actionview 7.0.8.6 → 7.1.0.beta1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (90) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +235 -387
  3. data/MIT-LICENSE +1 -1
  4. data/README.rdoc +1 -1
  5. data/app/assets/javascripts/rails-ujs.esm.js +668 -0
  6. data/app/assets/javascripts/rails-ujs.js +606 -0
  7. data/lib/action_view/base.rb +28 -7
  8. data/lib/action_view/buffers.rb +106 -8
  9. data/lib/action_view/cache_expiry.rb +40 -43
  10. data/lib/action_view/context.rb +1 -1
  11. data/lib/action_view/deprecator.rb +7 -0
  12. data/lib/action_view/digestor.rb +1 -1
  13. data/lib/action_view/gem_version.rb +4 -4
  14. data/lib/action_view/helpers/active_model_helper.rb +1 -1
  15. data/lib/action_view/helpers/asset_tag_helper.rb +130 -46
  16. data/lib/action_view/helpers/asset_url_helper.rb +6 -5
  17. data/lib/action_view/helpers/atom_feed_helper.rb +5 -5
  18. data/lib/action_view/helpers/cache_helper.rb +3 -9
  19. data/lib/action_view/helpers/capture_helper.rb +24 -10
  20. data/lib/action_view/helpers/content_exfiltration_prevention_helper.rb +70 -0
  21. data/lib/action_view/helpers/controller_helper.rb +6 -0
  22. data/lib/action_view/helpers/csp_helper.rb +2 -2
  23. data/lib/action_view/helpers/csrf_helper.rb +2 -2
  24. data/lib/action_view/helpers/date_helper.rb +17 -19
  25. data/lib/action_view/helpers/debug_helper.rb +3 -3
  26. data/lib/action_view/helpers/form_helper.rb +43 -18
  27. data/lib/action_view/helpers/form_options_helper.rb +2 -1
  28. data/lib/action_view/helpers/form_tag_helper.rb +43 -9
  29. data/lib/action_view/helpers/javascript_helper.rb +1 -0
  30. data/lib/action_view/helpers/number_helper.rb +2 -1
  31. data/lib/action_view/helpers/output_safety_helper.rb +2 -2
  32. data/lib/action_view/helpers/rendering_helper.rb +1 -1
  33. data/lib/action_view/helpers/sanitize_helper.rb +33 -14
  34. data/lib/action_view/helpers/tag_helper.rb +5 -27
  35. data/lib/action_view/helpers/tags/base.rb +11 -52
  36. data/lib/action_view/helpers/tags/collection_check_boxes.rb +1 -0
  37. data/lib/action_view/helpers/tags/collection_radio_buttons.rb +1 -0
  38. data/lib/action_view/helpers/tags/collection_select.rb +3 -0
  39. data/lib/action_view/helpers/tags/date_field.rb +1 -1
  40. data/lib/action_view/helpers/tags/date_select.rb +2 -0
  41. data/lib/action_view/helpers/tags/datetime_field.rb +14 -6
  42. data/lib/action_view/helpers/tags/datetime_local_field.rb +11 -2
  43. data/lib/action_view/helpers/tags/grouped_collection_select.rb +3 -0
  44. data/lib/action_view/helpers/tags/month_field.rb +1 -1
  45. data/lib/action_view/helpers/tags/select.rb +3 -0
  46. data/lib/action_view/helpers/tags/select_renderer.rb +56 -0
  47. data/lib/action_view/helpers/tags/time_field.rb +1 -1
  48. data/lib/action_view/helpers/tags/time_zone_select.rb +3 -0
  49. data/lib/action_view/helpers/tags/week_field.rb +1 -1
  50. data/lib/action_view/helpers/tags/weekday_select.rb +3 -0
  51. data/lib/action_view/helpers/tags.rb +2 -0
  52. data/lib/action_view/helpers/text_helper.rb +32 -16
  53. data/lib/action_view/helpers/translation_helper.rb +3 -3
  54. data/lib/action_view/helpers/url_helper.rb +41 -14
  55. data/lib/action_view/helpers.rb +2 -0
  56. data/lib/action_view/layouts.rb +4 -2
  57. data/lib/action_view/log_subscriber.rb +49 -32
  58. data/lib/action_view/lookup_context.rb +29 -13
  59. data/lib/action_view/path_registry.rb +57 -0
  60. data/lib/action_view/path_set.rb +13 -14
  61. data/lib/action_view/railtie.rb +26 -3
  62. data/lib/action_view/record_identifier.rb +15 -8
  63. data/lib/action_view/renderer/abstract_renderer.rb +1 -1
  64. data/lib/action_view/renderer/collection_renderer.rb +9 -1
  65. data/lib/action_view/renderer/partial_renderer/collection_caching.rb +2 -1
  66. data/lib/action_view/renderer/partial_renderer.rb +2 -1
  67. data/lib/action_view/renderer/renderer.rb +2 -0
  68. data/lib/action_view/renderer/streaming_template_renderer.rb +3 -2
  69. data/lib/action_view/renderer/template_renderer.rb +3 -2
  70. data/lib/action_view/rendering.rb +22 -4
  71. data/lib/action_view/ripper_ast_parser.rb +6 -6
  72. data/lib/action_view/template/error.rb +14 -1
  73. data/lib/action_view/template/handlers/builder.rb +4 -4
  74. data/lib/action_view/template/handlers/erb/erubi.rb +23 -27
  75. data/lib/action_view/template/handlers/erb.rb +73 -1
  76. data/lib/action_view/template/handlers.rb +1 -1
  77. data/lib/action_view/template/html.rb +1 -1
  78. data/lib/action_view/template/raw_file.rb +1 -1
  79. data/lib/action_view/template/renderable.rb +1 -1
  80. data/lib/action_view/template/resolver.rb +10 -2
  81. data/lib/action_view/template/text.rb +1 -1
  82. data/lib/action_view/template/types.rb +25 -34
  83. data/lib/action_view/template.rb +179 -52
  84. data/lib/action_view/template_path.rb +2 -0
  85. data/lib/action_view/test_case.rb +8 -5
  86. data/lib/action_view/unbound_template.rb +15 -5
  87. data/lib/action_view/version.rb +1 -1
  88. data/lib/action_view/view_paths.rb +15 -24
  89. data/lib/action_view.rb +4 -1
  90. metadata +29 -29
data/CHANGELOG.md CHANGED
@@ -1,64 +1,25 @@
1
- ## Rails 7.0.8.6 (October 23, 2024) ##
1
+ ## Rails 7.1.0.beta1 (September 13, 2023) ##
2
2
 
