actionview 7.0.8 → 7.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (90) hide show
  1. checksums.yaml +4 -4
  2. data/CHANGELOG.md +255 -346
  3. data/MIT-LICENSE +1 -1
  4. data/README.rdoc +1 -1
  5. data/app/assets/javascripts/rails-ujs.esm.js +668 -0
  6. data/app/assets/javascripts/rails-ujs.js +606 -0
  7. data/lib/action_view/base.rb +33 -12
  8. data/lib/action_view/buffers.rb +106 -8
  9. data/lib/action_view/cache_expiry.rb +40 -43
  10. data/lib/action_view/context.rb +1 -1
  11. data/lib/action_view/deprecator.rb +7 -0
  12. data/lib/action_view/digestor.rb +1 -1
  13. data/lib/action_view/gem_version.rb +3 -3
  14. data/lib/action_view/helpers/active_model_helper.rb +1 -1
  15. data/lib/action_view/helpers/asset_tag_helper.rb +130 -46
  16. data/lib/action_view/helpers/asset_url_helper.rb +6 -5
  17. data/lib/action_view/helpers/atom_feed_helper.rb +5 -5
  18. data/lib/action_view/helpers/cache_helper.rb +3 -9
  19. data/lib/action_view/helpers/capture_helper.rb +24 -10
  20. data/lib/action_view/helpers/content_exfiltration_prevention_helper.rb +70 -0
  21. data/lib/action_view/helpers/controller_helper.rb +6 -0
  22. data/lib/action_view/helpers/csp_helper.rb +2 -2
  23. data/lib/action_view/helpers/csrf_helper.rb +2 -2
  24. data/lib/action_view/helpers/date_helper.rb +17 -19
  25. data/lib/action_view/helpers/debug_helper.rb +3 -3
  26. data/lib/action_view/helpers/form_helper.rb +44 -19
  27. data/lib/action_view/helpers/form_options_helper.rb +2 -1
  28. data/lib/action_view/helpers/form_tag_helper.rb +43 -9
  29. data/lib/action_view/helpers/javascript_helper.rb +1 -0
  30. data/lib/action_view/helpers/number_helper.rb +2 -1
  31. data/lib/action_view/helpers/output_safety_helper.rb +2 -2
  32. data/lib/action_view/helpers/rendering_helper.rb +1 -1
  33. data/lib/action_view/helpers/sanitize_helper.rb +33 -14
  34. data/lib/action_view/helpers/tag_helper.rb +5 -27
  35. data/lib/action_view/helpers/tags/base.rb +11 -52
  36. data/lib/action_view/helpers/tags/collection_check_boxes.rb +1 -0
  37. data/lib/action_view/helpers/tags/collection_radio_buttons.rb +1 -0
  38. data/lib/action_view/helpers/tags/collection_select.rb +3 -0
  39. data/lib/action_view/helpers/tags/date_field.rb +1 -1
  40. data/lib/action_view/helpers/tags/date_select.rb +2 -0
  41. data/lib/action_view/helpers/tags/datetime_field.rb +14 -6
  42. data/lib/action_view/helpers/tags/datetime_local_field.rb +11 -2
  43. data/lib/action_view/helpers/tags/grouped_collection_select.rb +3 -0
  44. data/lib/action_view/helpers/tags/month_field.rb +1 -1
  45. data/lib/action_view/helpers/tags/select.rb +3 -0
  46. data/lib/action_view/helpers/tags/select_renderer.rb +56 -0
  47. data/lib/action_view/helpers/tags/time_field.rb +1 -1
  48. data/lib/action_view/helpers/tags/time_zone_select.rb +3 -0
  49. data/lib/action_view/helpers/tags/week_field.rb +1 -1
  50. data/lib/action_view/helpers/tags/weekday_select.rb +3 -0
  51. data/lib/action_view/helpers/tags.rb +2 -0
  52. data/lib/action_view/helpers/text_helper.rb +32 -16
  53. data/lib/action_view/helpers/translation_helper.rb +3 -3
  54. data/lib/action_view/helpers/url_helper.rb +41 -14
  55. data/lib/action_view/helpers.rb +2 -0
  56. data/lib/action_view/layouts.rb +6 -4
  57. data/lib/action_view/log_subscriber.rb +49 -32
  58. data/lib/action_view/lookup_context.rb +29 -13
  59. data/lib/action_view/path_registry.rb +57 -0
  60. data/lib/action_view/path_set.rb +13 -14
  61. data/lib/action_view/railtie.rb +26 -3
  62. data/lib/action_view/record_identifier.rb +15 -8
  63. data/lib/action_view/renderer/abstract_renderer.rb +1 -1
  64. data/lib/action_view/renderer/collection_renderer.rb +9 -1
  65. data/lib/action_view/renderer/partial_renderer/collection_caching.rb +2 -1
  66. data/lib/action_view/renderer/partial_renderer.rb +2 -1
  67. data/lib/action_view/renderer/renderer.rb +2 -0
  68. data/lib/action_view/renderer/streaming_template_renderer.rb +3 -2
  69. data/lib/action_view/renderer/template_renderer.rb +3 -2
  70. data/lib/action_view/rendering.rb +22 -4
  71. data/lib/action_view/ripper_ast_parser.rb +6 -6
  72. data/lib/action_view/template/error.rb +14 -1
  73. data/lib/action_view/template/handlers/builder.rb +4 -4
  74. data/lib/action_view/template/handlers/erb/erubi.rb +23 -27
  75. data/lib/action_view/template/handlers/erb.rb +73 -1
  76. data/lib/action_view/template/handlers.rb +1 -1
  77. data/lib/action_view/template/html.rb +1 -1
  78. data/lib/action_view/template/raw_file.rb +1 -1
  79. data/lib/action_view/template/renderable.rb +1 -1
  80. data/lib/action_view/template/resolver.rb +10 -2
  81. data/lib/action_view/template/text.rb +1 -1
  82. data/lib/action_view/template/types.rb +25 -34
  83. data/lib/action_view/template.rb +227 -53
  84. data/lib/action_view/template_path.rb +2 -0
  85. data/lib/action_view/test_case.rb +174 -21
  86. data/lib/action_view/unbound_template.rb +15 -5
  87. data/lib/action_view/version.rb +1 -1
  88. data/lib/action_view/view_paths.rb +15 -24
  89. data/lib/action_view.rb +4 -1
  90. metadata +23 -23
data/CHANGELOG.md CHANGED
@@ -1,493 +1,402 @@
1
- ## Rails 7.0.8 (September 09, 2023) ##
2
-
3
- * Fix `form_for` missing the hidden `_method` input for models with a
4
- namespaced route.
5
-
6
- *Hartley McGuire*
7
-
8
- * Fix `render collection: @records, cache: true` inside `jbuilder` templates
9
-
10
- The previous fix that shipped in `7.0.7` assumed template fragments are always strings,
11
- this isn't true with `jbuilder`.
12
-
13
- *Jean Boussier*
14
-
15
- ## Rails 7.0.7.2 (August 22, 2023) ##
1
+ ## Rails 7.1.0 (October 05, 2023) ##
16
2
 
