actionview 7.0.10 → 7.1.0.beta1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +235 -404
- data/MIT-LICENSE +1 -1
- data/README.rdoc +1 -1
- data/app/assets/javascripts/rails-ujs.esm.js +668 -0
- data/app/assets/javascripts/rails-ujs.js +606 -0
- data/lib/action_view/base.rb +28 -7
- data/lib/action_view/buffers.rb +106 -8
- data/lib/action_view/cache_expiry.rb +40 -43
- data/lib/action_view/context.rb +1 -1
- data/lib/action_view/deprecator.rb +7 -0
- data/lib/action_view/digestor.rb +1 -1
- data/lib/action_view/gem_version.rb +4 -4
- data/lib/action_view/helpers/active_model_helper.rb +1 -1
- data/lib/action_view/helpers/asset_tag_helper.rb +134 -50
- data/lib/action_view/helpers/asset_url_helper.rb +6 -5
- data/lib/action_view/helpers/atom_feed_helper.rb +5 -5
- data/lib/action_view/helpers/cache_helper.rb +3 -9
- data/lib/action_view/helpers/capture_helper.rb +24 -10
- data/lib/action_view/helpers/content_exfiltration_prevention_helper.rb +70 -0
- data/lib/action_view/helpers/controller_helper.rb +6 -0
- data/lib/action_view/helpers/csp_helper.rb +2 -2
- data/lib/action_view/helpers/csrf_helper.rb +2 -2
- data/lib/action_view/helpers/date_helper.rb +17 -19
- data/lib/action_view/helpers/debug_helper.rb +3 -3
- data/lib/action_view/helpers/form_helper.rb +46 -25
- data/lib/action_view/helpers/form_options_helper.rb +2 -1
- data/lib/action_view/helpers/form_tag_helper.rb +43 -9
- data/lib/action_view/helpers/javascript_helper.rb +1 -0
- data/lib/action_view/helpers/number_helper.rb +331 -36
- data/lib/action_view/helpers/output_safety_helper.rb +2 -2
- data/lib/action_view/helpers/rendering_helper.rb +1 -1
- data/lib/action_view/helpers/sanitize_helper.rb +40 -32
- data/lib/action_view/helpers/tag_helper.rb +5 -27
- data/lib/action_view/helpers/tags/base.rb +11 -52
- data/lib/action_view/helpers/tags/collection_check_boxes.rb +1 -0
- data/lib/action_view/helpers/tags/collection_radio_buttons.rb +1 -0
- data/lib/action_view/helpers/tags/collection_select.rb +3 -0
- data/lib/action_view/helpers/tags/date_field.rb +1 -1
- data/lib/action_view/helpers/tags/date_select.rb +2 -0
- data/lib/action_view/helpers/tags/datetime_field.rb +14 -6
- data/lib/action_view/helpers/tags/datetime_local_field.rb +11 -2
- data/lib/action_view/helpers/tags/grouped_collection_select.rb +3 -0
- data/lib/action_view/helpers/tags/month_field.rb +1 -1
- data/lib/action_view/helpers/tags/select.rb +3 -0
- data/lib/action_view/helpers/tags/select_renderer.rb +56 -0
- data/lib/action_view/helpers/tags/time_field.rb +1 -1
- data/lib/action_view/helpers/tags/time_zone_select.rb +3 -0
- data/lib/action_view/helpers/tags/week_field.rb +1 -1
- data/lib/action_view/helpers/tags/weekday_select.rb +3 -0
- data/lib/action_view/helpers/tags.rb +2 -0
- data/lib/action_view/helpers/text_helper.rb +100 -138
- data/lib/action_view/helpers/translation_helper.rb +3 -3
- data/lib/action_view/helpers/url_helper.rb +41 -14
- data/lib/action_view/helpers.rb +2 -0
- data/lib/action_view/layouts.rb +6 -4
- data/lib/action_view/log_subscriber.rb +49 -32
- data/lib/action_view/lookup_context.rb +29 -13
- data/lib/action_view/path_registry.rb +57 -0
- data/lib/action_view/path_set.rb +13 -14
- data/lib/action_view/railtie.rb +26 -3
- data/lib/action_view/record_identifier.rb +15 -8
- data/lib/action_view/renderer/abstract_renderer.rb +1 -1
- data/lib/action_view/renderer/collection_renderer.rb +9 -1
- data/lib/action_view/renderer/partial_renderer/collection_caching.rb +2 -1
- data/lib/action_view/renderer/partial_renderer.rb +2 -1
- data/lib/action_view/renderer/renderer.rb +2 -0
- data/lib/action_view/renderer/streaming_template_renderer.rb +3 -2
- data/lib/action_view/renderer/template_renderer.rb +3 -2
- data/lib/action_view/rendering.rb +22 -4
- data/lib/action_view/ripper_ast_parser.rb +6 -6
- data/lib/action_view/template/error.rb +14 -1
- data/lib/action_view/template/handlers/builder.rb +4 -4
- data/lib/action_view/template/handlers/erb/erubi.rb +23 -27
- data/lib/action_view/template/handlers/erb.rb +73 -1
- data/lib/action_view/template/handlers.rb +1 -1
- data/lib/action_view/template/html.rb +1 -1
- data/lib/action_view/template/raw_file.rb +1 -1
- data/lib/action_view/template/renderable.rb +1 -1
- data/lib/action_view/template/resolver.rb +10 -2