3
- * No changes.
3
+ * Fix `simple_format` with blank `wrapper_tag` option returns plain html tag
4
4
 
5
+ By default `simple_format` method returns the text wrapped with `<p>`. But if we explicitly specify
6
+ the `wrapper_tag: nil` in the options, it returns the text wrapped with `<></>` tag.
5
7
 
6
- ## Rails 7.0.8.5 (October 15, 2024) ##
7
-
8
- * No changes.
9
-
10
-
11
- ## Rails 7.0.8.4 (June 04, 2024) ##
12
-
13
- * No changes.
14
-
15
-
16
- ## Rails 7.0.8.3 (May 17, 2024) ##
17
-
18
- * No changes.
19
-
20
-
21
- ## Rails 7.0.8.2 (May 16, 2024) ##
22
-
23
- * No changes.
24
-
25
-
26
- ## Rails 7.0.8.1 (February 21, 2024) ##
27
-
28
- * No changes.
29
-
30
-
31
- ## Rails 7.0.8 (September 09, 2023) ##
32
-
33
- * Fix `form_for` missing the hidden `_method` input for models with a
34
- namespaced route.
35
-
36
- *Hartley McGuire*
37
-
38
- * Fix `render collection: @records, cache: true` inside `jbuilder` templates
39
-
40
- The previous fix that shipped in `7.0.7` assumed template fragments are always strings,
41
- this isn't true with `jbuilder`.
42
-
43
- *Jean Boussier*
44
-
45
- ## Rails 7.0.7.2 (August 22, 2023) ##
46
-
47
- * No changes.
48
-
49
-
50
- ## Rails 7.0.7.1 (August 22, 2023) ##
51
-
52
- * No changes.
53
-
8
+ Before:
54
9
 
55
- ## Rails 7.0.7 (August 09, 2023) ##
10
+ ```ruby
11
+ simple_format("Hello World", {}, { wrapper_tag: nil })
12
+ # <>Hello World</>
13
+ ```
56
14
 
57
- * Fix `render collection: @records, cache: true` to cache fragments as bare strings
15
+ After:
58
16
 
59
- Previously it would incorrectly cache them as Action View buffers.
17
+ ```ruby
18
+ simple_format("Hello World", {}, { wrapper_tag: nil })
19
+ # <p>Hello World</p>
20
+ ```
60
21
 
61
- *Jean Boussier*
22
+ *Akhil G Krishnan*, *Junichi Ito*
62
23
 
63
24
  * Don't double-encode nested `field_id` and `field_name` index values
64
25
 
@@ -67,457 +28,344 @@
67
28
 
68
29
  *Sean Doyle*
69
30
 
31
+ * Allow opting in/out of `Link preload` headers when calling `stylesheet_link_tag` or `javascript_include_tag`
70
32
 
