actionview 7.0.7.2 → 7.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (90) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +262 -329
  3. data/MIT-LICENSE +1 -1
  4. data/README.rdoc +1 -1
  5. data/app/assets/javascripts/rails-ujs.esm.js +693 -0
  6. data/app/assets/javascripts/rails-ujs.js +630 -0
  7. data/lib/action_view/base.rb +33 -12
  8. data/lib/action_view/buffers.rb +106 -8
  9. data/lib/action_view/cache_expiry.rb +40 -43
  10. data/lib/action_view/context.rb +1 -1
  11. data/lib/action_view/deprecator.rb +7 -0
  12. data/lib/action_view/digestor.rb +1 -1
  13. data/lib/action_view/gem_version.rb +4 -4
  14. data/lib/action_view/helpers/active_model_helper.rb +1 -1
  15. data/lib/action_view/helpers/asset_tag_helper.rb +130 -46
  16. data/lib/action_view/helpers/asset_url_helper.rb +6 -5
  17. data/lib/action_view/helpers/atom_feed_helper.rb +5 -5
  18. data/lib/action_view/helpers/cache_helper.rb +3 -9
  19. data/lib/action_view/helpers/capture_helper.rb +24 -10
  20. data/lib/action_view/helpers/content_exfiltration_prevention_helper.rb +70 -0
  21. data/lib/action_view/helpers/controller_helper.rb +6 -0
  22. data/lib/action_view/helpers/csp_helper.rb +2 -2
  23. data/lib/action_view/helpers/csrf_helper.rb +2 -2
  24. data/lib/action_view/helpers/date_helper.rb +17 -19
  25. data/lib/action_view/helpers/debug_helper.rb +3 -3
  26. data/lib/action_view/helpers/form_helper.rb +43 -17
  27. data/lib/action_view/helpers/form_options_helper.rb +2 -1
  28. data/lib/action_view/helpers/form_tag_helper.rb +43 -9
  29. data/lib/action_view/helpers/javascript_helper.rb +1 -0
  30. data/lib/action_view/helpers/number_helper.rb +2 -1
  31. data/lib/action_view/helpers/output_safety_helper.rb +2 -2
  32. data/lib/action_view/helpers/rendering_helper.rb +1 -1
  33. data/lib/action_view/helpers/sanitize_helper.rb +33 -14
  34. data/lib/action_view/helpers/tag_helper.rb +5 -27
  35. data/lib/action_view/helpers/tags/base.rb +11 -52
  36. data/lib/action_view/helpers/tags/collection_check_boxes.rb +1 -0
  37. data/lib/action_view/helpers/tags/collection_radio_buttons.rb +1 -0
  38. data/lib/action_view/helpers/tags/collection_select.rb +3 -0
  39. data/lib/action_view/helpers/tags/date_field.rb +1 -1
  40. data/lib/action_view/helpers/tags/date_select.rb +2 -0
  41. data/lib/action_view/helpers/tags/datetime_field.rb +14 -6
  42. data/lib/action_view/helpers/tags/datetime_local_field.rb +11 -2
  43. data/lib/action_view/helpers/tags/grouped_collection_select.rb +3 -0
  44. data/lib/action_view/helpers/tags/month_field.rb +1 -1
  45. data/lib/action_view/helpers/tags/select.rb +3 -0
  46. data/lib/action_view/helpers/tags/select_renderer.rb +56 -0
  47. data/lib/action_view/helpers/tags/time_field.rb +1 -1
  48. data/lib/action_view/helpers/tags/time_zone_select.rb +3 -0
  49. data/lib/action_view/helpers/tags/week_field.rb +1 -1
  50. data/lib/action_view/helpers/tags/weekday_select.rb +3 -0
  51. data/lib/action_view/helpers/tags.rb +2 -0
  52. data/lib/action_view/helpers/text_helper.rb +32 -16
  53. data/lib/action_view/helpers/translation_helper.rb +3 -3
  54. data/lib/action_view/helpers/url_helper.rb +41 -14
  55. data/lib/action_view/helpers.rb +2 -0
  56. data/lib/action_view/layouts.rb +6 -4
  57. data/lib/action_view/log_subscriber.rb +49 -32
  58. data/lib/action_view/lookup_context.rb +29 -13
  59. data/lib/action_view/path_registry.rb +57 -0
  60. data/lib/action_view/path_set.rb +13 -14
  61. data/lib/action_view/railtie.rb +26 -3
  62. data/lib/action_view/record_identifier.rb +15 -8
  63. data/lib/action_view/renderer/abstract_renderer.rb +1 -1
  64. data/lib/action_view/renderer/collection_renderer.rb +9 -1
  65. data/lib/action_view/renderer/partial_renderer/collection_caching.rb +10 -2
  66. data/lib/action_view/renderer/partial_renderer.rb +2 -1
  67. data/lib/action_view/renderer/renderer.rb +2 -0
  68. data/lib/action_view/renderer/streaming_template_renderer.rb +3 -2
  69. data/lib/action_view/renderer/template_renderer.rb +3 -2
  70. data/lib/action_view/rendering.rb +22 -4
  71. data/lib/action_view/ripper_ast_parser.rb +6 -6
  72. data/lib/action_view/template/error.rb +14 -1
  73. data/lib/action_view/template/handlers/builder.rb +4 -4
  74. data/lib/action_view/template/handlers/erb/erubi.rb +23 -27
  75. data/lib/action_view/template/handlers/erb.rb +73 -1
  76. data/lib/action_view/template/handlers.rb +1 -1
  77. data/lib/action_view/template/html.rb +1 -1
  78. data/lib/action_view/template/raw_file.rb +1 -1
  79. data/lib/action_view/template/renderable.rb +1 -1
  80. data/lib/action_view/template/resolver.rb +10 -2
  81. data/lib/action_view/template/text.rb +1 -1
  82. data/lib/action_view/template/types.rb +25 -34
  83. data/lib/action_view/template.rb +227 -53
  84. data/lib/action_view/template_path.rb +2 -0
  85. data/lib/action_view/test_case.rb +174 -21
  86. data/lib/action_view/unbound_template.rb +15 -5
  87. data/lib/action_view/version.rb +1 -1
  88. data/lib/action_view/view_paths.rb +15 -24
  89. data/lib/action_view.rb +4 -1
  90. metadata +24 -24
data/CHANGELOG.md CHANGED
@@ -1,479 +1,412 @@
1
- ## Rails 7.0.7.2 (August 22, 2023) ##
1
+ ## Rails 7.1.1 (October 11, 2023) ##
2
2
 