- data/lib/action_view/template/text.rb +1 -1
- data/lib/action_view/template/types.rb +25 -34
- data/lib/action_view/template.rb +180 -53
- data/lib/action_view/template_path.rb +2 -0
- data/lib/action_view/test_case.rb +8 -5
- data/lib/action_view/unbound_template.rb +15 -5
- data/lib/action_view/version.rb +1 -1
- data/lib/action_view/view_paths.rb +15 -24
- data/lib/action_view.rb +4 -1
- metadata +29 -26
data/CHANGELOG.md
CHANGED
|
@@ -1,81 +1,25 @@
|
|
|
1
|
-
## Rails 7.0.
|
|
1
|
+
## Rails 7.1.0.beta1 (September 13, 2023) ##
|
|
2
2
|
|
|
3
|
-
*
|
|
3
|
+
* Fix `simple_format` with blank `wrapper_tag` option returns plain html tag
|
|
4
4
|
|
|
5
|
+
By default `simple_format` method returns the text wrapped with `<p>`. But if we explicitly specify
|
|
6
|
+
the `wrapper_tag: nil` in the options, it returns the text wrapped with `<></>` tag.
|
|
5
7
|
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
* Fix the `number_to_human_size` view helper to correctly work with negative numbers.
|
|
9
|
-
|
|
10
|
-
*Earlopain*
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
## Rails 7.0.8.7 (December 10, 2024) ##
|
|
14
|
-
|
|
15
|
-
* No changes.
|
|
16
|
-
|
|
17
|
-
|
|
18
|
-
## Rails 7.0.8.6 (October 23, 2024) ##
|
|
19
|
-
|
|
20
|
-
* No changes.
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
## Rails 7.0.8.5 (October 15, 2024) ##
|
|
24
|
-
|
|
25
|
-
* No changes.
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
## Rails 7.0.8.4 (June 04, 2024) ##
|
|
29
|
-
|
|
30
|
-
* No changes.
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
## Rails 7.0.8.3 (May 17, 2024) ##
|
|
34
|
-
|
|
35
|
-
* No changes.
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
## Rails 7.0.8.2 (May 16, 2024) ##
|
|
39
|
-
|
|
40
|
-
* No changes.
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
## Rails 7.0.8.1 (February 21, 2024) ##
|
|
44
|
-
|
|
45
|
-
* No changes.
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
## Rails 7.0.8 (September 09, 2023) ##
|
|
49
|
-
|
|
50
|
-
* Fix `form_for` missing the hidden `_method` input for models with a
|
|
51
|
-
namespaced route.
|
|
52
|
-
|
|
53
|
-
*Hartley McGuire*
|
|
54
|
-
|
|
55
|
-
* Fix `render collection: @records, cache: true` inside `jbuilder` templates
|
|
56
|
-
|
|
57
|
-
The previous fix that shipped in `7.0.7` assumed template fragments are always strings,
|
|
58
|
-
this isn't true with `jbuilder`.
|
|
59
|
-
|
|
60
|
-
*Jean Boussier*
|
|
61
|
-
|
|
62
|
-
## Rails 7.0.7.2 (August 22, 2023) ##
|
|
63
|
-
|
|
64
|
-
* No changes.
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
## Rails 7.0.7.1 (August 22, 2023) ##
|
|
68
|
-
|
|
69
|
-
* No changes.
|
|
70
|
-
|
|
8
|
+
Before:
|
|
71
9
|
|
|
72
|
-
|
|
10
|
+
```ruby
|
|
11
|
+
simple_format("Hello World", {}, { wrapper_tag: nil })
|
|
12
|
+
# <>Hello World</>
|
|
13
|
+
```
|
|
73
14
|
|
|
74
|
-
|
|
15
|
+
After:
|
|
75
16
|
|
|
76
|
-
|
|
17
|
+
```ruby
|
|
18
|
+
simple_format("Hello World", {}, { wrapper_tag: nil })
|
|
19
|
+
# <p>Hello World</p>
|
|
20
|
+
```
|
|
77
21
|
|
|
78
|
-
*
|
|
22
|
+
*Akhil G Krishnan*, *Junichi Ito*
|
|
79
23
|
|
|
80
24
|
* Don't double-encode nested `field_id` and `field_name` index values
|
|
81
25
|
|
|
@@ -84,457 +28,344 @@
|
|
|
84
28
|
|
|
85
29
|
*Sean Doyle*
|
|
86
30
|
|
|
31
|
+
* Allow opting in/out of `Link preload` headers when calling `stylesheet_link_tag` or `javascript_include_tag`
|
|
87
32
|
|
|
88
|
-
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
93
|
-
## Rails 7.0.5.1 (June 26, 2023) ##
|
|
33
|
+
```ruby
|
|
34
|
+
# will exclude header, even if setting is enabled:
|
|
35
|
+
javascript_include_tag("http://example.com/all.js", preload_links_header: false)
|
|
94
36
|
|
|
95
|
-
|
|
37
|
+
# will include header, even if setting is disabled:
|
|
38
|
+
stylesheet_link_tag("http://example.com/all.js", preload_links_header: true)
|
|
39
|
+
```
|
|
96
40
|
|
|
41
|
+
*Alex Ghiculescu*
|
|
97
42
|
|
|
98
|
-
|
|
43
|
+
* Stop generating `Link preload` headers once it has reached 1KB.
|
|
99
44
|
|
|
100
|
-
|
|
45
|
+
Some proxies have trouble handling large headers, but more importantly preload links
|
|
46
|
+
have diminishing returns so it's preferable not to go overboard with them.
