actionview 7.0.8 → 7.1.0

Sign up to get free protection for your applications and to get access to all the features.
Files changed (90) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +255 -346
  3. data/MIT-LICENSE +1 -1
  4. data/README.rdoc +1 -1
  5. data/app/assets/javascripts/rails-ujs.esm.js +668 -0
  6. data/app/assets/javascripts/rails-ujs.js +606 -0
  7. data/lib/action_view/base.rb +33 -12
  8. data/lib/action_view/buffers.rb +106 -8
  9. data/lib/action_view/cache_expiry.rb +40 -43
  10. data/lib/action_view/context.rb +1 -1
  11. data/lib/action_view/deprecator.rb +7 -0
  12. data/lib/action_view/digestor.rb +1 -1
  13. data/lib/action_view/gem_version.rb +3 -3
  14. data/lib/action_view/helpers/active_model_helper.rb +1 -1
  15. data/lib/action_view/helpers/asset_tag_helper.rb +130 -46
  16. data/lib/action_view/helpers/asset_url_helper.rb +6 -5
  17. data/lib/action_view/helpers/atom_feed_helper.rb +5 -5
  18. data/lib/action_view/helpers/cache_helper.rb +3 -9
  19. data/lib/action_view/helpers/capture_helper.rb +24 -10
  20. data/lib/action_view/helpers/content_exfiltration_prevention_helper.rb +70 -0
  21. data/lib/action_view/helpers/controller_helper.rb +6 -0
  22. data/lib/action_view/helpers/csp_helper.rb +2 -2
  23. data/lib/action_view/helpers/csrf_helper.rb +2 -2
  24. data/lib/action_view/helpers/date_helper.rb +17 -19
  25. data/lib/action_view/helpers/debug_helper.rb +3 -3
  26. data/lib/action_view/helpers/form_helper.rb +44 -19
  27. data/lib/action_view/helpers/form_options_helper.rb +2 -1
  28. data/lib/action_view/helpers/form_tag_helper.rb +43 -9
  29. data/lib/action_view/helpers/javascript_helper.rb +1 -0
  30. data/lib/action_view/helpers/number_helper.rb +2 -1
  31. data/lib/action_view/helpers/output_safety_helper.rb +2 -2
  32. data/lib/action_view/helpers/rendering_helper.rb +1 -1
  33. data/lib/action_view/helpers/sanitize_helper.rb +33 -14
  34. data/lib/action_view/helpers/tag_helper.rb +5 -27
  35. data/lib/action_view/helpers/tags/base.rb +11 -52
  36. data/lib/action_view/helpers/tags/collection_check_boxes.rb +1 -0
  37. data/lib/action_view/helpers/tags/collection_radio_buttons.rb +1 -0
  38. data/lib/action_view/helpers/tags/collection_select.rb +3 -0
  39. data/lib/action_view/helpers/tags/date_field.rb +1 -1
  40. data/lib/action_view/helpers/tags/date_select.rb +2 -0
  41. data/lib/action_view/helpers/tags/datetime_field.rb +14 -6
  42. data/lib/action_view/helpers/tags/datetime_local_field.rb +11 -2
  43. data/lib/action_view/helpers/tags/grouped_collection_select.rb +3 -0
  44. data/lib/action_view/helpers/tags/month_field.rb +1 -1
  45. data/lib/action_view/helpers/tags/select.rb +3 -0
  46. data/lib/action_view/helpers/tags/select_renderer.rb +56 -0
  47. data/lib/action_view/helpers/tags/time_field.rb +1 -1
  48. data/lib/action_view/helpers/tags/time_zone_select.rb +3 -0
  49. data/lib/action_view/helpers/tags/week_field.rb +1 -1
  50. data/lib/action_view/helpers/tags/weekday_select.rb +3 -0
  51. data/lib/action_view/helpers/tags.rb +2 -0
  52. data/lib/action_view/helpers/text_helper.rb +32 -16
  53. data/lib/action_view/helpers/translation_helper.rb +3 -3
  54. data/lib/action_view/helpers/url_helper.rb +41 -14
  55. data/lib/action_view/helpers.rb +2 -0
  56. data/lib/action_view/layouts.rb +6 -4
  57. data/lib/action_view/log_subscriber.rb +49 -32
  58. data/lib/action_view/lookup_context.rb +29 -13
  59. data/lib/action_view/path_registry.rb +57 -0
  60. data/lib/action_view/path_set.rb +13 -14
  61. data/lib/action_view/railtie.rb +26 -3
  62. data/lib/action_view/record_identifier.rb +15 -8
  63. data/lib/action_view/renderer/abstract_renderer.rb +1 -1
  64. data/lib/action_view/renderer/collection_renderer.rb +9 -1
  65. data/lib/action_view/renderer/partial_renderer/collection_caching.rb +2 -1
  66. data/lib/action_view/renderer/partial_renderer.rb +2 -1
  67. data/lib/action_view/renderer/renderer.rb +2 -0
  68. data/lib/action_view/renderer/streaming_template_renderer.rb +3 -2
  69. data/lib/action_view/renderer/template_renderer.rb +3 -2
  70. data/lib/action_view/rendering.rb +22 -4
  71. data/lib/action_view/ripper_ast_parser.rb +6 -6
  72. data/lib/action_view/template/error.rb +14 -1
  73. data/lib/action_view/template/handlers/builder.rb +4 -4
  74. data/lib/action_view/template/handlers/erb/erubi.rb +23 -27
  75. data/lib/action_view/template/handlers/erb.rb +73 -1
  76. data/lib/action_view/template/handlers.rb +1 -1
  77. data/lib/action_view/template/html.rb +1 -1
  78. data/lib/action_view/template/raw_file.rb +1 -1
  79. data/lib/action_view/template/renderable.rb +1 -1
  80. data/lib/action_view/template/resolver.rb +10 -2
  81. data/lib/action_view/template/text.rb +1 -1
  82. data/lib/action_view/template/types.rb +25 -34
  83. data/lib/action_view/template.rb +227 -53
  84. data/lib/action_view/template_path.rb +2 -0
  85. data/lib/action_view/test_case.rb +174 -21
  86. data/lib/action_view/unbound_template.rb +15 -5
  87. data/lib/action_view/version.rb +1 -1
  88. data/lib/action_view/view_paths.rb +15 -24
  89. data/lib/action_view.rb +4 -1
  90. metadata +23 -23
data/CHANGELOG.md CHANGED
@@ -1,493 +1,402 @@
1
- ## Rails 7.0.8 (September 09, 2023) ##
2
-
3
- * Fix `form_for` missing the hidden `_method` input for models with a
4
- namespaced route.
5
-
6
- *Hartley McGuire*
7
-
8
- * Fix `render collection: @records, cache: true` inside `jbuilder` templates
9
-
10
- The previous fix that shipped in `7.0.7` assumed template fragments are always strings,
11
- this isn't true with `jbuilder`.
12
-
13
- *Jean Boussier*
14
-
15
- ## Rails 7.0.7.2 (August 22, 2023) ##
1
+ ## Rails 7.1.0 (October 05, 2023) ##
16
2
 