17
3
  * No changes.
18
4
 
19
5
 
20
- ## Rails 7.0.7.1 (August 22, 2023) ##
6
+ ## Rails 7.1.0.rc2 (October 01, 2023) ##
21
7
 
22
8
  * No changes.
23
9
 
24
10
 
25
- ## Rails 7.0.7 (August 09, 2023) ##
26
-
27
- * Fix `render collection: @records, cache: true` to cache fragments as bare strings
28
-
29
- Previously it would incorrectly cache them as Action View buffers.
30
-
31
- *Jean Boussier*
32
-
33
- * Don't double-encode nested `field_id` and `field_name` index values
34
-
35
- Pass `index: @options` as a default keyword argument to `field_id` and
36
- `field_name` view helper methods.
11
+ ## Rails 7.1.0.rc1 (September 27, 2023) ##
37
12
 
38
- *Sean Doyle*
13
+ * Introduce `ActionView::TestCase.register_parser`
39
14
 
15
+ ```ruby
16
+ register_parser :rss, -> rendered { RSS::Parser.parse(rendered) }
40
17
 
41
- ## Rails 7.0.6 (June 29, 2023) ##
18
+ test "renders RSS" do
19
+ article = Article.create!(title: "Hello, world")
42
20
 
43
- * No changes.
21
+ render formats: :rss, partial: article
44
22
 
23
+ assert_equal "Hello, world", rendered.rss.items.last.title
24
+ end
25
+ ```
45
26
 
46
- ## Rails 7.0.5.1 (June 26, 2023) ##
27
+ By default, register parsers for `:html` and `:json`.
47
28
 
48
- * No changes.
29
+ *Sean Doyle*
49
30
 
50
31
 
51
- ## Rails 7.0.5 (May 24, 2023) ##
32
+ ## Rails 7.1.0.beta1 (September 13, 2023) ##
52
33
 
53
- * `FormBuilder#id` finds id set by `form_for` and `form_with`.
34
+ * Fix `simple_format` with blank `wrapper_tag` option returns plain html tag
54
35
 
55
- *Matt Polito*
36
+ By default `simple_format` method returns the text wrapped with `<p>`. But if we explicitly specify
37
+ the `wrapper_tag: nil` in the options, it returns the text wrapped with `<></>` tag.
56
38
 
57
- * Allow all available locales for template lookups.
39
+ Before:
58
40
 
59
- *Ben Dilley*
41
+ ```ruby
42
+ simple_format("Hello World", {}, { wrapper_tag: nil })
43
+ # <>Hello World</>
44
+ ```
60
45
 
