actionview 7.0.10 → 7.1.0.beta1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (90) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +235 -404
  3. data/MIT-LICENSE +1 -1
  4. data/README.rdoc +1 -1
  5. data/app/assets/javascripts/rails-ujs.esm.js +668 -0
  6. data/app/assets/javascripts/rails-ujs.js +606 -0
  7. data/lib/action_view/base.rb +28 -7
  8. data/lib/action_view/buffers.rb +106 -8
  9. data/lib/action_view/cache_expiry.rb +40 -43
  10. data/lib/action_view/context.rb +1 -1
  11. data/lib/action_view/deprecator.rb +7 -0
  12. data/lib/action_view/digestor.rb +1 -1
  13. data/lib/action_view/gem_version.rb +4 -4
  14. data/lib/action_view/helpers/active_model_helper.rb +1 -1
  15. data/lib/action_view/helpers/asset_tag_helper.rb +134 -50
  16. data/lib/action_view/helpers/asset_url_helper.rb +6 -5
  17. data/lib/action_view/helpers/atom_feed_helper.rb +5 -5
  18. data/lib/action_view/helpers/cache_helper.rb +3 -9
  19. data/lib/action_view/helpers/capture_helper.rb +24 -10
  20. data/lib/action_view/helpers/content_exfiltration_prevention_helper.rb +70 -0
  21. data/lib/action_view/helpers/controller_helper.rb +6 -0
  22. data/lib/action_view/helpers/csp_helper.rb +2 -2
  23. data/lib/action_view/helpers/csrf_helper.rb +2 -2
  24. data/lib/action_view/helpers/date_helper.rb +17 -19
  25. data/lib/action_view/helpers/debug_helper.rb +3 -3
  26. data/lib/action_view/helpers/form_helper.rb +46 -25
  27. data/lib/action_view/helpers/form_options_helper.rb +2 -1
  28. data/lib/action_view/helpers/form_tag_helper.rb +43 -9
  29. data/lib/action_view/helpers/javascript_helper.rb +1 -0
  30. data/lib/action_view/helpers/number_helper.rb +331 -36
  31. data/lib/action_view/helpers/output_safety_helper.rb +2 -2
  32. data/lib/action_view/helpers/rendering_helper.rb +1 -1
  33. data/lib/action_view/helpers/sanitize_helper.rb +40 -32
  34. data/lib/action_view/helpers/tag_helper.rb +5 -27
  35. data/lib/action_view/helpers/tags/base.rb +11 -52
  36. data/lib/action_view/helpers/tags/collection_check_boxes.rb +1 -0
  37. data/lib/action_view/helpers/tags/collection_radio_buttons.rb +1 -0
  38. data/lib/action_view/helpers/tags/collection_select.rb +3 -0
  39. data/lib/action_view/helpers/tags/date_field.rb +1 -1
  40. data/lib/action_view/helpers/tags/date_select.rb +2 -0
  41. data/lib/action_view/helpers/tags/datetime_field.rb +14 -6
  42. data/lib/action_view/helpers/tags/datetime_local_field.rb +11 -2
  43. data/lib/action_view/helpers/tags/grouped_collection_select.rb +3 -0
  44. data/lib/action_view/helpers/tags/month_field.rb +1 -1
  45. data/lib/action_view/helpers/tags/select.rb +3 -0
  46. data/lib/action_view/helpers/tags/select_renderer.rb +56 -0
  47. data/lib/action_view/helpers/tags/time_field.rb +1 -1
  48. data/lib/action_view/helpers/tags/time_zone_select.rb +3 -0
  49. data/lib/action_view/helpers/tags/week_field.rb +1 -1
  50. data/lib/action_view/helpers/tags/weekday_select.rb +3 -0
  51. data/lib/action_view/helpers/tags.rb +2 -0
  52. data/lib/action_view/helpers/text_helper.rb +100 -138
  53. data/lib/action_view/helpers/translation_helper.rb +3 -3
  54. data/lib/action_view/helpers/url_helper.rb +41 -14
  55. data/lib/action_view/helpers.rb +2 -0
  56. data/lib/action_view/layouts.rb +6 -4
  57. data/lib/action_view/log_subscriber.rb +49 -32
  58. data/lib/action_view/lookup_context.rb +29 -13
  59. data/lib/action_view/path_registry.rb +57 -0
  60. data/lib/action_view/path_set.rb +13 -14
  61. data/lib/action_view/railtie.rb +26 -3
  62. data/lib/action_view/record_identifier.rb +15 -8
  63. data/lib/action_view/renderer/abstract_renderer.rb +1 -1
  64. data/lib/action_view/renderer/collection_renderer.rb +9 -1
  65. data/lib/action_view/renderer/partial_renderer/collection_caching.rb +2 -1
  66. data/lib/action_view/renderer/partial_renderer.rb +2 -1
  67. data/lib/action_view/renderer/renderer.rb +2 -0
  68. data/lib/action_view/renderer/streaming_template_renderer.rb +3 -2
  69. data/lib/action_view/renderer/template_renderer.rb +3 -2
  70. data/lib/action_view/rendering.rb +22 -4
  71. data/lib/action_view/ripper_ast_parser.rb +6 -6
  72. data/lib/action_view/template/error.rb +14 -1
  73. data/lib/action_view/template/handlers/builder.rb +4 -4
  74. data/lib/action_view/template/handlers/erb/erubi.rb +23 -27
  75. data/lib/action_view/template/handlers/erb.rb +73 -1
  76. data/lib/action_view/template/handlers.rb +1 -1
  77. data/lib/action_view/template/html.rb +1 -1
  78. data/lib/action_view/template/raw_file.rb +1 -1
  79. data/lib/action_view/template/renderable.rb +1 -1
  80. data/lib/action_view/template/resolver.rb +10 -2
  81. data/lib/action_view/template/text.rb +1 -1
  82. data/lib/action_view/template/types.rb +25 -34
  83. data/lib/action_view/template.rb +180 -53
  84. data/lib/action_view/template_path.rb +2 -0
  85. data/lib/action_view/test_case.rb +8 -5
  86. data/lib/action_view/unbound_template.rb +15 -5
  87. data/lib/action_view/version.rb +1 -1
  88. data/lib/action_view/view_paths.rb +15 -24
  89. data/lib/action_view.rb +4 -1
  90. metadata +29 -26
data/CHANGELOG.md CHANGED
@@ -1,81 +1,25 @@
1
- ## Rails 7.0.10 (October 28, 2025) ##
1
+ ## Rails 7.1.0.beta1 (September 13, 2023) ##
2
2
 