71
- ## Rails 7.0.6 (June 29, 2023) ##
72
-
73
- * No changes.
74
-
75
-
76
- ## Rails 7.0.5.1 (June 26, 2023) ##
77
-
78
- * No changes.
33
+ ```ruby
34
+ # will exclude header, even if setting is enabled:
35
+ javascript_include_tag("http://example.com/all.js", preload_links_header: false)
79
36
 
37
+ # will include header, even if setting is disabled:
38
+ stylesheet_link_tag("http://example.com/all.js", preload_links_header: true)
39
+ ```
80
40
 
81
- ## Rails 7.0.5 (May 24, 2023) ##
41
+ *Alex Ghiculescu*
82
42
 
83
- * `FormBuilder#id` finds id set by `form_for` and `form_with`.
43
+ * Stop generating `Link preload` headers once it has reached 1KB.
84
44
 
85
- *Matt Polito*
45
+ Some proxies have trouble handling large headers, but more importantly preload links
46
+ have diminishing returns so it's preferable not to go overboard with them.
86
47
 
87
- * Allow all available locales for template lookups.
48
+ If tighter control is needed, it's recommended to disable automatic generation of preloads
49
+ and to generate them manually from the controller or from a middleware.
88
50
 
89
- *Ben Dilley*
51
+ *Jean Boussier*
90
52
 
91
- * Choices of `select` can optionally contain html attributes as the last element
92
- of the child arrays when using grouped/nested collections
53
+ * `simple_format` helper now handles a `:sanitize_options` - any extra options you want appending to the sanitize.
93
54
 
