actionview 7.0.8.6 → 7.1.0.beta1
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/CHANGELOG.md +235 -387
- data/MIT-LICENSE +1 -1
- data/README.rdoc +1 -1
- data/app/assets/javascripts/rails-ujs.esm.js +668 -0
- data/app/assets/javascripts/rails-ujs.js +606 -0
- data/lib/action_view/base.rb +28 -7
- data/lib/action_view/buffers.rb +106 -8
- data/lib/action_view/cache_expiry.rb +40 -43
- data/lib/action_view/context.rb +1 -1
- data/lib/action_view/deprecator.rb +7 -0
- data/lib/action_view/digestor.rb +1 -1
- data/lib/action_view/gem_version.rb +4 -4
- data/lib/action_view/helpers/active_model_helper.rb +1 -1
- data/lib/action_view/helpers/asset_tag_helper.rb +130 -46
- data/lib/action_view/helpers/asset_url_helper.rb +6 -5
- data/lib/action_view/helpers/atom_feed_helper.rb +5 -5
- data/lib/action_view/helpers/cache_helper.rb +3 -9
- data/lib/action_view/helpers/capture_helper.rb +24 -10
- data/lib/action_view/helpers/content_exfiltration_prevention_helper.rb +70 -0
- data/lib/action_view/helpers/controller_helper.rb +6 -0
- data/lib/action_view/helpers/csp_helper.rb +2 -2
- data/lib/action_view/helpers/csrf_helper.rb +2 -2
- data/lib/action_view/helpers/date_helper.rb +17 -19
- data/lib/action_view/helpers/debug_helper.rb +3 -3
- data/lib/action_view/helpers/form_helper.rb +43 -18
- data/lib/action_view/helpers/form_options_helper.rb +2 -1
- data/lib/action_view/helpers/form_tag_helper.rb +43 -9
- data/lib/action_view/helpers/javascript_helper.rb +1 -0
- data/lib/action_view/helpers/number_helper.rb +2 -1
- data/lib/action_view/helpers/output_safety_helper.rb +2 -2
- data/lib/action_view/helpers/rendering_helper.rb +1 -1
- data/lib/action_view/helpers/sanitize_helper.rb +33 -14
- data/lib/action_view/helpers/tag_helper.rb +5 -27
- data/lib/action_view/helpers/tags/base.rb +11 -52
- data/lib/action_view/helpers/tags/collection_check_boxes.rb +1 -0
- data/lib/action_view/helpers/tags/collection_radio_buttons.rb +1 -0
- data/lib/action_view/helpers/tags/collection_select.rb +3 -0
- data/lib/action_view/helpers/tags/date_field.rb +1 -1
- data/lib/action_view/helpers/tags/date_select.rb +2 -0
- data/lib/action_view/helpers/tags/datetime_field.rb +14 -6
- data/lib/action_view/helpers/tags/datetime_local_field.rb +11 -2
- data/lib/action_view/helpers/tags/grouped_collection_select.rb +3 -0
- data/lib/action_view/helpers/tags/month_field.rb +1 -1
- data/lib/action_view/helpers/tags/select.rb +3 -0
- data/lib/action_view/helpers/tags/select_renderer.rb +56 -0
- data/lib/action_view/helpers/tags/time_field.rb +1 -1
- data/lib/action_view/helpers/tags/time_zone_select.rb +3 -0
- data/lib/action_view/helpers/tags/week_field.rb +1 -1
- data/lib/action_view/helpers/tags/weekday_select.rb +3 -0
- data/lib/action_view/helpers/tags.rb +2 -0
- data/lib/action_view/helpers/text_helper.rb +32 -16
- data/lib/action_view/helpers/translation_helper.rb +3 -3
- data/lib/action_view/helpers/url_helper.rb +41 -14
- data/lib/action_view/helpers.rb +2 -0
- data/lib/action_view/layouts.rb +4 -2
- data/lib/action_view/log_subscriber.rb +49 -32
- data/lib/action_view/lookup_context.rb +29 -13
- data/lib/action_view/path_registry.rb +57 -0
- data/lib/action_view/path_set.rb +13 -14
- data/lib/action_view/railtie.rb +26 -3
- data/lib/action_view/record_identifier.rb +15 -8
- data/lib/action_view/renderer/abstract_renderer.rb +1 -1
- data/lib/action_view/renderer/collection_renderer.rb +9 -1
- data/lib/action_view/renderer/partial_renderer/collection_caching.rb +2 -1
- data/lib/action_view/renderer/partial_renderer.rb +2 -1
