activerecord 3.1.10 → 3.1.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-!binary "U0hBMQ==":
-  metadata.gz: d3c49c6038597072b4626faa2b33eeb35d999414
-  data.tar.gz: 3b2195c8e344d8b2473108036745233fb93686e8
-!binary "U0hBNTEy":
-  metadata.gz: ad97f6c934b765a7f8f128c4a2c38fc2f965152feac00beaed09381cca330a21158cffdd490fe786e61fbdc0f0e627237bbc39500ebb419d7a275709e5468796
-  data.tar.gz: 9b29dc983b2331729c1eff4da246a54681835e8bc6744fa502049b57d672f1e2aca88256412ccb3c96c9b76508be4e7fe974e2d3f868994455a924c8547df88f
+SHA1:
+  metadata.gz: b0b0e3dda9642a618a998223568a92014fd55475
+  data.tar.gz: 719b6bde220e0abd79e27b6457c92d8ce8bb511b
+SHA512:
+  metadata.gz: 53b2dbbc486b8b41dd447b6cdf66d1ca264c44ecc818cf1ef993ccc2e6a3d8b515f074c093f4d6e32908ca89bd6ed74673f97183c2c7310a065a06308b550bb7
+  data.tar.gz: b161018a09558875e58f7773aef6953f8bfeada2f21c98423de067f6c2d97e2680a43e6365426e040e5e79e49dd006687ada6c8941bcc7c214ac11f09ebbf5b7

data/CHANGELOG.md

@@ -1,20 +1,32 @@
-## Rails 3.1.10
+## Rails 3.1.11 (unreleased) ##
+
+*   Quote numeric values being compared to non-numeric columns. Otherwise,
+    in some database, the string column values will be coerced to a numeric
+    allowing 0, 0.0 or false to match any string starting with a non-digit.
+
+    Example:
+
+        App.where(apikey: 0) # => SELECT * FROM users WHERE apikey = '0'
+
+    *Dylan Smith*
+
+## Rails 3.1.10 (Jan 8, 2013) ##
 
 *   Fix querying with an empty hash *Damien Mathieu* [CVE-2013-0155]
 
-## Rails 3.1.9
+## Rails 3.1.9 (Jan 2, 2013) ##
 
 *  CVE-2012-5664 ensure that options are never taken from the first parameter
 
-## Rails 3.1.8 (Aug 9, 2012)
+## Rails 3.1.8 (Aug 9, 2012) ##
 
 *   No changes.
 
-## Rails 3.1.7 (Jul 26, 2012)
+## Rails 3.1.7 (Jul 26, 2012) ##
 
 *   No changes.
 
-## Rails 3.1.6 (Jun 12, 2012)
+## Rails 3.1.6 (Jun 12, 2012) ##
 
 *   protect against the nesting of hashes changing the
     table context in the next call to build_from_hash. This fix

data/lib/active_record/base.rb

@@ -2071,7 +2071,7 @@ MSG
         set_values = (1..3).collect{|position| values_hash_from_param[position].blank? ? 1 : values_hash_from_param[position]}
         begin
           Date.new(*set_values)
-        rescue ArgumentError => ex # if Date.new raises an exception on an invalid date
+        rescue ArgumentError # if Date.new raises an exception on an invalid date
           instantiate_time_object(name, set_values).to_date # we instantiate Time object and convert it back to a date thus using Time's logic in handling invalid dates
         end
       end

data/lib/active_record/connection_adapters/abstract/quoting.rb

@@ -25,13 +25,19 @@ module ActiveRecord
         when true, false
           if column && column.type == :integer
             value ? '1' : '0'
+          elsif column && [:text, :string, :binary].include?(column.type)
+            value ? "'1'" : "'0'"
           else
             value ? quoted_true : quoted_false
           end
           # BigDecimals need to be put in a non-normalized form and quoted.
         when nil        then "NULL"
-        when BigDecimal then value.to_s('F')
-        when Numeric    then value.to_s
+        when Numeric, ActiveSupport::Duration
+          value = BigDecimal === value ? value.to_s('F') : value.to_s
+          if column && ![:integer, :float, :decimal].include?(column.type)
+            value = "'#{value}'"
+          end
+          value
         when Date, Time then "'#{quoted_date(value)}'"
         when Symbol     then "'#{quote_string(value.to_s)}'"
         else

data/lib/active_record/connection_adapters/mysql2_adapter.rb

@@ -166,8 +166,6 @@ module ActiveRecord
         if value.kind_of?(String) && column && column.type == :binary && column.class.respond_to?(:string_to_binary)
           s = column.class.string_to_binary(value).unpack("H*")[0]
           "x'#{s}'"
-        elsif value.kind_of?(BigDecimal)
-          value.to_s("F")
         else
           super
         end

data/lib/active_record/connection_adapters/mysql_adapter.rb

@@ -283,8 +283,6 @@ module ActiveRecord
         if value.kind_of?(String) && column && column.type == :binary && column.class.respond_to?(:string_to_binary)
           s = column.class.string_to_binary(value).unpack("H*")[0]
           "x'#{s}'"
-        elsif value.kind_of?(BigDecimal)
-          value.to_s("F")
         else
           super
         end

data/lib/active_record/relation/predicate_builder.rb

@@ -49,6 +49,10 @@ module ActiveRecord
           when Class
             # FIXME: I think we need to deprecate this behavior
             attribute.eq(value.name)
+          when Integer, ActiveSupport::Duration
+            # Arel treats integers as literals, but they should be quoted when compared with strings
+            column = engine.connection_pool.columns_hash[table.name][attribute.name.to_s]
+            attribute.eq(Arel::Nodes::SqlLiteral.new(engine.connection.quote(value, column)))
           else
             attribute.eq(value)
           end

data/lib/active_record/version.rb

@@ -2,7 +2,7 @@ module ActiveRecord
   module VERSION #:nodoc:
     MAJOR = 3
     MINOR = 1
-    TINY  = 10
+    TINY  = 11
     PRE   = nil
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.')

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activerecord
 version: !ruby/object:Gem::Version
-  version: 3.1.10
+  version: 3.1.11
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-01-08 00:00:00.000000000 Z
+date: 2013-02-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,28 +16,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.1.10
+        version: 3.1.11
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.1.10
+        version: 3.1.11
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.1.10
+        version: 3.1.11
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.1.10
+        version: 3.1.11
 - !ruby/object:Gem::Dependency
   name: arel
   requirement: !ruby/object:Gem::Requirement
@@ -225,7 +225,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.0.0.preview3
+rubygems_version: 2.0.0.rc.2
 signing_key: 
 specification_version: 4
 summary: Object-relational mapper framework (part of Rails).