94
- ```erb
95
- <%= form.select :foo, [["North America", [["United States","US"],["Canada","CA"]], { disabled: "disabled" }]] %>
96
- # => <select><optgroup label="North America" disabled="disabled"><option value="US">United States</option><option value="CA">Canada</option></optgroup></select>
55
+ Before:
56
+ ```ruby
57
+ simple_format("<a target=\"_blank\" href=\"http://example.com\">Continue</a>")
58
+ # => "<p><a href=\"http://example.com\">Continue</a></p>"
97
59
  ```
98
60
 
99
- *Chris Gunther*
100
-
101
-
102
- ## Rails 7.0.4.3 (March 13, 2023) ##
61
+ After:
62
+ ```ruby
63
+ simple_format("<a target=\"_blank\" href=\"http://example.com\">Continue</a>", {}, { sanitize_options: { attributes: %w[target href] } })
64
+ # => "<p><a target=\"_blank\" href=\"http://example.com\">Continue</a></p>"
65
+ ```
103
66
 
104
- * Ignore certain data-* attributes in rails-ujs when element is contenteditable
67
+ *Andrei Andriichuk*
105
68
 
106
- [CVE-2023-23913]
69
+ * Add support for HTML5 standards-compliant sanitizers, and default to `Rails::HTML5::Sanitizer`
70
+ in the Rails 7.1 configuration if it is supported.
107
71
 
72
+ Action View's HTML sanitizers can be configured by setting
73
+ `config.action_view.sanitizer_vendor`. Supported values are `Rails::HTML4::Sanitizer` or
74
+ `Rails::HTML5::Sanitizer`.
108
75
 
109
- ## Rails 7.0.4.2 (January 24, 2023) ##
76
+ The Rails 7.1 configuration will set this to `Rails::HTML5::Sanitizer` when it is supported, and
77
+ fall back to `Rails::HTML4::Sanitizer`. Previous configurations default to
78
+ `Rails::HTML4::Sanitizer`.
110
79
 
111
- * No changes.
80
+ *Mike Dalessio*
112
81
 
82
+ * `config.dom_testing_default_html_version` controls the HTML parser used by
83
+ `ActionView::TestCase#document_root_element`, which creates the DOM used by the assertions in
84
+ Rails::Dom::Testing.
113
85
 
114
- ## Rails 7.0.4.1 (January 17, 2023) ##
86
+ The Rails 7.1 default configuration opts into the HTML5 parser when it is supported, to better
87
+ represent what the DOM would be in a browser user agent. Previously this test helper always used
88
+ Nokogiri's HTML4 parser.
115
89
 
116
- * No changes.
90
+ *Mike Dalessio*
117
91
 
92
+ * Add support for the HTML picture tag. It supports passing a String, an Array or a Block.
93
+ Supports passing properties directly to the img tag via the `:image` key.
94
+ Since the picture tag requires an img tag, the last element you provide will be used for the img tag.
95
+ For complete control over the picture tag, a block can be passed, which will populate the contents of the tag accordingly.
118
96
 
119
- ## Rails 7.0.4 (September 09, 2022) ##
97
+ Can be used like this for a single source:
98
+ ```erb
99
+ <%= picture_tag("picture.webp") %>
100
+ ```
101
+ which will generate the following:
102
+ ```html
103
+ <picture>
104
+ <img src="/images/picture.webp" />
105
+ </picture>
106
+ ```
120
107
 
121
- * Guard against `ActionView::Helpers::FormTagHelper#field_name` calls with nil
122
- `object_name` arguments. For example:
108
+ For multiple sources:
109
+ ```erb
110
+ <%= picture_tag("picture.webp", "picture.png", :class => "mt-2", :image => { alt: "Image", class: "responsive-img" }) %>
111
+ ```
112
+ will generate:
113
+ ```html
114
+ <picture class="mt-2">
115
+ <source srcset="/images/picture.webp" />
116
+ <source srcset="/images/picture.png" />
117
+ <img alt="Image" class="responsive-img" src="/images/picture.png" />
118
+ </picture>
119
+ ```
123
120
 
121
+ Full control via a block:
124
122
  ```erb
125
- <%= fields do |f| %>
126
- <%= f.field_name :body %>
123
+ <%= picture_tag(:class => "my-class") do %>
124
+ <%= tag(:source, :srcset => image_path("picture.webp")) %>
125
+ <%= tag(:source, :srcset => image_path("picture.png")) %>
126
+ <%= image_tag("picture.png", :alt => "Image") %>
127
127
  <% end %>
128
128
  ```
129
+ will generate:
130
+ ```html
131
+ <picture class="my-class">
132
+ <source srcset="/images/picture.webp" />
133
+ <source srcset="/images/picture.png" />
134
+ <img alt="Image" src="/images/picture.png" />
135
+ </picture>
136
+ ```
129
137
 
130
- *Sean Doyle*
131
-
132
- * Strings returned from `strip_tags` are correctly tagged `html_safe?`
133
-
134
- Because these strings contain no HTML elements and the basic entities are escaped, they are safe
135
- to be included as-is as PCDATA in HTML content. Tagging them as html-safe avoids double-escaping
136
- entities when being concatenated to a SafeBuffer during rendering.
137
-
138
- Fixes [rails/rails-html-sanitizer#124](https://github.com/rails/rails-html-sanitizer/issues/124)
139
-
140
- *Mike Dalessio*
138
+ *Juan Pablo Balarini*
141
139
 
142
- ## Rails 7.0.3.1 (July 12, 2022) ##
140
+ * Remove deprecated support to passing instance variables as locals to partials.
143
141
 
144
- * No changes.
142
+ *Rafael Mendonça França*
145
143
 
144
+ * Remove deprecated constant `ActionView::Path`.
146
145
 
147
- ## Rails 7.0.3 (May 09, 2022) ##
146
+ *Rafael Mendonça França*
148
147
 
149
- * Ensure models passed to `form_for` attempt to call `to_model`.
148
+ * Guard `token_list` calls from escaping HTML too often
150
149
 
151
150
  *Sean Doyle*
152
151
 
153
- ## Rails 7.0.2.4 (April 26, 2022) ##
154
-
155
- * Fix and add protections for XSS in `ActionView::Helpers` and `ERB::Util`.
152
+ * `select` can now be called with a single hash containing options and some HTML options
156
153
 
157
- Escape dangerous characters in names of tags and names of attributes in the
158
- tag helpers, following the XML specification. Rename the option
159
- `:escape_attributes` to `:escape`, to simplify by applying the option to the
160
- whole tag.
154
+ Previously this would not work as expected:
161
155
 
162
- *Álvaro Martín Fraguas*
163
-
164
- ## Rails 7.0.2.3 (March 08, 2022) ##
165
-
166
- * No changes.
167
-
168
-
169
- ## Rails 7.0.2.2 (February 11, 2022) ##
170
-
171
- * No changes.
172
-
173
-
174
- ## Rails 7.0.2.1 (February 11, 2022) ##
175
-
176
- * No changes.
177
-
178
-
179
- ## Rails 7.0.2 (February 08, 2022) ##
180
-
181
- * Ensure `preload_link_tag` preloads JavaScript modules correctly.
182
-
183
- *Máximo Mussini*
184
-
185
- * Fix `stylesheet_link_tag` and similar helpers are being used to work in objects with
186
- a `response` method.
187
-
188
- *dark-panda*
189
-
190
-
191
- ## Rails 7.0.1 (January 06, 2022) ##
156
+ ```erb
157
+ <%= select :post, :author, authors, required: true %>
158
+ ```
192
159
 
193
- * Fix `button_to` to work with a hash parameter as URL.
160
+ Instead you needed to do this:
194
161
 
195
- *MingyuanQin*
162
+ ```erb
163
+ <%= select :post, :author, authors, {}, required: true %>
164
+ ```
196
165
 
197
- * Fix `link_to` with a model passed as an argument twice.
166
+ Now, either form is accepted, for the following HTML attributes: `required`, `multiple`, `size`.
198
167
 
199
168
  *Alex Ghiculescu*
200
169
 
170
+ * Datetime form helpers (`time_field`, `date_field`, `datetime_field`, `week_field`, `month_field`) now accept an instance of Time/Date/DateTime as `:value` option.
201
171
 
202
- ## Rails 7.0.0 (December 15, 2021) ##
203
-
204
- * Support `include_hidden:` option in calls to
205
- `ActionView::Helper::FormBuilder#file_field` with `multiple: true` to
206
- support submitting an empty collection of files.
207
-
208
- ```ruby
209
- form.file_field :attachments, multiple: true
210
- # => <input type="hidden" autocomplete="off" name="post[attachments][]" value="">
211
- <input type="file" multiple="multiple" id="post_attachments" name="post[attachments][]">
212
-
213
- form.file_field :attachments, multiple: true, include_hidden: false
214
- # => <input type="file" multiple="multiple" id="post_attachments" name="post[attachments][]">
172
+ Before:
173
+ ```erb
174
+ <%= form.datetime_field :written_at, value: Time.current.strftime("%Y-%m-%dT%T") %>
215
175
  ```
216
176
 