- data/lib/action_view/renderer/renderer.rb +2 -0
- data/lib/action_view/renderer/streaming_template_renderer.rb +3 -2
- data/lib/action_view/renderer/template_renderer.rb +3 -2
- data/lib/action_view/rendering.rb +22 -4
- data/lib/action_view/ripper_ast_parser.rb +6 -6
- data/lib/action_view/template/error.rb +14 -1
- data/lib/action_view/template/handlers/builder.rb +4 -4
- data/lib/action_view/template/handlers/erb/erubi.rb +23 -27
- data/lib/action_view/template/handlers/erb.rb +73 -1
- data/lib/action_view/template/handlers.rb +1 -1
- data/lib/action_view/template/html.rb +1 -1
- data/lib/action_view/template/raw_file.rb +1 -1
- data/lib/action_view/template/renderable.rb +1 -1
- data/lib/action_view/template/resolver.rb +10 -2
- data/lib/action_view/template/text.rb +1 -1
- data/lib/action_view/template/types.rb +25 -34
- data/lib/action_view/template.rb +179 -52
- data/lib/action_view/template_path.rb +2 -0
- data/lib/action_view/test_case.rb +8 -5
- data/lib/action_view/unbound_template.rb +15 -5
- data/lib/action_view/version.rb +1 -1
- data/lib/action_view/view_paths.rb +15 -24
- data/lib/action_view.rb +4 -1
- metadata +29 -29
data/CHANGELOG.md
CHANGED
@@ -1,64 +1,25 @@
|
|
1
|
-
## Rails 7.0.
|
1
|
+
## Rails 7.1.0.beta1 (September 13, 2023) ##
|
2
2
|
|
3
|
-
*
|
3
|
+
* Fix `simple_format` with blank `wrapper_tag` option returns plain html tag
|
4
4
|
|
5
|
+
By default `simple_format` method returns the text wrapped with `<p>`. But if we explicitly specify
|
6
|
+
the `wrapper_tag: nil` in the options, it returns the text wrapped with `<></>` tag.
|
5
7
|
|
6
|
-
|
7
|
-
|
8
|
-
* No changes.
|
9
|
-
|
10
|
-
|
11
|
-
## Rails 7.0.8.4 (June 04, 2024) ##
|
12
|
-
|
13
|
-
* No changes.
|
14
|
-
|
15
|
-
|
16
|
-
## Rails 7.0.8.3 (May 17, 2024) ##
|
17
|
-
|
18
|
-
* No changes.
|
19
|
-
|
20
|
-
|
21
|
-
## Rails 7.0.8.2 (May 16, 2024) ##
|
22
|
-
|
23
|
-
* No changes.
|
24
|
-
|
25
|
-
|
26
|
-
## Rails 7.0.8.1 (February 21, 2024) ##
|
27
|
-
|
28
|
-
* No changes.
|
29
|
-
|
30
|
-
|
31
|
-
## Rails 7.0.8 (September 09, 2023) ##
|
32
|
-
|
33
|
-
* Fix `form_for` missing the hidden `_method` input for models with a
|
34
|
-
namespaced route.
|
35
|
-
|
36
|
-
*Hartley McGuire*
|
37
|
-
|
38
|
-
* Fix `render collection: @records, cache: true` inside `jbuilder` templates
|
39
|
-
|
40
|
-
The previous fix that shipped in `7.0.7` assumed template fragments are always strings,
|
41
|
-
this isn't true with `jbuilder`.
|
42
|
-
|
43
|
-
*Jean Boussier*
|
44
|
-
|
45
|
-
## Rails 7.0.7.2 (August 22, 2023) ##
|
46
|
-
|
47
|
-
* No changes.
|
48
|
-
|
49
|
-
|
50
|
-
## Rails 7.0.7.1 (August 22, 2023) ##
|
51
|
-
|
52
|
-
* No changes.
|
53
|
-
|
8
|
+
Before:
|
54
9
|
|
55
|
-
|
10
|
+
```ruby
|
11
|
+
simple_format("Hello World", {}, { wrapper_tag: nil })
|
12
|
+
# <>Hello World</>
|
13
|
+
```
|
56
14
|
|
57
|
-
|
15
|
+
After:
|
58
16
|
|
59
|
-
|
17
|
+
```ruby
|
18
|
+
simple_format("Hello World", {}, { wrapper_tag: nil })
|
19
|
+
# <p>Hello World</p>
|
20
|
+
```
|
60
21
|
|
61
|
-
*
|
22
|
+
*Akhil G Krishnan*, *Junichi Ito*
|
62
23
|
|
63
24
|
* Don't double-encode nested `field_id` and `field_name` index values
|
64
25
|
|
@@ -67,457 +28,344 @@
|
|
67
28
|
|
68
29
|
*Sean Doyle*
|
69
30
|
|
31
|
+
* Allow opting in/out of `Link preload` headers when calling `stylesheet_link_tag` or `javascript_include_tag`
|
70
32
|
|
71
|
-
|
72
|
-
|
73
|
-
|
74
|
-
|
75
|
-
|
76
|
-
## Rails 7.0.5.1 (June 26, 2023) ##
|
77
|
-
|
78
|
-
* No changes.
