actionview 7.0.7.2 → 7.1.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +262 -329
- data/MIT-LICENSE +1 -1
- data/README.rdoc +1 -1
- data/app/assets/javascripts/rails-ujs.esm.js +693 -0
- data/app/assets/javascripts/rails-ujs.js +630 -0
- data/lib/action_view/base.rb +33 -12
- data/lib/action_view/buffers.rb +106 -8
- data/lib/action_view/cache_expiry.rb +40 -43
- data/lib/action_view/context.rb +1 -1
- data/lib/action_view/deprecator.rb +7 -0
- data/lib/action_view/digestor.rb +1 -1
- data/lib/action_view/gem_version.rb +4 -4
- data/lib/action_view/helpers/active_model_helper.rb +1 -1
- data/lib/action_view/helpers/asset_tag_helper.rb +130 -46
- data/lib/action_view/helpers/asset_url_helper.rb +6 -5
- data/lib/action_view/helpers/atom_feed_helper.rb +5 -5
- data/lib/action_view/helpers/cache_helper.rb +3 -9
- data/lib/action_view/helpers/capture_helper.rb +24 -10
- data/lib/action_view/helpers/content_exfiltration_prevention_helper.rb +70 -0
- data/lib/action_view/helpers/controller_helper.rb +6 -0
- data/lib/action_view/helpers/csp_helper.rb +2 -2
- data/lib/action_view/helpers/csrf_helper.rb +2 -2
- data/lib/action_view/helpers/date_helper.rb +17 -19
- data/lib/action_view/helpers/debug_helper.rb +3 -3
- data/lib/action_view/helpers/form_helper.rb +43 -17
- data/lib/action_view/helpers/form_options_helper.rb +2 -1
- data/lib/action_view/helpers/form_tag_helper.rb +43 -9
- data/lib/action_view/helpers/javascript_helper.rb +1 -0
- data/lib/action_view/helpers/number_helper.rb +2 -1
- data/lib/action_view/helpers/output_safety_helper.rb +2 -2
- data/lib/action_view/helpers/rendering_helper.rb +1 -1
- data/lib/action_view/helpers/sanitize_helper.rb +33 -14
- data/lib/action_view/helpers/tag_helper.rb +5 -27
- data/lib/action_view/helpers/tags/base.rb +11 -52
- data/lib/action_view/helpers/tags/collection_check_boxes.rb +1 -0
- data/lib/action_view/helpers/tags/collection_radio_buttons.rb +1 -0
- data/lib/action_view/helpers/tags/collection_select.rb +3 -0
- data/lib/action_view/helpers/tags/date_field.rb +1 -1
- data/lib/action_view/helpers/tags/date_select.rb +2 -0
- data/lib/action_view/helpers/tags/datetime_field.rb +14 -6
- data/lib/action_view/helpers/tags/datetime_local_field.rb +11 -2
- data/lib/action_view/helpers/tags/grouped_collection_select.rb +3 -0
- data/lib/action_view/helpers/tags/month_field.rb +1 -1
- data/lib/action_view/helpers/tags/select.rb +3 -0
- data/lib/action_view/helpers/tags/select_renderer.rb +56 -0
- data/lib/action_view/helpers/tags/time_field.rb +1 -1
- data/lib/action_view/helpers/tags/time_zone_select.rb +3 -0
- data/lib/action_view/helpers/tags/week_field.rb +1 -1
- data/lib/action_view/helpers/tags/weekday_select.rb +3 -0
- data/lib/action_view/helpers/tags.rb +2 -0
- data/lib/action_view/helpers/text_helper.rb +32 -16
- data/lib/action_view/helpers/translation_helper.rb +3 -3
- data/lib/action_view/helpers/url_helper.rb +41 -14
- data/lib/action_view/helpers.rb +2 -0
- data/lib/action_view/layouts.rb +6 -4
- data/lib/action_view/log_subscriber.rb +49 -32
- data/lib/action_view/lookup_context.rb +29 -13
- data/lib/action_view/path_registry.rb +57 -0
- data/lib/action_view/path_set.rb +13 -14
- data/lib/action_view/railtie.rb +26 -3
- data/lib/action_view/record_identifier.rb +15 -8
- data/lib/action_view/renderer/abstract_renderer.rb +1 -1
- data/lib/action_view/renderer/collection_renderer.rb +9 -1
- data/lib/action_view/renderer/partial_renderer/collection_caching.rb +10 -2
- data/lib/action_view/renderer/partial_renderer.rb +2 -1
- data/lib/action_view/renderer/renderer.rb +2 -0
- data/lib/action_view/renderer/streaming_template_renderer.rb +3 -2
- data/lib/action_view/renderer/template_renderer.rb +3 -2
- data/lib/action_view/rendering.rb +22 -4