61
- * Choices of `select` can optionally contain html attributes as the last element
62
- of the child arrays when using grouped/nested collections
46
+ After:
63
47
 
64
- ```erb
65
- <%= form.select :foo, [["North America", [["United States","US"],["Canada","CA"]], { disabled: "disabled" }]] %>
66
- # => <select><optgroup label="North America" disabled="disabled"><option value="US">United States</option><option value="CA">Canada</option></optgroup></select>
48
+ ```ruby
49
+ simple_format("Hello World", {}, { wrapper_tag: nil })
50
+ # <p>Hello World</p>
67
51
  ```
68
52
 
69
- *Chris Gunther*
53
+ *Akhil G Krishnan*, *Junichi Ito*
70
54
 
55
+ * Don't double-encode nested `field_id` and `field_name` index values
71
56
 
72
- ## Rails 7.0.4.3 (March 13, 2023) ##
57
+ Pass `index: @options` as a default keyword argument to `field_id` and
58
+ `field_name` view helper methods.
73
59
 
74
- * Ignore certain data-* attributes in rails-ujs when element is contenteditable
60
+ *Sean Doyle*
75
61
 
76
- [CVE-2023-23913]
62
+ * Allow opting in/out of `Link preload` headers when calling `stylesheet_link_tag` or `javascript_include_tag`
77
63
 
64
+ ```ruby
65
+ # will exclude header, even if setting is enabled:
66
+ javascript_include_tag("http://example.com/all.js", preload_links_header: false)
78
67
 
79
- ## Rails 7.0.4.2 (January 24, 2023) ##
68
+ # will include header, even if setting is disabled:
69
+ stylesheet_link_tag("http://example.com/all.js", preload_links_header: true)
70
+ ```
80
71
 
81
- * No changes.
72
+ *Alex Ghiculescu*
82
73
 
74
+ * Stop generating `Link preload` headers once it has reached 1KB.
83
75
 
84
- ## Rails 7.0.4.1 (January 17, 2023) ##
76
+ Some proxies have trouble handling large headers, but more importantly preload links
77
+ have diminishing returns so it's preferable not to go overboard with them.
85
78
 
86
- * No changes.
79
+ If tighter control is needed, it's recommended to disable automatic generation of preloads
80
+ and to generate them manually from the controller or from a middleware.
87
81
 
82
+ *Jean Boussier*
88
83
 
89
- ## Rails 7.0.4 (September 09, 2022) ##
84
+ * `simple_format` helper now handles a `:sanitize_options` - any extra options you want appending to the sanitize.
90
85
 
91
- * Guard against `ActionView::Helpers::FormTagHelper#field_name` calls with nil
92
- `object_name` arguments. For example:
86
+ Before:
87
+ ```ruby
88
+ simple_format("<a target=\"_blank\" href=\"http://example.com\">Continue</a>")
89
+ # => "<p><a href=\"http://example.com\">Continue</a></p>"
90
+ ```
93
91
 
94
- ```erb
95
- <%= fields do |f| %>
96
- <%= f.field_name :body %>
97
- <% end %>
92
+ After:
93
+ ```ruby
94
+ simple_format("<a target=\"_blank\" href=\"http://example.com\">Continue</a>", {}, { sanitize_options: { attributes: %w[target href] } })
95
+ # => "<p><a target=\"_blank\" href=\"http://example.com\">Continue</a></p>"
98
96
  ```
99
97
 
100
- *Sean Doyle*
98
+ *Andrei Andriichuk*
101
99
 
102
- * Strings returned from `strip_tags` are correctly tagged `html_safe?`
100
+ * Add support for HTML5 standards-compliant sanitizers, and default to `Rails::HTML5::Sanitizer`
101
+ in the Rails 7.1 configuration if it is supported.
103
102
 
104
- Because these strings contain no HTML elements and the basic entities are escaped, they are safe
105
- to be included as-is as PCDATA in HTML content. Tagging them as html-safe avoids double-escaping
106
- entities when being concatenated to a SafeBuffer during rendering.
103
+ Action View's HTML sanitizers can be configured by setting
104
+ `config.action_view.sanitizer_vendor`. Supported values are `Rails::HTML4::Sanitizer` or
105
+ `Rails::HTML5::Sanitizer`.
107
106
 
108
- Fixes [rails/rails-html-sanitizer#124](https://github.com/rails/rails-html-sanitizer/issues/124)
107
+ The Rails 7.1 configuration will set this to `Rails::HTML5::Sanitizer` when it is supported, and
108
+ fall back to `Rails::HTML4::Sanitizer`. Previous configurations default to
109
+ `Rails::HTML4::Sanitizer`.
109
110
 