|
33
|
+
```ruby
|
34
|
+
# will exclude header, even if setting is enabled:
|
35
|
+
javascript_include_tag("http://example.com/all.js", preload_links_header: false)
|
79
36
|
|
37
|
+
# will include header, even if setting is disabled:
|
38
|
+
stylesheet_link_tag("http://example.com/all.js", preload_links_header: true)
|
39
|
+
```
|
80
40
|
|
81
|
-
|
41
|
+
*Alex Ghiculescu*
|
82
42
|
|
83
|
-
* `
|
43
|
+
* Stop generating `Link preload` headers once it has reached 1KB.
|
84
44
|
|
85
|
-
|
45
|
+
Some proxies have trouble handling large headers, but more importantly preload links
|
46
|
+
have diminishing returns so it's preferable not to go overboard with them.
|
86
47
|
|
87
|
-
|
48
|
+
If tighter control is needed, it's recommended to disable automatic generation of preloads
|
49
|
+
and to generate them manually from the controller or from a middleware.
|
88
50
|
|
89
|
-
*
|
51
|
+
*Jean Boussier*
|
90
52
|
|
91
|
-
*
|
92
|
-
of the child arrays when using grouped/nested collections
|
53
|
+
* `simple_format` helper now handles a `:sanitize_options` - any extra options you want appending to the sanitize.
|
93
54
|
|
94
|
-
|
95
|
-
|
96
|
-
|
55
|
+
Before:
|
56
|
+
```ruby
|
57
|
+
simple_format("<a target=\"_blank\" href=\"http://example.com\">Continue</a>")
|
58
|
+
# => "<p><a href=\"http://example.com\">Continue</a></p>"
|
97
59
|
```
|
98
60
|
|
99
|
-
|
100
|
-
|
101
|
-
|
102
|
-
|
61
|
+
After:
|
62
|
+
```ruby
|
63
|
+
simple_format("<a target=\"_blank\" href=\"http://example.com\">Continue</a>", {}, { sanitize_options: { attributes: %w[target href] } })
|
64
|
+
# => "<p><a target=\"_blank\" href=\"http://example.com\">Continue</a></p>"
|
65
|
+
```
|
103
66
|
|
104
|
-
*
|
67
|
+
*Andrei Andriichuk*
|
105
68
|
|
106
|
-
|
69
|
+
* Add support for HTML5 standards-compliant sanitizers, and default to `Rails::HTML5::Sanitizer`
|
70
|
+
in the Rails 7.1 configuration if it is supported.
|
107
71
|
|
72
|
+
Action View's HTML sanitizers can be configured by setting
|
73
|
+
`config.action_view.sanitizer_vendor`. Supported values are `Rails::HTML4::Sanitizer` or
|
74
|
+
`Rails::HTML5::Sanitizer`.
|
108
75
|
|
109
|
-
|
76
|
+
The Rails 7.1 configuration will set this to `Rails::HTML5::Sanitizer` when it is supported, and
|
77
|
+
fall back to `Rails::HTML4::Sanitizer`. Previous configurations default to
|
78
|
+
`Rails::HTML4::Sanitizer`.
|
110
79
|
|
111
|
-
*
|
80
|
+
*Mike Dalessio*
|
112
81
|
|
82
|
+
* `config.dom_testing_default_html_version` controls the HTML parser used by
|
83
|
+
`ActionView::TestCase#document_root_element`, which creates the DOM used by the assertions in
|
84
|
+
Rails::Dom::Testing.
|
113
85
|
|
114
|
-
|
86
|
+
The Rails 7.1 default configuration opts into the HTML5 parser when it is supported, to better
|
87
|
+
represent what the DOM would be in a browser user agent. Previously this test helper always used
|
88
|
+
Nokogiri's HTML4 parser.
|
115
89
|
|
116
|
-
*
|
90
|
+
*Mike Dalessio*
|
117
91
|
|
92
|
+
* Add support for the HTML picture tag. It supports passing a String, an Array or a Block.
|
93
|
+
Supports passing properties directly to the img tag via the `:image` key.
|
94
|
+
Since the picture tag requires an img tag, the last element you provide will be used for the img tag.
|
95
|
+
For complete control over the picture tag, a block can be passed, which will populate the contents of the tag accordingly.