217
- *Sean Doyle*
218
-
219
- * Fix `number_with_precision(raise: true)` always raising even on valid numbers.
220
-
221
- *Pedro Moreira*
177
+ After:
178
+ ```erb
179
+ <%= form.datetime_field :written_at, value: Time.current %>
180
+ ```
222
181
 
182
+ *Andrey Samsonov*
223
183
 
224
- ## Rails 7.0.0.rc3 (December 14, 2021) ##
184
+ * Choices of `select` can optionally contain html attributes as the last element
185
+ of the child arrays when using grouped/nested collections
225
186
 
226
- * No changes.
187
+ ```erb
188
+ <%= form.select :foo, [["North America", [["United States","US"],["Canada","CA"]], { disabled: "disabled" }]] %>
189
+ # => <select><optgroup label="North America" disabled="disabled"><option value="US">United States</option><option value="CA">Canada</option></optgroup></select>
190
+ ```
227
191
 
192
+ *Chris Gunther*
228
193
 
229
- ## Rails 7.0.0.rc2 (December 14, 2021) ##
194
+ * `check_box_tag` and `radio_button_tag` now accept `checked` as a keyword argument
230
195
 
231
- * No changes.
196
+ This is to make the API more consistent with the `FormHelper` variants. You can now
197
+ provide `checked` as a positional or keyword argument:
232
198
 
233
- ## Rails 7.0.0.rc1 (December 06, 2021) ##
199
+ ```erb
200
+ = check_box_tag "admin", "1", false
201
+ = check_box_tag "admin", "1", checked: false
234
202
 
235
- * Support `fields model: [@nested, @model]` the same way as `form_with model:
236
- [@nested, @model]`.
203
+ = radio_button_tag 'favorite_color', 'maroon', false
204
+ = radio_button_tag 'favorite_color', 'maroon', checked: false
205
+ ```
237
206
 
238
- *Sean Doyle*
207
+ *Alex Ghiculescu*
239
208
 
240
- * Infer HTTP verb `[method]` from a model or Array with model as the first
241
- argument to `button_to` when combined with a block:
209
+ * Allow passing a class to `dom_id`.
210
+ You no longer need to call `new` when passing a class to `dom_id`.
211
+ This makes `dom_id` behave like `dom_class` in this regard.
212
+ Apart from saving a few keystrokes, it prevents Ruby from needing
213
+ to instantiate a whole new object just to generate a string.
242
214
 
215
+ Before:
243
216
  ```ruby
244
- button_to(Workshop.find(1)){ "Update" }
245
- #=> <form method="post" action="/workshops/1" class="button_to">
246
- #=> <input type="hidden" name="_method" value="patch" autocomplete="off" />
247
- #=> <button type="submit">Update</button>
248
- #=> </form>
249
-
250
- button_to([ Workshop.find(1), Session.find(1) ]) { "Update" }
251
- #=> <form method="post" action="/workshops/1/sessions/1" class="button_to">
252
- #=> <input type="hidden" name="_method" value="patch" autocomplete="off" />
253
- #=> <button type="submit">Update</button>
254
- #=> </form>
217
+ dom_id(Post) # => NoMethodError: undefined method `to_key' for Post:Class
255
218
  ```
256
219
 
257
- *Sean Doyle*
258
-
259
- * Support passing a Symbol as the first argument to `FormBuilder#button`:
260
-
220
+ After:
261
221
  ```ruby
262
- form.button(:draft, value: true)
263
- # => <button name="post[draft]" value="true" type="submit">Create post</button>
264
-
265
- form.button(:draft, value: true) do
266
- content_tag(:strong, "Save as draft")
267
- end
268
- # => <button name="post[draft]" value="true" type="submit">
269
- # <strong>Save as draft</strong>
270
- # </button>
222
+ dom_id(Post) # => "new_post"
271
223
  ```
272
224
 