3
- * No changes.
4
-
5
-
6
- ## Rails 7.0.7.1 (August 22, 2023) ##
7
-
8
- * No changes.
9
-
10
-
11
- ## Rails 7.0.7 (August 09, 2023) ##
3
+ * Updated `@rails/ujs` files to ignore certain data-* attributes when element is contenteditable.
12
4
 
13
- * Fix `render collection: @records, cache: true` to cache fragments as bare strings
5
+ This fix was already landed in >= 7.0.4.3, < 7.1.0.
6
+ [[CVE-2023-23913](https://github.com/advisories/GHSA-xp5h-f8jf-rc8q)]
14
7
 
15
- Previously it would incorrectly cache them as Action View buffers.
8
+ *Ryunosuke Sato*
16
9
 
17
- *Jean Boussier*
18
-
19
- * Don't double-encode nested `field_id` and `field_name` index values
20
10
 
21
- Pass `index: @options` as a default keyword argument to `field_id` and
22
- `field_name` view helper methods.
23
-
24
- *Sean Doyle*
25
-
26
-
27
- ## Rails 7.0.6 (June 29, 2023) ##
11
+ ## Rails 7.1.0 (October 05, 2023) ##
28
12
 
29
13
  * No changes.
30
14
 
31
15
 
32
- ## Rails 7.0.5.1 (June 26, 2023) ##
16
+ ## Rails 7.1.0.rc2 (October 01, 2023) ##
33
17
 
34
18
  * No changes.
35
19
 
36
20
 
37
- ## Rails 7.0.5 (May 24, 2023) ##
21
+ ## Rails 7.1.0.rc1 (September 27, 2023) ##
38
22
 
39
- * `FormBuilder#id` finds id set by `form_for` and `form_with`.
23
+ * Introduce `ActionView::TestCase.register_parser`
40
24
 