110
111
  *Mike Dalessio*
111
112
 
112
- ## Rails 7.0.3.1 (July 12, 2022) ##
113
-
114
- * No changes.
115
-
116
-
117
- ## Rails 7.0.3 (May 09, 2022) ##
118
-
119
- * Ensure models passed to `form_for` attempt to call `to_model`.
120
-
121
- *Sean Doyle*
122
-
123
- ## Rails 7.0.2.4 (April 26, 2022) ##
113
+ * `config.dom_testing_default_html_version` controls the HTML parser used by
114
+ `ActionView::TestCase#document_root_element`, which creates the DOM used by the assertions in
115
+ Rails::Dom::Testing.
124
116
 
125
- * Fix and add protections for XSS in `ActionView::Helpers` and `ERB::Util`.
126
-
127
- Escape dangerous characters in names of tags and names of attributes in the
128
- tag helpers, following the XML specification. Rename the option
129
- `:escape_attributes` to `:escape`, to simplify by applying the option to the
130
- whole tag.
131
-
132
- *Álvaro Martín Fraguas*
133
-
134
- ## Rails 7.0.2.3 (March 08, 2022) ##
117
+ The Rails 7.1 default configuration opts into the HTML5 parser when it is supported, to better
118
+ represent what the DOM would be in a browser user agent. Previously this test helper always used
119
+ Nokogiri's HTML4 parser.
135
120
 
136
- * No changes.
121
+ *Mike Dalessio*
137
122
 
123
+ * Add support for the HTML picture tag. It supports passing a String, an Array or a Block.
124
+ Supports passing properties directly to the img tag via the `:image` key.
125
+ Since the picture tag requires an img tag, the last element you provide will be used for the img tag.
126
+ For complete control over the picture tag, a block can be passed, which will populate the contents of the tag accordingly.
138
127
 
139
- ## Rails 7.0.2.2 (February 11, 2022) ##
128
+ Can be used like this for a single source:
129
+ ```erb
130
+ <%= picture_tag("picture.webp") %>
131
+ ```
132
+ which will generate the following:
133
+ ```html
134
+ <picture>
135
+ <img src="/images/picture.webp" />
136
+ </picture>
137
+ ```
140
138
 
141
- * No changes.
139
+ For multiple sources:
140
+ ```erb
141
+ <%= picture_tag("picture.webp", "picture.png", :class => "mt-2", :image => { alt: "Image", class: "responsive-img" }) %>
142
+ ```
143
+ will generate:
144
+ ```html
145
+ <picture class="mt-2">
146
+ <source srcset="/images/picture.webp" />
147
+ <source srcset="/images/picture.png" />
148
+ <img alt="Image" class="responsive-img" src="/images/picture.png" />
149
+ </picture>
150
+ ```
142
151
 
152
+ Full control via a block:
153
+ ```erb
154
+ <%= picture_tag(:class => "my-class") do %>
155
+ <%= tag(:source, :srcset => image_path("picture.webp")) %>
156
+ <%= tag(:source, :srcset => image_path("picture.png")) %>
157
+ <%= image_tag("picture.png", :alt => "Image") %>
158
+ <% end %>
159
+ ```
160
+ will generate:
161
+ ```html
162
+ <picture class="my-class">
163
+ <source srcset="/images/picture.webp" />
164
+ <source srcset="/images/picture.png" />
165
+ <img alt="Image" src="/images/picture.png" />
166
+ </picture>
167
+ ```
143
168
 
144
- ## Rails 7.0.2.1 (February 11, 2022) ##
169
+ *Juan Pablo Balarini*
145
170
 
146
- * No changes.
171
+ * Remove deprecated support to passing instance variables as locals to partials.
147
172
 
173
+ *Rafael Mendonça França*
148
174
 
149
- ## Rails 7.0.2 (February 08, 2022) ##
175
+ * Remove deprecated constant `ActionView::Path`.
150
176
 
151
- * Ensure `preload_link_tag` preloads JavaScript modules correctly.
177
+ *Rafael Mendonça França*
152
178
 
153
- *Máximo Mussini*
179
+ * Guard `token_list` calls from escaping HTML too often
154
180
 
155
- * Fix `stylesheet_link_tag` and similar helpers are being used to work in objects with
156
- a `response` method.
181
+ *Sean Doyle*
157
182
 
158
- *dark-panda*
183
+ * `select` can now be called with a single hash containing options and some HTML options
159
184
 
185
+ Previously this would not work as expected:
160
186
 
161
- ## Rails 7.0.1 (January 06, 2022) ##
187
+ ```erb
188
+ <%= select :post, :author, authors, required: true %>
189
+ ```
162
190
 
163
- * Fix `button_to` to work with a hash parameter as URL.
191
+ Instead you needed to do this:
164
192
 
165
- *MingyuanQin*
193
+ ```erb
194
+ <%= select :post, :author, authors, {}, required: true %>
195
+ ```
166
196
 