3
- * No changes.
3
+ * Fix `simple_format` with blank `wrapper_tag` option returns plain html tag
4
4
 
5
+ By default `simple_format` method returns the text wrapped with `<p>`. But if we explicitly specify
6
+ the `wrapper_tag: nil` in the options, it returns the text wrapped with `<></>` tag.
5
7
 
6
- ## Rails 7.0.9 (October 28, 2025) ##
7
-
8
- * Fix the `number_to_human_size` view helper to correctly work with negative numbers.
9
-
10
- *Earlopain*
11
-
12
-
13
- ## Rails 7.0.8.7 (December 10, 2024) ##
14
-
15
- * No changes.
16
-
17
-
18
- ## Rails 7.0.8.6 (October 23, 2024) ##
19
-
20
- * No changes.
21
-
22
-
23
- ## Rails 7.0.8.5 (October 15, 2024) ##
24
-
25
- * No changes.
26
-
27
-
28
- ## Rails 7.0.8.4 (June 04, 2024) ##
29
-
30
- * No changes.
31
-
32
-
33
- ## Rails 7.0.8.3 (May 17, 2024) ##
34
-
35
- * No changes.
36
-
37
-
38
- ## Rails 7.0.8.2 (May 16, 2024) ##
39
-
40
- * No changes.
41
-
42
-
43
- ## Rails 7.0.8.1 (February 21, 2024) ##
44
-
45
- * No changes.
46
-
47
-
48
- ## Rails 7.0.8 (September 09, 2023) ##
49
-
50
- * Fix `form_for` missing the hidden `_method` input for models with a
51
- namespaced route.
52
-
53
- *Hartley McGuire*
54
-
55
- * Fix `render collection: @records, cache: true` inside `jbuilder` templates
56
-
57
- The previous fix that shipped in `7.0.7` assumed template fragments are always strings,
58
- this isn't true with `jbuilder`.
59
-
60
- *Jean Boussier*
61
-
62
- ## Rails 7.0.7.2 (August 22, 2023) ##
63
-
64
- * No changes.
65
-
66
-
67
- ## Rails 7.0.7.1 (August 22, 2023) ##
68
-
69
- * No changes.
70
-
8
+ Before:
71
9
 
72
- ## Rails 7.0.7 (August 09, 2023) ##
10
+ ```ruby
11
+ simple_format("Hello World", {}, { wrapper_tag: nil })
12
+ # <>Hello World</>
13
+ ```
73
14
 
74
- * Fix `render collection: @records, cache: true` to cache fragments as bare strings
15
+ After:
75
16
 
76
- Previously it would incorrectly cache them as Action View buffers.
17
+ ```ruby
18
+ simple_format("Hello World", {}, { wrapper_tag: nil })
19
+ # <p>Hello World</p>
20
+ ```
77
21
 
78
- *Jean Boussier*
22
+ *Akhil G Krishnan*, *Junichi Ito*
79
23
 
80
24
  * Don't double-encode nested `field_id` and `field_name` index values
81
25
 