- data/lib/action_view/ripper_ast_parser.rb +6 -6
- data/lib/action_view/template/error.rb +14 -1
- data/lib/action_view/template/handlers/builder.rb +4 -4
- data/lib/action_view/template/handlers/erb/erubi.rb +23 -27
- data/lib/action_view/template/handlers/erb.rb +73 -1
- data/lib/action_view/template/handlers.rb +1 -1
- data/lib/action_view/template/html.rb +1 -1
- data/lib/action_view/template/raw_file.rb +1 -1
- data/lib/action_view/template/renderable.rb +1 -1
- data/lib/action_view/template/resolver.rb +10 -2
- data/lib/action_view/template/text.rb +1 -1
- data/lib/action_view/template/types.rb +25 -34
- data/lib/action_view/template.rb +227 -53
- data/lib/action_view/template_path.rb +2 -0
- data/lib/action_view/test_case.rb +174 -21
- data/lib/action_view/unbound_template.rb +15 -5
- data/lib/action_view/version.rb +1 -1
- data/lib/action_view/view_paths.rb +15 -24
- data/lib/action_view.rb +4 -1
- metadata +24 -24
data/CHANGELOG.md
CHANGED
|
@@ -1,479 +1,412 @@
|
|
|
1
|
-
## Rails 7.
|
|
1
|
+
## Rails 7.1.1 (October 11, 2023) ##
|
|
2
2
|
|
|
3
|
-
*
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
## Rails 7.0.7.1 (August 22, 2023) ##
|
|
7
|
-
|
|
8
|
-
* No changes.
|
|
9
|
-
|
|
10
|
-
|
|
11
|
-
## Rails 7.0.7 (August 09, 2023) ##
|
|
3
|
+
* Updated `@rails/ujs` files to ignore certain data-* attributes when element is contenteditable.
|
|
12
4
|
|
|
13
|
-
|
|
5
|
+
This fix was already landed in >= 7.0.4.3, < 7.1.0.
|
|
6
|
+
[[CVE-2023-23913](https://github.com/advisories/GHSA-xp5h-f8jf-rc8q)]
|
|
14
7
|
|
|
15
|
-
|
|
8
|
+
*Ryunosuke Sato*
|
|
16
9
|
|
|
17
|
-
*Jean Boussier*
|
|
18
|
-
|
|
19
|
-
* Don't double-encode nested `field_id` and `field_name` index values
|
|
20
10
|
|
|
21
|
-
|
|
22
|
-
`field_name` view helper methods.
|
|
23
|
-
|
|
24
|
-
*Sean Doyle*
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
## Rails 7.0.6 (June 29, 2023) ##
|
|
11
|
+
## Rails 7.1.0 (October 05, 2023) ##
|
|
28
12
|
|
|
29
13
|
* No changes.
|
|
30
14
|
|
|
31
15
|
|
|
32
|
-
## Rails 7.0.
|
|
16
|
+
## Rails 7.1.0.rc2 (October 01, 2023) ##
|
|
33
17
|
|
|
34
18
|
* No changes.
|
|
35
19
|
|
|
36
20
|
|
|
37
|
-
## Rails 7.0.
|
|
21
|
+
## Rails 7.1.0.rc1 (September 27, 2023) ##
|
|
38
22
|
|
|
39
|
-
*
|
|
23
|
+
* Introduce `ActionView::TestCase.register_parser`
|
|
40
24
|
|
|
41
|
-
|
|
25
|
+
```ruby
|
|
26
|
+
register_parser :rss, -> rendered { RSS::Parser.parse(rendered) }
|
|
42
27
|
|
|
43
|
-
|
|
28
|
+
test "renders RSS" do
|
|
29
|
+
article = Article.create!(title: "Hello, world")
|
|
44
30
|
|
|
45
|
-
|
|
31
|
+
render formats: :rss, partial: article
|
|
46
32
|
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
```erb
|
|
51
|
-
<%= form.select :foo, [["North America", [["United States","US"],["Canada","CA"]], { disabled: "disabled" }]] %>
|
|
52
|
-
# => <select><optgroup label="North America" disabled="disabled"><option value="US">United States</option><option value="CA">Canada</option></optgroup></select>
|
|
33
|
+
assert_equal "Hello, world", rendered.rss.items.last.title
|
|
34
|
+
end
|
|
53
35
|
```
|
|
54
36
|
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
## Rails 7.0.4.3 (March 13, 2023) ##
|
|
37
|
+
By default, register parsers for `:html` and `:json`.
|
|
59
38
|
|
|
60
|
-
*
|
|
39
|
+
*Sean Doyle*
|
|
61
40
|
|
|
62
|
-
[CVE-2023-23913]
|
|
63
41
|
|
|
42
|
+
## Rails 7.1.0.beta1 (September 13, 2023) ##
|
|
64
43
|
|
|
65
|
-
|
|
44
|
+
* Fix `simple_format` with blank `wrapper_tag` option returns plain html tag
|
|
66
45
|
|
|
67
|
-
|
|
46
|
+
By default `simple_format` method returns the text wrapped with `<p>`. But if we explicitly specify
|
|
47
|
+
the `wrapper_tag: nil` in the options, it returns the text wrapped with `<></>` tag.