41
- *Matt Polito*
25
+ ```ruby
26
+ register_parser :rss, -> rendered { RSS::Parser.parse(rendered) }
42
27
 
43
- * Allow all available locales for template lookups.
28
+ test "renders RSS" do
29
+ article = Article.create!(title: "Hello, world")
44
30
 
45
- *Ben Dilley*
31
+ render formats: :rss, partial: article
46
32
 
47
- * Choices of `select` can optionally contain html attributes as the last element
48
- of the child arrays when using grouped/nested collections
49
-
50
- ```erb
51
- <%= form.select :foo, [["North America", [["United States","US"],["Canada","CA"]], { disabled: "disabled" }]] %>
52
- # => <select><optgroup label="North America" disabled="disabled"><option value="US">United States</option><option value="CA">Canada</option></optgroup></select>
33
+ assert_equal "Hello, world", rendered.rss.items.last.title
34
+ end
53
35
  ```
54
36
 
55
- *Chris Gunther*
56
-
57
-
58
- ## Rails 7.0.4.3 (March 13, 2023) ##
37
+ By default, register parsers for `:html` and `:json`.
59
38
 
60
- * Ignore certain data-* attributes in rails-ujs when element is contenteditable
39
+ *Sean Doyle*
61
40
 
62
- [CVE-2023-23913]
63
41
 
42
+ ## Rails 7.1.0.beta1 (September 13, 2023) ##
64
43
 
65
- ## Rails 7.0.4.2 (January 24, 2023) ##
44
+ * Fix `simple_format` with blank `wrapper_tag` option returns plain html tag
66
45
 
67
- * No changes.
46
+ By default `simple_format` method returns the text wrapped with `<p>`. But if we explicitly specify
47
+ the `wrapper_tag: nil` in the options, it returns the text wrapped with `<></>` tag.
68
48
 
49
+ Before:
69
50
 
70
- ## Rails 7.0.4.1 (January 17, 2023) ##
51
+ ```ruby
52
+ simple_format("Hello World", {}, { wrapper_tag: nil })
53
+ # <>Hello World</>
54
+ ```
71
55
 
72
- * No changes.
56
+ After:
73
57
 
58
+ ```ruby
59
+ simple_format("Hello World", {}, { wrapper_tag: nil })
60
+ # <p>Hello World</p>
61
+ ```
74
62
 
75
- ## Rails 7.0.4 (September 09, 2022) ##
63
+ *Akhil G Krishnan*, *Junichi Ito*
76
64
 
77
- * Guard against `ActionView::Helpers::FormTagHelper#field_name` calls with nil
78
- `object_name` arguments. For example:
65
+ * Don't double-encode nested `field_id` and `field_name` index values
79
66
 
80
- ```erb
81
- <%= fields do |f| %>
82
- <%= f.field_name :body %>
83
- <% end %>
84
- ```
67
+ Pass `index: @options` as a default keyword argument to `field_id` and
68
+ `field_name` view helper methods.
85
69
 
86
70
  *Sean Doyle*
87
71
 
88
- * Strings returned from `strip_tags` are correctly tagged `html_safe?`
72
+ * Allow opting in/out of `Link preload` headers when calling `stylesheet_link_tag` or `javascript_include_tag`
89
73
 
90
- Because these strings contain no HTML elements and the basic entities are escaped, they are safe
91
- to be included as-is as PCDATA in HTML content. Tagging them as html-safe avoids double-escaping
92
- entities when being concatenated to a SafeBuffer during rendering.
74
+ ```ruby
75
+ # will exclude header, even if setting is enabled:
76
+ javascript_include_tag("http://example.com/all.js", preload_links_header: false)
93
77
 