@@ -84,457 +28,344 @@
84
28
 
85
29
  *Sean Doyle*
86
30
 
31
+ * Allow opting in/out of `Link preload` headers when calling `stylesheet_link_tag` or `javascript_include_tag`
87
32
 
88
- ## Rails 7.0.6 (June 29, 2023) ##
89
-
90
- * No changes.
91
-
92
-
93
- ## Rails 7.0.5.1 (June 26, 2023) ##
33
+ ```ruby
34
+ # will exclude header, even if setting is enabled:
35
+ javascript_include_tag("http://example.com/all.js", preload_links_header: false)
94
36
 
95
- * No changes.
37
+ # will include header, even if setting is disabled:
38
+ stylesheet_link_tag("http://example.com/all.js", preload_links_header: true)
39
+ ```
96
40
 
41
+ *Alex Ghiculescu*
97
42
 
98
- ## Rails 7.0.5 (May 24, 2023) ##
43
+ * Stop generating `Link preload` headers once it has reached 1KB.
99
44
 
100
- * `FormBuilder#id` finds id set by `form_for` and `form_with`.
45
+ Some proxies have trouble handling large headers, but more importantly preload links
46
+ have diminishing returns so it's preferable not to go overboard with them.
101
47
 
102
- *Matt Polito*
48
+ If tighter control is needed, it's recommended to disable automatic generation of preloads
49
+ and to generate them manually from the controller or from a middleware.
103
50
 
104
- * Allow all available locales for template lookups.
51
+ *Jean Boussier*
105
52
 
106
- *Ben Dilley*
53
+ * `simple_format` helper now handles a `:sanitize_options` - any extra options you want appending to the sanitize.
107
54
 