17
3
  * No changes.
18
4
 
19
5
 
20
- ## Rails 7.0.7.1 (August 22, 2023) ##
6
+ ## Rails 7.1.0.rc2 (October 01, 2023) ##
21
7
 
22
8
  * No changes.
23
9
 
24
10
 
25
- ## Rails 7.0.7 (August 09, 2023) ##
26
-
27
- * Fix `render collection: @records, cache: true` to cache fragments as bare strings
28
-
29
- Previously it would incorrectly cache them as Action View buffers.
30
-
31
- *Jean Boussier*
32
-
33
- * Don't double-encode nested `field_id` and `field_name` index values
34
-
35
- Pass `index: @options` as a default keyword argument to `field_id` and
36
- `field_name` view helper methods.
11
+ ## Rails 7.1.0.rc1 (September 27, 2023) ##
37
12
 
38
- *Sean Doyle*
13
+ * Introduce `ActionView::TestCase.register_parser`
39
14
 
15
+ ```ruby
16
+ register_parser :rss, -> rendered { RSS::Parser.parse(rendered) }
40
17
 
41
- ## Rails 7.0.6 (June 29, 2023) ##
18
+ test "renders RSS" do
19
+ article = Article.create!(title: "Hello, world")
42
20
 
43
- * No changes.
21
+ render formats: :rss, partial: article
44
22
 
23
+ assert_equal "Hello, world", rendered.rss.items.last.title
24
+ end
25
+ ```
45
26
 
46
- ## Rails 7.0.5.1 (June 26, 2023) ##
27
+ By default, register parsers for `:html` and `:json`.
47
28
 
48
- * No changes.
29
+ *Sean Doyle*
49
30
 
50
31
 
51
- ## Rails 7.0.5 (May 24, 2023) ##
32
+ ## Rails 7.1.0.beta1 (September 13, 2023) ##
52
33
 
53
- * `FormBuilder#id` finds id set by `form_for` and `form_with`.
34
+ * Fix `simple_format` with blank `wrapper_tag` option returns plain html tag
54
35
 
55
- *Matt Polito*
36
+ By default `simple_format` method returns the text wrapped with `<p>`. But if we explicitly specify
37
+ the `wrapper_tag: nil` in the options, it returns the text wrapped with `<></>` tag.
56
38
 
57
- * Allow all available locales for template lookups.
39
+ Before:
58
40
 
59
- *Ben Dilley*
41
+ ```ruby
42
+ simple_format("Hello World", {}, { wrapper_tag: nil })
43
+ # <>Hello World</>
44
+ ```
60
45
 