94
- Fixes [rails/rails-html-sanitizer#124](https://github.com/rails/rails-html-sanitizer/issues/124)
78
+ # will include header, even if setting is disabled:
79
+ stylesheet_link_tag("http://example.com/all.js", preload_links_header: true)
80
+ ```
95
81
 
96
- *Mike Dalessio*
82
+ *Alex Ghiculescu*
97
83
 
98
- ## Rails 7.0.3.1 (July 12, 2022) ##
84
+ * Stop generating `Link preload` headers once it has reached 1KB.
99
85
 
100
- * No changes.
86
+ Some proxies have trouble handling large headers, but more importantly preload links
87
+ have diminishing returns so it's preferable not to go overboard with them.
101
88
 
89
+ If tighter control is needed, it's recommended to disable automatic generation of preloads
90
+ and to generate them manually from the controller or from a middleware.
102
91
 
103
- ## Rails 7.0.3 (May 09, 2022) ##
92
+ *Jean Boussier*
104
93
 
105
- * Ensure models passed to `form_for` attempt to call `to_model`.
94
+ * `simple_format` helper now handles a `:sanitize_options` - any extra options you want appending to the sanitize.
106
95
 
107
- *Sean Doyle*
96
+ Before:
97
+ ```ruby
98
+ simple_format("<a target=\"_blank\" href=\"http://example.com\">Continue</a>")
99
+ # => "<p><a href=\"http://example.com\">Continue</a></p>"
100
+ ```
108
101
 
109
- ## Rails 7.0.2.4 (April 26, 2022) ##
102
+ After:
103
+ ```ruby
104
+ simple_format("<a target=\"_blank\" href=\"http://example.com\">Continue</a>", {}, { sanitize_options: { attributes: %w[target href] } })
105
+ # => "<p><a target=\"_blank\" href=\"http://example.com\">Continue</a></p>"
106
+ ```
110
107
 
111
- * Fix and add protections for XSS in `ActionView::Helpers` and `ERB::Util`.
108
+ *Andrei Andriichuk*
112
109
 
113
- Escape dangerous characters in names of tags and names of attributes in the
114
- tag helpers, following the XML specification. Rename the option
115
- `:escape_attributes` to `:escape`, to simplify by applying the option to the
116
- whole tag.
110
+ * Add support for HTML5 standards-compliant sanitizers, and default to `Rails::HTML5::Sanitizer`
111
+ in the Rails 7.1 configuration if it is supported.
117
112
 
118
- *Álvaro Martín Fraguas*
113
+ Action View's HTML sanitizers can be configured by setting
114
+ `config.action_view.sanitizer_vendor`. Supported values are `Rails::HTML4::Sanitizer` or
115
+ `Rails::HTML5::Sanitizer`.
119
116
 
120
- ## Rails 7.0.2.3 (March 08, 2022) ##
117
+ The Rails 7.1 configuration will set this to `Rails::HTML5::Sanitizer` when it is supported, and
118
+ fall back to `Rails::HTML4::Sanitizer`. Previous configurations default to
119
+ `Rails::HTML4::Sanitizer`.
121
120
 
122
- * No changes.
121
+ *Mike Dalessio*
123
122
 
123
+ * `config.dom_testing_default_html_version` controls the HTML parser used by
124
+ `ActionView::TestCase#document_root_element`, which creates the DOM used by the assertions in
125
+ Rails::Dom::Testing.
124
126
 
125
- ## Rails 7.0.2.2 (February 11, 2022) ##
127
+ The Rails 7.1 default configuration opts into the HTML5 parser when it is supported, to better
128
+ represent what the DOM would be in a browser user agent. Previously this test helper always used
129
+ Nokogiri's HTML4 parser.
126
130
 
127
- * No changes.
131
+ *Mike Dalessio*
128
132
 
133
+ * Add support for the HTML picture tag. It supports passing a String, an Array or a Block.
134
+ Supports passing properties directly to the img tag via the `:image` key.
135
+ Since the picture tag requires an img tag, the last element you provide will be used for the img tag.
136
+ For complete control over the picture tag, a block can be passed, which will populate the contents of the tag accordingly.
129
137
 
130
- ## Rails 7.0.2.1 (February 11, 2022) ##
138
+ Can be used like this for a single source:
139
+ ```erb
140
+ <%= picture_tag("picture.webp") %>
141
+ ```
142
+ which will generate the following:
143
+ ```html
144
+ <picture>
145
+ <img src="/images/picture.webp" />
146
+ </picture>
147
+ ```
131
148
 
132
- * No changes.
149
+ For multiple sources:
150
+ ```erb
151
+ <%= picture_tag("picture.webp", "picture.png", :class => "mt-2", :image => { alt: "Image", class: "responsive-img" }) %>
152
+ ```
153
+ will generate:
154
+ ```html
155
+ <picture class="mt-2">
156
+ <source srcset="/images/picture.webp" />
157
+ <source srcset="/images/picture.png" />
158
+ <img alt="Image" class="responsive-img" src="/images/picture.png" />
159
+ </picture>
160
+ ```
133
161
 
162
+ Full control via a block:
163
+ ```erb
164
+ <%= picture_tag(:class => "my-class") do %>
165
+ <%= tag(:source, :srcset => image_path("picture.webp")) %>
166
+ <%= tag(:source, :srcset => image_path("picture.png")) %>
167
+ <%= image_tag("picture.png", :alt => "Image") %>
168
+ <% end %>
169
+ ```
170
+ will generate:
171
+ ```html
172
+ <picture class="my-class">
173
+ <source srcset="/images/picture.webp" />
174
+ <source srcset="/images/picture.png" />
175
+ <img alt="Image" src="/images/picture.png" />
176
+ </picture>
177
+ ```
134
178
 
135
- ## Rails 7.0.2 (February 08, 2022) ##
179
+ *Juan Pablo Balarini*
136
180
 
137
- * Ensure `preload_link_tag` preloads JavaScript modules correctly.
181
+ * Remove deprecated support to passing instance variables as locals to partials.
138
182
 
139
- *Máximo Mussini*
183
+ *Rafael Mendonça França*
140
184
 
141
- * Fix `stylesheet_link_tag` and similar helpers are being used to work in objects with
142
- a `response` method.
185
+ * Remove deprecated constant `ActionView::Path`.
143
186
 
144
- *dark-panda*
187
+ *Rafael Mendonça França*
145
188
 
189
+ * Guard `token_list` calls from escaping HTML too often
146
190
 
147
- ## Rails 7.0.1 (January 06, 2022) ##
191
+ *Sean Doyle*
148
192
 
149
- * Fix `button_to` to work with a hash parameter as URL.
193
+ * `select` can now be called with a single hash containing options and some HTML options
150
194
 
151
- *MingyuanQin*
195
+ Previously this would not work as expected:
152
196
 
153
- * Fix `link_to` with a model passed as an argument twice.
197
+ ```erb
198
+ <%= select :post, :author, authors, required: true %>
199
+ ```
154
200
 
155
- *Alex Ghiculescu*
201
+ Instead you needed to do this:
156
202
 
203
+ ```erb
204
+ <%= select :post, :author, authors, {}, required: true %>
205
+ ```
157
206
 
158
- ## Rails 7.0.0 (December 15, 2021) ##
207
+ Now, either form is accepted, for the following HTML attributes: `required`, `multiple`, `size`.
159
208
 
160
- * Support `include_hidden:` option in calls to
161
- `ActionView::Helper::FormBuilder#file_field` with `multiple: true` to
162
- support submitting an empty collection of files.
209
+ *Alex Ghiculescu*
163
210
 
164
- ```ruby
165
- form.file_field :attachments, multiple: true
166
- # => <input type="hidden" autocomplete="off" name="post[attachments][]" value="">
167
- <input type="file" multiple="multiple" id="post_attachments" name="post[attachments][]">
211
+ * Datetime form helpers (`time_field`, `date_field`, `datetime_field`, `week_field`, `month_field`) now accept an instance of Time/Date/DateTime as `:value` option.
168
212
 