273
- *Sean Doyle*
225
+ *Goulven Champenois*
274
226
 
275
- * Introduce the `field_name` view helper, along with the
276
- `FormBuilder#field_name` counterpart:
227
+ * Report `:locals` as part of the data returned by ActionView render instrumentation.
277
228
 
229
+ Before:
278
230
  ```ruby
279
- form_for @post do |f|
280
- f.field_tag :tag, name: f.field_name(:tag, multiple: true)
281
- # => <input type="text" name="post[tag][]">
282
- end
231
+ {
232
+ identifier: "/Users/adam/projects/notifications/app/views/posts/index.html.erb",
233
+ layout: "layouts/application"
234
+ }
283
235
  ```
284
236
 
285
- *Sean Doyle*
286
-
287
- * Execute the `ActionView::Base.field_error_proc` within the context of the
288
- `ActionView::Base` instance:
289
-
237
+ After:
290
238
  ```ruby
291
- config.action_view.field_error_proc = proc { |html| content_tag(:div, html, class: "field_with_errors") }
239
+ {
240
+ identifier: "/Users/adam/projects/notifications/app/views/posts/index.html.erb",
241
+ layout: "layouts/application",
242
+ locals: {foo: "bar"}
243
+ }
292
244
  ```
293
245
 
294
- *Sean Doyle*
246
+ *Aaron Gough*
295
247
 
296
- * Add support for `button_to ..., authenticity_token: false`
248
+ * Strip `break_sequence` at the end of `word_wrap`.
297
249
 