61
- * Choices of `select` can optionally contain html attributes as the last element
62
- of the child arrays when using grouped/nested collections
46
+ After:
63
47
 
64
- ```erb
65
- <%= form.select :foo, [["North America", [["United States","US"],["Canada","CA"]], { disabled: "disabled" }]] %>
66
- # => <select><optgroup label="North America" disabled="disabled"><option value="US">United States</option><option value="CA">Canada</option></optgroup></select>
48
+ ```ruby
49
+ simple_format("Hello World", {}, { wrapper_tag: nil })
50
+ # <p>Hello World</p>
67
51
  ```
68
52
 
69
- *Chris Gunther*
53
+ *Akhil G Krishnan*, *Junichi Ito*
70
54
 
55
+ * Don't double-encode nested `field_id` and `field_name` index values
71
56
 
72
- ## Rails 7.0.4.3 (March 13, 2023) ##
57
+ Pass `index: @options` as a default keyword argument to `field_id` and
58
+ `field_name` view helper methods.
73
59
 
74
- * Ignore certain data-* attributes in rails-ujs when element is contenteditable
60
+ *Sean Doyle*
75
61
 
76
- [CVE-2023-23913]
62
+ * Allow opting in/out of `Link preload` headers when calling `stylesheet_link_tag` or `javascript_include_tag`
77
63
 
64
+ ```ruby
65
+ # will exclude header, even if setting is enabled:
66
+ javascript_include_tag("http://example.com/all.js", preload_links_header: false)
78
67
 
79
- ## Rails 7.0.4.2 (January 24, 2023) ##
68
+ # will include header, even if setting is disabled:
69
+ stylesheet_link_tag("http://example.com/all.js", preload_links_header: true)
70
+ ```
80
71
 
81
- * No changes.
72
+ *Alex Ghiculescu*
82
73
 
74
+ * Stop generating `Link preload` headers once it has reached 1KB.
83
75
 
84
- ## Rails 7.0.4.1 (January 17, 2023) ##
76
+ Some proxies have trouble handling large headers, but more importantly preload links
77
+ have diminishing returns so it's preferable not to go overboard with them.
85
78
 
86
- * No changes.
79
+ If tighter control is needed, it's recommended to disable automatic generation of preloads
80
+ and to generate them manually from the controller or from a middleware.
87
81
 
82
+ *Jean Boussier*
88
83
 
89
- ## Rails 7.0.4 (September 09, 2022) ##
84
+ * `simple_format` helper now handles a `:sanitize_options` - any extra options you want appending to the sanitize.
90
85
 
91
- * Guard against `ActionView::Helpers::FormTagHelper#field_name` calls with nil
92
- `object_name` arguments. For example:
86
+ Before:
87
+ ```ruby
88
+ simple_format("<a target=\"_blank\" href=\"http://example.com\">Continue</a>")
89
+ # => "<p><a href=\"http://example.com\">Continue</a></p>"
90
+ ```
93
91
 
94
- ```erb
95
- <%= fields do |f| %>
96
- <%= f.field_name :body %>
97
- <% end %>
92
+ After:
93
+ ```ruby
94
+ simple_format("<a target=\"_blank\" href=\"http://example.com\">Continue</a>", {}, { sanitize_options: { attributes: %w[target href] } })
95
+ # => "<p><a target=\"_blank\" href=\"http://example.com\">Continue</a></p>"
98
96
  ```
99
97
 
100
- *Sean Doyle*
98
+ *Andrei Andriichuk*
101
99
 
102
- * Strings returned from `strip_tags` are correctly tagged `html_safe?`
100
+ * Add support for HTML5 standards-compliant sanitizers, and default to `Rails::HTML5::Sanitizer`
101
+ in the Rails 7.1 configuration if it is supported.
103
102
 
104
- Because these strings contain no HTML elements and the basic entities are escaped, they are safe
105
- to be included as-is as PCDATA in HTML content. Tagging them as html-safe avoids double-escaping
106
- entities when being concatenated to a SafeBuffer during rendering.
103
+ Action View's HTML sanitizers can be configured by setting
104
+ `config.action_view.sanitizer_vendor`. Supported values are `Rails::HTML4::Sanitizer` or
105
+ `Rails::HTML5::Sanitizer`.
107
106
 
108
- Fixes [rails/rails-html-sanitizer#124](https://github.com/rails/rails-html-sanitizer/issues/124)
107
+ The Rails 7.1 configuration will set this to `Rails::HTML5::Sanitizer` when it is supported, and
108
+ fall back to `Rails::HTML4::Sanitizer`. Previous configurations default to
109
+ `Rails::HTML4::Sanitizer`.
109
110
 