|
|
101
47
|
|
|
102
|
-
|
|
48
|
+
If tighter control is needed, it's recommended to disable automatic generation of preloads
|
|
49
|
+
and to generate them manually from the controller or from a middleware.
|
|
103
50
|
|
|
104
|
-
*
|
|
51
|
+
*Jean Boussier*
|
|
105
52
|
|
|
106
|
-
|
|
53
|
+
* `simple_format` helper now handles a `:sanitize_options` - any extra options you want appending to the sanitize.
|
|
107
54
|
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
<%= form.select :foo, [["North America", [["United States","US"],["Canada","CA"]], { disabled: "disabled" }]] %>
|
|
113
|
-
# => <select><optgroup label="North America" disabled="disabled"><option value="US">United States</option><option value="CA">Canada</option></optgroup></select>
|
|
55
|
+
Before:
|
|
56
|
+
```ruby
|
|
57
|
+
simple_format("<a target=\"_blank\" href=\"http://example.com\">Continue</a>")
|
|
58
|
+
# => "<p><a href=\"http://example.com\">Continue</a></p>"
|
|
114
59
|
```
|
|
115
60
|
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
119
|
-
|
|
61
|
+
After:
|
|
62
|
+
```ruby
|
|
63
|
+
simple_format("<a target=\"_blank\" href=\"http://example.com\">Continue</a>", {}, { sanitize_options: { attributes: %w[target href] } })
|
|
64
|
+
# => "<p><a target=\"_blank\" href=\"http://example.com\">Continue</a></p>"
|
|
65
|
+
```
|
|
120
66
|
|
|
121
|
-
*
|
|
67
|
+
*Andrei Andriichuk*
|
|
122
68
|
|
|
123
|
-
|
|
69
|
+
* Add support for HTML5 standards-compliant sanitizers, and default to `Rails::HTML5::Sanitizer`
|
|
70
|
+
in the Rails 7.1 configuration if it is supported.
|
|
124
71
|
|
|
72
|
+
Action View's HTML sanitizers can be configured by setting
|
|
73
|
+
`config.action_view.sanitizer_vendor`. Supported values are `Rails::HTML4::Sanitizer` or
|
|
74
|
+
`Rails::HTML5::Sanitizer`.
|
|
125
75
|
|
|
126
|
-
|
|
76
|
+
The Rails 7.1 configuration will set this to `Rails::HTML5::Sanitizer` when it is supported, and
|
|
77
|
+
fall back to `Rails::HTML4::Sanitizer`. Previous configurations default to
|
|
78
|
+
`Rails::HTML4::Sanitizer`.
|
|
127
79
|
|
|
128
|
-
*
|
|
80
|
+
*Mike Dalessio*
|
|
129
81
|
|
|
82
|
+
* `config.dom_testing_default_html_version` controls the HTML parser used by
|
|
83
|
+
`ActionView::TestCase#document_root_element`, which creates the DOM used by the assertions in
|
|
84
|
+
Rails::Dom::Testing.
|
|
130
85
|
|
|
131
|
-
|
|
86
|
+
The Rails 7.1 default configuration opts into the HTML5 parser when it is supported, to better
|
|
87
|
+
represent what the DOM would be in a browser user agent. Previously this test helper always used
|
|
88
|
+
Nokogiri's HTML4 parser.
|
|
132
89
|
|
|
133
|
-
*
|
|
90
|
+
*Mike Dalessio*
|
|
134
91
|
|
|
92
|
+
* Add support for the HTML picture tag. It supports passing a String, an Array or a Block.
|
|
93
|
+
Supports passing properties directly to the img tag via the `:image` key.
|
|
94
|
+
Since the picture tag requires an img tag, the last element you provide will be used for the img tag.
|
|
95
|
+
For complete control over the picture tag, a block can be passed, which will populate the contents of the tag accordingly.
|
|
135
96
|
|
|
136
|
-
|
|
97
|
+
Can be used like this for a single source:
|
|
98
|
+
```erb
|
|
99
|
+
<%= picture_tag("picture.webp") %>
|
|
100
|
+
```
|
|
101
|
+
which will generate the following:
|
|
102
|
+
```html
|
|
103
|
+
<picture>
|
|
104
|
+
<img src="/images/picture.webp" />
|
|
105
|
+
</picture>
|
|
106
|
+
```
|
|
137
107
|
|
|
138
|
-
|
|
139
|
-
|
|
108
|
+
For multiple sources:
|
|
109
|
+
```erb
|
|
110
|
+
<%= picture_tag("picture.webp", "picture.png", :class => "mt-2", :image => { alt: "Image", class: "responsive-img" }) %>
|
|
111
|
+
```
|
|
112
|
+
will generate:
|
|
113
|
+
```html
|
|
114
|
+
<picture class="mt-2">
|
|
115
|
+
<source srcset="/images/picture.webp" />
|
|
116
|
+
<source srcset="/images/picture.png" />
|
|
117
|
+
<img alt="Image" class="responsive-img" src="/images/picture.png" />
|
|
118
|
+
</picture>
|
|
119
|
+
```
|
|
140
120
|
|
|
121
|
+
Full control via a block:
|
|
141
122
|
```erb
|
|
142
|
-
<%=
|
|
143
|
-
|
|
123
|
+
<%= picture_tag(:class => "my-class") do %>
|
|
124
|
+
<%= tag(:source, :srcset => image_path("picture.webp")) %>
|
|
125
|
+
<%= tag(:source, :srcset => image_path("picture.png")) %>
|
|
126
|
+
<%= image_tag("picture.png", :alt => "Image") %>
|
|
144
127
|
<% end %>
|
|
145
128
|
```
|
|
129
|
+
will generate:
|
|
130
|
+
```html
|
|
131
|
+
<picture class="my-class">
|
|
132
|
+
<source srcset="/images/picture.webp" />
|
|
133
|
+
<source srcset="/images/picture.png" />
|
|
134
|
+
<img alt="Image" src="/images/picture.png" />
|
|
135
|
+
</picture>
|
|
136
|
+
```
|
|
146
137
|
|
|
147
|
-
*
|
|
148
|
-
|
|
149
|
-
* Strings returned from `strip_tags` are correctly tagged `html_safe?`
|
|
150
|
-
|
|
151
|
-
Because these strings contain no HTML elements and the basic entities are escaped, they are safe
|
|
152
|
-
to be included as-is as PCDATA in HTML content. Tagging them as html-safe avoids double-escaping
|
|
153
|
-
entities when being concatenated to a SafeBuffer during rendering.