|
|
68
48
|
|
|
49
|
+
Before:
|
|
69
50
|
|
|
70
|
-
|
|
51
|
+
```ruby
|
|
52
|
+
simple_format("Hello World", {}, { wrapper_tag: nil })
|
|
53
|
+
# <>Hello World</>
|
|
54
|
+
```
|
|
71
55
|
|
|
72
|
-
|
|
56
|
+
After:
|
|
73
57
|
|
|
58
|
+
```ruby
|
|
59
|
+
simple_format("Hello World", {}, { wrapper_tag: nil })
|
|
60
|
+
# <p>Hello World</p>
|
|
61
|
+
```
|
|
74
62
|
|
|
75
|
-
|
|
63
|
+
*Akhil G Krishnan*, *Junichi Ito*
|
|
76
64
|
|
|
77
|
-
*
|
|
78
|
-
`object_name` arguments. For example:
|
|
65
|
+
* Don't double-encode nested `field_id` and `field_name` index values
|
|
79
66
|
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
<%= f.field_name :body %>
|
|
83
|
-
<% end %>
|
|
84
|
-
```
|
|
67
|
+
Pass `index: @options` as a default keyword argument to `field_id` and
|
|
68
|
+
`field_name` view helper methods.
|
|
85
69
|
|
|
86
70
|
*Sean Doyle*
|
|
87
71
|
|
|
88
|
-
*
|
|
72
|
+
* Allow opting in/out of `Link preload` headers when calling `stylesheet_link_tag` or `javascript_include_tag`
|
|
89
73
|
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
|
|
74
|
+
```ruby
|
|
75
|
+
# will exclude header, even if setting is enabled:
|
|
76
|
+
javascript_include_tag("http://example.com/all.js", preload_links_header: false)
|
|
93
77
|
|
|
94
|
-
|
|
78
|
+
# will include header, even if setting is disabled:
|
|
79
|
+
stylesheet_link_tag("http://example.com/all.js", preload_links_header: true)
|
|
80
|
+
```
|
|
95
81
|
|
|
96
|
-
*
|
|
82
|
+
*Alex Ghiculescu*
|
|
97
83
|
|
|
98
|
-
|
|
84
|
+
* Stop generating `Link preload` headers once it has reached 1KB.
|
|
99
85
|
|
|
100
|
-
|
|
86
|
+
Some proxies have trouble handling large headers, but more importantly preload links
|
|
87
|
+
have diminishing returns so it's preferable not to go overboard with them.
|
|
101
88
|
|
|
89
|
+
If tighter control is needed, it's recommended to disable automatic generation of preloads
|
|
90
|
+
and to generate them manually from the controller or from a middleware.
|
|
102
91
|
|
|
103
|
-
|
|
92
|
+
*Jean Boussier*
|
|
104
93
|
|
|
105
|
-
*
|
|
94
|
+
* `simple_format` helper now handles a `:sanitize_options` - any extra options you want appending to the sanitize.
|
|
106
95
|
|
|
107
|
-
|
|
96
|
+
Before:
|
|
97
|
+
```ruby
|
|
98
|
+
simple_format("<a target=\"_blank\" href=\"http://example.com\">Continue</a>")
|
|
99
|
+
# => "<p><a href=\"http://example.com\">Continue</a></p>"
|
|
100
|
+
```
|
|
108
101
|
|
|
109
|
-
|
|
102
|
+
After:
|
|
103
|
+
```ruby
|
|
104
|
+
simple_format("<a target=\"_blank\" href=\"http://example.com\">Continue</a>", {}, { sanitize_options: { attributes: %w[target href] } })
|
|
105
|
+
# => "<p><a target=\"_blank\" href=\"http://example.com\">Continue</a></p>"
|
|
106
|
+
```
|
|
110
107
|
|
|
111
|
-
*
|
|
108
|
+
*Andrei Andriichuk*
|
|
112
109
|
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
`:escape_attributes` to `:escape`, to simplify by applying the option to the
|
|
116
|
-
whole tag.
|
|
110
|
+
* Add support for HTML5 standards-compliant sanitizers, and default to `Rails::HTML5::Sanitizer`
|
|
111
|
+
in the Rails 7.1 configuration if it is supported.
|
|
117
112
|
|
|
118
|
-
|
|
113
|
+
Action View's HTML sanitizers can be configured by setting
|
|
114
|
+
`config.action_view.sanitizer_vendor`. Supported values are `Rails::HTML4::Sanitizer` or
|
|
115
|
+
`Rails::HTML5::Sanitizer`.
|
|
119
116
|
|
|
120
|
-
|
|
117
|
+
The Rails 7.1 configuration will set this to `Rails::HTML5::Sanitizer` when it is supported, and
|
|
118
|
+
fall back to `Rails::HTML4::Sanitizer`. Previous configurations default to
|
|
119
|
+
`Rails::HTML4::Sanitizer`.
|
|
121
120
|
|
|
122
|
-
*
|
|
121
|
+
*Mike Dalessio*
|
|
123
122
|
|
|
123
|
+
* `config.dom_testing_default_html_version` controls the HTML parser used by
|
|
124
|
+
`ActionView::TestCase#document_root_element`, which creates the DOM used by the assertions in
|
|
125
|
+
Rails::Dom::Testing.
|
|
124
126
|
|
|
125
|
-
|
|
127
|
+
The Rails 7.1 default configuration opts into the HTML5 parser when it is supported, to better
|
|
128
|
+
represent what the DOM would be in a browser user agent. Previously this test helper always used
|
|
129
|
+
Nokogiri's HTML4 parser.
|
|
126
130
|
|
|
127
|
-
*
|
|
131
|
+
*Mike Dalessio*
|
|
128
132
|
|
|
133
|
+
* Add support for the HTML picture tag. It supports passing a String, an Array or a Block.
