethod = Rails.handleMethod;
|
611
642
|
|
612
|
-
if ((typeof jQuery !== "undefined" && jQuery !== null) && (jQuery.ajax != null)
|
643
|
+
if ((typeof jQuery !== "undefined" && jQuery !== null) && (jQuery.ajax != null)) {
|
644
|
+
if (jQuery.rails) {
|
645
|
+
throw new Error('If you load both jquery_ujs and rails-ujs, use rails-ujs only.');
|
646
|
+
}
|
613
647
|
jQuery.rails = Rails;
|
614
648
|
jQuery.ajaxPrefilter(function(options, originalOptions, xhr) {
|
615
649
|
if (!options.crossDomain) {
|
@@ -638,12 +672,13 @@ Released under the MIT license
|
|
638
672
|
delegate(document, Rails.linkDisableSelector, 'ajax:stopped', enableElement);
|
639
673
|
delegate(document, Rails.buttonDisableSelector, 'ajax:complete', enableElement);
|
640
674
|
delegate(document, Rails.buttonDisableSelector, 'ajax:stopped', enableElement);
|
675
|
+
delegate(document, Rails.linkClickSelector, 'click', preventInsignificantClick);
|
641
676
|
delegate(document, Rails.linkClickSelector, 'click', handleDisabledElement);
|
642
677
|
delegate(document, Rails.linkClickSelector, 'click', handleConfirm);
|
643
|
-
delegate(document, Rails.linkClickSelector, 'click', handleMetaClick);
|
644
678
|
delegate(document, Rails.linkClickSelector, 'click', disableElement);
|
645
679
|
delegate(document, Rails.linkClickSelector, 'click', handleRemote);
|
646
680
|
delegate(document, Rails.linkClickSelector, 'click', handleMethod);
|
681
|
+
delegate(document, Rails.buttonClickSelector, 'click', preventInsignificantClick);
|
647
682
|
delegate(document, Rails.buttonClickSelector, 'click', handleDisabledElement);
|
648
683
|
delegate(document, Rails.buttonClickSelector, 'click', handleConfirm);
|
649
684
|
delegate(document, Rails.buttonClickSelector, 'click', disableElement);
|
@@ -661,10 +696,12 @@ Released under the MIT license
|
|
661
696
|
});
|
662
697
|
delegate(document, Rails.formSubmitSelector, 'ajax:send', disableElement);
|
663
698
|
delegate(document, Rails.formSubmitSelector, 'ajax:complete', enableElement);
|
699
|
+
delegate(document, Rails.formInputClickSelector, 'click', preventInsignificantClick);
|
664
700
|
delegate(document, Rails.formInputClickSelector, 'click', handleDisabledElement);
|
665
701
|
delegate(document, Rails.formInputClickSelector, 'click', handleConfirm);
|
666
702
|
delegate(document, Rails.formInputClickSelector, 'click', formSubmitButtonClick);
|
667
703
|
document.addEventListener('DOMContentLoaded', refreshCSRFTokens);
|
704
|
+
document.addEventListener('DOMContentLoaded', loadCSPNonce);
|
668
705
|
return window._rails_loaded = true;
|
669
706
|
};
|
670
707
|
|
metadata
CHANGED
@@ -1,14 +1,14 @@
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
2
2
|
name: actionview
|
3
3
|
version: !ruby/object:Gem::Version
|
4
|
-
version: 5.1
|
4
|
+
version: 5.2.8.1
|
5
5
|
platform: ruby
|
6
6
|
authors:
|
7
7
|
- David Heinemeier Hansson
|
8
|
-
autorequire:
|
8
|
+
autorequire:
|
9
9
|
bindir: bin
|
10
10
|
cert_chain: []
|
11
|
-
date:
|
11
|
+
date: 2022-07-12 00:00:00.000000000 Z
|
12
12
|
dependencies:
|
13
13
|
- !ruby/object:Gem::Dependency
|
14
14
|
name: activesupport
|
@@ -16,14 +16,14 @@ dependencies:
|
|
16
16
|
requirements:
|
17
17
|
- - '='
|
18
18
|
- !ruby/object:Gem::Version
|
19
|
-
version: 5.1
|
19
|
+
version: 5.2.8.1
|
20
20
|
type: :runtime
|
21
21
|
prerelease: false
|
22
22
|
version_requirements: !ruby/object:Gem::Requirement
|
23
23
|
requirements:
|
24
24
|
- - '='
|
25
25
|
- !ruby/object:Gem::Version
|
26
|
-
version: 5.1
|
26