|
118
96
|
|
119
|
-
|
97
|
+
Can be used like this for a single source:
|
98
|
+
```erb
|
99
|
+
<%= picture_tag("picture.webp") %>
|
100
|
+
```
|
101
|
+
which will generate the following:
|
102
|
+
```html
|
103
|
+
<picture>
|
104
|
+
<img src="/images/picture.webp" />
|
105
|
+
</picture>
|
106
|
+
```
|
120
107
|
|
121
|
-
|
122
|
-
|
108
|
+
For multiple sources:
|
109
|
+
```erb
|
110
|
+
<%= picture_tag("picture.webp", "picture.png", :class => "mt-2", :image => { alt: "Image", class: "responsive-img" }) %>
|
111
|
+
```
|
112
|
+
will generate:
|
113
|
+
```html
|
114
|
+
<picture class="mt-2">
|
115
|
+
<source srcset="/images/picture.webp" />
|
116
|
+
<source srcset="/images/picture.png" />
|
117
|
+
<img alt="Image" class="responsive-img" src="/images/picture.png" />
|
118
|
+
</picture>
|
119
|
+
```
|
123
120
|
|
121
|
+
Full control via a block:
|
124
122
|
```erb
|
125
|
-
<%=
|
126
|
-
|
123
|
+
<%= picture_tag(:class => "my-class") do %>
|
124
|
+
<%= tag(:source, :srcset => image_path("picture.webp")) %>
|
125
|
+
<%= tag(:source, :srcset => image_path("picture.png")) %>
|
126
|
+
<%= image_tag("picture.png", :alt => "Image") %>
|
127
127
|
<% end %>
|
128
128
|
```
|
129
|
+
will generate:
|
130
|
+
```html
|
131
|
+
<picture class="my-class">
|
132
|
+
<source srcset="/images/picture.webp" />
|
133
|
+
<source srcset="/images/picture.png" />
|
134
|
+
<img alt="Image" src="/images/picture.png" />
|
135
|
+
</picture>
|
136
|
+
```
|
129
137
|
|
130
|
-
*
|
131
|
-
|
132
|
-
* Strings returned from `strip_tags` are correctly tagged `html_safe?`
|
133
|
-
|
134
|
-
Because these strings contain no HTML elements and the basic entities are escaped, they are safe
|
135
|
-
to be included as-is as PCDATA in HTML content. Tagging them as html-safe avoids double-escaping
|
136
|
-
entities when being concatenated to a SafeBuffer during rendering.
|
137
|
-
|
138
|
-
Fixes [rails/rails-html-sanitizer#124](https://github.com/rails/rails-html-sanitizer/issues/124)
|
139
|
-
|
140
|
-
*Mike Dalessio*
|
138
|
+
*Juan Pablo Balarini*
|
141
139
|
|
142
|
-
|
140
|
+
* Remove deprecated support to passing instance variables as locals to partials.
|
143
141
|
|
144
|
-
*
|
142
|
+
*Rafael Mendonça França*
|
145
143
|
|
144
|
+
* Remove deprecated constant `ActionView::Path`.
|
146
145
|
|
147
|
-
|
146
|
+
*Rafael Mendonça França*
|
148
147
|
|
149
|
-
*
|
148
|
+
* Guard `token_list` calls from escaping HTML too often
|
150
149
|
|
151
150
|
*Sean Doyle*
|
152
151
|
|
153
|
-
|
154
|
-
|
155
|
-
* Fix and add protections for XSS in `ActionView::Helpers` and `ERB::Util`.
|
152
|
+
* `select` can now be called with a single hash containing options and some HTML options
|
156
153
|
|
157
|
-
|
158
|
-
tag helpers, following the XML specification. Rename the option
|
159
|
-
`:escape_attributes` to `:escape`, to simplify by applying the option to the
|
160
|
-
whole tag.
|
154
|
+
Previously this would not work as expected:
|
161
155
|
|
162
|
-
|
163
|
-
|
164
|
-
|
165
|
-
|
166
|
-
* No changes.
|
167
|
-
|
168
|
-
|
169
|
-
## Rails 7.0.2.2 (February 11, 2022) ##
|
170
|
-
|
171
|
-
* No changes.
|
172
|
-
|
173
|
-
|
174
|
-
## Rails 7.0.2.1 (February 11, 2022) ##
|
175
|
-
|
176
|
-
* No changes.
|
177
|
-
|
178
|
-
|
179
|
-
## Rails 7.0.2 (February 08, 2022) ##
|
180
|
-
|
181
|
-
* Ensure `preload_link_tag` preloads JavaScript modules correctly.
|
182
|
-
|
183
|
-
*Máximo Mussini*
|
184
|
-
|
185
|
-
* Fix `stylesheet_link_tag` and similar helpers are being used to work in objects with
|
186
|
-
a `response` method.
|
187
|
-
|
188
|
-
*dark-panda*
|
189
|
-
|
190
|
-
|
191
|
-
## Rails 7.0.1 (January 06, 2022) ##
|
156
|
+
```erb
|
157
|
+
<%= select :post, :author, authors, required: true %>
|
158
|
+
```
|
192
159
|
|
193
|
-
|
160
|
+
Instead you needed to do this:
|
194
161
|
|
195
|
-
|
162
|
+
```erb
|
163
|
+
<%= select :post, :author, authors, {}, required: true %>
|
164
|
+
```
|
196
165
|
|
197
|
-
|
166
|
+
Now, either form is accepted, for the following HTML attributes: `required`, `multiple`, `size`.
|
198
167
|
|
199
168
|
*Alex Ghiculescu*
|
200
169
|
|
170
|
+
* Datetime form helpers (`time_field`, `date_field`, `datetime_field`, `week_field`, `month_field`) now accept an instance of Time/Date/DateTime as `:value` option.
