actionview 6.0.3.rc1 → 6.0.3.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8eafe5ec8eee9ac7ae7c2a412a01e25ecf75d6895cb3a0719b00585e5d9415f3
-  data.tar.gz: c643fd1d07cea723cb3d19e999b27d5946ec4b4eb278f15e1b952b7de120453d
+  metadata.gz: e6282f389eee279f6440f9f50afaf82451b879cc361b88a8d9ef6b87c1e0b8be
+  data.tar.gz: 520b6458a6d53f4624567f56b5ded7ee33fe4cec7baa2b203ff1d43935d947d9
 SHA512:
-  metadata.gz: 642b3a371281cae6d3d1d88f1761cf74b9ad562d7a8bbe0764aa5b1dd2d4c367bfb229cbc6ee9ebb60d235e44670b68451a72fd8563efe9c640faced6f8d9f5d
-  data.tar.gz: 82f51fe028a6ab597daa5ba942efabc3d23690c5479740a72f7cc21167e11c4de5463450a9030897c0c743fc9d29feeae8b46c9b0a359d2686f59ff2c9fe7482
+  metadata.gz: fb5f8f4244443405de3555039f1a57766eecc9d6c682ffd7103871251c897a81a59d816824de7046eca0ae3479060baebd2921299465f41caaef20614d18bac6
+  data.tar.gz: ab3d33e56c39c3f196f8f2fdd0b8d20a6eeda87d7364e448a7e3a8fc01c0668a31c9368a9ce248ac384851c4b2d0fb9f5d93ecfec8520dcd2c479cbdba78d6a8

data/CHANGELOG.md

@@ -1,4 +1,25 @@
-## Rails 6.0.3.rc1 (April 30, 2020) ##
+## Rails 6.0.3.4 (October 07, 2020) ##
+
+*   No changes.
+
+
+## Rails 6.0.3.3 (September 09, 2020) ##
+
+*   [CVE-2020-8185] Fix potential XSS vulnerability in the `translate`/`t` helper.
+
+    *Jonathan Hefner*
+
+
+## Rails 6.0.3.2 (June 17, 2020) ##
+
+*   No changes.
+
+
+## Rails 6.0.3.1 (May 18, 2020) ##
+
+*   [CVE-2020-8167] Check that request is same-origin prior to including CSRF token in XHRs
+
+## Rails 6.0.3 (May 06, 2020) ##
 
 *   annotated_source_code returns an empty array so TemplateErrors without a
     template in the backtrace are surfaced properly by DebugExceptions.

data/lib/action_view/gem_version.rb

@@ -10,7 +10,7 @@ module ActionView
     MAJOR = 6
     MINOR = 0
     TINY  = 3
-    PRE   = "rc1"
+    PRE   = "4"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

data/lib/action_view/helpers/translation_helper.rb

@@ -76,13 +76,20 @@ module ActionView
 
         if html_safe_translation_key?(key)
           html_safe_options = options.dup
+
           options.except(*I18n::RESERVED_KEYS).each do |name, value|
             unless name == :count && value.is_a?(Numeric)
               html_safe_options[name] = ERB::Util.html_escape(value.to_s)
             end
           end
+
+          html_safe_options[:default] = MISSING_TRANSLATION unless html_safe_options[:default].blank?
+
           translation = I18n.translate(scope_key_by_partial(key), **html_safe_options.merge(raise: i18n_raise))
-          if translation.respond_to?(:map)
+
+          if translation.equal?(MISSING_TRANSLATION)
+            options[:default].first
+          elsif translation.respond_to?(:map)
             translation.map { |element| element.respond_to?(:html_safe) ? element.html_safe : element }
           else
             translation.respond_to?(:html_safe) ? translation.html_safe : translation
@@ -121,6 +128,9 @@ module ActionView
       alias :l :localize
 
       private
+        MISSING_TRANSLATION = Object.new
+        private_constant :MISSING_TRANSLATION
+
         def scope_key_by_partial(key)
           stringified_key = key.to_s
           if stringified_key.first == "."

data/lib/assets/compiled/rails-ujs.js

@@ -247,8 +247,8 @@ Released under the MIT license
         }
         if (!options.crossDomain) {
           xhr.setRequestHeader('X-Requested-With', 'XMLHttpRequest');
+          CSRFProtection(xhr);
         }
-        CSRFProtection(xhr);
         xhr.withCredentials = !!options.withCredentials;
         xhr.onreadystatechange = function() {
           if (xhr.readyState === XMLHttpRequest.DONE) {

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: actionview
 version: !ruby/object:Gem::Version
-  version: 6.0.3.rc1
+  version: 6.0.3.4
 platform: ruby
 authors:
 - David Heinemeier Hansson
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2020-05-01 00:00:00.000000000 Z
+date: 2020-10-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.3.rc1
+        version: 6.0.3.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.3.rc1
+        version: 6.0.3.4
 - !ruby/object:Gem::Dependency
   name: builder
   requirement: !ruby/object:Gem::Requirement
@@ -92,28 +92,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.3.rc1
+        version: 6.0.3.4
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.3.rc1
+        version: 6.0.3.4
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.3.rc1
+        version: 6.0.3.4
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.3.rc1
+        version: 6.0.3.4
 description: Simple, battle-tested conventions and helpers for building web pages.
 email: david@loudthinking.com
 executables: []
@@ -236,11 +236,11 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v6.0.3.rc1/actionview/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v6.0.3.rc1/
+  changelog_uri: https://github.com/rails/rails/blob/v6.0.3.4/actionview/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v6.0.3.4/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v6.0.3.rc1/actionview
-post_install_message: 
+  source_code_uri: https://github.com/rails/rails/tree/v6.0.3.4/actionview
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -251,13 +251,13 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: 2.5.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
-  - - ">"
+  - - ">="
     - !ruby/object:Gem::Version
-      version: 1.3.1
+      version: '0'
 requirements:
 - none
-rubygems_version: 3.1.2
-signing_key: 
+rubygems_version: 3.1.4
+signing_key:
 specification_version: 4
 summary: Rendering framework putting the V in MVC (part of Rails).
 test_files: []