|
|
154
|
-
|
|
155
|
-
Fixes [rails/rails-html-sanitizer#124](https://github.com/rails/rails-html-sanitizer/issues/124)
|
|
156
|
-
|
|
157
|
-
*Mike Dalessio*
|
|
138
|
+
*Juan Pablo Balarini*
|
|
158
139
|
|
|
159
|
-
|
|
140
|
+
* Remove deprecated support to passing instance variables as locals to partials.
|
|
160
141
|
|
|
161
|
-
*
|
|
142
|
+
*Rafael Mendonça França*
|
|
162
143
|
|
|
144
|
+
* Remove deprecated constant `ActionView::Path`.
|
|
163
145
|
|
|
164
|
-
|
|
146
|
+
*Rafael Mendonça França*
|
|
165
147
|
|
|
166
|
-
*
|
|
148
|
+
* Guard `token_list` calls from escaping HTML too often
|
|
167
149
|
|
|
168
150
|
*Sean Doyle*
|
|
169
151
|
|
|
170
|
-
|
|
152
|
+
* `select` can now be called with a single hash containing options and some HTML options
|
|
171
153
|
|
|
172
|
-
|
|
173
|
-
|
|
174
|
-
Escape dangerous characters in names of tags and names of attributes in the
|
|
175
|
-
tag helpers, following the XML specification. Rename the option
|
|
176
|
-
`:escape_attributes` to `:escape`, to simplify by applying the option to the
|
|
177
|
-
whole tag.
|
|
178
|
-
|
|
179
|
-
*Álvaro Martín Fraguas*
|
|
180
|
-
|
|
181
|
-
## Rails 7.0.2.3 (March 08, 2022) ##
|
|
182
|
-
|
|
183
|
-
* No changes.
|
|
184
|
-
|
|
185
|
-
|
|
186
|
-
## Rails 7.0.2.2 (February 11, 2022) ##
|
|
187
|
-
|
|
188
|
-
* No changes.
|
|
189
|
-
|
|
190
|
-
|
|
191
|
-
## Rails 7.0.2.1 (February 11, 2022) ##
|
|
154
|
+
Previously this would not work as expected:
|
|
192
155
|
|
|
193
|
-
|
|
194
|
-
|
|
195
|
-
|
|
196
|
-
## Rails 7.0.2 (February 08, 2022) ##
|
|
197
|
-
|
|
198
|
-
* Ensure `preload_link_tag` preloads JavaScript modules correctly.
|
|
199
|
-
|
|
200
|
-
*Máximo Mussini*
|
|
201
|
-
|
|
202
|
-
* Fix `stylesheet_link_tag` and similar helpers are being used to work in objects with
|
|
203
|
-
a `response` method.
|
|
204
|
-
|
|
205
|
-
*dark-panda*
|
|
206
|
-
|
|
207
|
-
|
|
208
|
-
## Rails 7.0.1 (January 06, 2022) ##
|
|
156
|
+
```erb
|
|
157
|
+
<%= select :post, :author, authors, required: true %>
|
|
158
|
+
```
|
|
209
159
|
|
|
210
|
-
|
|
160
|
+
Instead you needed to do this:
|
|
211
161
|
|
|
212
|
-
|
|
162
|
+
```erb
|
|
163
|
+
<%= select :post, :author, authors, {}, required: true %>
|
|
164
|
+
```
|
|
213
165
|
|
|
214
|
-
|
|
166
|
+
Now, either form is accepted, for the following HTML attributes: `required`, `multiple`, `size`.
|
|
215
167
|
|
|
216
168
|
*Alex Ghiculescu*
|
|
217
169
|
|
|
170
|
+
* Datetime form helpers (`time_field`, `date_field`, `datetime_field`, `week_field`, `month_field`) now accept an instance of Time/Date/DateTime as `:value` option.
|
|
218
171
|
|
|
219
|
-
|
|
220
|
-
|
|
221
|
-
|
|
222
|
-
`ActionView::Helper::FormBuilder#file_field` with `multiple: true` to
|
|
223
|
-
support submitting an empty collection of files.