|
201
171
|
|
202
|
-
|
203
|
-
|
204
|
-
|
205
|
-
`ActionView::Helper::FormBuilder#file_field` with `multiple: true` to
|
206
|
-
support submitting an empty collection of files.
|
207
|
-
|
208
|
-
```ruby
|
209
|
-
form.file_field :attachments, multiple: true
|
210
|
-
# => <input type="hidden" autocomplete="off" name="post[attachments][]" value="">
|
211
|
-
<input type="file" multiple="multiple" id="post_attachments" name="post[attachments][]">
|
212
|
-
|
213
|
-
form.file_field :attachments, multiple: true, include_hidden: false
|
214
|
-
# => <input type="file" multiple="multiple" id="post_attachments" name="post[attachments][]">
|
172
|
+
Before:
|
173
|
+
```erb
|
174
|
+
<%= form.datetime_field :written_at, value: Time.current.strftime("%Y-%m-%dT%T") %>
|
215
175
|
```
|
216
176
|
|
217
|
-
|
218
|
-
|
219
|
-
|
220
|
-
|
221
|
-
*Pedro Moreira*
|
177
|
+
After:
|
178
|
+
```erb
|
179
|
+
<%= form.datetime_field :written_at, value: Time.current %>
|
180
|
+
```
|
222
181
|
|
182
|
+
*Andrey Samsonov*
|
223
183
|
|
224
|
-
|
184
|
+
* Choices of `select` can optionally contain html attributes as the last element
|
185
|
+
of the child arrays when using grouped/nested collections
|
225
186
|
|
226
|
-
|
187
|
+
```erb
|
188
|
+
<%= form.select :foo, [["North America", [["United States","US"],["Canada","CA"]], { disabled: "disabled" }]] %>
|
189
|
+
# => <select><optgroup label="North America" disabled="disabled"><option value="US">United States</option><option value="CA">Canada</option></optgroup></select>
|
190
|
+
```
|
227
191
|
|
192
|
+
*Chris Gunther*
|
228
193
|
|
229
|
-
|
194
|
+
* `check_box_tag` and `radio_button_tag` now accept `checked` as a keyword argument
|
230
195
|
|
231
|
-
|
196
|
+
This is to make the API more consistent with the `FormHelper` variants. You can now
|
197
|
+
provide `checked` as a positional or keyword argument:
|
232
198
|
|
233
|
-
|
199
|
+
```erb
|
200
|
+
= check_box_tag "admin", "1", false
|
201
|
+
= check_box_tag "admin", "1", checked: false
|
234
202
|
|
235
|
-
|
236
|
-
|
203
|
+
= radio_button_tag 'favorite_color', 'maroon', false
|
204
|
+
= radio_button_tag 'favorite_color', 'maroon', checked: false
|
205
|
+
```
|
237
206
|
|
238
|
-
*
|
207
|
+
*Alex Ghiculescu*
|
239
208
|
|
240
|
-
*
|
241
|
-
|
209
|
+
* Allow passing a class to `dom_id`.
|
210
|
+
You no longer need to call `new` when passing a class to `dom_id`.
|
211
|
+
This makes `dom_id` behave like `dom_class` in this regard.
|
212
|
+
Apart from saving a few keystrokes, it prevents Ruby from needing
|
213
|
+
to instantiate a whole new object just to generate a string.
|
242
214
|
|
215
|
+
Before:
|
243
216
|
```ruby
|
244
|
-
|
245
|
-
#=> <form method="post" action="/workshops/1" class="button_to">
|
246
|
-
#=> <input type="hidden" name="_method" value="patch" autocomplete="off" />
|
247
|
-
#=> <button type="submit">Update</button>
|
248
|
-
#=> </form>
|
249
|
-
|
250
|
-
button_to([ Workshop.find(1), Session.find(1) ]) { "Update" }
|
251
|
-
#=> <form method="post" action="/workshops/1/sessions/1" class="button_to">
|
252
|
-
#=> <input type="hidden" name="_method" value="patch" autocomplete="off" />
|
253
|
-
#=> <button type="submit">Update</button>
|
254
|
-
#=> </form>
|
217
|
+
dom_id(Post) # => NoMethodError: undefined method `to_key' for Post:Class
|
255
218
|
```
|
256
219
|
|
257
|
-
|
258
|
-
|
259
|
-
* Support passing a Symbol as the first argument to `FormBuilder#button`:
|
260
|
-
|
220
|
+
After:
|
261
221
|
```ruby
|
262
|
-
|
263
|
-
# => <button name="post[draft]" value="true" type="submit">Create post</button>
|
264
|
-
|
265
|
-
form.button(:draft, value: true) do
|
266
|
-
content_tag(:strong, "Save as draft")
|
267
|
-
end
|
268
|
-
# => <button name="post[draft]" value="true" type="submit">
|
269
|
-
# <strong>Save as draft</strong>
|
270
|
-
# </button>
|
222
|
+
dom_id(Post) # => "new_post"
|
271
223
|
```
|
272
224
|
|
273
|
-
*
|
225
|
+
*Goulven Champenois*
|
274
226
|
|
275
|
-
*
|
276
|
-
`FormBuilder#field_name` counterpart:
|
227
|
+
* Report `:locals` as part of the data returned by ActionView render instrumentation.