110
111
  *Mike Dalessio*
111
112
 
112
- ## Rails 7.0.3.1 (July 12, 2022) ##
113
-
114
- * No changes.
115
-
116
-
117
- ## Rails 7.0.3 (May 09, 2022) ##
118
-
119
- * Ensure models passed to `form_for` attempt to call `to_model`.
120
-
121
- *Sean Doyle*
122
-
123
- ## Rails 7.0.2.4 (April 26, 2022) ##
113
+ * `config.dom_testing_default_html_version` controls the HTML parser used by
114
+ `ActionView::TestCase#document_root_element`, which creates the DOM used by the assertions in
115
+ Rails::Dom::Testing.
124
116
 
125
- * Fix and add protections for XSS in `ActionView::Helpers` and `ERB::Util`.
126
-
127
- Escape dangerous characters in names of tags and names of attributes in the
128
- tag helpers, following the XML specification. Rename the option
129
- `:escape_attributes` to `:escape`, to simplify by applying the option to the
130
- whole tag.
131
-
132
- *Álvaro Martín Fraguas*
133
-
134
- ## Rails 7.0.2.3 (March 08, 2022) ##
117
+ The Rails 7.1 default configuration opts into the HTML5 parser when it is supported, to better
118
+ represent what the DOM would be in a browser user agent. Previously this test helper always used
119
+ Nokogiri's HTML4 parser.
135
120
 
136
- * No changes.
121
+ *Mike Dalessio*
137
122
 
123
+ * Add support for the HTML picture tag. It supports passing a String, an Array or a Block.
124
+ Supports passing properties directly to the img tag via the `:image` key.
125
+ Since the picture tag requires an img tag, the last element you provide will be used for the img tag.
126
+ For complete control over the picture tag, a block can be passed, which will populate the contents of the tag accordingly.
138
127
 
139
- ## Rails 7.0.2.2 (February 11, 2022) ##
128
+ Can be used like this for a single source:
129
+ ```erb
130
+ <%= picture_tag("picture.webp") %>
131
+ ```
132
+ which will generate the following:
133
+ ```html
134
+ <picture>
135
+ <img src="/images/picture.webp" />
136
+ </picture>
137
+ ```
140
138
 
141
- * No changes.
139
+ For multiple sources:
140
+ ```erb
141
+ <%= picture_tag("picture.webp", "picture.png", :class => "mt-2", :image => { alt: "Image", class: "responsive-img" }) %>
142
+ ```
143
+ will generate:
144
+ ```html
145
+ <picture class="mt-2">
146
+ <source srcset="/images/picture.webp" />
147
+ <source srcset="/images/picture.png" />
148
+ <img alt="Image" class="responsive-img" src="/images/picture.png" />
149
+ </picture>
150
+ ```
142
151
 
152
+ Full control via a block:
153
+ ```erb
154
+ <%= picture_tag(:class => "my-class") do %>
155
+ <%= tag(:source, :srcset => image_path("picture.webp")) %>
156
+ <%= tag(:source, :srcset => image_path("picture.png")) %>
157
+ <%= image_tag("picture.png", :alt => "Image") %>
158
+ <% end %>
159
+ ```
160
+ will generate:
161
+ ```html
162
+ <picture class="my-class">
163
+ <source srcset="/images/picture.webp" />
164
+ <source srcset="/images/picture.png" />
165
+ <img alt="Image" src="/images/picture.png" />
166
+ </picture>
167
+ ```
143
168
 
144
- ## Rails 7.0.2.1 (February 11, 2022) ##
169
+ *Juan Pablo Balarini*
145
170
 
146
- * No changes.
171
+ * Remove deprecated support to passing instance variables as locals to partials.
147
172
 
173
+ *Rafael Mendonça França*
148
174
 
149
- ## Rails 7.0.2 (February 08, 2022) ##
175
+ * Remove deprecated constant `ActionView::Path`.
150
176
 
151
- * Ensure `preload_link_tag` preloads JavaScript modules correctly.
177
+ *Rafael Mendonça França*
152
178
 
153
- *Máximo Mussini*
179
+ * Guard `token_list` calls from escaping HTML too often
154
180
 
155
- * Fix `stylesheet_link_tag` and similar helpers are being used to work in objects with
156
- a `response` method.
181
+ *Sean Doyle*
157
182
 
158
- *dark-panda*
183
+ * `select` can now be called with a single hash containing options and some HTML options
159
184
 
185
+ Previously this would not work as expected:
160
186
 
161
- ## Rails 7.0.1 (January 06, 2022) ##
187
+ ```erb
188
+ <%= select :post, :author, authors, required: true %>
189
+ ```
162
190
 
163
- * Fix `button_to` to work with a hash parameter as URL.
191
+ Instead you needed to do this:
164
192
 
165
- *MingyuanQin*
193
+ ```erb
194
+ <%= select :post, :author, authors, {}, required: true %>
195
+ ```
166
196
 