167
- * Fix `link_to` with a model passed as an argument twice.
197
+ Now, either form is accepted, for the following HTML attributes: `required`, `multiple`, `size`.
168
198
 
169
199
  *Alex Ghiculescu*
170
200
 
201
+ * Datetime form helpers (`time_field`, `date_field`, `datetime_field`, `week_field`, `month_field`) now accept an instance of Time/Date/DateTime as `:value` option.
171
202
 
172
- ## Rails 7.0.0 (December 15, 2021) ##
173
-
174
- * Support `include_hidden:` option in calls to
175
- `ActionView::Helper::FormBuilder#file_field` with `multiple: true` to
176
- support submitting an empty collection of files.
177
-
178
- ```ruby
179
- form.file_field :attachments, multiple: true
180
- # => <input type="hidden" autocomplete="off" name="post[attachments][]" value="">
181
- <input type="file" multiple="multiple" id="post_attachments" name="post[attachments][]">
182
-
183
- form.file_field :attachments, multiple: true, include_hidden: false
184
- # => <input type="file" multiple="multiple" id="post_attachments" name="post[attachments][]">
203
+ Before:
204
+ ```erb
205
+ <%= form.datetime_field :written_at, value: Time.current.strftime("%Y-%m-%dT%T") %>
185
206
  ```
186
207
 
187
- *Sean Doyle*
188
-
189
- * Fix `number_with_precision(raise: true)` always raising even on valid numbers.
190
-
191
- *Pedro Moreira*
208
+ After:
209
+ ```erb
210
+ <%= form.datetime_field :written_at, value: Time.current %>
211
+ ```
192
212
 
213
+ *Andrey Samsonov*
193
214
 
194
- ## Rails 7.0.0.rc3 (December 14, 2021) ##
215
+ * Choices of `select` can optionally contain html attributes as the last element
216
+ of the child arrays when using grouped/nested collections
195
217
 
196
- * No changes.
218
+ ```erb
219
+ <%= form.select :foo, [["North America", [["United States","US"],["Canada","CA"]], { disabled: "disabled" }]] %>
220
+ # => <select><optgroup label="North America" disabled="disabled"><option value="US">United States</option><option value="CA">Canada</option></optgroup></select>
221
+ ```
197
222
 
223
+ *Chris Gunther*
198
224
 
199
- ## Rails 7.0.0.rc2 (December 14, 2021) ##
225
+ * `check_box_tag` and `radio_button_tag` now accept `checked` as a keyword argument
200
226
 
201
- * No changes.
227
+ This is to make the API more consistent with the `FormHelper` variants. You can now
228
+ provide `checked` as a positional or keyword argument:
202
229
 
203
- ## Rails 7.0.0.rc1 (December 06, 2021) ##
230
+ ```erb
231
+ = check_box_tag "admin", "1", false
232
+ = check_box_tag "admin", "1", checked: false
204
233
 