|
277
228
|
|
229
|
+
Before:
|
278
230
|
```ruby
|
279
|
-
|
280
|
-
|
281
|
-
|
282
|
-
|
231
|
+
{
|
232
|
+
identifier: "/Users/adam/projects/notifications/app/views/posts/index.html.erb",
|
233
|
+
layout: "layouts/application"
|
234
|
+
}
|
283
235
|
```
|
284
236
|
|
285
|
-
|
286
|
-
|
287
|
-
* Execute the `ActionView::Base.field_error_proc` within the context of the
|
288
|
-
`ActionView::Base` instance:
|
289
|
-
|
237
|
+
After:
|
290
238
|
```ruby
|
291
|
-
|
239
|
+
{
|
240
|
+
identifier: "/Users/adam/projects/notifications/app/views/posts/index.html.erb",
|
241
|
+
layout: "layouts/application",
|
242
|
+
locals: {foo: "bar"}
|
243
|
+
}
|
292
244
|
```
|
293
245
|
|
294
|
-
*
|
246
|
+
*Aaron Gough*
|
295
247
|
|
296
|
-
*
|
248
|
+
* Strip `break_sequence` at the end of `word_wrap`.
|
297
249
|
|
298
|
-
|
299
|
-
button_to "Create", Post.new, authenticity_token: false
|
300
|
-
# => <form class="button_to" method="post" action="/posts"><button type="submit">Create</button></form>
|
250
|
+
This fixes a bug where `word_wrap` didn't properly strip off break sequences that had printable characters.
|
301
251
|
|
302
|
-
|
303
|
-
# => <form class="button_to" method="post" action="/posts"><button type="submit">Create</button><input type="hidden" name="form_token" value="abc123..." autocomplete="off" /></form>
|
252
|
+
For example, compare the outputs of this template:
|
304
253
|
|
305
|
-
|
306
|
-
#
|
254
|
+
```erb
|
255
|
+
# <%= word_wrap("11 22\n33 44", line_width: 2, break_sequence: "\n# ") %>
|
307
256
|
```
|
308
257
|
|
309
|
-
|
310
|
-
|
311
|
-
* Support rendering `<form>` elements _without_ `[action]` attributes by:
|
258
|
+
Before:
|
312
259
|
|
313
|
-
|
314
|
-
|
315
|
-
|
316
|
-
|
260
|
+
```
|
261
|
+
# 11
|
262
|
+
# 22
|
263
|
+
#
|
264
|
+
# 33
|
265
|
+
# 44
|
266
|
+
#
|
267
|
+
```
|
317
268
|
|
318
|
-
|
269
|
+
After:
|
319
270
|
|
320
|
-
|
271
|
+
```
|
272
|
+
# 11
|
273
|
+
# 22
|
274
|
+
# 33
|
275
|
+
# 44
|
276
|
+
```
|
321
277
|
|
322
|
-
|
323
|
-
# generates day options like <option value="1">1st</option>\n<option value="2">2nd</option>...
|
278
|
+
*Max Chernyak*
|
324
279
|
|
325
|
-
|
280
|
+
* Allow templates to set strict `locals`.
|
326
281
|
|
327
|
-
|
328
|
-
is used with a single argument:
|
282
|
+
By default, templates will accept any `locals` as keyword arguments. To define what `locals` a template accepts, add a `locals` magic comment:
|
329
283
|
|
330
|
-
|
331
|
-
|
284
|
+
```erb
|
285
|
+
<%# locals: (message:) -%>
|
286
|
+
<%= message %>
|
287
|
+
```
|
332
288
|
|
333
|
-
|
289
|
+
Default values can also be provided:
|
334
290
|
|
335
|
-
|
336
|
-
|
337
|
-
|
338
|
-
|
339
|
-
end
|
340
|
-
end
|
291
|
+
```erb
|
292
|
+
<%# locals: (message: "Hello, world!") -%>
|
293
|
+
<%= message %>
|
294
|
+
```
|
341
295
|
|
342
|
-
|
343
|
-
model implemented a `#to_s` method that called the `name` method.