167
- * Fix `link_to` with a model passed as an argument twice.
197
+ Now, either form is accepted, for the following HTML attributes: `required`, `multiple`, `size`.
168
198
 
169
199
  *Alex Ghiculescu*
170
200
 
201
+ * Datetime form helpers (`time_field`, `date_field`, `datetime_field`, `week_field`, `month_field`) now accept an instance of Time/Date/DateTime as `:value` option.
171
202
 
172
- ## Rails 7.0.0 (December 15, 2021) ##
173
-
174
- * Support `include_hidden:` option in calls to
175
- `ActionView::Helper::FormBuilder#file_field` with `multiple: true` to
176
- support submitting an empty collection of files.
177
-
178
- ```ruby
179
- form.file_field :attachments, multiple: true
180
- # => <input type="hidden" autocomplete="off" name="post[attachments][]" value="">
181
- <input type="file" multiple="multiple" id="post_attachments" name="post[attachments][]">
182
-
183
- form.file_field :attachments, multiple: true, include_hidden: false
184
- # => <input type="file" multiple="multiple" id="post_attachments" name="post[attachments][]">
203
+ Before:
204
+ ```erb
205
+ <%= form.datetime_field :written_at, value: Time.current.strftime("%Y-%m-%dT%T") %>
185
206
  ```
186
207
 
187
- *Sean Doyle*
188
-
189
- * Fix `number_with_precision(raise: true)` always raising even on valid numbers.
190
-
191
- *Pedro Moreira*
208
+ After:
209
+ ```erb
210
+ <%= form.datetime_field :written_at, value: Time.current %>
211
+ ```
192
212
 
213
+ *Andrey Samsonov*
193
214
 
194
- ## Rails 7.0.0.rc3 (December 14, 2021) ##
215
+ * Choices of `select` can optionally contain html attributes as the last element
216
+ of the child arrays when using grouped/nested collections
195
217
 
196
- * No changes.
218
+ ```erb
219
+ <%= form.select :foo, [["North America", [["United States","US"],["Canada","CA"]], { disabled: "disabled" }]] %>
220
+ # => <select><optgroup label="North America" disabled="disabled"><option value="US">United States</option><option value="CA">Canada</option></optgroup></select>
221
+ ```
197
222
 
223
+ *Chris Gunther*
198
224
 
199
- ## Rails 7.0.0.rc2 (December 14, 2021) ##
225
+ * `check_box_tag` and `radio_button_tag` now accept `checked` as a keyword argument
200
226
 
201
- * No changes.
227
+ This is to make the API more consistent with the `FormHelper` variants. You can now
228
+ provide `checked` as a positional or keyword argument:
202
229
 
203
- ## Rails 7.0.0.rc1 (December 06, 2021) ##
230
+ ```erb
231
+ = check_box_tag "admin", "1", false
232
+ = check_box_tag "admin", "1", checked: false
204
233
 