|
|
134
|
+
Supports passing properties directly to the img tag via the `:image` key.
|
|
135
|
+
Since the picture tag requires an img tag, the last element you provide will be used for the img tag.
|
|
136
|
+
For complete control over the picture tag, a block can be passed, which will populate the contents of the tag accordingly.
|
|
129
137
|
|
|
130
|
-
|
|
138
|
+
Can be used like this for a single source:
|
|
139
|
+
```erb
|
|
140
|
+
<%= picture_tag("picture.webp") %>
|
|
141
|
+
```
|
|
142
|
+
which will generate the following:
|
|
143
|
+
```html
|
|
144
|
+
<picture>
|
|
145
|
+
<img src="/images/picture.webp" />
|
|
146
|
+
</picture>
|
|
147
|
+
```
|
|
131
148
|
|
|
132
|
-
|
|
149
|
+
For multiple sources:
|
|
150
|
+
```erb
|
|
151
|
+
<%= picture_tag("picture.webp", "picture.png", :class => "mt-2", :image => { alt: "Image", class: "responsive-img" }) %>
|
|
152
|
+
```
|
|
153
|
+
will generate:
|
|
154
|
+
```html
|
|
155
|
+
<picture class="mt-2">
|
|
156
|
+
<source srcset="/images/picture.webp" />
|
|
157
|
+
<source srcset="/images/picture.png" />
|
|
158
|
+
<img alt="Image" class="responsive-img" src="/images/picture.png" />
|
|
159
|
+
</picture>
|
|
160
|
+
```
|
|
133
161
|
|
|
162
|
+
Full control via a block:
|
|
163
|
+
```erb
|
|
164
|
+
<%= picture_tag(:class => "my-class") do %>
|
|
165
|
+
<%= tag(:source, :srcset => image_path("picture.webp")) %>
|
|
166
|
+
<%= tag(:source, :srcset => image_path("picture.png")) %>
|
|
167
|
+
<%= image_tag("picture.png", :alt => "Image") %>
|
|
168
|
+
<% end %>
|
|
169
|
+
```
|
|
170
|
+
will generate:
|
|
171
|
+
```html
|
|
172
|
+
<picture class="my-class">
|
|
173
|
+
<source srcset="/images/picture.webp" />
|
|
174
|
+
<source srcset="/images/picture.png" />
|
|
175
|
+
<img alt="Image" src="/images/picture.png" />
|
|
176
|
+
</picture>
|
|
177
|
+
```
|
|
134
178
|
|
|
135
|
-
|
|
179
|
+
*Juan Pablo Balarini*
|
|
136
180
|
|
|
137
|
-
*
|
|
181
|
+
* Remove deprecated support to passing instance variables as locals to partials.
|
|
138
182
|
|
|
139
|
-
*
|
|
183
|
+
*Rafael Mendonça França*
|
|
140
184
|
|
|
141
|
-
*
|
|
142
|
-
a `response` method.
|
|
185
|
+
* Remove deprecated constant `ActionView::Path`.
|
|
143
186
|
|
|
144
|
-
*
|
|
187
|
+
*Rafael Mendonça França*
|
|
145
188
|
|
|
189
|
+
* Guard `token_list` calls from escaping HTML too often
|
|
146
190
|
|
|
147
|
-
|
|
191
|
+
*Sean Doyle*
|
|
148
192
|
|
|
149
|
-
*
|
|
193
|
+
* `select` can now be called with a single hash containing options and some HTML options
|
|
150
194
|
|
|
151
|
-
|
|
195
|
+
Previously this would not work as expected:
|
|
152
196
|
|
|
153
|
-
|
|
197
|
+
```erb
|
|
198
|
+
<%= select :post, :author, authors, required: true %>
|
|
199
|
+
```
|
|
154
200
|
|
|
155
|
-
|
|
201
|
+
Instead you needed to do this:
|
|
156
202
|
|
|
203
|
+
```erb
|
|
204
|
+
<%= select :post, :author, authors, {}, required: true %>
|
|
205
|
+
```
|
|
157
206
|
|
|
158
|
-
|
|
207
|
+
Now, either form is accepted, for the following HTML attributes: `required`, `multiple`, `size`.
|
|
159
208
|
|
|
160
|
-
*
|
|
161
|
-
`ActionView::Helper::FormBuilder#file_field` with `multiple: true` to
|
|
162
|
-
support submitting an empty collection of files.
|
|
209
|
+
*Alex Ghiculescu*
|
|
163
210
|
|
|
164
|
-
|
|
165
|
-
form.file_field :attachments, multiple: true
|
|
166
|
-
# => <input type="hidden" autocomplete="off" name="post[attachments][]" value="">
|
|
167
|
-
<input type="file" multiple="multiple" id="post_attachments" name="post[attachments][]">
|
|
211
|
+
* Datetime form helpers (`time_field`, `date_field`, `datetime_field`, `week_field`, `month_field`) now accept an instance of Time/Date/DateTime as `:value` option.