|
|
224
|
-
|
|
225
|
-
```ruby
|
|
226
|
-
form.file_field :attachments, multiple: true
|
|
227
|
-
# => <input type="hidden" autocomplete="off" name="post[attachments][]" value="">
|
|
228
|
-
<input type="file" multiple="multiple" id="post_attachments" name="post[attachments][]">
|
|
229
|
-
|
|
230
|
-
form.file_field :attachments, multiple: true, include_hidden: false
|
|
231
|
-
# => <input type="file" multiple="multiple" id="post_attachments" name="post[attachments][]">
|
|
172
|
+
Before:
|
|
173
|
+
```erb
|
|
174
|
+
<%= form.datetime_field :written_at, value: Time.current.strftime("%Y-%m-%dT%T") %>
|
|
232
175
|
```
|
|
233
176
|
|
|
234
|
-
|
|
235
|
-
|
|
236
|
-
|
|
237
|
-
|
|
238
|
-
*Pedro Moreira*
|
|
177
|
+
After:
|
|
178
|
+
```erb
|
|
179
|
+
<%= form.datetime_field :written_at, value: Time.current %>
|
|
180
|
+
```
|
|
239
181
|
|
|
182
|
+
*Andrey Samsonov*
|
|
240
183
|
|
|
241
|
-
|
|
184
|
+
* Choices of `select` can optionally contain html attributes as the last element
|
|
185
|
+
of the child arrays when using grouped/nested collections
|
|
242
186
|
|
|
243
|
-
|
|
187
|
+
```erb
|
|
188
|
+
<%= form.select :foo, [["North America", [["United States","US"],["Canada","CA"]], { disabled: "disabled" }]] %>
|
|
189
|
+
# => <select><optgroup label="North America" disabled="disabled"><option value="US">United States</option><option value="CA">Canada</option></optgroup></select>
|
|
190
|
+
```
|
|
244
191
|
|
|
192
|
+
*Chris Gunther*
|
|
245
193
|
|
|
246
|
-
|
|
194
|
+
* `check_box_tag` and `radio_button_tag` now accept `checked` as a keyword argument
|
|
247
195
|
|
|
248
|
-
|
|
196
|
+
This is to make the API more consistent with the `FormHelper` variants. You can now
|
|
197
|
+
provide `checked` as a positional or keyword argument:
|
|
249
198
|
|
|
250
|
-
|
|
199
|
+
```erb
|
|
200
|
+
= check_box_tag "admin", "1", false
|
|
201
|
+
= check_box_tag "admin", "1", checked: false
|
|
251
202
|
|
|
252
|
-
|
|
253
|
-
|
|
203
|
+
= radio_button_tag 'favorite_color', 'maroon', false
|
|
204
|
+
= radio_button_tag 'favorite_color', 'maroon', checked: false
|
|
205
|
+
```
|
|
254
206
|
|
|
255
|
-
*
|
|
207
|
+
*Alex Ghiculescu*
|
|
256
208
|
|
|
257
|
-
*
|
|
258
|
-
|
|
209
|
+
* Allow passing a class to `dom_id`.
|
|
210
|
+
You no longer need to call `new` when passing a class to `dom_id`.
|
|
211
|
+
This makes `dom_id` behave like `dom_class` in this regard.
|
|
212
|
+
Apart from saving a few keystrokes, it prevents Ruby from needing
|
|
213
|
+
to instantiate a whole new object just to generate a string.
|
|
259
214
|
|
|
215
|
+
Before:
|
|
260
216
|
```ruby
|
|
261
|
-
|
|
262
|
-
#=> <form method="post" action="/workshops/1" class="button_to">
|
|
263
|
-
#=> <input type="hidden" name="_method" value="patch" autocomplete="off" />
|
|
264
|
-
#=> <button type="submit">Update</button>
|
|
265
|
-
#=> </form>
|
|
266
|
-
|
|
267
|
-
button_to([ Workshop.find(1), Session.find(1) ]) { "Update" }
|
|
268
|
-
#=> <form method="post" action="/workshops/1/sessions/1" class="button_to">
|
|
269
|
-
#=> <input type="hidden" name="_method" value="patch" autocomplete="off" />
|
|
270
|
-
#=> <button type="submit">Update</button>
|
|
271
|
-
#=> </form>
|
|
217
|
+
dom_id(Post) # => NoMethodError: undefined method `to_key' for Post:Class
|
|
272
218
|
```
|
|
273
219
|
|
|
274
|
-
|
|
275
|
-
|
|
276
|
-
* Support passing a Symbol as the first argument to `FormBuilder#button`:
|
|
277
|
-
|
|
220
|
+
After:
|
|
278
221
|
```ruby
|
|
279
|
-
|
|
280
|
-
# => <button name="post[draft]" value="true" type="submit">Create post</button>
|
|
281
|
-
|
|
282
|
-
form.button(:draft, value: true) do
|
|
283
|
-
content_tag(:strong, "Save as draft")
|
|
284
|
-
end
|
|
285
|
-
# => <button name="post[draft]" value="true" type="submit">
|
|
286
|
-
# <strong>Save as draft</strong>
|
|
287
|
-
# </button>
|
|
222
|
+
dom_id(Post) # => "new_post"
|
|
288
223
|
```
|
|
289
224
|
|
|
290
|
-
*
|
|
225
|
+
*Goulven Champenois*
|
|
291
226
|
|
|
292
|
-
*
|
|
293
|
-
`FormBuilder#field_name` counterpart:
|
|
227
|
+
* Report `:locals` as part of the data returned by ActionView render instrumentation.