205
- * Support `fields model: [@nested, @model]` the same way as `form_with model:
206
- [@nested, @model]`.
234
+ = radio_button_tag 'favorite_color', 'maroon', false
235
+ = radio_button_tag 'favorite_color', 'maroon', checked: false
236
+ ```
207
237
 
208
- *Sean Doyle*
238
+ *Alex Ghiculescu*
209
239
 
210
- * Infer HTTP verb `[method]` from a model or Array with model as the first
211
- argument to `button_to` when combined with a block:
240
+ * Allow passing a class to `dom_id`.
241
+ You no longer need to call `new` when passing a class to `dom_id`.
242
+ This makes `dom_id` behave like `dom_class` in this regard.
243
+ Apart from saving a few keystrokes, it prevents Ruby from needing
244
+ to instantiate a whole new object just to generate a string.
212
245
 
246
+ Before:
213
247
  ```ruby
214
- button_to(Workshop.find(1)){ "Update" }
215
- #=> <form method="post" action="/workshops/1" class="button_to">
216
- #=> <input type="hidden" name="_method" value="patch" autocomplete="off" />
217
- #=> <button type="submit">Update</button>
218
- #=> </form>
219
-
220
- button_to([ Workshop.find(1), Session.find(1) ]) { "Update" }
221
- #=> <form method="post" action="/workshops/1/sessions/1" class="button_to">
222
- #=> <input type="hidden" name="_method" value="patch" autocomplete="off" />
223
- #=> <button type="submit">Update</button>
224
- #=> </form>
248
+ dom_id(Post) # => NoMethodError: undefined method `to_key' for Post:Class
225
249
  ```
226
250
 
227
- *Sean Doyle*
228
-
229
- * Support passing a Symbol as the first argument to `FormBuilder#button`:
230
-
251
+ After:
231
252
  ```ruby
232
- form.button(:draft, value: true)
233
- # => <button name="post[draft]" value="true" type="submit">Create post</button>
234
-
235
- form.button(:draft, value: true) do
236
- content_tag(:strong, "Save as draft")
237
- end
238
- # => <button name="post[draft]" value="true" type="submit">
239
- # <strong>Save as draft</strong>
240
- # </button>
253
+ dom_id(Post) # => "new_post"
241
254
  ```
242
255
 
243
- *Sean Doyle*
256
+ *Goulven Champenois*
244
257
 
245
- * Introduce the `field_name` view helper, along with the
246
- `FormBuilder#field_name` counterpart:
258
+ * Report `:locals` as part of the data returned by ActionView render instrumentation.
247
259
 
260
+ Before:
248
261
  ```ruby
249
- form_for @post do |f|
250
- f.field_tag :tag, name: f.field_name(:tag, multiple: true)
251
- # => <input type="text" name="post[tag][]">
252
- end
262
+ {
263
+ identifier: "/Users/adam/projects/notifications/app/views/posts/index.html.erb",
264
+ layout: "layouts/application"
265
+ }
253
266
  ```
254
267
 
255
- *Sean Doyle*
256
-
257
- * Execute the `ActionView::Base.field_error_proc` within the context of the
258
- `ActionView::Base` instance:
259
-
268
+ After:
260
269
  ```ruby
261
- config.action_view.field_error_proc = proc { |html| content_tag(:div, html, class: "field_with_errors") }
270
+ {
271
+ identifier: "/Users/adam/projects/notifications/app/views/posts/index.html.erb",
272
+ layout: "layouts/application",
273
+ locals: {foo: "bar"}
274
+ }
262
275
  ```
263
276
 
264
- *Sean Doyle*
277
+ *Aaron Gough*
265
278
 
266
- * Add support for `button_to ..., authenticity_token: false`
279
+ * Strip `break_sequence` at the end of `word_wrap`.
267
280
 
268
- ```ruby
269
- button_to "Create", Post.new, authenticity_token: false
270
- # => <form class="button_to" method="post" action="/posts"><button type="submit">Create</button></form>
281
+ This fixes a bug where `word_wrap` didn't properly strip off break sequences that had printable characters.
271
282
 
272
- button_to "Create", Post.new, authenticity_token: true
273
- # => <form class="button_to" method="post" action="/posts"><button type="submit">Create</button><input type="hidden" name="form_token" value="abc123..." autocomplete="off" /></form>
283
+ For example, compare the outputs of this template:
274
284
 
275
- button_to "Create", Post.new, authenticity_token: "secret"
276
- # => <form class="button_to" method="post" action="/posts"><button type="submit">Create</button><input type="hidden" name="form_token" value="secret" autocomplete="off" /></form>
285
+ ```erb
286
+ # <%= word_wrap("11 22\n33 44", line_width: 2, break_sequence: "\n# ") %>
277
287
  ```
278
288
 
279
- *Sean Doyle*
280
-
281
- * Support rendering `<form>` elements _without_ `[action]` attributes by:
289
+ Before:
282
290
 
283
- * `form_with url: false` or `form_with ..., html: { action: false }`
284
- * `form_for ..., url: false` or `form_for ..., html: { action: false }`
285
- * `form_tag false` or `form_tag ..., action: false`
286
- * `button_to "...", false` or `button_to(false) { ... }`
291
+ ```
292
+ # 11
293
+ # 22
294
+ #
295
+ # 33
296
+ # 44
297
+ #
298
+ ```
287
299
 
288
- *Sean Doyle*
300
+ After:
289
301
 
290
- * Add `:day_format` option to `date_select`
302
+ ```
303
+ # 11
304
+ # 22
305
+ # 33
306
+ # 44
307
+ ```
291
308
 
292
- date_select("article", "written_on", day_format: ->(day) { day.ordinalize })
293
- # generates day options like <option value="1">1st</option>\n<option value="2">2nd</option>...
309
+ *Max Chernyak*
294
310
 
295
- *Shunichi Ikegami*
311
+ * Allow templates to set strict `locals`.
296
312
 
297
- * Allow `link_to` helper to infer link name from `Model#to_s` when it
298
- is used with a single argument:
313
+ By default, templates will accept any `locals` as keyword arguments. To define what `locals` a template accepts, add a `locals` magic comment:
299
314
 
300
- link_to @profile
301
- #=> <a href="/profiles/1">Eileen</a>
315
+ ```erb
316
+ <%# locals: (message:) -%>
317
+ <%= message %>
318
+ ```
302
319
 
303
- This assumes the model class implements a `to_s` method like this:
320
+ Default values can also be provided:
304
321
 
305
- class Profile < ApplicationRecord
306
- # ...
307
- def to_s
308
- name
309
- end
310
- end
322
+ ```erb
323
+ <%# locals: (message: "Hello, world!") -%>
324
+ <%= message %>
325
+ ```
311
326
 