|
+
version: 5.2.8.1
|
27
27
|
- !ruby/object:Gem::Dependency
|
28
28
|
name: builder
|
29
29
|
requirement: !ruby/object:Gem::Requirement
|
@@ -92,28 +92,28 @@ dependencies:
|
|
92
92
|
requirements:
|
93
93
|
- - '='
|
94
94
|
- !ruby/object:Gem::Version
|
95
|
-
version: 5.1
|
95
|
+
version: 5.2.8.1
|
96
96
|
type: :development
|
97
97
|
prerelease: false
|
98
98
|
version_requirements: !ruby/object:Gem::Requirement
|
99
99
|
requirements:
|
100
100
|
- - '='
|
101
101
|
- !ruby/object:Gem::Version
|
102
|
-
version: 5.1
|
102
|
+
version: 5.2.8.1
|
103
103
|
- !ruby/object:Gem::Dependency
|
104
104
|
name: activemodel
|
105
105
|
requirement: !ruby/object:Gem::Requirement
|
106
106
|
requirements:
|
107
107
|
- - '='
|
108
108
|
- !ruby/object:Gem::Version
|
109
|
-
version: 5.1
|
109
|
+
version: 5.2.8.1
|
110
110
|
type: :development
|
111
111
|
prerelease: false
|
112
112
|
version_requirements: !ruby/object:Gem::Requirement
|
113
113
|
requirements:
|
114
114
|
- - '='
|
115
115
|
- !ruby/object:Gem::Version
|
116
|
-
version: 5.1
|
116
|
+
version: 5.2.8.1
|
117
117
|
description: Simple, battle-tested conventions and helpers for building web pages.
|
118
118
|
email: david@loudthinking.com
|
119
119
|
executables: []
|
@@ -139,6 +139,7 @@ files:
|
|
139
139
|
- lib/action_view/helpers/cache_helper.rb
|
140
140
|
- lib/action_view/helpers/capture_helper.rb
|
141
141
|
- lib/action_view/helpers/controller_helper.rb
|
142
|
+
- lib/action_view/helpers/csp_helper.rb
|
142
143
|
- lib/action_view/helpers/csrf_helper.rb
|
143
144
|
- lib/action_view/helpers/date_helper.rb
|
144
145
|
- lib/action_view/helpers/debug_helper.rb
|
@@ -213,9 +214,7 @@ files:
|
|
213
214
|
- lib/action_view/template/handlers.rb
|
214
215
|
- lib/action_view/template/handlers/builder.rb
|
215
216
|
- lib/action_view/template/handlers/erb.rb
|
216
|
-
- lib/action_view/template/handlers/erb/deprecated_erubis.rb
|
217
217
|
- lib/action_view/template/handlers/erb/erubi.rb
|
218
|
-
- lib/action_view/template/handlers/erb/erubis.rb
|
219
218
|
- lib/action_view/template/handlers/html.rb
|
220
219
|
- lib/action_view/template/handlers/raw.rb
|
221
220
|
- lib/action_view/template/html.rb
|
@@ -231,9 +230,9 @@ homepage: http://rubyonrails.org
|
|
231
230
|
licenses:
|
232
231
|
- MIT
|
233
232
|
metadata:
|
234
|
-
source_code_uri: https://github.com/rails/rails/tree/v5.1
|
235
|
-
changelog_uri: https://github.com/rails/rails/blob/v5.1
|
236
|
-
post_install_message:
|
233
|
+
source_code_uri: https://github.com/rails/rails/tree/v5.2.8.1/actionview
|
234
|
+
changelog_uri: https://github.com/rails/rails/blob/v5.2.8.1/actionview/CHANGELOG.md
|
235
|
+
post_install_message:
|
237
236
|
rdoc_options: []
|
238
237
|
require_paths:
|
239
238
|
- lib
|
@@ -249,8 +248,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
249
248
|
version: '0'
|
250
249
|
requirements:
|
251
250
|
- none
|
252
|
-
rubygems_version: 3.
|
253
|
-
signing_key:
|
251
|
+
rubygems_version: 3.3.3
|
252
|
+
signing_key:
|
254
253
|
specification_version: 4
|
255
254
|
summary: Rendering framework putting the V in MVC (part of Rails).
|
256
255
|
test_files: []
|
@@ -1,9 +0,0 @@
|
|
1
|
-
::ActiveSupport::Deprecation.warn("ActionView::Template::Handlers::Erubis is deprecated and will be removed from Rails 5.2. Switch to ActionView::Template::Handlers::ERB::Erubi instead.")
|
2
|
-
|
3
|
-
module ActionView
|
4
|
-
class Template
|
5
|
-
module Handlers
|
6
|
-
Erubis = ERB::Erubis
|
7
|
-
end
|
8
|
-
end
|
9
|
-
end
|