169
- form.file_field :attachments, multiple: true, include_hidden: false
170
- # => <input type="file" multiple="multiple" id="post_attachments" name="post[attachments][]">
213
+ Before:
214
+ ```erb
215
+ <%= form.datetime_field :written_at, value: Time.current.strftime("%Y-%m-%dT%T") %>
171
216
  ```
172
217
 
173
- *Sean Doyle*
174
-
175
- * Fix `number_with_precision(raise: true)` always raising even on valid numbers.
176
-
177
- *Pedro Moreira*
218
+ After:
219
+ ```erb
220
+ <%= form.datetime_field :written_at, value: Time.current %>
221
+ ```
178
222
 
223
+ *Andrey Samsonov*
179
224
 
180
- ## Rails 7.0.0.rc3 (December 14, 2021) ##
225
+ * Choices of `select` can optionally contain html attributes as the last element
226
+ of the child arrays when using grouped/nested collections
181
227
 
182
- * No changes.
228
+ ```erb
229
+ <%= form.select :foo, [["North America", [["United States","US"],["Canada","CA"]], { disabled: "disabled" }]] %>
230
+ # => <select><optgroup label="North America" disabled="disabled"><option value="US">United States</option><option value="CA">Canada</option></optgroup></select>
231
+ ```
183
232
 
233
+ *Chris Gunther*
184
234
 
185
- ## Rails 7.0.0.rc2 (December 14, 2021) ##
235
+ * `check_box_tag` and `radio_button_tag` now accept `checked` as a keyword argument
186
236
 
187
- * No changes.
237
+ This is to make the API more consistent with the `FormHelper` variants. You can now
238
+ provide `checked` as a positional or keyword argument:
188
239
 
189
- ## Rails 7.0.0.rc1 (December 06, 2021) ##
240
+ ```erb
241
+ = check_box_tag "admin", "1", false
242
+ = check_box_tag "admin", "1", checked: false
190
243
 
191
- * Support `fields model: [@nested, @model]` the same way as `form_with model:
192
- [@nested, @model]`.
244
+ = radio_button_tag 'favorite_color', 'maroon', false
245
+ = radio_button_tag 'favorite_color', 'maroon', checked: false
246
+ ```
193
247
 
194
- *Sean Doyle*
248
+ *Alex Ghiculescu*
195
249
 
196
- * Infer HTTP verb `[method]` from a model or Array with model as the first
197
- argument to `button_to` when combined with a block:
250
+ * Allow passing a class to `dom_id`.
251
+ You no longer need to call `new` when passing a class to `dom_id`.
252
+ This makes `dom_id` behave like `dom_class` in this regard.
253
+ Apart from saving a few keystrokes, it prevents Ruby from needing
254
+ to instantiate a whole new object just to generate a string.
198
255
 
256
+ Before:
199
257
  ```ruby
200
- button_to(Workshop.find(1)){ "Update" }
201
- #=> <form method="post" action="/workshops/1" class="button_to">
202
- #=> <input type="hidden" name="_method" value="patch" autocomplete="off" />
203
- #=> <button type="submit">Update</button>
204
- #=> </form>
205
-
206
- button_to([ Workshop.find(1), Session.find(1) ]) { "Update" }
207
- #=> <form method="post" action="/workshops/1/sessions/1" class="button_to">
208
- #=> <input type="hidden" name="_method" value="patch" autocomplete="off" />
209
- #=> <button type="submit">Update</button>
210
- #=> </form>
258
+ dom_id(Post) # => NoMethodError: undefined method `to_key' for Post:Class
211
259
  ```
212
260
 
213
- *Sean Doyle*
214
-
215
- * Support passing a Symbol as the first argument to `FormBuilder#button`:
216
-
261
+ After:
217
262
  ```ruby
218
- form.button(:draft, value: true)
219
- # => <button name="post[draft]" value="true" type="submit">Create post</button>
220
-
221
- form.button(:draft, value: true) do
222
- content_tag(:strong, "Save as draft")
223
- end
224
- # => <button name="post[draft]" value="true" type="submit">
225
- # <strong>Save as draft</strong>
226
- # </button>
263
+ dom_id(Post) # => "new_post"
227
264
  ```
228
265
 