312
- Previously you had to supply a second argument even if the `Profile`
313
- model implemented a `#to_s` method that called the `name` method.
327
+ Or `locals` can be disabled entirely:
314
328
 
315
- link_to @profile, @profile.name
316
- #=> <a href="/profiles/1">Eileen</a>
329
+ ```erb
330
+ <%# locals: () %>
331
+ ```
317
332
 
318
- *Olivier Lacan*
333
+ *Joel Hawksley*
319
334
 
320
- * Support svg unpaired tags for `tag` helper.
335
+ * Add `include_seconds` option for `datetime_local_field`
321
336
 
322
- tag.svg { tag.use('href' => "#cool-icon") }
323
- # => <svg><use href="#cool-icon"></svg>
337
+ This allows to omit seconds part in the input field, by passing `include_seconds: false`
324
338
 
325
- *Oleksii Vasyliev*
339
+ *Wojciech Wnętrzak*
326
340
 
341
+ * Guard against `ActionView::Helpers::FormTagHelper#field_name` calls with nil
342
+ `object_name` arguments. For example:
327
343
 
328
- ## Rails 7.0.0.alpha2 (September 15, 2021) ##
344
+ ```erb
345
+ <%= fields do |f| %>
346
+ <%= f.field_name :body %>
347
+ <% end %>
348
+ ```
329
349
 
330
- * No changes.
350
+ *Sean Doyle*
331
351
 
352
+ * Strings returned from `strip_tags` are correctly tagged `html_safe?`
332
353
 
333
- ## Rails 7.0.0.alpha1 (September 15, 2021) ##
354
+ Because these strings contain no HTML elements and the basic entities are escaped, they are safe
355
+ to be included as-is as PCDATA in HTML content. Tagging them as html-safe avoids double-escaping
356
+ entities when being concatenated to a SafeBuffer during rendering.
334
357
 
335
- * Improves the performance of ActionView::Helpers::NumberHelper formatters by avoiding the use of
336
- exceptions as flow control.
358
+ Fixes [rails/rails-html-sanitizer#124](https://github.com/rails/rails-html-sanitizer/issues/124)
337
359
 
338
360
  *Mike Dalessio*
339
361
 
340
- * `preload_link_tag` properly inserts `as` attributes for files with `image` MIME types, such as JPG or SVG.
341
-
342
- *Nate Berkopec*
343
-
344
- * Add `weekday_options_for_select` and `weekday_select` helper methods. Also adds `weekday_select` to `FormBuilder`.
345
-
346
- *Drew Bragg*, *Dana Kashubeck*, *Kasper Timm Hansen*
347
-
348
- * Add `caching?` helper that returns whether the current code path is being cached and `uncacheable!` to denote helper methods that can't participate in fragment caching.
349
-
350
- *Ben Toews*, *John Hawthorn*, *Kasper Timm Hansen*, *Joel Hawksley*
351
-
352
- * Add `include_seconds` option for `time_field`.
353
-
354
- <%= form.time_field :foo, include_seconds: false %>
355
- # => <input value="16:22" type="time" />
356
-
357
- Default includes seconds:
358
-
359
- <%= form.time_field :foo %>
360
- # => <input value="16:22:01.440" type="time" />
361
-
362
- This allows you to take advantage of [different rendering options](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/input/time#time_value_format) in some browsers.
363
-
364
- *Alex Ghiculescu*
365
-
366
- * Improve error messages when template file does not exist at absolute filepath.
367
-
368
- *Ted Whang*
362
+ * Move `convert_to_model` call from `form_for` into `form_with`
369
363
 
370
- * Add `:country_code` option to `sms_to` for consistency with `phone_to`.
364
+ Now that `form_for` is implemented in terms of `form_with`, remove the
365
+ `convert_to_model` call from `form_for`.
371
366
 
372
- *Jonathan Hefner*
373
-
374
- * OpenSSL constants are now used for Digest computations.
367
+ *Sean Doyle*
375
368
 
376
- *Dirkjan Bussink*
369
+ * Fix and add protections for XSS in `ActionView::Helpers` and `ERB::Util`.
377
370
 
378
- * The `translate` helper now passes `default` values that aren't
379
- translation keys through `I18n.translate` for interpolation.
371
+ Escape dangerous characters in names of tags and names of attributes in the
372
+ tag helpers, following the XML specification. Rename the option
373
+ `:escape_attributes` to `:escape`, to simplify by applying the option to the
374
+ whole tag.
380
375
 
381
- *Jonathan Hefner*
376
+ *Álvaro Martín Fraguas*
382
377
 
383
- * Adds option `extname` to `stylesheet_link_tag` to skip default
384
- `.css` extension appended to the stylesheet path.
378
+ * Extend audio_tag and video_tag to accept Active Storage attachments.
385
379
 