|
|
168
212
|
|
|
169
|
-
|
|
170
|
-
|
|
213
|
+
Before:
|
|
214
|
+
```erb
|
|
215
|
+
<%= form.datetime_field :written_at, value: Time.current.strftime("%Y-%m-%dT%T") %>
|
|
171
216
|
```
|
|
172
217
|
|
|
173
|
-
|
|
174
|
-
|
|
175
|
-
|
|
176
|
-
|
|
177
|
-
*Pedro Moreira*
|
|
218
|
+
After:
|
|
219
|
+
```erb
|
|
220
|
+
<%= form.datetime_field :written_at, value: Time.current %>
|
|
221
|
+
```
|
|
178
222
|
|
|
223
|
+
*Andrey Samsonov*
|
|
179
224
|
|
|
180
|
-
|
|
225
|
+
* Choices of `select` can optionally contain html attributes as the last element
|
|
226
|
+
of the child arrays when using grouped/nested collections
|
|
181
227
|
|
|
182
|
-
|
|
228
|
+
```erb
|
|
229
|
+
<%= form.select :foo, [["North America", [["United States","US"],["Canada","CA"]], { disabled: "disabled" }]] %>
|
|
230
|
+
# => <select><optgroup label="North America" disabled="disabled"><option value="US">United States</option><option value="CA">Canada</option></optgroup></select>
|
|
231
|
+
```
|
|
183
232
|
|
|
233
|
+
*Chris Gunther*
|
|
184
234
|
|
|
185
|
-
|
|
235
|
+
* `check_box_tag` and `radio_button_tag` now accept `checked` as a keyword argument
|
|
186
236
|
|
|
187
|
-
|
|
237
|
+
This is to make the API more consistent with the `FormHelper` variants. You can now
|
|
238
|
+
provide `checked` as a positional or keyword argument:
|
|
188
239
|
|
|
189
|
-
|
|
240
|
+
```erb
|
|
241
|
+
= check_box_tag "admin", "1", false
|
|
242
|
+
= check_box_tag "admin", "1", checked: false
|
|
190
243
|
|
|
191
|
-
|
|
192
|
-
|
|
244
|
+
= radio_button_tag 'favorite_color', 'maroon', false
|
|
245
|
+
= radio_button_tag 'favorite_color', 'maroon', checked: false
|
|
246
|
+
```
|
|
193
247
|
|
|
194
|
-
*
|
|
248
|
+
*Alex Ghiculescu*
|
|
195
249
|
|
|
196
|
-
*
|
|
197
|
-
|
|
250
|
+
* Allow passing a class to `dom_id`.
|
|
251
|
+
You no longer need to call `new` when passing a class to `dom_id`.
|
|
252
|
+
This makes `dom_id` behave like `dom_class` in this regard.
|
|
253
|
+
Apart from saving a few keystrokes, it prevents Ruby from needing
|
|
254
|
+
to instantiate a whole new object just to generate a string.
|
|
198
255
|
|
|
256
|
+
Before:
|
|
199
257
|
```ruby
|
|
200
|
-
|
|
201
|
-
#=> <form method="post" action="/workshops/1" class="button_to">
|
|
202
|
-
#=> <input type="hidden" name="_method" value="patch" autocomplete="off" />
|
|
203
|
-
#=> <button type="submit">Update</button>
|
|
204
|
-
#=> </form>
|
|
205
|
-
|
|
206
|
-
button_to([ Workshop.find(1), Session.find(1) ]) { "Update" }
|
|
207
|
-
#=> <form method="post" action="/workshops/1/sessions/1" class="button_to">
|
|
208
|
-
#=> <input type="hidden" name="_method" value="patch" autocomplete="off" />
|
|
209
|
-
#=> <button type="submit">Update</button>
|
|
210
|
-
#=> </form>
|
|
258
|
+
dom_id(Post) # => NoMethodError: undefined method `to_key' for Post:Class
|
|
211
259
|
```
|
|
212
260
|
|
|
213
|
-
|
|
214
|
-
|
|
215
|
-
* Support passing a Symbol as the first argument to `FormBuilder#button`:
|
|
216
|
-
|
|
261
|
+
After:
|
|
217
262
|
```ruby
|
|
218
|
-
|
|
219
|
-
# => <button name="post[draft]" value="true" type="submit">Create post</button>
|
|
220
|
-
|
|
221
|
-
form.button(:draft, value: true) do
|
|
222
|
-
content_tag(:strong, "Save as draft")
|
|
223
|
-
end
|
|
224
|
-
# => <button name="post[draft]" value="true" type="submit">
|
|
225
|
-
# <strong>Save as draft</strong>
|
|
226
|
-
# </button>
|
|
263
|
+
dom_id(Post) # => "new_post"
|
|
227
264
|
```
|
|
228
265
|
|
|
229
|
-
*
|
|
266
|
+
*Goulven Champenois*
|
|
230
267
|
|
|
231
|
-
*
|
|
232
|
-
`FormBuilder#field_name` counterpart:
|
|
268
|
+
* Report `:locals` as part of the data returned by ActionView render instrumentation.