|
|
294
228
|
|
|
229
|
+
Before:
|
|
295
230
|
```ruby
|
|
296
|
-
|
|
297
|
-
|
|
298
|
-
|
|
299
|
-
|
|
231
|
+
{
|
|
232
|
+
identifier: "/Users/adam/projects/notifications/app/views/posts/index.html.erb",
|
|
233
|
+
layout: "layouts/application"
|
|
234
|
+
}
|
|
300
235
|
```
|
|
301
236
|
|
|
302
|
-
|
|
303
|
-
|
|
304
|
-
* Execute the `ActionView::Base.field_error_proc` within the context of the
|
|
305
|
-
`ActionView::Base` instance:
|
|
306
|
-
|
|
237
|
+
After:
|
|
307
238
|
```ruby
|
|
308
|
-
|
|
239
|
+
{
|
|
240
|
+
identifier: "/Users/adam/projects/notifications/app/views/posts/index.html.erb",
|
|
241
|
+
layout: "layouts/application",
|
|
242
|
+
locals: {foo: "bar"}
|
|
243
|
+
}
|
|
309
244
|
```
|
|
310
245
|
|
|
311
|
-
*
|
|
246
|
+
*Aaron Gough*
|
|
312
247
|
|
|
313
|
-
*
|
|
248
|
+
* Strip `break_sequence` at the end of `word_wrap`.
|
|
314
249
|
|
|
315
|
-
|
|
316
|
-
button_to "Create", Post.new, authenticity_token: false
|
|
317
|
-
# => <form class="button_to" method="post" action="/posts"><button type="submit">Create</button></form>
|
|
250
|
+
This fixes a bug where `word_wrap` didn't properly strip off break sequences that had printable characters.
|
|
318
251
|
|
|
319
|
-
|
|
320
|
-
# => <form class="button_to" method="post" action="/posts"><button type="submit">Create</button><input type="hidden" name="form_token" value="abc123..." autocomplete="off" /></form>
|
|
252
|
+
For example, compare the outputs of this template:
|
|
321
253
|
|
|
322
|
-
|
|
323
|
-
#
|
|
254
|
+
```erb
|
|
255
|
+
# <%= word_wrap("11 22\n33 44", line_width: 2, break_sequence: "\n# ") %>
|
|
324
256
|
```
|
|
325
257
|
|
|
326
|
-
|
|
327
|
-
|
|
328
|
-
* Support rendering `<form>` elements _without_ `[action]` attributes by:
|
|
258
|
+
Before:
|
|
329
259
|
|
|
330
|
-
|
|
331
|
-
|
|
332
|
-
|
|
333
|
-
|
|
260
|
+
```
|
|
261
|
+
# 11
|
|
262
|
+
# 22
|
|
263
|
+
#
|
|
264
|
+
# 33
|
|
265
|
+
# 44
|
|
266
|
+
#
|
|
267
|
+
```
|
|
334
268
|
|
|
335
|
-
|
|
269
|
+
After:
|
|
336
270
|
|
|
337
|
-
|
|
271
|
+
```
|
|
272
|
+
# 11
|
|
273
|
+
# 22
|
|
274
|
+
# 33
|
|
275
|
+
# 44
|
|
276
|
+
```
|
|
338
277
|
|
|
339
|
-
|
|
340
|
-
# generates day options like <option value="1">1st</option>\n<option value="2">2nd</option>...
|
|
278
|
+
*Max Chernyak*
|
|
341
279
|
|
|
342
|
-
|
|
280
|
+
* Allow templates to set strict `locals`.
|
|
343
281
|
|
|
344
|
-
|
|
345
|
-
is used with a single argument:
|
|
282
|
+
By default, templates will accept any `locals` as keyword arguments. To define what `locals` a template accepts, add a `locals` magic comment:
|
|
346
283
|
|
|
347
|
-
|
|
348
|
-
|
|
284
|
+
```erb
|
|
285
|
+
<%# locals: (message:) -%>
|
|
286
|
+
<%= message %>
|
|
287
|
+
```
|
|
349
288
|
|
|
350
|
-
|
|
289
|
+
Default values can also be provided:
|
|
351
290
|
|
|
352
|
-
|
|
353
|
-
|
|
354
|
-
|
|
355
|
-
|
|
356
|
-
end
|
|
357
|
-
end
|
|
291
|
+
```erb
|
|
292
|
+
<%# locals: (message: "Hello, world!") -%>
|
|
293
|
+
<%= message %>
|
|
294
|
+
```
|
|
358
295
|
|
|
359
|
-
|
|
360
|
-
model implemented a `#to_s` method that called the `name` method.