205
- * Support `fields model: [@nested, @model]` the same way as `form_with model:
206
- [@nested, @model]`.
234
+ = radio_button_tag 'favorite_color', 'maroon', false
235
+ = radio_button_tag 'favorite_color', 'maroon', checked: false
236
+ ```
207
237
 
208
- *Sean Doyle*
238
+ *Alex Ghiculescu*
209
239
 
210
- * Infer HTTP verb `[method]` from a model or Array with model as the first
211
- argument to `button_to` when combined with a block:
240
+ * Allow passing a class to `dom_id`.
241
+ You no longer need to call `new` when passing a class to `dom_id`.
242
+ This makes `dom_id` behave like `dom_class` in this regard.
243
+ Apart from saving a few keystrokes, it prevents Ruby from needing
244
+ to instantiate a whole new object just to generate a string.
212
245
 
246
+ Before:
213
247
  ```ruby
214
- button_to(Workshop.find(1)){ "Update" }
215
- #=> <form method="post" action="/workshops/1" class="button_to">
216
- #=> <input type="hidden" name="_method" value="patch" autocomplete="off" />
217
- #=> <button type="submit">Update</button>
218
- #=> </form>
219
-
220
- button_to([ Workshop.find(1), Session.find(1) ]) { "Update" }
221
- #=> <form method="post" action="/workshops/1/sessions/1" class="button_to">
222
- #=> <input type="hidden" name="_method" value="patch" autocomplete="off" />
223
- #=> <button type="submit">Update</button>
224
- #=> </form>
248
+ dom_id(Post) # => NoMethodError: undefined method `to_key' for Post:Class
225
249
  ```
226
250
 
227
- *Sean Doyle*
228
-
229
- * Support passing a Symbol as the first argument to `FormBuilder#button`:
230
-
251
+ After:
231
252
  ```ruby
232
- form.button(:draft, value: true)
233
- # => <button name="post[draft]" value="true" type="submit">Create post</button>
234
-
235
- form.button(:draft, value: true) do
236
- content_tag(:strong, "Save as draft")
237
- end
238
- # => <button name="post[draft]" value="true" type="submit">
239
- # <strong>Save as draft</strong>
240
- # </button>
253
+ dom_id(Post) # => "new_post"
241
254
  ```
242
255
 
243
- *Sean Doyle*
256
+ *Goulven Champenois*
244
257
 
245
- * Introduce the `field_name` view helper, along with the
246
- `FormBuilder#field_name` counterpart:
258
+ * Report `:locals` as part of the data returned by ActionView render instrumentation.
247
259
 
260
+ Before:
248
261
  ```ruby
249
- form_for @post do |f|
250
- f.field_tag :tag, name: f.field_name(:tag, multiple: true)
251
- # => <input type="text" name="post[tag][]">
252
- end
262
+ {
263
+ identifier: "/Users/adam/projects/notifications/app/views/posts/index.html.erb",
264
+ layout: "layouts/application"
265
+ }
253
266
  ```
254
267
 
255
- *Sean Doyle*
256
-
257
- * Execute the `ActionView::Base.field_error_proc` within the context of the
258
- `ActionView::Base` instance:
259
-
268
+ After:
260
269
  ```ruby
261
- config.action_view.field_error_proc = proc { |html| content_tag(:div, html, class: "field_with_errors") }
270
+ {
271
+ identifier: "/Users/adam/projects/notifications/app/views/posts/index.html.erb",
272
+ layout: "layouts/application",
273
+ locals: {foo: "bar"}
274
+ }
262
275
  ```
263
276
 
264
- *Sean Doyle*
277
+ *Aaron Gough*
265
278
 
266
- * Add support for `button_to ..., authenticity_token: false`
279
+ * Strip `break_sequence` at the end of `word_wrap`.
267
280
 
268
- ```ruby
269
- button_to "Create", Post.new, authenticity_token: false
270
- # => <form class="button_to" method="post" action="/posts"><button type="submit">Create</button></form>
281
+ This fixes a bug where `word_wrap` didn't properly strip off break sequences that had printable characters.
271
282
 
272
- button_to "Create", Post.new, authenticity_token: true
273
- # => <form class="button_to" method="post" action="/posts"><button type="submit">Create</button><input type="hidden" name="form_token" value="abc123..." autocomplete="off" /></form>
283
+ For example, compare the outputs of this template:
274
284
 
275
- button_to "Create", Post.new, authenticity_token: "secret"
276
- # => <form class="button_to" method="post" action="/posts"><button type="submit">Create</button><input type="hidden" name="form_token" value="secret" autocomplete="off" /></form>
285
+ ```erb
286
+ # <%= word_wrap("11 22\n33 44", line_width: 2, break_sequence: "\n# ") %>
277
287
  ```
278
288
 
279
- *Sean Doyle*
280
-
281
- * Support rendering `<form>` elements _without_ `[action]` attributes by:
289
+ Before:
282
290
 
283
- * `form_with url: false` or `form_with ..., html: { action: false }`
284
- * `form_for ..., url: false` or `form_for ..., html: { action: false }`
285
- * `form_tag false` or `form_tag ..., action: false`
286
- * `button_to "...", false` or `button_to(false) { ... }`
291
+ ```
292
+ # 11
293
+ # 22
294
+ #
295
+ # 33
296
+ # 44
297
+ #
298
+ ```
287
299
 
288
- *Sean Doyle*
300
+ After:
289
301
 
290
- * Add `:day_format` option to `date_select`
302
+ ```
303
+ # 11
304
+ # 22
305
+ # 33
306
+ # 44
307
+ ```
291
308
 
292
- date_select("article", "written_on", day_format: ->(day) { day.ordinalize })
293
- # generates day options like <option value="1">1st</option>\n<option value="2">2nd</option>...
309
+ *Max Chernyak*
294
310
 
295
- *Shunichi Ikegami*
311
+ * Allow templates to set strict `locals`.
296
312
 
297
- * Allow `link_to` helper to infer link name from `Model#to_s` when it
298
- is used with a single argument:
313
+ By default, templates will accept any `locals` as keyword arguments. To define what `locals` a template accepts, add a `locals` magic comment:
299
314
 
300
- link_to @profile
301
- #=> <a href="/profiles/1">Eileen</a>
315
+ ```erb
316
+ <%# locals: (message:) -%>
317
+ <%= message %>
318
+ ```
302
319
 
303
- This assumes the model class implements a `to_s` method like this:
320
+ Default values can also be provided:
304
321
 
305
- class Profile < ApplicationRecord
306
- # ...
307
- def to_s
308
- name
309
- end
310
- end
322
+ ```erb
323
+ <%# locals: (message: "Hello, world!") -%>
324
+ <%= message %>
325
+ ```
311
326
 
