actionview 6.0.3 → 6.0.3.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d99216cc5b0490da69d6d2f0bf03f24672fcbe27470d7c9dceb0e5250f2561b0
-  data.tar.gz: 63c769589ca139c17218a50043279c8da909c48b76b73ed007974aa4f7b66a67
+  metadata.gz: 89e55bc3b644f0c076f014f03e20112e8356f12e1df1499d06f05b719e0c42eb
+  data.tar.gz: 0eb23a5977758d30fe1c5e84cf8524dc2c4e44d617f220b31d30c80db4d2f19a
 SHA512:
-  metadata.gz: 4d8deb39281451c706021f63cdd42917b11e534c698a90de33661057a36f32ad1bec4705908e77dbe615d4beeb103a3267607d8209ff0c0b7b9fa9cea32e46e9
-  data.tar.gz: 62562e0c5a27dbb5eefb1e92256b838e26d03660b88650abef30025a4eb99ebca6d383e43a36d214aa5a512cbe3d34f7475a7b462fd039075e0431682a7e104f
+  metadata.gz: c2a4784eaaca3f1a1cec44fcf489671f378e67495978c65bf133d9de259eada5a31dc6b668128128722503c9741368bdbdb53d353fdf17a94c645f778cc75576
+  data.tar.gz: 34cb71bc7d56e1a74ef58201cbb111319361f4159139c00650ea0c4b89b77fb7bc04fc34cd320b501ed37d42c4dc1b789d4c89dc39f1755a249a98499a3c5361

data/CHANGELOG.md

@@ -1,3 +1,29 @@
+## Rails 6.0.3.5 (February 10, 2021) ##
+
+*   No changes.
+
+
+## Rails 6.0.3.4 (October 07, 2020) ##
+
+*   No changes.
+
+
+## Rails 6.0.3.3 (September 09, 2020) ##
+
+*   [CVE-2020-8185] Fix potential XSS vulnerability in the `translate`/`t` helper.
+
+    *Jonathan Hefner*
+
+
+## Rails 6.0.3.2 (June 17, 2020) ##
+
+*   No changes.
+
+
+## Rails 6.0.3.1 (May 18, 2020) ##
+
+*   [CVE-2020-8167] Check that request is same-origin prior to including CSRF token in XHRs
+
 ## Rails 6.0.3 (May 06, 2020) ##
 
 *   annotated_source_code returns an empty array so TemplateErrors without a

data/lib/action_view/gem_version.rb

@@ -10,7 +10,7 @@ module ActionView
     MAJOR = 6
     MINOR = 0
     TINY  = 3
-    PRE   = nil
+    PRE   = "5"
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
   end

data/lib/action_view/helpers/translation_helper.rb

@@ -76,13 +76,20 @@ module ActionView
 
         if html_safe_translation_key?(key)
           html_safe_options = options.dup
+
           options.except(*I18n::RESERVED_KEYS).each do |name, value|
             unless name == :count && value.is_a?(Numeric)
               html_safe_options[name] = ERB::Util.html_escape(value.to_s)
             end
           end
+
+          html_safe_options[:default] = MISSING_TRANSLATION unless html_safe_options[:default].blank?
+
           translation = I18n.translate(scope_key_by_partial(key), **html_safe_options.merge(raise: i18n_raise))
-          if translation.respond_to?(:map)
+
+          if translation.equal?(MISSING_TRANSLATION)
+            options[:default].first
+          elsif translation.respond_to?(:map)
             translation.map { |element| element.respond_to?(:html_safe) ? element.html_safe : element }
           else
             translation.respond_to?(:html_safe) ? translation.html_safe : translation
@@ -121,6 +128,9 @@ module ActionView
       alias :l :localize
 
       private
+        MISSING_TRANSLATION = Object.new
+        private_constant :MISSING_TRANSLATION
+
         def scope_key_by_partial(key)
           stringified_key = key.to_s
           if stringified_key.first == "."

data/lib/assets/compiled/rails-ujs.js

@@ -247,8 +247,8 @@ Released under the MIT license
         }
         if (!options.crossDomain) {
           xhr.setRequestHeader('X-Requested-With', 'XMLHttpRequest');
+          CSRFProtection(xhr);
         }
-        CSRFProtection(xhr);
         xhr.withCredentials = !!options.withCredentials;
         xhr.onreadystatechange = function() {
           if (xhr.readyState === XMLHttpRequest.DONE) {

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: actionview
 version: !ruby/object:Gem::Version
-  version: 6.0.3
+  version: 6.0.3.5
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-05-06 00:00:00.000000000 Z
+date: 2021-02-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.3
+        version: 6.0.3.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.3
+        version: 6.0.3.5
 - !ruby/object:Gem::Dependency
   name: builder
   requirement: !ruby/object:Gem::Requirement
@@ -92,28 +92,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.3
+        version: 6.0.3.5
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.3
+        version: 6.0.3.5
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.3
+        version: 6.0.3.5
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 6.0.3
+        version: 6.0.3.5
 description: Simple, battle-tested conventions and helpers for building web pages.
 email: david@loudthinking.com
 executables: []
@@ -236,10 +236,10 @@ licenses:
 - MIT
 metadata:
   bug_tracker_uri: https://github.com/rails/rails/issues
-  changelog_uri: https://github.com/rails/rails/blob/v6.0.3/actionview/CHANGELOG.md
-  documentation_uri: https://api.rubyonrails.org/v6.0.3/
+  changelog_uri: https://github.com/rails/rails/blob/v6.0.3.5/actionview/CHANGELOG.md
+  documentation_uri: https://api.rubyonrails.org/v6.0.3.5/
   mailing_list_uri: https://discuss.rubyonrails.org/c/rubyonrails-talk
-  source_code_uri: https://github.com/rails/rails/tree/v6.0.3/actionview
+  source_code_uri: https://github.com/rails/rails/tree/v6.0.3.5/actionview
 post_install_message: 
 rdoc_options: []
 require_paths:
@@ -256,7 +256,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements:
 - none
-rubygems_version: 3.1.2
+rubygems_version: 3.0.3
 signing_key: 
 specification_version: 4
 summary: Rendering framework putting the V in MVC (part of Rails).