|
296
|
+
Or `locals` can be disabled entirely:
|
344
297
|
|
345
|
-
|
346
|
-
|
298
|
+
```erb
|
299
|
+
<%# locals: () %>
|
300
|
+
```
|
347
301
|
|
348
|
-
*
|
302
|
+
*Joel Hawksley*
|
349
303
|
|
350
|
-
*
|
304
|
+
* Add `include_seconds` option for `datetime_local_field`
|
351
305
|
|
352
|
-
|
353
|
-
# => <svg><use href="#cool-icon"></svg>
|
306
|
+
This allows to omit seconds part in the input field, by passing `include_seconds: false`
|
354
307
|
|
355
|
-
*
|
308
|
+
*Wojciech Wnętrzak*
|
356
309
|
|
310
|
+
* Guard against `ActionView::Helpers::FormTagHelper#field_name` calls with nil
|
311
|
+
`object_name` arguments. For example:
|
357
312
|
|
358
|
-
|
313
|
+
```erb
|
314
|
+
<%= fields do |f| %>
|
315
|
+
<%= f.field_name :body %>
|
316
|
+
<% end %>
|
317
|
+
```
|
359
318
|
|
360
|
-
*
|
319
|
+
*Sean Doyle*
|
361
320
|
|
321
|
+
* Strings returned from `strip_tags` are correctly tagged `html_safe?`
|
362
322
|
|
363
|
-
|
323
|
+
Because these strings contain no HTML elements and the basic entities are escaped, they are safe
|
324
|
+
to be included as-is as PCDATA in HTML content. Tagging them as html-safe avoids double-escaping
|
325
|
+
entities when being concatenated to a SafeBuffer during rendering.
|
364
326
|
|
365
|
-
|
366
|
-
exceptions as flow control.
|
327
|
+
Fixes [rails/rails-html-sanitizer#124](https://github.com/rails/rails-html-sanitizer/issues/124)
|
367
328
|
|
368
329
|
*Mike Dalessio*
|
369
330
|
|
370
|
-
* `
|
371
|
-
|
372
|
-
*Nate Berkopec*
|
373
|
-
|
374
|
-
* Add `weekday_options_for_select` and `weekday_select` helper methods. Also adds `weekday_select` to `FormBuilder`.
|
375
|
-
|
376
|
-
*Drew Bragg*, *Dana Kashubeck*, *Kasper Timm Hansen*
|
377
|
-
|
378
|
-
* Add `caching?` helper that returns whether the current code path is being cached and `uncacheable!` to denote helper methods that can't participate in fragment caching.
|
379
|
-
|
380
|
-
*Ben Toews*, *John Hawthorn*, *Kasper Timm Hansen*, *Joel Hawksley*
|
381
|
-
|
382
|
-
* Add `include_seconds` option for `time_field`.
|
383
|
-
|
384
|
-
<%= form.time_field :foo, include_seconds: false %>
|
385
|
-
# => <input value="16:22" type="time" />
|
386
|
-
|
387
|
-
Default includes seconds:
|
388
|
-
|
389
|
-
<%= form.time_field :foo %>
|
390
|
-
# => <input value="16:22:01.440" type="time" />
|
391
|
-
|
392
|
-
This allows you to take advantage of [different rendering options](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/input/time#time_value_format) in some browsers.
|
393
|
-
|
394
|
-
*Alex Ghiculescu*
|
331
|
+
* Move `convert_to_model` call from `form_for` into `form_with`
|
395
332
|
|
396
|
-
|
333
|
+
Now that `form_for` is implemented in terms of `form_with`, remove the
|
334
|
+
`convert_to_model` call from `form_for`.
|
397
335
|
|
398
|
-
*
|
399
|
-
|
400
|
-
* Add `:country_code` option to `sms_to` for consistency with `phone_to`.
|
401
|
-
|
402
|
-
*Jonathan Hefner*
|
403
|
-
|
404
|
-
* OpenSSL constants are now used for Digest computations.
|
336
|
+
*Sean Doyle*
|
405
337
|
|
406
|
-
|
338
|
+
* Fix and add protections for XSS in `ActionView::Helpers` and `ERB::Util`.
|
407
339
|
|
408
|
-
|
409
|
-
|
340
|
+
Escape dangerous characters in names of tags and names of attributes in the
|
341
|
+
tag helpers, following the XML specification. Rename the option
|
342
|
+
`:escape_attributes` to `:escape`, to simplify by applying the option to the
|
343
|
+
whole tag.
|
410
344
|
|
411
|
-
|
345
|
+
*Álvaro Martín Fraguas*
|
412
346
|
|
413
|
-
*
|
414
|
-
`.css` extension appended to the stylesheet path.
|
347
|
+
* Extend audio_tag and video_tag to accept Active Storage attachments.
|
415
348
|
|
416
|
-
|
349
|
+
Now it's possible to write
|
417
350
|
|
418
351
|
```ruby
|
419
|
-
|
420
|
-
|
352
|
+
audio_tag(user.audio_file)
|
353
|
+
video_tag(user.video_file)
|
421
354
|
```
|
422
355
|
|
423
|
-
|
356
|
+
Instead of
|
424
357
|
|
425
358
|
```ruby
|
426
|
-
|
427
|
-
|
359
|
+
audio_tag(polymorphic_path(user.audio_file))
|
360
|
+
video_tag(polymorphic_path(user.video_file))
|
428
361
|
```
|
429
362
|
|
430
|
-
|
431
|
-
|
432
|
-
* Deprecate `render` locals to be assigned to instance variables.
|
433
|
-
|
434
|
-
*Petrik de Heus*
|
363
|
+
`image_tag` already supported that, so this follows the same pattern.