|
|
296
|
+
Or `locals` can be disabled entirely:
|
|
361
297
|
|
|
362
|
-
|
|
363
|
-
|
|
298
|
+
```erb
|
|
299
|
+
<%# locals: () %>
|
|
300
|
+
```
|
|
364
301
|
|
|
365
|
-
*
|
|
302
|
+
*Joel Hawksley*
|
|
366
303
|
|
|
367
|
-
*
|
|
304
|
+
* Add `include_seconds` option for `datetime_local_field`
|
|
368
305
|
|
|
369
|
-
|
|
370
|
-
# => <svg><use href="#cool-icon"></svg>
|
|
306
|
+
This allows to omit seconds part in the input field, by passing `include_seconds: false`
|
|
371
307
|
|
|
372
|
-
*
|
|
308
|
+
*Wojciech Wnętrzak*
|
|
373
309
|
|
|
310
|
+
* Guard against `ActionView::Helpers::FormTagHelper#field_name` calls with nil
|
|
311
|
+
`object_name` arguments. For example:
|
|
374
312
|
|
|
375
|
-
|
|
313
|
+
```erb
|
|
314
|
+
<%= fields do |f| %>
|
|
315
|
+
<%= f.field_name :body %>
|
|
316
|
+
<% end %>
|
|
317
|
+
```
|
|
376
318
|
|
|
377
|
-
*
|
|
319
|
+
*Sean Doyle*
|
|
378
320
|
|
|
321
|
+
* Strings returned from `strip_tags` are correctly tagged `html_safe?`
|
|
379
322
|
|
|
380
|
-
|
|
323
|
+
Because these strings contain no HTML elements and the basic entities are escaped, they are safe
|
|
324
|
+
to be included as-is as PCDATA in HTML content. Tagging them as html-safe avoids double-escaping
|
|
325
|
+
entities when being concatenated to a SafeBuffer during rendering.
|
|
381
326
|
|
|
382
|
-
|
|
383
|
-
exceptions as flow control.
|
|
327
|
+
Fixes [rails/rails-html-sanitizer#124](https://github.com/rails/rails-html-sanitizer/issues/124)
|
|
384
328
|
|
|
385
329
|
*Mike Dalessio*
|
|
386
330
|
|
|
387
|
-
* `
|
|
388
|
-
|
|
389
|
-
*Nate Berkopec*
|
|
390
|
-
|
|
391
|
-
* Add `weekday_options_for_select` and `weekday_select` helper methods. Also adds `weekday_select` to `FormBuilder`.
|
|
392
|
-
|
|
393
|
-
*Drew Bragg*, *Dana Kashubeck*, *Kasper Timm Hansen*
|
|
394
|
-
|
|
395
|
-
* Add `caching?` helper that returns whether the current code path is being cached and `uncacheable!` to denote helper methods that can't participate in fragment caching.
|
|
396
|
-
|
|
397
|
-
*Ben Toews*, *John Hawthorn*, *Kasper Timm Hansen*, *Joel Hawksley*
|
|
398
|
-
|
|
399
|
-
* Add `include_seconds` option for `time_field`.
|
|
400
|
-
|
|
401
|
-
<%= form.time_field :foo, include_seconds: false %>
|
|
402
|
-
# => <input value="16:22" type="time" />
|
|
403
|
-
|
|
404
|
-
Default includes seconds:
|
|
405
|
-
|
|
406
|
-
<%= form.time_field :foo %>
|
|
407
|
-
# => <input value="16:22:01.440" type="time" />
|
|
408
|
-
|
|
409
|
-
This allows you to take advantage of [different rendering options](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/input/time#time_value_format) in some browsers.
|
|
331
|
+
* Move `convert_to_model` call from `form_for` into `form_with`
|
|
410
332
|
|
|
411
|
-
|
|
412
|
-
|
|
413
|
-
* Improve error messages when template file does not exist at absolute filepath.
|
|
414
|
-
|
|
415
|
-
*Ted Whang*
|
|
416
|
-
|
|
417
|
-
* Add `:country_code` option to `sms_to` for consistency with `phone_to`.
|
|
333
|
+
Now that `form_for` is implemented in terms of `form_with`, remove the
|
|
334
|
+
`convert_to_model` call from `form_for`.
|
|
418
335
|
|
|
419
|
-
*
|
|
420
|
-
|
|
421
|
-
* OpenSSL constants are now used for Digest computations.
|
|
336
|
+
*Sean Doyle*
|
|
422
337
|
|
|
423
|
-
|
|
338
|
+
* Fix and add protections for XSS in `ActionView::Helpers` and `ERB::Util`.
|
|
424
339
|
|
|
425
|
-
|
|
426
|
-
|
|
340
|
+
Escape dangerous characters in names of tags and names of attributes in the
|
|
341
|
+
tag helpers, following the XML specification. Rename the option
|
|
342
|
+
`:escape_attributes` to `:escape`, to simplify by applying the option to the
|
|
343
|
+
whole tag.
|
|
427
344
|
|
|
428
|
-
|
|
345
|
+
*Álvaro Martín Fraguas*
|
|
429
346
|
|
|
430
|
-
*
|
|
431
|
-
`.css` extension appended to the stylesheet path.
|
|
347
|
+
* Extend audio_tag and video_tag to accept Active Storage attachments.
|
|
432
348
|
|
|
433
|
-
|
|
349
|
+
Now it's possible to write
|
|
434
350
|
|
|
435
351
|
```ruby
|
|
436
|
-
|
|
437
|
-
|
|
352
|
+
audio_tag(user.audio_file)
|
|
353
|
+
video_tag(user.video_file)
|
|
438
354
|
```
|
|
439
355
|
|
|
440
|
-
|
|
356
|
+
Instead of
|
|
441
357
|
|
|
442
358
|
```ruby
|
|
443
|
-
|
|
444
|
-
|
|
359
|
+
audio_tag(polymorphic_path(user.audio_file))
|
|
360
|
+
video_tag(polymorphic_path(user.video_file))
|
|
445
361
|
```
|
|
446
362
|
|
|
447
|
-
|
|
448
|
-
|
|
449
|
-
* Deprecate `render` locals to be assigned to instance variables.
|
|
363
|
+
`image_tag` already supported that, so this follows the same pattern.