108
- * Choices of `select` can optionally contain html attributes as the last element
109
- of the child arrays when using grouped/nested collections
110
-
111
- ```erb
112
- <%= form.select :foo, [["North America", [["United States","US"],["Canada","CA"]], { disabled: "disabled" }]] %>
113
- # => <select><optgroup label="North America" disabled="disabled"><option value="US">United States</option><option value="CA">Canada</option></optgroup></select>
55
+ Before:
56
+ ```ruby
57
+ simple_format("<a target=\"_blank\" href=\"http://example.com\">Continue</a>")
58
+ # => "<p><a href=\"http://example.com\">Continue</a></p>"
114
59
  ```
115
60
 
116
- *Chris Gunther*
117
-
118
-
119
- ## Rails 7.0.4.3 (March 13, 2023) ##
61
+ After:
62
+ ```ruby
63
+ simple_format("<a target=\"_blank\" href=\"http://example.com\">Continue</a>", {}, { sanitize_options: { attributes: %w[target href] } })
64
+ # => "<p><a target=\"_blank\" href=\"http://example.com\">Continue</a></p>"
65
+ ```
120
66
 
121
- * Ignore certain data-* attributes in rails-ujs when element is contenteditable
67
+ *Andrei Andriichuk*
122
68
 
123
- [CVE-2023-23913]
69
+ * Add support for HTML5 standards-compliant sanitizers, and default to `Rails::HTML5::Sanitizer`
70
+ in the Rails 7.1 configuration if it is supported.
124
71
 
72
+ Action View's HTML sanitizers can be configured by setting
73
+ `config.action_view.sanitizer_vendor`. Supported values are `Rails::HTML4::Sanitizer` or
74
+ `Rails::HTML5::Sanitizer`.
125
75
 
126
- ## Rails 7.0.4.2 (January 24, 2023) ##
76
+ The Rails 7.1 configuration will set this to `Rails::HTML5::Sanitizer` when it is supported, and
77
+ fall back to `Rails::HTML4::Sanitizer`. Previous configurations default to
78
+ `Rails::HTML4::Sanitizer`.
127
79
 
128
- * No changes.
80
+ *Mike Dalessio*
129
81
 
82
+ * `config.dom_testing_default_html_version` controls the HTML parser used by
83
+ `ActionView::TestCase#document_root_element`, which creates the DOM used by the assertions in
84
+ Rails::Dom::Testing.
130
85
 
131
- ## Rails 7.0.4.1 (January 17, 2023) ##
86
+ The Rails 7.1 default configuration opts into the HTML5 parser when it is supported, to better
87
+ represent what the DOM would be in a browser user agent. Previously this test helper always used
88
+ Nokogiri's HTML4 parser.
132
89
 
133
- * No changes.
90
+ *Mike Dalessio*
134
91
 
92
+ * Add support for the HTML picture tag. It supports passing a String, an Array or a Block.
93
+ Supports passing properties directly to the img tag via the `:image` key.
94
+ Since the picture tag requires an img tag, the last element you provide will be used for the img tag.
95
+ For complete control over the picture tag, a block can be passed, which will populate the contents of the tag accordingly.
135
96
 
136
- ## Rails 7.0.4 (September 09, 2022) ##
97
+ Can be used like this for a single source:
98
+ ```erb
99
+ <%= picture_tag("picture.webp") %>
100
+ ```
101
+ which will generate the following:
102
+ ```html
103
+ <picture>
104
+ <img src="/images/picture.webp" />
105
+ </picture>
106
+ ```
137
107
 
138
- * Guard against `ActionView::Helpers::FormTagHelper#field_name` calls with nil
139
- `object_name` arguments. For example:
108
+ For multiple sources:
109
+ ```erb
110
+ <%= picture_tag("picture.webp", "picture.png", :class => "mt-2", :image => { alt: "Image", class: "responsive-img" }) %>
111
+ ```
112
+ will generate:
113
+ ```html
114
+ <picture class="mt-2">
115
+ <source srcset="/images/picture.webp" />
116
+ <source srcset="/images/picture.png" />
117
+ <img alt="Image" class="responsive-img" src="/images/picture.png" />
118
+ </picture>
119
+ ```
140
120
 
121
+ Full control via a block:
141
122
  ```erb
142
- <%= fields do |f| %>
143
- <%= f.field_name :body %>
123
+ <%= picture_tag(:class => "my-class") do %>
124
+ <%= tag(:source, :srcset => image_path("picture.webp")) %>
125
+ <%= tag(:source, :srcset => image_path("picture.png")) %>
126
+ <%= image_tag("picture.png", :alt => "Image") %>
144
127
  <% end %>
145
128
  ```
129
+ will generate:
130
+ ```html
131
+ <picture class="my-class">
132
+ <source srcset="/images/picture.webp" />
133
+ <source srcset="/images/picture.png" />
134
+ <img alt="Image" src="/images/picture.png" />
135
+ </picture>
136
+ ```
146
137
 
147
- *Sean Doyle*
148
-
149
- * Strings returned from `strip_tags` are correctly tagged `html_safe?`
150
-
151
- Because these strings contain no HTML elements and the basic entities are escaped, they are safe
152
- to be included as-is as PCDATA in HTML content. Tagging them as html-safe avoids double-escaping
153
- entities when being concatenated to a SafeBuffer during rendering.
154
-
155
- Fixes [rails/rails-html-sanitizer#124](https://github.com/rails/rails-html-sanitizer/issues/124)
156
-
157
- *Mike Dalessio*
138
+ *Juan Pablo Balarini*
158
139
 
159
- ## Rails 7.0.3.1 (July 12, 2022) ##
140
+ * Remove deprecated support to passing instance variables as locals to partials.
160
141
 
161
- * No changes.
142
+ *Rafael Mendonça França*
162
143
 
144
+ * Remove deprecated constant `ActionView::Path`.
163
145
 
164
- ## Rails 7.0.3 (May 09, 2022) ##
146
+ *Rafael Mendonça França*
165
147
 
166
- * Ensure models passed to `form_for` attempt to call `to_model`.
148
+ * Guard `token_list` calls from escaping HTML too often
167
149
 
168
150
  *Sean Doyle*
169
151
 
170
- ## Rails 7.0.2.4 (April 26, 2022) ##
152
+ * `select` can now be called with a single hash containing options and some HTML options
171
153
 
172
- * Fix and add protections for XSS in `ActionView::Helpers` and `ERB::Util`.
173
-
174
- Escape dangerous characters in names of tags and names of attributes in the
175
- tag helpers, following the XML specification. Rename the option
176
- `:escape_attributes` to `:escape`, to simplify by applying the option to the
177
- whole tag.
178
-
179
- *Álvaro Martín Fraguas*
180
-
181
- ## Rails 7.0.2.3 (March 08, 2022) ##
182
-
183
- * No changes.
184
-
185
-
186
- ## Rails 7.0.2.2 (February 11, 2022) ##
187
-
188
- * No changes.
189
-
190
-
191
- ## Rails 7.0.2.1 (February 11, 2022) ##
154
+ Previously this would not work as expected:
192
155
 
193
- * No changes.
194
-
195
-
196
- ## Rails 7.0.2 (February 08, 2022) ##
197
-
198
- * Ensure `preload_link_tag` preloads JavaScript modules correctly.
199
-
200
- *Máximo Mussini*
201
-
202
- * Fix `stylesheet_link_tag` and similar helpers are being used to work in objects with
203
- a `response` method.
204
-
205
- *dark-panda*
206
-
207
-
208
- ## Rails 7.0.1 (January 06, 2022) ##
156
+ ```erb
157
+ <%= select :post, :author, authors, required: true %>
158
+ ```
209
159
 
210
- * Fix `button_to` to work with a hash parameter as URL.
160
+ Instead you needed to do this:
211
161
 
212
- *MingyuanQin*
162
+ ```erb
163
+ <%= select :post, :author, authors, {}, required: true %>
164
+ ```
213
165
 
214
- * Fix `link_to` with a model passed as an argument twice.
166
+ Now, either form is accepted, for the following HTML attributes: `required`, `multiple`, `size`.
215
167
 
216
168
  *Alex Ghiculescu*
217
169
 
170
+ * Datetime form helpers (`time_field`, `date_field`, `datetime_field`, `week_field`, `month_field`) now accept an instance of Time/Date/DateTime as `:value` option.
218
171
 
219
- ## Rails 7.0.0 (December 15, 2021) ##
220
-
221
- * Support `include_hidden:` option in calls to
222
- `ActionView::Helper::FormBuilder#file_field` with `multiple: true` to
223
- support submitting an empty collection of files.
224
-
225
- ```ruby
226
- form.file_field :attachments, multiple: true
227
- # => <input type="hidden" autocomplete="off" name="post[attachments][]" value="">
228
- <input type="file" multiple="multiple" id="post_attachments" name="post[attachments][]">
229
-
230
- form.file_field :attachments, multiple: true, include_hidden: false
231
- # => <input type="file" multiple="multiple" id="post_attachments" name="post[attachments][]">
172
+ Before:
173
+ ```erb
174
+ <%= form.datetime_field :written_at, value: Time.current.strftime("%Y-%m-%dT%T") %>
232
175
  ```
233
176
 