229
- *Sean Doyle*
266
+ *Goulven Champenois*
230
267
 
231
- * Introduce the `field_name` view helper, along with the
232
- `FormBuilder#field_name` counterpart:
268
+ * Report `:locals` as part of the data returned by ActionView render instrumentation.
233
269
 
270
+ Before:
234
271
  ```ruby
235
- form_for @post do |f|
236
- f.field_tag :tag, name: f.field_name(:tag, multiple: true)
237
- # => <input type="text" name="post[tag][]">
238
- end
272
+ {
273
+ identifier: "/Users/adam/projects/notifications/app/views/posts/index.html.erb",
274
+ layout: "layouts/application"
275
+ }
239
276
  ```
240
277
 
241
- *Sean Doyle*
242
-
243
- * Execute the `ActionView::Base.field_error_proc` within the context of the
244
- `ActionView::Base` instance:
245
-
278
+ After:
246
279
  ```ruby
247
- config.action_view.field_error_proc = proc { |html| content_tag(:div, html, class: "field_with_errors") }
280
+ {
281
+ identifier: "/Users/adam/projects/notifications/app/views/posts/index.html.erb",
282
+ layout: "layouts/application",
283
+ locals: {foo: "bar"}
284
+ }
248
285
  ```
249
286
 
250
- *Sean Doyle*
287
+ *Aaron Gough*
251
288
 
252
- * Add support for `button_to ..., authenticity_token: false`
289
+ * Strip `break_sequence` at the end of `word_wrap`.
253
290
 