|
435
364
|
|
436
|
-
*
|
365
|
+
*Matheus Richard*
|
437
366
|
|
438
|
-
|
439
|
-
|
440
|
-
* Change `ActionView::Helpers::FormBuilder#button` to transform `formmethod`
|
441
|
-
attributes into `_method="$VERB"` Form Data to enable varied same-form actions:
|
442
|
-
|
443
|
-
<%= form_with model: post, method: :put do %>
|
444
|
-
<%= form.button "Update" %>
|
445
|
-
<%= form.button "Delete", formmethod: :delete %>
|
446
|
-
<% end %>
|
447
|
-
<%# => <form action="posts/1">
|
448
|
-
=> <input type="hidden" name="_method" value="put">
|
449
|
-
=> <button type="submit">Update</button>
|
450
|
-
=> <button type="submit" formmethod="post" name="_method" value="delete">Delete</button>
|
451
|
-
=> </form>
|
452
|
-
%>
|
453
|
-
|
454
|
-
*Sean Doyle*
|
455
|
-
|
456
|
-
* Change `ActionView::Helpers::UrlHelper#button_to` to *always* render a
|
457
|
-
`<button>` element, regardless of whether or not the content is passed as
|
458
|
-
the first argument or as a block.
|
459
|
-
|
460
|
-
<%= button_to "Delete", post_path(@post), method: :delete %>
|
461
|
-
# => <form action="/posts/1"><input type="hidden" name="_method" value="delete"><button type="submit">Delete</button></form>
|
462
|
-
|
463
|
-
<%= button_to post_path(@post), method: :delete do %>
|
464
|
-
Delete
|
465
|
-
<% end %>
|
466
|
-
# => <form action="/posts/1"><input type="hidden" name="_method" value="delete"><button type="submit">Delete</button></form>
|
467
|
-
|
468
|
-
*Sean Doyle*, *Dusan Orlovic*
|
469
|
-
|
470
|
-
* Add `config.action_view.preload_links_header` to allow disabling of
|
471
|
-
the `Link` header being added by default when using `stylesheet_link_tag`
|
472
|
-
and `javascript_include_tag`.
|
473
|
-
|
474
|
-
*Andrew White*
|
475
|
-
|
476
|
-
* The `translate` helper now resolves `default` values when a `nil` key is
|
477
|
-
specified, instead of always returning `nil`.
|
478
|
-
|
479
|
-
*Jonathan Hefner*
|
480
|
-
|
481
|
-
* Add `config.action_view.image_loading` to configure the default value of
|
482
|
-
the `image_tag` `:loading` option.
|
483
|
-
|
484
|
-
By setting `config.action_view.image_loading = "lazy"`, an application can opt in to
|
485
|
-
lazy loading images sitewide, without changing view code.
|
486
|
-
|
487
|
-
*Jonathan Hefner*
|
488
|
-
|
489
|
-
* `ActionView::Helpers::FormBuilder#id` returns the value
|
490
|
-
of the `<form>` element's `id` attribute. With a `method` argument, returns
|
491
|
-
the `id` attribute for a form field with that name.
|
492
|
-
|
493
|
-
<%= form_for @post do |f| %>
|
494
|
-
<%# ... %>
|
495
|
-
|
496
|
-
<% content_for :sticky_footer do %>
|
497
|
-
<%= form.button(form: f.id) %>
|
498
|
-
<% end %>
|
499
|
-
<% end %>
|
500
|
-
|
501
|
-
*Sean Doyle*
|
502
|
-
|
503
|
-
* `ActionView::Helpers::FormBuilder#field_id` returns the value generated by
|
504
|
-
the FormBuilder for the given attribute name.
|
505
|
-
|
506
|
-
<%= form_for @post do |f| %>
|
507
|
-
<%= f.label :title %>
|
508
|
-
<%= f.text_field :title, aria: { describedby: f.field_id(:title, :error) } %>
|
509
|
-
<%= tag.span("is blank", id: f.field_id(:title, :error) %>
|
510
|
-
<% end %>
|
511
|
-
|
512
|
-
*Sean Doyle*
|
513
|
-
|
514
|
-
* Add `tag.attributes` to transform a Hash into HTML Attributes, ready to be
|
515
|
-
interpolated into ERB.
|
516
|
-
|
517
|
-
<input <%= tag.attributes(type: :text, aria: { label: "Search" }) %> >
|
518
|
-
# => <input type="text" aria-label="Search">
|
367
|
+
* Ensure models passed to `form_for` attempt to call `to_model`.
|
519
368
|
|
520
369
|
*Sean Doyle*
|
521
370
|
|
522
|
-
|
523
|
-
Please check [6-1-stable](https://github.com/rails/rails/blob/6-1-stable/actionview/CHANGELOG.md) for previous changes.
|
371
|
+
Please check [7-0-stable](https://github.com/rails/rails/blob/7-0-stable/actionview/CHANGELOG.md) for previous changes.
|