padrino-core 0.10.7 → 0.11.0

data/lib/padrino-core/application/rendering/extensions/erubis.rb

@@ -0,0 +1,55 @@
+begin
+  require 'erubis'
+
+  module Padrino
+    module Erubis
+      ##
+      # SafeBufferEnhancer is an Erubis Enhancer that compiles templates that
+      # are fit for using ActiveSupport::SafeBuffer as a Buffer.
+      #
+      # @api private
+      module SafeBufferEnhancer
+        def add_expr_literal(src, code)
+          src << " #{@bufvar}.concat((" << code << ').to_s);'
+        end
+
+        def add_expr_escaped(src, code)          
+          src << " #{@bufvar}.safe_concat " << code << ';'
+        end
+
+        def add_text(src, text)
+          src << " #{@bufvar}.safe_concat '" << escape_text(text) << "';" unless text.empty?
+        end
+      end
+
+      ##
+      # SafeBufferTemplate is the classic Erubis template, augmented with
+      # SafeBufferEnhancer.
+      #
+      # @api private
+      class SafeBufferTemplate < ::Erubis::Eruby
+        include SafeBufferEnhancer
+      end
+
+      ##
+      # Modded ErubisTemplate that doesn't insist in an String as output
+      # buffer.
+      #
+      # @api private
+      class Template < Tilt::ErubisTemplate
+        def precompiled_preamble(locals)
+          old_postamble = super.split("\n")[0..-2]
+          [old_postamble, "#{@outvar} = _buf = (#{@outvar} || ActiveSupport::SafeBuffer.new)"].join("\n")
+        end
+      end
+    end
+  end
+  
+  Tilt.prefer Padrino::Erubis::Template, :erb
+
+  if defined? Padrino::Rendering
+    Padrino::Rendering.engine_configurations[:erb] = 
+      {:engine_class => Padrino::Erubis::SafeBufferTemplate}
+  end
+rescue LoadError
+end

data/lib/padrino-core/application/rendering/extensions/haml.rb

@@ -0,0 +1,26 @@
+begin
+  require 'haml'
+  require 'haml/helpers/xss_mods'
+
+  module Haml
+    module Helpers
+      include XssMods
+    end
+
+    module Util
+      def self.rails_xss_safe?
+        true
+      end
+    end
+  end
+
+  if defined? Padrino::Rendering
+    Padrino::Rendering.engine_configurations[:haml] =
+      {:escape_html => true}
+
+    class Tilt::HamlTemplate
+      include Padrino::Rendering::SafeTemplate
+    end
+  end
+rescue LoadError
+end

data/lib/padrino-core/application/rendering/extensions/slim.rb

@@ -0,0 +1,14 @@
+begin
+  require 'slim'
+
+  if defined? Padrino::Rendering
+    Padrino::Rendering.engine_configurations[:slim] =
+      {:generator => Temple::Generators::RailsOutputBuffer,
+      :buffer => "@_out_buf", :use_html_safe => true}
+
+    class Slim::Template
+      include Padrino::Rendering::SafeTemplate
+    end
+  end
+rescue LoadError
+end

data/lib/padrino-core/application/routing.rb

@@ -11,6 +11,9 @@ class Sinatra::Request
   def controller
     route_obj && route_obj.controller
   end
+  def action
+    route_obj && route_obj.action
+  end
 end
 
 ##
@@ -28,8 +31,8 @@ class HttpRouter
       @route    = path.route
       @params ||= {}
       @params.update(env['router.params'])
-      @block_params = if path.route.is_a?(HttpRouter::RegexRoute)
-        params_list = env['router.request'].extra_env['router.regex_match'].to_a
+      @block_params = if match_data = env['router.request'].extra_env['router.regex_match']
+        params_list = match_data.to_a
         params_list.shift
         @params[:captures] = params_list
         params_list
@@ -47,7 +50,6 @@ class HttpRouter
         (@route.before_filters - settings.filters[:before]).each { |block| instance_eval(&block) }
         @layout = path.route.use_layout if path.route.use_layout
         @route.custom_conditions.each { |block| pass if block.bind(self).call == false } if @route.custom_conditions
-        @block_params     = @block_params[0, @route.dest.arity] if @route.dest.arity > 0
         halt_response     = catch(:halt) { route_eval { @route.dest[self, @block_params] } }
         @_response_buffer = halt_response.is_a?(Array) ? halt_response.last : halt_response
         successful        = true
@@ -62,7 +64,7 @@ class HttpRouter
 
   # @private
   class Route
-    attr_accessor :use_layout, :controller, :cache, :cache_key, :cache_expires_in
+    attr_accessor :use_layout, :controller, :action, :cache, :cache_key, :cache_expires_in, :parent
 
     def before_filters(&block)
       @_before_filters ||= []
@@ -84,6 +86,40 @@ class HttpRouter
 
