activerecord 3.2.11 → 3.2.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-!binary "U0hBMQ==":
-  metadata.gz: 15dff0d8e4b58a0f40ac3a7d2ca4fe47f4cffcc5
-  data.tar.gz: 4d7f2c2ce872a0a9c257842866d987eb137a2289
-!binary "U0hBNTEy":
-  metadata.gz: f22193ea0cc6f227067da8e9dea39ed7bcbe07a02a83c44ef5b7b2bb2dd344081fc9f3f4daa0b062aabf39c4190795b94bafde1aa72c4d43e54ce74a467d5377
-  data.tar.gz: f41409bf293b77322e45d4e554c670cc69d40233a484caad31b4523cf6f3029528a76302d9ae7ad8233059615fab42618b1d02a24667f76270602ffd175d27c7
+SHA1:
+  metadata.gz: 41f4755c9a0e90c223bc3546bba991c54e447232
+  data.tar.gz: 79dd37a61899bc19b93cd5348b7995c0b08b3a40
+SHA512:
+  metadata.gz: 24d5fa3615c010447bbf81eb13f38ef7fa1d90fe7f0aaefdd9a31479a79fbb44bd9945d9ab3300550c034d47b01ded7dcc51f4d5e4a48a8c4adceb2e08cbc62b
+  data.tar.gz: 340fb9aa98abe8ab95ff6b6103ee8cc2487099f7797a2c905e364ea70de8aefa33af017bf0ef8a34a2c1d8391a7dd2d892e79c108e7a376082bcb7b99e6db51f

data/CHANGELOG.md

@@ -1,4 +1,16 @@
-## Rails 3.2.11 ##
+## Rails 3.2.12 (unreleased) ##
+
+*   Quote numeric values being compared to non-numeric columns. Otherwise,
+    in some database, the string column values will be coerced to a numeric
+    allowing 0, 0.0 or false to match any string starting with a non-digit.
+
+    Example:
+
+        App.where(apikey: 0) # => SELECT * FROM users WHERE apikey = '0'
+
+    *Dylan Smith*
+
+## Rails 3.2.11 (Jan 8, 2013) ##
 
 *   Fix querying with an empty hash *Damien Mathieu* [CVE-2013-0155]
 

data/lib/active_record/connection_adapters/abstract/quoting.rb

@@ -25,13 +25,19 @@ module ActiveRecord
         when true, false
           if column && column.type == :integer
             value ? '1' : '0'
+          elsif column && [:text, :string, :binary].include?(column.type)
+            value ? "'1'" : "'0'"
           else
             value ? quoted_true : quoted_false
           end
           # BigDecimals need to be put in a non-normalized form and quoted.
         when nil        then "NULL"
-        when BigDecimal then value.to_s('F')
-        when Numeric    then value.to_s
+        when Numeric, ActiveSupport::Duration
+          value = BigDecimal === value ? value.to_s('F') : value.to_s
+          if column && ![:integer, :float, :decimal].include?(column.type)
+            value = "'#{value}'"
+          end
+          value
         when Date, Time then "'#{quoted_date(value)}'"
         when Symbol     then "'#{quote_string(value.to_s)}'"
         else

data/lib/active_record/connection_adapters/abstract_mysql_adapter.rb

@@ -199,8 +199,6 @@ module ActiveRecord
         if value.kind_of?(String) && column && column.type == :binary && column.class.respond_to?(:string_to_binary)
           s = column.class.string_to_binary(value).unpack("H*")[0]
           "x'#{s}'"
-        elsif value.kind_of?(BigDecimal)
-          value.to_s("F")
         else
           super
         end

data/lib/active_record/relation/predicate_builder.rb

@@ -51,6 +51,10 @@ module ActiveRecord
           when Class
             # FIXME: I think we need to deprecate this behavior
             attribute.eq(value.name)
+          when Integer, ActiveSupport::Duration
+            # Arel treats integers as literals, but they should be quoted when compared with strings
+            column = engine.connection.schema_cache.columns_hash[table.name][attribute.name.to_s]
+            attribute.eq(Arel::Nodes::SqlLiteral.new(engine.connection.quote(value, column)))
           else
             attribute.eq(value)
           end

data/lib/active_record/version.rb

@@ -2,7 +2,7 @@ module ActiveRecord
   module VERSION #:nodoc:
     MAJOR = 3
     MINOR = 2
-    TINY  = 11
+    TINY  = 12
     PRE   = nil
 
     STRING = [MAJOR, MINOR, TINY, PRE].compact.join('.')

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: activerecord
 version: !ruby/object:Gem::Version
-  version: 3.2.11
+  version: 3.2.12
 platform: ruby
 authors:
 - David Heinemeier Hansson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2013-01-08 00:00:00.000000000 Z
+date: 2013-02-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -16,28 +16,28 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.2.11
+        version: 3.2.12
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.2.11
+        version: 3.2.12
 - !ruby/object:Gem::Dependency
   name: activemodel
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.2.11
+        version: 3.2.12
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 3.2.11
+        version: 3.2.12
 - !ruby/object:Gem::Dependency
   name: arel
   requirement: !ruby/object:Gem::Requirement
@@ -245,7 +245,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.0.0.preview3
+rubygems_version: 2.0.0.rc.2
 signing_key: 
 specification_version: 4
 summary: Object-relational mapper framework (part of Rails).