234
- *Sean Doyle*
235
-
236
- * Fix `number_with_precision(raise: true)` always raising even on valid numbers.
237
-
238
- *Pedro Moreira*
177
+ After:
178
+ ```erb
179
+ <%= form.datetime_field :written_at, value: Time.current %>
180
+ ```
239
181
 
182
+ *Andrey Samsonov*
240
183
 
241
- ## Rails 7.0.0.rc3 (December 14, 2021) ##
184
+ * Choices of `select` can optionally contain html attributes as the last element
185
+ of the child arrays when using grouped/nested collections
242
186
 
243
- * No changes.
187
+ ```erb
188
+ <%= form.select :foo, [["North America", [["United States","US"],["Canada","CA"]], { disabled: "disabled" }]] %>
189
+ # => <select><optgroup label="North America" disabled="disabled"><option value="US">United States</option><option value="CA">Canada</option></optgroup></select>
190
+ ```
244
191
 
192
+ *Chris Gunther*
245
193
 
246
- ## Rails 7.0.0.rc2 (December 14, 2021) ##
194
+ * `check_box_tag` and `radio_button_tag` now accept `checked` as a keyword argument
247
195
 
248
- * No changes.
196
+ This is to make the API more consistent with the `FormHelper` variants. You can now
197
+ provide `checked` as a positional or keyword argument:
249
198
 
250
- ## Rails 7.0.0.rc1 (December 06, 2021) ##
199
+ ```erb
200
+ = check_box_tag "admin", "1", false
201
+ = check_box_tag "admin", "1", checked: false
251
202
 
252
- * Support `fields model: [@nested, @model]` the same way as `form_with model:
253
- [@nested, @model]`.
203
+ = radio_button_tag 'favorite_color', 'maroon', false
204
+ = radio_button_tag 'favorite_color', 'maroon', checked: false
205
+ ```
254
206
 
255
- *Sean Doyle*
207
+ *Alex Ghiculescu*
256
208
 
257
- * Infer HTTP verb `[method]` from a model or Array with model as the first
258
- argument to `button_to` when combined with a block:
209
+ * Allow passing a class to `dom_id`.
210
+ You no longer need to call `new` when passing a class to `dom_id`.
211
+ This makes `dom_id` behave like `dom_class` in this regard.
212
+ Apart from saving a few keystrokes, it prevents Ruby from needing
213
+ to instantiate a whole new object just to generate a string.
259
214
 
215
+ Before:
260
216
  ```ruby
261
- button_to(Workshop.find(1)){ "Update" }
262
- #=> <form method="post" action="/workshops/1" class="button_to">
263
- #=> <input type="hidden" name="_method" value="patch" autocomplete="off" />
264
- #=> <button type="submit">Update</button>
265
- #=> </form>
266
-
267
- button_to([ Workshop.find(1), Session.find(1) ]) { "Update" }
268
- #=> <form method="post" action="/workshops/1/sessions/1" class="button_to">
269
- #=> <input type="hidden" name="_method" value="patch" autocomplete="off" />
270
- #=> <button type="submit">Update</button>
271
- #=> </form>
217
+ dom_id(Post) # => NoMethodError: undefined method `to_key' for Post:Class
272
218
  ```
273
219
 
274
- *Sean Doyle*
275
-
276
- * Support passing a Symbol as the first argument to `FormBuilder#button`:
277
-
220
+ After:
278
221
  ```ruby
279
- form.button(:draft, value: true)
280
- # => <button name="post[draft]" value="true" type="submit">Create post</button>
281
-
282
- form.button(:draft, value: true) do
283
- content_tag(:strong, "Save as draft")
284
- end
285
- # => <button name="post[draft]" value="true" type="submit">
286
- # <strong>Save as draft</strong>
287
- # </button>
222
+ dom_id(Post) # => "new_post"
288
223
  ```
289
224
 