|
|
450
364
|
|
|
451
|
-
*
|
|
365
|
+
*Matheus Richard*
|
|
452
366
|
|
|
453
|
-
*
|
|
454
|
-
|
|
455
|
-
*André Luis Leal Cardoso Junior*
|
|
456
|
-
|
|
457
|
-
* Change `ActionView::Helpers::FormBuilder#button` to transform `formmethod`
|
|
458
|
-
attributes into `_method="$VERB"` Form Data to enable varied same-form actions:
|
|
459
|
-
|
|
460
|
-
<%= form_with model: post, method: :put do %>
|
|
461
|
-
<%= form.button "Update" %>
|
|
462
|
-
<%= form.button "Delete", formmethod: :delete %>
|
|
463
|
-
<% end %>
|
|
464
|
-
<%# => <form action="posts/1">
|
|
465
|
-
=> <input type="hidden" name="_method" value="put">
|
|
466
|
-
=> <button type="submit">Update</button>
|
|
467
|
-
=> <button type="submit" formmethod="post" name="_method" value="delete">Delete</button>
|
|
468
|
-
=> </form>
|
|
469
|
-
%>
|
|
470
|
-
|
|
471
|
-
*Sean Doyle*
|
|
472
|
-
|
|
473
|
-
* Change `ActionView::Helpers::UrlHelper#button_to` to *always* render a
|
|
474
|
-
`<button>` element, regardless of whether or not the content is passed as
|
|
475
|
-
the first argument or as a block.
|
|
476
|
-
|
|
477
|
-
<%= button_to "Delete", post_path(@post), method: :delete %>
|
|
478
|
-
# => <form action="/posts/1"><input type="hidden" name="_method" value="delete"><button type="submit">Delete</button></form>
|
|
479
|
-
|
|
480
|
-
<%= button_to post_path(@post), method: :delete do %>
|
|
481
|
-
Delete
|
|
482
|
-
<% end %>
|
|
483
|
-
# => <form action="/posts/1"><input type="hidden" name="_method" value="delete"><button type="submit">Delete</button></form>
|
|
484
|
-
|
|
485
|
-
*Sean Doyle*, *Dusan Orlovic*
|
|
486
|
-
|
|
487
|
-
* Add `config.action_view.preload_links_header` to allow disabling of
|
|
488
|
-
the `Link` header being added by default when using `stylesheet_link_tag`
|
|
489
|
-
and `javascript_include_tag`.
|
|
490
|
-
|
|
491
|
-
*Andrew White*
|
|
492
|
-
|
|
493
|
-
* The `translate` helper now resolves `default` values when a `nil` key is
|
|
494
|
-
specified, instead of always returning `nil`.
|
|
495
|
-
|
|
496
|
-
*Jonathan Hefner*
|
|
497
|
-
|
|
498
|
-
* Add `config.action_view.image_loading` to configure the default value of
|
|
499
|
-
the `image_tag` `:loading` option.
|
|
500
|
-
|
|
501
|
-
By setting `config.action_view.image_loading = "lazy"`, an application can opt in to
|
|
502
|
-
lazy loading images sitewide, without changing view code.
|
|
503
|
-
|
|
504
|
-
*Jonathan Hefner*
|
|
505
|
-
|
|
506
|
-
* `ActionView::Helpers::FormBuilder#id` returns the value
|
|
507
|
-
of the `<form>` element's `id` attribute. With a `method` argument, returns
|
|
508
|
-
the `id` attribute for a form field with that name.
|
|
509
|
-
|
|
510
|
-
<%= form_for @post do |f| %>
|
|
511
|
-
<%# ... %>
|
|
512
|
-
|
|
513
|
-
<% content_for :sticky_footer do %>
|
|
514
|
-
<%= form.button(form: f.id) %>
|
|
515
|
-
<% end %>
|
|
516
|
-
<% end %>
|
|
517
|
-
|
|
518
|
-
*Sean Doyle*
|
|
519
|
-
|
|
520
|
-
* `ActionView::Helpers::FormBuilder#field_id` returns the value generated by
|
|
521
|
-
the FormBuilder for the given attribute name.
|
|
522
|
-
|
|
523
|
-
<%= form_for @post do |f| %>
|
|
524
|
-
<%= f.label :title %>
|
|
525
|
-
<%= f.text_field :title, aria: { describedby: f.field_id(:title, :error) } %>
|
|
526
|
-
<%= tag.span("is blank", id: f.field_id(:title, :error) %>
|
|
527
|
-
<% end %>
|
|
528
|
-
|
|
529
|
-
*Sean Doyle*
|
|
530
|
-
|
|
531
|
-
* Add `tag.attributes` to transform a Hash into HTML Attributes, ready to be
|
|
532
|
-
interpolated into ERB.
|
|
533
|
-
|
|
534
|
-
<input <%= tag.attributes(type: :text, aria: { label: "Search" }) %> >
|
|
535
|
-
# => <input type="text" aria-label="Search">
|
|
367
|
+
* Ensure models passed to `form_for` attempt to call `to_model`.
|
|
536
368
|
|
|
537
369
|
*Sean Doyle*
|
|
538
370
|
|
|
539
|
-
|
|
540
|
-
Please check [6-1-stable](https://github.com/rails/rails/blob/6-1-stable/actionview/CHANGELOG.md) for previous changes.
|
|
371
|
+
Please check [7-0-stable](https://github.com/rails/rails/blob/7-0-stable/actionview/CHANGELOG.md) for previous changes.
|