386
- Before:
380
+ Now it's possible to write
387
381
 
388
382
  ```ruby
389
- stylesheet_link_tag "style.less"
390
- # <link href="/stylesheets/style.less.scss" rel="stylesheet">
383
+ audio_tag(user.audio_file)
384
+ video_tag(user.video_file)
391
385
  ```
392
386
 
393
- After:
387
+ Instead of
394
388
 
395
389
  ```ruby
396
- stylesheet_link_tag "style.less", extname: false, skip_pipeline: true, rel: "stylesheet/less"
397
- # <link href="/stylesheets/style.less" rel="stylesheet/less">
390
+ audio_tag(polymorphic_path(user.audio_file))
391
+ video_tag(polymorphic_path(user.video_file))
398
392
  ```
399
393
 
400
- *Abhay Nikam*
401
-
402
- * Deprecate `render` locals to be assigned to instance variables.
403
-
404
- *Petrik de Heus*
394
+ `image_tag` already supported that, so this follows the same pattern.
405
395
 
406
- * Remove legacy default `media=screen` from `stylesheet_link_tag`.
396
+ *Matheus Richard*
407
397
 
408
- *André Luis Leal Cardoso Junior*
409
-
410
- * Change `ActionView::Helpers::FormBuilder#button` to transform `formmethod`
411
- attributes into `_method="$VERB"` Form Data to enable varied same-form actions:
412
-
413
- <%= form_with model: post, method: :put do %>
414
- <%= form.button "Update" %>
415
- <%= form.button "Delete", formmethod: :delete %>
416
- <% end %>
417
- <%# => <form action="posts/1">
418
- => <input type="hidden" name="_method" value="put">
419
- => <button type="submit">Update</button>
420
- => <button type="submit" formmethod="post" name="_method" value="delete">Delete</button>
421
- => </form>
422
- %>
423
-
424
- *Sean Doyle*
425
-
426
- * Change `ActionView::Helpers::UrlHelper#button_to` to *always* render a
427
- `<button>` element, regardless of whether or not the content is passed as
428
- the first argument or as a block.
429
-
430
- <%= button_to "Delete", post_path(@post), method: :delete %>
431
- # => <form action="/posts/1"><input type="hidden" name="_method" value="delete"><button type="submit">Delete</button></form>
432
-
433
- <%= button_to post_path(@post), method: :delete do %>
434
- Delete
435
- <% end %>
436
- # => <form action="/posts/1"><input type="hidden" name="_method" value="delete"><button type="submit">Delete</button></form>
437
-
438
- *Sean Doyle*, *Dusan Orlovic*
439
-
440
- * Add `config.action_view.preload_links_header` to allow disabling of
441
- the `Link` header being added by default when using `stylesheet_link_tag`
442
- and `javascript_include_tag`.
443
-
444
- *Andrew White*
445
-
446
- * The `translate` helper now resolves `default` values when a `nil` key is
447
- specified, instead of always returning `nil`.
448
-
449
- *Jonathan Hefner*
450
-
451
- * Add `config.action_view.image_loading` to configure the default value of
452
- the `image_tag` `:loading` option.
453
-
454
- By setting `config.action_view.image_loading = "lazy"`, an application can opt in to
455
- lazy loading images sitewide, without changing view code.
456
-
457
- *Jonathan Hefner*
458
-
459
- * `ActionView::Helpers::FormBuilder#id` returns the value
460
- of the `<form>` element's `id` attribute. With a `method` argument, returns
461
- the `id` attribute for a form field with that name.
462
-
463
- <%= form_for @post do |f| %>
464
- <%# ... %>
465
-
466
- <% content_for :sticky_footer do %>
467
- <%= form.button(form: f.id) %>
468
- <% end %>
469
- <% end %>
470
-
471
- *Sean Doyle*
472
-
473
- * `ActionView::Helpers::FormBuilder#field_id` returns the value generated by
474
- the FormBuilder for the given attribute name.
475
-
476
- <%= form_for @post do |f| %>
477
- <%= f.label :title %>
478
- <%= f.text_field :title, aria: { describedby: f.field_id(:title, :error) } %>
479
- <%= tag.span("is blank", id: f.field_id(:title, :error) %>
480
- <% end %>
481
-
482
- *Sean Doyle*
483
-
484
- * Add `tag.attributes` to transform a Hash into HTML Attributes, ready to be
485
- interpolated into ERB.
486
-
487
- <input <%= tag.attributes(type: :text, aria: { label: "Search" }) %> >
488
- # => <input type="text" aria-label="Search">
398
+ * Ensure models passed to `form_for` attempt to call `to_model`.
489
399
 
490
400
  *Sean Doyle*
491
401
 
492
-
493
- Please check [6-1-stable](https://github.com/rails/rails/blob/6-1-stable/actionview/CHANGELOG.md) for previous changes.
402
+ Please check [7-0-stable](https://github.com/rails/rails/blob/7-0-stable/actionview/CHANGELOG.md) for previous changes.