290
- *Sean Doyle*
225
+ *Goulven Champenois*
291
226
 
292
- * Introduce the `field_name` view helper, along with the
293
- `FormBuilder#field_name` counterpart:
227
+ * Report `:locals` as part of the data returned by ActionView render instrumentation.
294
228
 
229
+ Before:
295
230
  ```ruby
296
- form_for @post do |f|
297
- f.field_tag :tag, name: f.field_name(:tag, multiple: true)
298
- # => <input type="text" name="post[tag][]">
299
- end
231
+ {
232
+ identifier: "/Users/adam/projects/notifications/app/views/posts/index.html.erb",
233
+ layout: "layouts/application"
234
+ }
300
235
  ```
301
236
 
302
- *Sean Doyle*
303
-
304
- * Execute the `ActionView::Base.field_error_proc` within the context of the
305
- `ActionView::Base` instance:
306
-
237
+ After:
307
238
  ```ruby
308
- config.action_view.field_error_proc = proc { |html| content_tag(:div, html, class: "field_with_errors") }
239
+ {
240
+ identifier: "/Users/adam/projects/notifications/app/views/posts/index.html.erb",
241
+ layout: "layouts/application",
242
+ locals: {foo: "bar"}
243
+ }
309
244
  ```
310
245
 
311
- *Sean Doyle*
246
+ *Aaron Gough*
312
247
 
313
- * Add support for `button_to ..., authenticity_token: false`
248
+ * Strip `break_sequence` at the end of `word_wrap`.
314
249
 