312
- Previously you had to supply a second argument even if the `Profile`
313
- model implemented a `#to_s` method that called the `name` method.
327
+ Or `locals` can be disabled entirely:
314
328
 
315
- link_to @profile, @profile.name
316
- #=> <a href="/profiles/1">Eileen</a>
329
+ ```erb
330
+ <%# locals: () %>
331
+ ```
317
332
 
318
- *Olivier Lacan*
333
+ *Joel Hawksley*
319
334
 
320
- * Support svg unpaired tags for `tag` helper.
335
+ * Add `include_seconds` option for `datetime_local_field`
321
336
 
322
- tag.svg { tag.use('href' => "#cool-icon") }
323
- # => <svg><use href="#cool-icon"></svg>
337
+ This allows to omit seconds part in the input field, by passing `include_seconds: false`
324
338
 
325
- *Oleksii Vasyliev*
339
+ *Wojciech Wnętrzak*
326
340
 
341
+ * Guard against `ActionView::Helpers::FormTagHelper#field_name` calls with nil
342
+ `object_name` arguments. For example:
327
343
 
328
- ## Rails 7.0.0.alpha2 (September 15, 2021) ##
344
+ ```erb
345
+ <%= fields do |f| %>
346
+ <%= f.field_name :body %>
347
+ <% end %>
348
+ ```
329
349
 
330
- * No changes.
350
+ *Sean Doyle*
331
351
 
352
+ * Strings returned from `strip_tags` are correctly tagged `html_safe?`
332
353
 
333
- ## Rails 7.0.0.alpha1 (September 15, 2021) ##
354
+ Because these strings contain no HTML elements and the basic entities are escaped, they are safe
355
+ to be included as-is as PCDATA in HTML content. Tagging them as html-safe avoids double-escaping
356
+ entities when being concatenated to a SafeBuffer during rendering.
334
357
 
335
- * Improves the performance of ActionView::Helpers::NumberHelper formatters by avoiding the use of
336
- exceptions as flow control.
358
+ Fixes [rails/rails-html-sanitizer#124](https://github.com/rails/rails-html-sanitizer/issues/124)
337
359
 
338
360
  *Mike Dalessio*
339
361
 
340
- * `preload_link_tag` properly inserts `as` attributes for files with `image` MIME types, such as JPG or SVG.
341
-
342
- *Nate Berkopec*
343
-
344
- * Add `weekday_options_for_select` and `weekday_select` helper methods. Also adds `weekday_select` to `FormBuilder`.
345
-
346
- *Drew Bragg*, *Dana Kashubeck*, *Kasper Timm Hansen*
347
-
348
- * Add `caching?` helper that returns whether the current code path is being cached and `uncacheable!` to denote helper methods that can't participate in fragment caching.
349
-
350
- *Ben Toews*, *John Hawthorn*, *Kasper Timm Hansen*, *Joel Hawksley*
351
-
352
- * Add `include_seconds` option for `time_field`.
353
-
354
- <%= form.time_field :foo, include_seconds: false %>
355
- # => <input value="16:22" type="time" />
356
-
357
- Default includes seconds:
358
-
359
- <%= form.time_field :foo %>
360
- # => <input value="16:22:01.440" type="time" />
361
-
362
- This allows you to take advantage of [different rendering options](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/input/time#time_value_format) in some browsers.
363
-
364
- *Alex Ghiculescu*
365
-
366
- * Improve error messages when template file does not exist at absolute filepath.
367
-
368
- *Ted Whang*
362
+ * Move `convert_to_model` call from `form_for` into `form_with`
369
363
 
370
- * Add `:country_code` option to `sms_to` for consistency with `phone_to`.
364
+ Now that `form_for` is implemented in terms of `form_with`, remove the
365
+ `convert_to_model` call from `form_for`.
371
366
 
372
- *Jonathan Hefner*
373
-
374
- * OpenSSL constants are now used for Digest computations.
367
+ *Sean Doyle*
375
368
 
376
- *Dirkjan Bussink*
369
+ * Fix and add protections for XSS in `ActionView::Helpers` and `ERB::Util`.
377
370
 
378
- * The `translate` helper now passes `default` values that aren't
379
- translation keys through `I18n.translate` for interpolation.
371
+ Escape dangerous characters in names of tags and names of attributes in the
372
+ tag helpers, following the XML specification. Rename the option
373
+ `:escape_attributes` to `:escape`, to simplify by applying the option to the
374
+ whole tag.
380
375
 
381
- *Jonathan Hefner*
376
+ *Álvaro Martín Fraguas*
382
377
 
383
- * Adds option `extname` to `stylesheet_link_tag` to skip default
384
- `.css` extension appended to the stylesheet path.
378
+ * Extend audio_tag and video_tag to accept Active Storage attachments.
385
379
 