       @_custom_conditions
     end
+
+    def significant_variable_names
+      @significant_variable_names ||= @original_path.nil? ? [] : @original_path.scan(/(^|[^\\])[:\*]([a-zA-Z0-9_]+)/).map{|p| p.last.to_sym}
+    end
+  end
+
+  class Node::Path
+    def to_code
+      path_ivar = inject_root_ivar(self)
+      "#{"if !callback && request.path.size == 1 && request.path.first == '' && (request.rack_request.head? || request.rack_request.get?) && request.rack_request.path_info[-1] == ?/
+        catch(:pass) do
+          response = ::Rack::Response.new
+          response.redirect(request.rack_request.path_info[0, request.rack_request.path_info.size - 1], 302)
+          return response.finish
+        end
+      end" if router.redirect_trailing_slash?}
+
+      #{"if request.#{router.ignore_trailing_slash? ? 'path_finished?' : 'path.empty?'}" unless route.match_partially}
+        catch(:pass) do
+          if callback
+            request.called = true
+            callback.call(Response.new(request, #{path_ivar}))
+          else
+            env = request.rack_request.dup.env
+            env['router.request'] = request
+            env['router.params'] ||= {}
+            #{"env['router.params'].merge!(Hash[#{param_names.inspect}.zip(request.params)])" if dynamic?}
+            @router.rewrite#{"_partial" if route.match_partially}_path_info(env, request)
+            response = @router.process_destination_path(#{path_ivar}, env)
+            return response unless router.pass_on_response(response)
+          end
+        end
+      #{"end" unless route.match_partially}"
+    end
   end
 end
 
@@ -98,7 +134,7 @@ module Padrino
     def apply?(request)
       detect = @args.any? do |arg|
         case arg
-        when Symbol then request.route_obj && (request.route_obj.named == arg or request.route_obj.named == [@scoped_controller, arg].flatten.join("_").to_sym)
+        when Symbol then request.route_obj && (request.route_obj.name == arg or request.route_obj.name == [@scoped_controller, arg].flatten.join("_").to_sym)
         else             arg === request.path_info
         end
       end || @options.any? do |name, val|
@@ -166,7 +202,7 @@ module Padrino
     # Class methods responsible for enhanced routing for controllers.
     module ClassMethods
       ##
-      # Method for organize in a better way our routes.
+      # Method to organize our routes in a better way.
       #
       # @param [Array] args
       #   Controller arguments.
@@ -237,8 +273,8 @@ module Padrino
       #     get :index, :map => "/:lang" do; "params[:lang] == :de"; end
       #   end
       #
-      # In a controller before and after filters are scoped and didn't affect other controllers or main app.
-      # In a controller layout are scoped and didn't affect others controllers and main app.
+      # In a controller, before and after filters are scoped and don't affect other controllers or the main app.
+      # In a controller, layouts are scoped and don't affect other controllers or the main app.
       #
       # @example
       #   controller :posts do
@@ -449,7 +485,8 @@ module Padrino
       #
       def recognize_path(path)
         responses = @router.recognize(Rack::MockRequest.env_for(path))
-        [responses[0].path.route.named, responses[0].params]
+        responses = responses[0] if responses[0].is_a?(Array)
+        [responses[0].path.route.name, responses[0].params]
       end
 
       ##
@@ -470,11 +507,12 @@ module Padrino
           params[:format] = params[:format].to_s unless params[:format].nil?
           params = value_to_param(params)
         end
-        url = if params_array.empty?
-          compiled_router.url(name, params)
-        else
-          compiled_router.url(name, *(params_array << params))
-        end
+        url =
+          if params_array.empty?
+            compiled_router.path(name, params)
+          else
+            compiled_router.path(name, *(params_array << params))
+          end
         url[0,0] = conform_uri(uri_root) if defined?(uri_root)
         url[0,0] = conform_uri(ENV['RACK_BASE_URI']) if ENV['RACK_BASE_URI']
         url = "/" if url.blank?
@@ -556,8 +594,17 @@ module Padrino
           # Do padrino parsing. We dup options so we can build HEAD request correctly
           route_options = options.dup
           route_options[:provides] = @_provides if @_provides
+
+          # CSRF protection is always active except when explicitly switched off
+          if allow_disabled_csrf
+            unless route_options[:csrf_protection] == false
+              route_options[:csrf_protection] = true
+            end
+          end
+
           path, *route_options[:with] = path if path.is_a?(Array)
-          path, name, options, route_options = *parse_route(path, route_options, verb)
+          action = path
+          path, name, route_parents, options, route_options = *parse_route(path, route_options, verb)
           options.reverse_merge!(@_conditions) if @_conditions
 