298
- ```ruby
299
- button_to "Create", Post.new, authenticity_token: false
300
- # => <form class="button_to" method="post" action="/posts"><button type="submit">Create</button></form>
250
+ This fixes a bug where `word_wrap` didn't properly strip off break sequences that had printable characters.
301
251
 
302
- button_to "Create", Post.new, authenticity_token: true
303
- # => <form class="button_to" method="post" action="/posts"><button type="submit">Create</button><input type="hidden" name="form_token" value="abc123..." autocomplete="off" /></form>
252
+ For example, compare the outputs of this template:
304
253
 
305
- button_to "Create", Post.new, authenticity_token: "secret"
306
- # => <form class="button_to" method="post" action="/posts"><button type="submit">Create</button><input type="hidden" name="form_token" value="secret" autocomplete="off" /></form>
254
+ ```erb
255
+ # <%= word_wrap("11 22\n33 44", line_width: 2, break_sequence: "\n# ") %>
307
256
  ```
308
257
 
309
- *Sean Doyle*
310
-
311
- * Support rendering `<form>` elements _without_ `[action]` attributes by:
258
+ Before:
312
259
 
313
- * `form_with url: false` or `form_with ..., html: { action: false }`
314
- * `form_for ..., url: false` or `form_for ..., html: { action: false }`
315
- * `form_tag false` or `form_tag ..., action: false`
316
- * `button_to "...", false` or `button_to(false) { ... }`
260
+ ```
261
+ # 11
262
+ # 22
263
+ #
264
+ # 33
265
+ # 44
266
+ #
267
+ ```
317
268
 
318
- *Sean Doyle*
269
+ After:
319
270
 
320
- * Add `:day_format` option to `date_select`
271
+ ```
272
+ # 11
273
+ # 22
274
+ # 33
275
+ # 44
276
+ ```
321
277
 
322
- date_select("article", "written_on", day_format: ->(day) { day.ordinalize })
323
- # generates day options like <option value="1">1st</option>\n<option value="2">2nd</option>...
278
+ *Max Chernyak*
324
279
 
325
- *Shunichi Ikegami*
280
+ * Allow templates to set strict `locals`.
326
281
 
327
- * Allow `link_to` helper to infer link name from `Model#to_s` when it
328
- is used with a single argument:
282
+ By default, templates will accept any `locals` as keyword arguments. To define what `locals` a template accepts, add a `locals` magic comment:
329
283
 
330
- link_to @profile
331
- #=> <a href="/profiles/1">Eileen</a>
284
+ ```erb
285
+ <%# locals: (message:) -%>
286
+ <%= message %>
287
+ ```
332
288
 
333
- This assumes the model class implements a `to_s` method like this:
289
+ Default values can also be provided:
334
290
 
335
- class Profile < ApplicationRecord
336
- # ...
337
- def to_s
338
- name
339
- end
340
- end
291
+ ```erb
292
+ <%# locals: (message: "Hello, world!") -%>
293
+ <%= message %>
294
+ ```
341
295
 
342
- Previously you had to supply a second argument even if the `Profile`
343
- model implemented a `#to_s` method that called the `name` method.
296
+ Or `locals` can be disabled entirely:
344
297
 
345
- link_to @profile, @profile.name
346
- #=> <a href="/profiles/1">Eileen</a>
298
+ ```erb
299
+ <%# locals: () %>
300
+ ```
347
301
 
348
- *Olivier Lacan*
302
+ *Joel Hawksley*
349
303
 
350
- * Support svg unpaired tags for `tag` helper.
304
+ * Add `include_seconds` option for `datetime_local_field`
351
305
 
352
- tag.svg { tag.use('href' => "#cool-icon") }
353
- # => <svg><use href="#cool-icon"></svg>
306
+ This allows to omit seconds part in the input field, by passing `include_seconds: false`
354
307
 
355
- *Oleksii Vasyliev*
308
+ *Wojciech Wnętrzak*
356
309
 
310
+ * Guard against `ActionView::Helpers::FormTagHelper#field_name` calls with nil
311
+ `object_name` arguments. For example:
357
312
 
358
- ## Rails 7.0.0.alpha2 (September 15, 2021) ##
313
+ ```erb
314
+ <%= fields do |f| %>
315
+ <%= f.field_name :body %>
316
+ <% end %>
317
+ ```
359
318
 
360
- * No changes.
319
+ *Sean Doyle*
361
320
 
321
+ * Strings returned from `strip_tags` are correctly tagged `html_safe?`
362
322
 
363
- ## Rails 7.0.0.alpha1 (September 15, 2021) ##
323
+ Because these strings contain no HTML elements and the basic entities are escaped, they are safe
324
+ to be included as-is as PCDATA in HTML content. Tagging them as html-safe avoids double-escaping
325
+ entities when being concatenated to a SafeBuffer during rendering.
364
326
 
365
- * Improves the performance of ActionView::Helpers::NumberHelper formatters by avoiding the use of
366
- exceptions as flow control.
327
+ Fixes [rails/rails-html-sanitizer#124](https://github.com/rails/rails-html-sanitizer/issues/124)
367
328
 
368
329
  *Mike Dalessio*
369
330
 
370
- * `preload_link_tag` properly inserts `as` attributes for files with `image` MIME types, such as JPG or SVG.
371
-
372
- *Nate Berkopec*
373
-
374
- * Add `weekday_options_for_select` and `weekday_select` helper methods. Also adds `weekday_select` to `FormBuilder`.
375
-
376
- *Drew Bragg*, *Dana Kashubeck*, *Kasper Timm Hansen*
377
-
378
- * Add `caching?` helper that returns whether the current code path is being cached and `uncacheable!` to denote helper methods that can't participate in fragment caching.
379
-
380
- *Ben Toews*, *John Hawthorn*, *Kasper Timm Hansen*, *Joel Hawksley*
381
-
382
- * Add `include_seconds` option for `time_field`.
383
-
384
- <%= form.time_field :foo, include_seconds: false %>
385
- # => <input value="16:22" type="time" />
386
-
387
- Default includes seconds:
388
-
389
- <%= form.time_field :foo %>
390
- # => <input value="16:22:01.440" type="time" />
391
-
392
- This allows you to take advantage of [different rendering options](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/input/time#time_value_format) in some browsers.
393
-
394
- *Alex Ghiculescu*
331
+ * Move `convert_to_model` call from `form_for` into `form_with`