|
|
233
269
|
|
|
270
|
+
Before:
|
|
234
271
|
```ruby
|
|
235
|
-
|
|
236
|
-
|
|
237
|
-
|
|
238
|
-
|
|
272
|
+
{
|
|
273
|
+
identifier: "/Users/adam/projects/notifications/app/views/posts/index.html.erb",
|
|
274
|
+
layout: "layouts/application"
|
|
275
|
+
}
|
|
239
276
|
```
|
|
240
277
|
|
|
241
|
-
|
|
242
|
-
|
|
243
|
-
* Execute the `ActionView::Base.field_error_proc` within the context of the
|
|
244
|
-
`ActionView::Base` instance:
|
|
245
|
-
|
|
278
|
+
After:
|
|
246
279
|
```ruby
|
|
247
|
-
|
|
280
|
+
{
|
|
281
|
+
identifier: "/Users/adam/projects/notifications/app/views/posts/index.html.erb",
|
|
282
|
+
layout: "layouts/application",
|
|
283
|
+
locals: {foo: "bar"}
|
|
284
|
+
}
|
|
248
285
|
```
|
|
249
286
|
|
|
250
|
-
*
|
|
287
|
+
*Aaron Gough*
|
|
251
288
|
|
|
252
|
-
*
|
|
289
|
+
* Strip `break_sequence` at the end of `word_wrap`.
|
|
253
290
|
|
|
254
|
-
|
|
255
|
-
button_to "Create", Post.new, authenticity_token: false
|
|
256
|
-
# => <form class="button_to" method="post" action="/posts"><button type="submit">Create</button></form>
|
|
291
|
+
This fixes a bug where `word_wrap` didn't properly strip off break sequences that had printable characters.
|
|
257
292
|
|
|
258
|
-
|
|
259
|
-
# => <form class="button_to" method="post" action="/posts"><button type="submit">Create</button><input type="hidden" name="form_token" value="abc123..." autocomplete="off" /></form>
|
|
293
|
+
For example, compare the outputs of this template:
|
|
260
294
|
|
|
261
|
-
|
|
262
|
-
#
|
|
295
|
+
```erb
|
|
296
|
+
# <%= word_wrap("11 22\n33 44", line_width: 2, break_sequence: "\n# ") %>
|
|
263
297
|
```
|
|
264
298
|
|
|
265
|
-
|
|
266
|
-
|
|
267
|
-
* Support rendering `<form>` elements _without_ `[action]` attributes by:
|
|
299
|
+
Before:
|
|
268
300
|
|
|
269
|
-
|
|
270
|
-
|
|
271
|
-
|
|
272
|
-
|
|
301
|
+
```
|
|
302
|
+
# 11
|
|
303
|
+
# 22
|
|
304
|
+
#
|
|
305
|
+
# 33
|
|
306
|
+
# 44
|
|
307
|
+
#
|
|
308
|
+
```
|
|
273
309
|
|
|
274
|
-
|
|
310
|
+
After:
|
|
275
311
|
|
|
276
|
-
|
|
312
|
+
```
|
|
313
|
+
# 11
|
|
314
|
+
# 22
|
|
315
|
+
# 33
|
|
316
|
+
# 44
|
|
317
|
+
```
|
|
277
318
|
|
|
278
|
-
|
|
279
|
-
# generates day options like <option value="1">1st</option>\n<option value="2">2nd</option>...
|
|
319
|
+
*Max Chernyak*
|
|
280
320
|
|
|
281
|
-
|
|
321
|
+
* Allow templates to set strict `locals`.
|
|
282
322
|
|
|
283
|
-
|
|
284
|
-
is used with a single argument:
|
|
323
|
+
By default, templates will accept any `locals` as keyword arguments. To define what `locals` a template accepts, add a `locals` magic comment:
|
|
285
324
|
|
|
286
|
-
|
|
287
|
-
|
|
325
|
+
```erb
|
|
326
|
+
<%# locals: (message:) -%>
|
|
327
|
+
<%= message %>
|
|
328
|
+
```
|
|
288
329
|
|
|
289
|
-
|
|
330
|
+
Default values can also be provided:
|
|
290
331
|
|
|
291
|
-
|
|
292
|
-
|
|
293
|
-
|
|
294
|
-
|
|
295
|
-
end
|
|
296
|
-
end
|
|
332
|
+
```erb
|
|
333
|
+
<%# locals: (message: "Hello, world!") -%>
|
|
334
|
+
<%= message %>
|
|
335
|
+
```
|
|
297
336
|
|
|
298
|
-
|
|
299
|
-
model implemented a `#to_s` method that called the `name` method.
|
|
337
|
+
Or `locals` can be disabled entirely:
|
|
300
338
|
|
|
301
|
-
|
|
302
|
-
|
|
339
|
+
```erb
|
|
340
|
+
<%# locals: () %>
|
|
341
|
+
```
|
|
303
342
|
|
|
304
|
-
*
|
|
343
|
+
*Joel Hawksley*
|
|
305
344
|
|
|
306
|
-
*
|
|
345
|
+
* Add `include_seconds` option for `datetime_local_field`
|
|
307
346
|
|
|
308
|
-
|
|
309
|
-
# => <svg><use href="#cool-icon"></svg>
|
|
347
|
+
This allows to omit seconds part in the input field, by passing `include_seconds: false`
|
|
310
348
|
|
|
311
|
-
*
|
|
349
|
+
*Wojciech Wnętrzak*
|
|
312
350
|
|
|
351
|
+
* Guard against `ActionView::Helpers::FormTagHelper#field_name` calls with nil
|
|
352
|
+
`object_name` arguments. For example:
|
|
313
353
|
|
|
314
|
-
|
|
354
|
+
```erb
|
|
355
|
+
<%= fields do |f| %>
|
|
356
|
+
<%= f.field_name :body %>
|
|
357
|
+
<% end %>
|
|
358
|
+
```
|
|
315
359
|
|
|
316
|
-
*
|
|
360
|
+
*Sean Doyle*
|
|
317
361
|
|
|
362
|
+
* Strings returned from `strip_tags` are correctly tagged `html_safe?`
|
|
318
363
|
|
|
319
|
-
|
|
364
|
+
Because these strings contain no HTML elements and the basic entities are escaped, they are safe
|
|
365
|
+
to be included as-is as PCDATA in HTML content. Tagging them as html-safe avoids double-escaping
|
|
366
|
+
entities when being concatenated to a SafeBuffer during rendering.