386
- Before:
380
+ Now it's possible to write
387
381
 
388
382
  ```ruby
389
- stylesheet_link_tag "style.less"
390
- # <link href="/stylesheets/style.less.scss" rel="stylesheet">
383
+ audio_tag(user.audio_file)
384
+ video_tag(user.video_file)
391
385
  ```
392
386
 
393
- After:
387
+ Instead of
394
388
 
395
389
  ```ruby
396
- stylesheet_link_tag "style.less", extname: false, skip_pipeline: true, rel: "stylesheet/less"
397
- # <link href="/stylesheets/style.less" rel="stylesheet/less">
390
+ audio_tag(polymorphic_path(user.audio_file))
391
+ video_tag(polymorphic_path(user.video_file))
398
392
  ```
399
393
 
400
- *Abhay Nikam*
401
-
402
- * Deprecate `render` locals to be assigned to instance variables.
403
-
404
- *Petrik de Heus*
394
+ `image_tag` already supported that, so this follows the same pattern.
405
395
 
406
- * Remove legacy default `media=screen` from `stylesheet_link_tag`.
396
+ *Matheus Richard*
407
397
 
408
- *André Luis Leal Cardoso Junior*
409
-
410
- * Change `ActionView::Helpers::FormBuilder#button` to transform `formmethod`
411
- attributes into `_method="$VERB"` Form Data to enable varied same-form actions:
412
-
413
- <%= form_with model: post, method: :put do %>
414
- <%= form.button "Update" %>
415
- <%= form.button "Delete", formmethod: :delete %>
416
- <% end %>
417
- <%# => <form action="posts/1">
418
- => <input type="hidden" name="_method" value="put">
419
- => <button type="submit">Update</button>
420
- => <button type="submit" formmethod="post" name="_method" value="delete">Delete</button>
421
- => </form>
422
- %>
423
-
424
- *Sean Doyle*
425
-
426
- * Change `ActionView::Helpers::UrlHelper#button_to` to *always* render a
427
- `<button>` element, regardless of whether or not the content is passed as
428
- the first argument or as a block.
429
-
430
- <%= button_to "Delete", post_path(@post), method: :delete %>
431
- # => <form action="/posts/1"><input type="hidden" name="_method" value="delete"><button type="submit">Delete</button></form>
432
-
433
- <%= button_to post_path(@post), method: :delete do %>
434
- Delete
435
- <% end %>
436
- # => <form action="/posts/1"><input type="hidden" name="_method" value="delete"><button type="submit">Delete</button></form>
437
-
438
- *Sean Doyle*, *Dusan Orlovic*
439
-
440
- * Add `config.action_view.preload_links_header` to allow disabling of
441
- the `Link` header being added by default when using `stylesheet_link_tag`
442
- and `javascript_include_tag`.
443
-
444
- *Andrew White*
445
-
446
- * The `translate` helper now resolves `default` values when a `nil` key is
447
- specified, instead of always returning `nil`.
448
-
449
- *Jonathan Hefner*
450
-
451
- * Add `config.action_view.image_loading` to configure the default value of
452
- the `image_tag` `:loading` option.
453
-
454
- By setting `config.action_view.image_loading = "lazy"`, an application can opt in to
455
- lazy loading images sitewide, without changing view code.
456
-
457
- *Jonathan Hefner*
458
-
459
- * `ActionView::Helpers::FormBuilder#id` returns the value
460
- of the `<form>` element's `id` attribute. With a `method` argument, returns
461
- the `id` attribute for a form field with that name.
462
-
463
- <%= form_for @post do |f| %>
464
- <%# ... %>
465
-
466
- <% content_for :sticky_footer do %>
467
- <%= form.button(form: f.id) %>
468
- <% end %>
469
- <% end %>
470
-
471
- *Sean Doyle*
472
-
473
- * `ActionView::Helpers::FormBuilder#field_id` returns the value generated by
474
- the FormBuilder for the given attribute name.
475
-
476
- <%= form_for @post do |f| %>
477
- <%= f.label :title %>
478
- <%= f.text_field :title, aria: { describedby: f.field_id(:title, :error) } %>
479
- <%= tag.span("is blank", id: f.field_id(:title, :error) %>
480
- <% end %>
481
-
482
- *Sean Doyle*
483
-
484
- * Add `tag.attributes` to transform a Hash into HTML Attributes, ready to be
485
- interpolated into ERB.
486
-
487
- <input <%= tag.attributes(type: :text, aria: { label: "Search" }) %> >
488
- # => <input type="text" aria-label="Search">
398
+ * Ensure models passed to `form_for` attempt to call `to_model`.
489
399
 
490
400
  *Sean Doyle*
491
401
 
492
-
493
- Please check [6-1-stable](https://github.com/rails/rails/blob/6-1-stable/actionview/CHANGELOG.md) for previous changes.
402
+ Please check [7-0-stable](https://github.com/rails/rails/blob/7-0-stable/actionview/CHANGELOG.md) for previous changes.