315
- ```ruby
316
- button_to "Create", Post.new, authenticity_token: false
317
- # => <form class="button_to" method="post" action="/posts"><button type="submit">Create</button></form>
250
+ This fixes a bug where `word_wrap` didn't properly strip off break sequences that had printable characters.
318
251
 
319
- button_to "Create", Post.new, authenticity_token: true
320
- # => <form class="button_to" method="post" action="/posts"><button type="submit">Create</button><input type="hidden" name="form_token" value="abc123..." autocomplete="off" /></form>
252
+ For example, compare the outputs of this template:
321
253
 
322
- button_to "Create", Post.new, authenticity_token: "secret"
323
- # => <form class="button_to" method="post" action="/posts"><button type="submit">Create</button><input type="hidden" name="form_token" value="secret" autocomplete="off" /></form>
254
+ ```erb
255
+ # <%= word_wrap("11 22\n33 44", line_width: 2, break_sequence: "\n# ") %>
324
256
  ```
325
257
 
326
- *Sean Doyle*
327
-
328
- * Support rendering `<form>` elements _without_ `[action]` attributes by:
258
+ Before:
329
259
 
330
- * `form_with url: false` or `form_with ..., html: { action: false }`
331
- * `form_for ..., url: false` or `form_for ..., html: { action: false }`
332
- * `form_tag false` or `form_tag ..., action: false`
333
- * `button_to "...", false` or `button_to(false) { ... }`
260
+ ```
261
+ # 11
262
+ # 22
263
+ #
264
+ # 33
265
+ # 44
266
+ #
267
+ ```
334
268
 
335
- *Sean Doyle*
269
+ After:
336
270
 
337
- * Add `:day_format` option to `date_select`
271
+ ```
272
+ # 11
273
+ # 22
274
+ # 33
275
+ # 44
276
+ ```
338
277
 
339
- date_select("article", "written_on", day_format: ->(day) { day.ordinalize })
340
- # generates day options like <option value="1">1st</option>\n<option value="2">2nd</option>...
278
+ *Max Chernyak*
341
279
 
342
- *Shunichi Ikegami*
280
+ * Allow templates to set strict `locals`.
343
281
 
344
- * Allow `link_to` helper to infer link name from `Model#to_s` when it
345
- is used with a single argument:
282
+ By default, templates will accept any `locals` as keyword arguments. To define what `locals` a template accepts, add a `locals` magic comment:
346
283
 
347
- link_to @profile
348
- #=> <a href="/profiles/1">Eileen</a>
284
+ ```erb
285
+ <%# locals: (message:) -%>
286
+ <%= message %>
287
+ ```
349
288
 
350
- This assumes the model class implements a `to_s` method like this:
289
+ Default values can also be provided:
351
290
 
352
- class Profile < ApplicationRecord
353
- # ...
354
- def to_s
355
- name
356
- end
357
- end
291
+ ```erb
292
+ <%# locals: (message: "Hello, world!") -%>
293
+ <%= message %>
294
+ ```
358
295
 
359
- Previously you had to supply a second argument even if the `Profile`
360
- model implemented a `#to_s` method that called the `name` method.
296
+ Or `locals` can be disabled entirely:
361
297
 
362
- link_to @profile, @profile.name
363
- #=> <a href="/profiles/1">Eileen</a>
298
+ ```erb
299
+ <%# locals: () %>
300
+ ```
364
301
 
365
- *Olivier Lacan*
302
+ *Joel Hawksley*
366
303
 
367
- * Support svg unpaired tags for `tag` helper.
304
+ * Add `include_seconds` option for `datetime_local_field`
368
305
 
369
- tag.svg { tag.use('href' => "#cool-icon") }
370
- # => <svg><use href="#cool-icon"></svg>
306
+ This allows to omit seconds part in the input field, by passing `include_seconds: false`
371
307
 
372
- *Oleksii Vasyliev*
308
+ *Wojciech Wnętrzak*
373
309
 
310
+ * Guard against `ActionView::Helpers::FormTagHelper#field_name` calls with nil
311
+ `object_name` arguments. For example:
374
312
 
375
- ## Rails 7.0.0.alpha2 (September 15, 2021) ##
313
+ ```erb
314
+ <%= fields do |f| %>
315
+ <%= f.field_name :body %>
316
+ <% end %>
317
+ ```
376
318
 
377
- * No changes.
319
+ *Sean Doyle*
378
320
 
321
+ * Strings returned from `strip_tags` are correctly tagged `html_safe?`
379
322
 
380
- ## Rails 7.0.0.alpha1 (September 15, 2021) ##
323
+ Because these strings contain no HTML elements and the basic entities are escaped, they are safe
324
+ to be included as-is as PCDATA in HTML content. Tagging them as html-safe avoids double-escaping
325
+ entities when being concatenated to a SafeBuffer during rendering.
381
326
 
382
- * Improves the performance of ActionView::Helpers::NumberHelper formatters by avoiding the use of
383
- exceptions as flow control.
327
+ Fixes [rails/rails-html-sanitizer#124](https://github.com/rails/rails-html-sanitizer/issues/124)
384
328
 
385
329
  *Mike Dalessio*
386
330
 
387
- * `preload_link_tag` properly inserts `as` attributes for files with `image` MIME types, such as JPG or SVG.
388
-
389
- *Nate Berkopec*
390
-
391
- * Add `weekday_options_for_select` and `weekday_select` helper methods. Also adds `weekday_select` to `FormBuilder`.
392
-
393
- *Drew Bragg*, *Dana Kashubeck*, *Kasper Timm Hansen*
394
-
395
- * Add `caching?` helper that returns whether the current code path is being cached and `uncacheable!` to denote helper methods that can't participate in fragment caching.
396
-
397
- *Ben Toews*, *John Hawthorn*, *Kasper Timm Hansen*, *Joel Hawksley*
398
-
399
- * Add `include_seconds` option for `time_field`.
400
-
401
- <%= form.time_field :foo, include_seconds: false %>
402
- # => <input value="16:22" type="time" />
403
-
404
- Default includes seconds:
405
-
406
- <%= form.time_field :foo %>
407
- # => <input value="16:22:01.440" type="time" />
408
-
409
- This allows you to take advantage of [different rendering options](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/input/time#time_value_format) in some browsers.
331
+ * Move `convert_to_model` call from `form_for` into `form_with`
410
332
 