|
|
320
367
|
|
|
321
|
-
|
|
322
|
-
exceptions as flow control.
|
|
368
|
+
Fixes [rails/rails-html-sanitizer#124](https://github.com/rails/rails-html-sanitizer/issues/124)
|
|
323
369
|
|
|
324
370
|
*Mike Dalessio*
|
|
325
371
|
|
|
326
|
-
* `
|
|
372
|
+
* Move `convert_to_model` call from `form_for` into `form_with`
|
|
327
373
|
|
|
328
|
-
|
|
374
|
+
Now that `form_for` is implemented in terms of `form_with`, remove the
|
|
375
|
+
`convert_to_model` call from `form_for`.
|
|
329
376
|
|
|
330
|
-
*
|
|
331
|
-
|
|
332
|
-
*Drew Bragg*, *Dana Kashubeck*, *Kasper Timm Hansen*
|
|
333
|
-
|
|
334
|
-
* Add `caching?` helper that returns whether the current code path is being cached and `uncacheable!` to denote helper methods that can't participate in fragment caching.
|
|
335
|
-
|
|
336
|
-
*Ben Toews*, *John Hawthorn*, *Kasper Timm Hansen*, *Joel Hawksley*
|
|
337
|
-
|
|
338
|
-
* Add `include_seconds` option for `time_field`.
|
|
339
|
-
|
|
340
|
-
<%= form.time_field :foo, include_seconds: false %>
|
|
341
|
-
# => <input value="16:22" type="time" />
|
|
342
|
-
|
|
343
|
-
Default includes seconds:
|
|
344
|
-
|
|
345
|
-
<%= form.time_field :foo %>
|
|
346
|
-
# => <input value="16:22:01.440" type="time" />
|
|
347
|
-
|
|
348
|
-
This allows you to take advantage of [different rendering options](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/input/time#time_value_format) in some browsers.
|
|
349
|
-
|
|
350
|
-
*Alex Ghiculescu*
|
|
351
|
-
|
|
352
|
-
* Improve error messages when template file does not exist at absolute filepath.
|
|
353
|
-
|
|
354
|
-
*Ted Whang*
|
|
355
|
-
|
|
356
|
-
* Add `:country_code` option to `sms_to` for consistency with `phone_to`.
|
|
357
|
-
|
|
358
|
-
*Jonathan Hefner*
|
|
359
|
-
|
|
360
|
-
* OpenSSL constants are now used for Digest computations.
|
|
377
|
+
*Sean Doyle*
|
|
361
378
|
|
|
362
|
-
|
|
379
|
+
* Fix and add protections for XSS in `ActionView::Helpers` and `ERB::Util`.
|
|
363
380
|
|
|
364
|
-
|
|
365
|
-
|
|
381
|
+
Escape dangerous characters in names of tags and names of attributes in the
|
|
382
|
+
tag helpers, following the XML specification. Rename the option
|
|
383
|
+
`:escape_attributes` to `:escape`, to simplify by applying the option to the
|
|
384
|
+
whole tag.
|
|
366
385
|
|
|
367
|
-
|
|
386
|
+
*Álvaro Martín Fraguas*
|
|
368
387
|
|
|
369
|
-
*
|
|
370
|
-
`.css` extension appended to the stylesheet path.
|
|
388
|
+
* Extend audio_tag and video_tag to accept Active Storage attachments.
|
|
371
389
|
|
|
372
|
-
|
|
390
|
+
Now it's possible to write
|
|
373
391
|
|
|
374
392
|
```ruby
|
|
375
|
-
|
|
376
|
-
|
|
393
|
+
audio_tag(user.audio_file)
|
|
394
|
+
video_tag(user.video_file)
|
|
377
395
|
```
|
|
378
396
|
|
|
379
|
-
|
|
397
|
+
Instead of
|
|
380
398
|
|
|
381
399
|
```ruby
|
|
382
|
-
|
|
383
|
-
|
|
400
|
+
audio_tag(polymorphic_path(user.audio_file))
|
|
401
|
+
video_tag(polymorphic_path(user.video_file))
|
|
384
402
|
```
|
|
385
403
|
|
|
386
|
-
|
|
387
|
-
|
|
388
|
-
* Deprecate `render` locals to be assigned to instance variables.
|
|
389
|
-
|
|
390
|
-
*Petrik de Heus*
|
|
391
|
-
|
|
392
|
-
* Remove legacy default `media=screen` from `stylesheet_link_tag`.
|
|
404
|
+
`image_tag` already supported that, so this follows the same pattern.