254
- ```ruby
255
- button_to "Create", Post.new, authenticity_token: false
256
- # => <form class="button_to" method="post" action="/posts"><button type="submit">Create</button></form>
291
+ This fixes a bug where `word_wrap` didn't properly strip off break sequences that had printable characters.
257
292
 
258
- button_to "Create", Post.new, authenticity_token: true
259
- # => <form class="button_to" method="post" action="/posts"><button type="submit">Create</button><input type="hidden" name="form_token" value="abc123..." autocomplete="off" /></form>
293
+ For example, compare the outputs of this template:
260
294
 
261
- button_to "Create", Post.new, authenticity_token: "secret"
262
- # => <form class="button_to" method="post" action="/posts"><button type="submit">Create</button><input type="hidden" name="form_token" value="secret" autocomplete="off" /></form>
295
+ ```erb
296
+ # <%= word_wrap("11 22\n33 44", line_width: 2, break_sequence: "\n# ") %>
263
297
  ```
264
298
 
265
- *Sean Doyle*
266
-
267
- * Support rendering `<form>` elements _without_ `[action]` attributes by:
299
+ Before:
268
300
 
269
- * `form_with url: false` or `form_with ..., html: { action: false }`
270
- * `form_for ..., url: false` or `form_for ..., html: { action: false }`
271
- * `form_tag false` or `form_tag ..., action: false`
272
- * `button_to "...", false` or `button_to(false) { ... }`
301
+ ```
302
+ # 11
303
+ # 22
304
+ #
305
+ # 33
306
+ # 44
307
+ #
308
+ ```
273
309
 
274
- *Sean Doyle*
310
+ After:
275
311
 
276
- * Add `:day_format` option to `date_select`
312
+ ```
313
+ # 11
314
+ # 22
315
+ # 33
316
+ # 44
317
+ ```
277
318
 
278
- date_select("article", "written_on", day_format: ->(day) { day.ordinalize })
279
- # generates day options like <option value="1">1st</option>\n<option value="2">2nd</option>...
319
+ *Max Chernyak*
280
320
 
281
- *Shunichi Ikegami*
321
+ * Allow templates to set strict `locals`.
282
322
 
283
- * Allow `link_to` helper to infer link name from `Model#to_s` when it
284
- is used with a single argument:
323
+ By default, templates will accept any `locals` as keyword arguments. To define what `locals` a template accepts, add a `locals` magic comment:
285
324
 
286
- link_to @profile
287
- #=> <a href="/profiles/1">Eileen</a>
325
+ ```erb
326
+ <%# locals: (message:) -%>
327
+ <%= message %>
328
+ ```
288
329
 
289
- This assumes the model class implements a `to_s` method like this:
330
+ Default values can also be provided:
290
331
 
291
- class Profile < ApplicationRecord
292
- # ...
293
- def to_s
294
- name
295
- end
296
- end
332
+ ```erb
333
+ <%# locals: (message: "Hello, world!") -%>
334
+ <%= message %>
335
+ ```
297
336
 
298
- Previously you had to supply a second argument even if the `Profile`
299
- model implemented a `#to_s` method that called the `name` method.
337
+ Or `locals` can be disabled entirely:
300
338
 
301
- link_to @profile, @profile.name
302
- #=> <a href="/profiles/1">Eileen</a>
339
+ ```erb
340
+ <%# locals: () %>
341
+ ```
303
342
 
304
- *Olivier Lacan*
343
+ *Joel Hawksley*
305
344
 
306
- * Support svg unpaired tags for `tag` helper.
345
+ * Add `include_seconds` option for `datetime_local_field`
307
346
 
308
- tag.svg { tag.use('href' => "#cool-icon") }
309
- # => <svg><use href="#cool-icon"></svg>
347
+ This allows to omit seconds part in the input field, by passing `include_seconds: false`
310
348
 
311
- *Oleksii Vasyliev*
349
+ *Wojciech Wnętrzak*
312
350
 
351
+ * Guard against `ActionView::Helpers::FormTagHelper#field_name` calls with nil
352
+ `object_name` arguments. For example:
313
353
 
314
- ## Rails 7.0.0.alpha2 (September 15, 2021) ##
354
+ ```erb
355
+ <%= fields do |f| %>
356
+ <%= f.field_name :body %>
357
+ <% end %>
358
+ ```
315
359
 
316
- * No changes.
360
+ *Sean Doyle*
317
361
 
362
+ * Strings returned from `strip_tags` are correctly tagged `html_safe?`
318
363
 
319
- ## Rails 7.0.0.alpha1 (September 15, 2021) ##
364
+ Because these strings contain no HTML elements and the basic entities are escaped, they are safe
365
+ to be included as-is as PCDATA in HTML content. Tagging them as html-safe avoids double-escaping
366
+ entities when being concatenated to a SafeBuffer during rendering.
320
367
 
321
- * Improves the performance of ActionView::Helpers::NumberHelper formatters by avoiding the use of
322
- exceptions as flow control.
368
+ Fixes [rails/rails-html-sanitizer#124](https://github.com/rails/rails-html-sanitizer/issues/124)
323
369
 
324
370
  *Mike Dalessio*
325
371
 
326
- * `preload_link_tag` properly inserts `as` attributes for files with `image` MIME types, such as JPG or SVG.
372
+ * Move `convert_to_model` call from `form_for` into `form_with`
327
373
 
328
- *Nate Berkopec*
374
+ Now that `form_for` is implemented in terms of `form_with`, remove the
375
+ `convert_to_model` call from `form_for`.
329
376
 
330
- * Add `weekday_options_for_select` and `weekday_select` helper methods. Also adds `weekday_select` to `FormBuilder`.
331
-
332
- *Drew Bragg*, *Dana Kashubeck*, *Kasper Timm Hansen*
333
-
334
- * Add `caching?` helper that returns whether the current code path is being cached and `uncacheable!` to denote helper methods that can't participate in fragment caching.
335
-
336
- *Ben Toews*, *John Hawthorn*, *Kasper Timm Hansen*, *Joel Hawksley*
337
-
338
- * Add `include_seconds` option for `time_field`.
339
-
340
- <%= form.time_field :foo, include_seconds: false %>
341
- # => <input value="16:22" type="time" />
342
-
343
- Default includes seconds:
344
-
345
- <%= form.time_field :foo %>
346
- # => <input value="16:22:01.440" type="time" />
347
-
348