411
- *Alex Ghiculescu*
412
-
413
- * Improve error messages when template file does not exist at absolute filepath.
414
-
415
- *Ted Whang*
416
-
417
- * Add `:country_code` option to `sms_to` for consistency with `phone_to`.
333
+ Now that `form_for` is implemented in terms of `form_with`, remove the
334
+ `convert_to_model` call from `form_for`.
418
335
 
419
- *Jonathan Hefner*
420
-
421
- * OpenSSL constants are now used for Digest computations.
336
+ *Sean Doyle*
422
337
 
423
- *Dirkjan Bussink*
338
+ * Fix and add protections for XSS in `ActionView::Helpers` and `ERB::Util`.
424
339
 
425
- * The `translate` helper now passes `default` values that aren't
426
- translation keys through `I18n.translate` for interpolation.
340
+ Escape dangerous characters in names of tags and names of attributes in the
341
+ tag helpers, following the XML specification. Rename the option
342
+ `:escape_attributes` to `:escape`, to simplify by applying the option to the
343
+ whole tag.
427
344
 
428
- *Jonathan Hefner*
345
+ *Álvaro Martín Fraguas*
429
346
 
430
- * Adds option `extname` to `stylesheet_link_tag` to skip default
431
- `.css` extension appended to the stylesheet path.
347
+ * Extend audio_tag and video_tag to accept Active Storage attachments.
432
348
 
433
- Before:
349
+ Now it's possible to write
434
350
 
435
351
  ```ruby
436
- stylesheet_link_tag "style.less"
437
- # <link href="/stylesheets/style.less.scss" rel="stylesheet">
352
+ audio_tag(user.audio_file)
353
+ video_tag(user.video_file)
438
354
  ```
439
355
 
440
- After:
356
+ Instead of
441
357
 
442
358
  ```ruby
443
- stylesheet_link_tag "style.less", extname: false, skip_pipeline: true, rel: "stylesheet/less"
444
- # <link href="/stylesheets/style.less" rel="stylesheet/less">
359
+ audio_tag(polymorphic_path(user.audio_file))
360
+ video_tag(polymorphic_path(user.video_file))
445
361
  ```
446
362
 
447
- *Abhay Nikam*
448
-
449
- * Deprecate `render` locals to be assigned to instance variables.
363
+ `image_tag` already supported that, so this follows the same pattern.
450
364
 
451
- *Petrik de Heus*
365
+ *Matheus Richard*
452
366
 
453
- * Remove legacy default `media=screen` from `stylesheet_link_tag`.
454
-
455
- *André Luis Leal Cardoso Junior*
456
-
457
- * Change `ActionView::Helpers::FormBuilder#button` to transform `formmethod`
458
- attributes into `_method="$VERB"` Form Data to enable varied same-form actions:
459
-
460
- <%= form_with model: post, method: :put do %>
461
- <%= form.button "Update" %>
462
- <%= form.button "Delete", formmethod: :delete %>
463
- <% end %>
464
- <%# => <form action="posts/1">
465
- => <input type="hidden" name="_method" value="put">
466
- => <button type="submit">Update</button>
467
- => <button type="submit" formmethod="post" name="_method" value="delete">Delete</button>
468
- => </form>
469
- %>
470
-
471
- *Sean Doyle*
472
-
473
- * Change `ActionView::Helpers::UrlHelper#button_to` to *always* render a
474
- `<button>` element, regardless of whether or not the content is passed as
475
- the first argument or as a block.
476
-
477
- <%= button_to "Delete", post_path(@post), method: :delete %>
478
- # => <form action="/posts/1"><input type="hidden" name="_method" value="delete"><button type="submit">Delete</button></form>
479
-
480
- <%= button_to post_path(@post), method: :delete do %>
481
- Delete
482
- <% end %>
483
- # => <form action="/posts/1"><input type="hidden" name="_method" value="delete"><button type="submit">Delete</button></form>
484
-
485
- *Sean Doyle*, *Dusan Orlovic*
486
-
487
- * Add `config.action_view.preload_links_header` to allow disabling of
488
- the `Link` header being added by default when using `stylesheet_link_tag`
489
- and `javascript_include_tag`.
490
-
491
- *Andrew White*
492
-
493
- * The `translate` helper now resolves `default` values when a `nil` key is
494
- specified, instead of always returning `nil`.
495
-
496
- *Jonathan Hefner*
497
-
498
- * Add `config.action_view.image_loading` to configure the default value of
499
- the `image_tag` `:loading` option.
500
-
501
- By setting `config.action_view.image_loading = "lazy"`, an application can opt in to
502
- lazy loading images sitewide, without changing view code.
503
-
504
- *Jonathan Hefner*
505
-
506
- * `ActionView::Helpers::FormBuilder#id` returns the value
507
- of the `<form>` element's `id` attribute. With a `method` argument, returns
508
- the `id` attribute for a form field with that name.
509
-
510
- <%= form_for @post do |f| %>
511
- <%# ... %>
512
-
513
- <% content_for :sticky_footer do %>
514
- <%= form.button(form: f.id) %>
515
- <% end %>
516
- <% end %>
517
-
518
- *Sean Doyle*
519
-
520
- * `ActionView::Helpers::FormBuilder#field_id` returns the value generated by
521
- the FormBuilder for the given attribute name.
522
-
523
- <%= form_for @post do |f| %>
524
- <%= f.label :title %>
525
- <%= f.text_field :title, aria: { describedby: f.field_id(:title, :error) } %>
526
- <%= tag.span("is blank", id: f.field_id(:title, :error) %>
527
- <% end %>
528
-
529
- *Sean Doyle*
530
-
531
- * Add `tag.attributes` to transform a Hash into HTML Attributes, ready to be
532
- interpolated into ERB.
533
-
534
- <input <%= tag.attributes(type: :text, aria: { label: "Search" }) %> >
535
- # => <input type="text" aria-label="Search">
367
+ * Ensure models passed to `form_for` attempt to call `to_model`.
536
368
 
537
369
  *Sean Doyle*
538
370
 
539
-
540
- Please check [6-1-stable](https://github.com/rails/rails/blob/6-1-stable/actionview/CHANGELOG.md) for previous changes.
371
+ Please check [7-0-stable](https://github.com/rails/rails/blob/7-0-stable/actionview/CHANGELOG.md) for previous changes.