|
|
393
405
|
|
|
394
|
-
*
|
|
406
|
+
*Matheus Richard*
|
|
395
407
|
|
|
396
|
-
*
|
|
397
|
-
attributes into `_method="$VERB"` Form Data to enable varied same-form actions:
|
|
398
|
-
|
|
399
|
-
<%= form_with model: post, method: :put do %>
|
|
400
|
-
<%= form.button "Update" %>
|
|
401
|
-
<%= form.button "Delete", formmethod: :delete %>
|
|
402
|
-
<% end %>
|
|
403
|
-
<%# => <form action="posts/1">
|
|
404
|
-
=> <input type="hidden" name="_method" value="put">
|
|
405
|
-
=> <button type="submit">Update</button>
|
|
406
|
-
=> <button type="submit" formmethod="post" name="_method" value="delete">Delete</button>
|
|
407
|
-
=> </form>
|
|
408
|
-
%>
|
|
409
|
-
|
|
410
|
-
*Sean Doyle*
|
|
411
|
-
|
|
412
|
-
* Change `ActionView::Helpers::UrlHelper#button_to` to *always* render a
|
|
413
|
-
`<button>` element, regardless of whether or not the content is passed as
|
|
414
|
-
the first argument or as a block.
|
|
415
|
-
|
|
416
|
-
<%= button_to "Delete", post_path(@post), method: :delete %>
|
|
417
|
-
# => <form action="/posts/1"><input type="hidden" name="_method" value="delete"><button type="submit">Delete</button></form>
|
|
418
|
-
|
|
419
|
-
<%= button_to post_path(@post), method: :delete do %>
|
|
420
|
-
Delete
|
|
421
|
-
<% end %>
|
|
422
|
-
# => <form action="/posts/1"><input type="hidden" name="_method" value="delete"><button type="submit">Delete</button></form>
|
|
423
|
-
|
|
424
|
-
*Sean Doyle*, *Dusan Orlovic*
|
|
425
|
-
|
|
426
|
-
* Add `config.action_view.preload_links_header` to allow disabling of
|
|
427
|
-
the `Link` header being added by default when using `stylesheet_link_tag`
|
|
428
|
-
and `javascript_include_tag`.
|
|
429
|
-
|
|
430
|
-
*Andrew White*
|
|
431
|
-
|
|
432
|
-
* The `translate` helper now resolves `default` values when a `nil` key is
|
|
433
|
-
specified, instead of always returning `nil`.
|
|
434
|
-
|
|
435
|
-
*Jonathan Hefner*
|
|
436
|
-
|
|
437
|
-
* Add `config.action_view.image_loading` to configure the default value of
|
|
438
|
-
the `image_tag` `:loading` option.
|
|
439
|
-
|
|
440
|
-
By setting `config.action_view.image_loading = "lazy"`, an application can opt in to
|
|
441
|
-
lazy loading images sitewide, without changing view code.
|
|
442
|
-
|
|
443
|
-
*Jonathan Hefner*
|
|
444
|
-
|
|
445
|
-
* `ActionView::Helpers::FormBuilder#id` returns the value
|
|
446
|
-
of the `<form>` element's `id` attribute. With a `method` argument, returns
|
|
447
|
-
the `id` attribute for a form field with that name.
|
|
448
|
-
|
|
449
|
-
<%= form_for @post do |f| %>
|
|
450
|
-
<%# ... %>
|
|
451
|
-
|
|
452
|
-
<% content_for :sticky_footer do %>
|
|
453
|
-
<%= form.button(form: f.id) %>
|
|
454
|
-
<% end %>
|
|
455
|
-
<% end %>
|
|
456
|
-
|
|
457
|
-
*Sean Doyle*
|
|
458
|
-
|
|
459
|
-
* `ActionView::Helpers::FormBuilder#field_id` returns the value generated by
|
|
460
|
-
the FormBuilder for the given attribute name.
|
|
461
|
-
|
|
462
|
-
<%= form_for @post do |f| %>
|
|
463
|
-
<%= f.label :title %>
|
|
464
|
-
<%= f.text_field :title, aria: { describedby: f.field_id(:title, :error) } %>
|
|
465
|
-
<%= tag.span("is blank", id: f.field_id(:title, :error) %>
|
|
466
|
-
<% end %>
|
|
467
|
-
|
|
468
|
-
*Sean Doyle*
|
|
469
|
-
|
|
470
|
-
* Add `tag.attributes` to transform a Hash into HTML Attributes, ready to be
|
|
471
|
-
interpolated into ERB.
|
|
472
|
-
|
|
473
|
-
<input <%= tag.attributes(type: :text, aria: { label: "Search" }) %> >
|
|
474
|
-
# => <input type="text" aria-label="Search">
|
|
408
|
+
* Ensure models passed to `form_for` attempt to call `to_model`.
|
|
475
409
|
|
|
476
410
|
*Sean Doyle*
|
|
477
411
|
|
|
478
|
-
|
|
479
|
-
Please check [6-1-stable](https://github.com/rails/rails/blob/6-1-stable/actionview/CHANGELOG.md) for previous changes.
|
|
412
|
+
Please check [7-0-stable](https://github.com/rails/rails/blob/7-0-stable/actionview/CHANGELOG.md) for previous changes.
|