395
332
 
396
- * Improve error messages when template file does not exist at absolute filepath.
333
+ Now that `form_for` is implemented in terms of `form_with`, remove the
334
+ `convert_to_model` call from `form_for`.
397
335
 
398
- *Ted Whang*
399
-
400
- * Add `:country_code` option to `sms_to` for consistency with `phone_to`.
401
-
402
- *Jonathan Hefner*
403
-
404
- * OpenSSL constants are now used for Digest computations.
336
+ *Sean Doyle*
405
337
 
406
- *Dirkjan Bussink*
338
+ * Fix and add protections for XSS in `ActionView::Helpers` and `ERB::Util`.
407
339
 
408
- * The `translate` helper now passes `default` values that aren't
409
- translation keys through `I18n.translate` for interpolation.
340
+ Escape dangerous characters in names of tags and names of attributes in the
341
+ tag helpers, following the XML specification. Rename the option
342
+ `:escape_attributes` to `:escape`, to simplify by applying the option to the
343
+ whole tag.
410
344
 
411
- *Jonathan Hefner*
345
+ *Álvaro Martín Fraguas*
412
346
 
413
- * Adds option `extname` to `stylesheet_link_tag` to skip default
414
- `.css` extension appended to the stylesheet path.
347
+ * Extend audio_tag and video_tag to accept Active Storage attachments.
415
348
 
416
- Before:
349
+ Now it's possible to write
417
350
 
418
351
  ```ruby
419
- stylesheet_link_tag "style.less"
420
- # <link href="/stylesheets/style.less.scss" rel="stylesheet">
352
+ audio_tag(user.audio_file)
353
+ video_tag(user.video_file)
421
354
  ```
422
355
 
423
- After:
356
+ Instead of
424
357
 
425
358
  ```ruby
426
- stylesheet_link_tag "style.less", extname: false, skip_pipeline: true, rel: "stylesheet/less"
427
- # <link href="/stylesheets/style.less" rel="stylesheet/less">
359
+ audio_tag(polymorphic_path(user.audio_file))
360
+ video_tag(polymorphic_path(user.video_file))
428
361
  ```
429
362
 
430
- *Abhay Nikam*
431
-
432
- * Deprecate `render` locals to be assigned to instance variables.
433
-
434
- *Petrik de Heus*
363
+ `image_tag` already supported that, so this follows the same pattern.
435
364
 
436
- * Remove legacy default `media=screen` from `stylesheet_link_tag`.
365
+ *Matheus Richard*
437
366
 
438
- *André Luis Leal Cardoso Junior*
439
-
440
- * Change `ActionView::Helpers::FormBuilder#button` to transform `formmethod`
441
- attributes into `_method="$VERB"` Form Data to enable varied same-form actions:
442
-
443
- <%= form_with model: post, method: :put do %>
444
- <%= form.button "Update" %>
445
- <%= form.button "Delete", formmethod: :delete %>
446
- <% end %>
447
- <%# => <form action="posts/1">
448
- => <input type="hidden" name="_method" value="put">
449
- => <button type="submit">Update</button>
450
- => <button type="submit" formmethod="post" name="_method" value="delete">Delete</button>
451
- => </form>
452
- %>
453
-
454
- *Sean Doyle*
455
-
456
- * Change `ActionView::Helpers::UrlHelper#button_to` to *always* render a
457
- `<button>` element, regardless of whether or not the content is passed as
458
- the first argument or as a block.
459
-
460
- <%= button_to "Delete", post_path(@post), method: :delete %>
461
- # => <form action="/posts/1"><input type="hidden" name="_method" value="delete"><button type="submit">Delete</button></form>
462
-
463
- <%= button_to post_path(@post), method: :delete do %>
464
- Delete
465
- <% end %>
466
- # => <form action="/posts/1"><input type="hidden" name="_method" value="delete"><button type="submit">Delete</button></form>
467
-
468
- *Sean Doyle*, *Dusan Orlovic*
469
-
470
- * Add `config.action_view.preload_links_header` to allow disabling of
471
- the `Link` header being added by default when using `stylesheet_link_tag`
472
- and `javascript_include_tag`.
473
-
474
- *Andrew White*
475
-
476
- * The `translate` helper now resolves `default` values when a `nil` key is
477
- specified, instead of always returning `nil`.
478
-
479
- *Jonathan Hefner*
480
-
481
- * Add `config.action_view.image_loading` to configure the default value of
482
- the `image_tag` `:loading` option.
483
-
484
- By setting `config.action_view.image_loading = "lazy"`, an application can opt in to
485
- lazy loading images sitewide, without changing view code.
486
-
487
- *Jonathan Hefner*
488
-
489
- * `ActionView::Helpers::FormBuilder#id` returns the value
490
- of the `<form>` element's `id` attribute. With a `method` argument, returns
491
- the `id` attribute for a form field with that name.
492
-
493
- <%= form_for @post do |f| %>
494
- <%# ... %>
495
-
496
- <% content_for :sticky_footer do %>
497
- <%= form.button(form: f.id) %>
498
- <% end %>
499
- <% end %>
500
-
501
- *Sean Doyle*
502
-
503
- * `ActionView::Helpers::FormBuilder#field_id` returns the value generated by
504
- the FormBuilder for the given attribute name.
505
-
506
- <%= form_for @post do |f| %>
507
- <%= f.label :title %>
508
- <%= f.text_field :title, aria: { describedby: f.field_id(:title, :error) } %>
509
- <%= tag.span("is blank", id: f.field_id(:title, :error) %>
510
- <% end %>
511
-
512
- *Sean Doyle*
513
-
514
- * Add `tag.attributes` to transform a Hash into HTML Attributes, ready to be
515
- interpolated into ERB.
516
-
517
- <input <%= tag.attributes(type: :text, aria: { label: "Search" }) %> >
518
- # => <input type="text" aria-label="Search">
367
+ * Ensure models passed to `form_for` attempt to call `to_model`.
519
368
 
520
369
  *Sean Doyle*
521
370
 
522
-
523
- Please check [6-1-stable](https://github.com/rails/rails/blob/6-1-stable/actionview/CHANGELOG.md) for previous changes.
371
+ Please check [7-0-stable](https://github.com/rails/rails/blob/7-0-stable/actionview/CHANGELOG.md) for previous changes.