- This allows you to take advantage of [different rendering options](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/input/time#time_value_format) in some browsers.
349
-
350
- *Alex Ghiculescu*
351
-
352
- * Improve error messages when template file does not exist at absolute filepath.
353
-
354
- *Ted Whang*
355
-
356
- * Add `:country_code` option to `sms_to` for consistency with `phone_to`.
357
-
358
- *Jonathan Hefner*
359
-
360
- * OpenSSL constants are now used for Digest computations.
377
+ *Sean Doyle*
361
378
 
362
- *Dirkjan Bussink*
379
+ * Fix and add protections for XSS in `ActionView::Helpers` and `ERB::Util`.
363
380
 
364
- * The `translate` helper now passes `default` values that aren't
365
- translation keys through `I18n.translate` for interpolation.
381
+ Escape dangerous characters in names of tags and names of attributes in the
382
+ tag helpers, following the XML specification. Rename the option
383
+ `:escape_attributes` to `:escape`, to simplify by applying the option to the
384
+ whole tag.
366
385
 
367
- *Jonathan Hefner*
386
+ *Álvaro Martín Fraguas*
368
387
 
369
- * Adds option `extname` to `stylesheet_link_tag` to skip default
370
- `.css` extension appended to the stylesheet path.
388
+ * Extend audio_tag and video_tag to accept Active Storage attachments.
371
389
 
372
- Before:
390
+ Now it's possible to write
373
391
 
374
392
  ```ruby
375
- stylesheet_link_tag "style.less"
376
- # <link href="/stylesheets/style.less.scss" rel="stylesheet">
393
+ audio_tag(user.audio_file)
394
+ video_tag(user.video_file)
377
395
  ```
378
396
 
379
- After:
397
+ Instead of
380
398
 
381
399
  ```ruby
382
- stylesheet_link_tag "style.less", extname: false, skip_pipeline: true, rel: "stylesheet/less"
383
- # <link href="/stylesheets/style.less" rel="stylesheet/less">
400
+ audio_tag(polymorphic_path(user.audio_file))
401
+ video_tag(polymorphic_path(user.video_file))
384
402
  ```
385
403
 
386
- *Abhay Nikam*
387
-
388
- * Deprecate `render` locals to be assigned to instance variables.
389
-
390
- *Petrik de Heus*
391
-
392
- * Remove legacy default `media=screen` from `stylesheet_link_tag`.
404
+ `image_tag` already supported that, so this follows the same pattern.
393
405
 
394
- *André Luis Leal Cardoso Junior*
406
+ *Matheus Richard*
395
407
 
396
- * Change `ActionView::Helpers::FormBuilder#button` to transform `formmethod`
397
- attributes into `_method="$VERB"` Form Data to enable varied same-form actions:
398
-
399
- <%= form_with model: post, method: :put do %>
400
- <%= form.button "Update" %>
401
- <%= form.button "Delete", formmethod: :delete %>
402
- <% end %>
403
- <%# => <form action="posts/1">
404
- => <input type="hidden" name="_method" value="put">
405
- => <button type="submit">Update</button>
406
- => <button type="submit" formmethod="post" name="_method" value="delete">Delete</button>
407
- => </form>
408
- %>
409
-
410
- *Sean Doyle*
411
-
412
- * Change `ActionView::Helpers::UrlHelper#button_to` to *always* render a
413
- `<button>` element, regardless of whether or not the content is passed as
414
- the first argument or as a block.
415
-
416
- <%= button_to "Delete", post_path(@post), method: :delete %>
417
- # => <form action="/posts/1"><input type="hidden" name="_method" value="delete"><button type="submit">Delete</button></form>
418
-
419
- <%= button_to post_path(@post), method: :delete do %>
420
- Delete
421
- <% end %>
422
- # => <form action="/posts/1"><input type="hidden" name="_method" value="delete"><button type="submit">Delete</button></form>
423
-
424
- *Sean Doyle*, *Dusan Orlovic*
425
-
426
- * Add `config.action_view.preload_links_header` to allow disabling of
427
- the `Link` header being added by default when using `stylesheet_link_tag`
428
- and `javascript_include_tag`.
429
-
430
- *Andrew White*
431
-
432
- * The `translate` helper now resolves `default` values when a `nil` key is
433
- specified, instead of always returning `nil`.
434
-
435
- *Jonathan Hefner*
436
-
437
- * Add `config.action_view.image_loading` to configure the default value of
438
- the `image_tag` `:loading` option.
439
-
440
- By setting `config.action_view.image_loading = "lazy"`, an application can opt in to
441
- lazy loading images sitewide, without changing view code.
442
-
443
- *Jonathan Hefner*
444
-
445
- * `ActionView::Helpers::FormBuilder#id` returns the value
446
- of the `<form>` element's `id` attribute. With a `method` argument, returns
447
- the `id` attribute for a form field with that name.
448
-
449
- <%= form_for @post do |f| %>
450
- <%# ... %>
451
-
452
- <% content_for :sticky_footer do %>
453
- <%= form.button(form: f.id) %>
454
- <% end %>
455
- <% end %>
456
-
457
- *Sean Doyle*
458
-
459
- * `ActionView::Helpers::FormBuilder#field_id` returns the value generated by
460
- the FormBuilder for the given attribute name.
461
-
462
- <%= form_for @post do |f| %>
463
- <%= f.label :title %>
464
- <%= f.text_field :title, aria: { describedby: f.field_id(:title, :error) } %>
465
- <%= tag.span("is blank", id: f.field_id(:title, :error) %>
466
- <% end %>
467
-
468
- *Sean Doyle*
469
-
470
- * Add `tag.attributes` to transform a Hash into HTML Attributes, ready to be
471
- interpolated into ERB.
472
-
473
- <input <%= tag.attributes(type: :text, aria: { label: "Search" }) %> >
474
- # => <input type="text" aria-label="Search">
408
+ * Ensure models passed to `form_for` attempt to call `to_model`.
475
409
 
476
410
  *Sean Doyle*
477
411
 
478
-
479
- Please check [6-1-stable](https://github.com/rails/rails/blob/6-1-stable/actionview/CHANGELOG.md) for previous changes.
412
+ Please check [7-0-stable](https://github.com/rails/rails/blob/7-0-stable/actionview/CHANGELOG.md) for previous changes.