           # Sinatra defaults
@@ -572,20 +619,22 @@ module Padrino
 
           # HTTPRouter route construction
           route = router.add(path, route_options)
-          route.name(name) if name
+          route.name = name if name
+          route.action = action
           priority_name = options.delete(:priority) || :normal
           priority = ROUTE_PRIORITY[priority_name] or raise("Priority #{priority_name} not recognized, try #{ROUTE_PRIORITY.keys.join(', ')}")
           route.cache = options.key?(:cache) ? options.delete(:cache) : @_cache
-          route.send(verb.downcase.to_sym)
-          route.host(options.delete(:host)) if options.key?(:host)
-          route.user_agent(options.delete(:agent)) if options.key?(:agent)
+          route.parent = route_parents ? (route_parents.count == 1 ? route_parents.first : route_parents) : route_parents
+          route.add_request_method(verb.downcase.to_sym)
+          route.host = options.delete(:host) if options.key?(:host)
+          route.user_agent = options.delete(:agent) if options.key?(:agent)
           if options.key?(:default_values)
             defaults = options.delete(:default_values)
-            route.default(defaults) if defaults
+            route.add_default_values(defaults) if defaults
           end
           options.delete_if do |option, args|
-            if route.send(:significant_variable_names).include?(option)
-              route.matching(option => Array(args).first)
+            if route.significant_variable_names.include?(option)
+              route.add_match_with(option => Array(args).first)
               true
             end
           end
@@ -646,8 +695,8 @@ module Padrino
 
             if @_use_format or format_params = options[:provides]
               process_path_for_provides(path, format_params)
-              options[:matching] ||= {}
-              options[:matching][:format] = /[^\.]+/
+              # options[:add_match_with] ||= {}
+              # options[:add_match_with][:format] = /[^\.]+/
             end
 
             absolute_map = map && map[0] == ?/
@@ -657,14 +706,14 @@ module Padrino
               if map.blank? and !absolute_map
                 controller_path = controller.join("/")
                 path.gsub!(%r{^\(/\)|/\?}, "")
-                path = File.join(controller_path, path)
+                path = File.join(controller_path, path)  unless @_map
               end
               # Here we build the correct name route
             end
 
             # Now we need to parse our 'parent' params and parent scope
             if !absolute_map and parent_params = options.delete(:parent) || @_parents
-              parent_params = Array(@_parents) + Array(parent_params)
+              parent_params = (Array(@_parents) + Array(parent_params)).uniq
               path = process_path_for_parent_params(path, parent_params)
             end
 
@@ -692,7 +741,7 @@ module Padrino
           # Merge in option defaults
           options.reverse_merge!(:default_values => @_defaults)
 
-          [path, name, options, route_options]
+          [path, name, parent_params, options, route_options]
         end
 
         ##
@@ -758,7 +807,7 @@ module Padrino
           condition do
             mime_types        = types.map { |t| mime_type(t) }
             url_format        = params[:format].to_sym if params[:format]
-            accepts           = request.accept.map { |a| a.split(";")[0].strip }
+            accepts           = request.accept.map { |a| a.to_str }
 
             # per rfc2616-sec14:
             # Assume */* if no ACCEPT header is given.
@@ -793,6 +842,21 @@ module Padrino
             matched_format
           end
         end
+
+        ##
+        # Implements CSRF checking when `allow_disabled_csrf` is set to true.
+        #
+        # This condition is always on, except when it is explicitly switched
+        # off.
+        #
+        # @example
+        #   post("/", :csrf_protection => false)
+        #
+        def csrf_protection(on = true)
+          if on
+            condition { halt 403 if request.env['protection.csrf.failed'] }
+          end
+        end
     end
 
     ##
@@ -836,7 +900,7 @@ module Padrino
         else
           path_params << params
         end
-        @route.url(*path_params)
+        @route.path(*path_params)
       end
 
       ##
@@ -905,13 +969,19 @@ module Padrino
         end
 
         def dispatch!
-          static! if settings.static? && (request.get? || request.head?)
-          route!
+          invoke do
+            static! if settings.static? && (request.get? || request.head?)
+            route!
+          end
         rescue ::Exception => boom
-          filter! :before
-          handle_exception!(boom)
+          filter! :before  if boom.kind_of? ::Sinatra::NotFound
+          invoke { @boom_handled = handle_exception!(boom) }
         ensure
-          filter! :after unless env['sinatra.static_file']
+          @boom_handled  or begin
+            filter! :after  unless env['sinatra.static_file']
+          rescue ::Exception => boom
+            invoke { handle_exception!(boom) } unless @env['sinatra.error']
+          end
         end
 
         def route!(base=settings, pass_block=nil)
@@ -919,9 +989,10 @@ module Padrino
           if base.compiled_router and match = base.compiled_router.call(@request.env)
             if match.respond_to?(:each)
               route_eval do
-                match[1].each {|k,v| response[k] = v}
+                match[1].each { |k,v| response[k] = v }
                 status match[0]
                 route_missing if match[0] == 404
+                route_missing if allow = response['Allow'] and allow.include?(request.env['REQUEST_METHOD'])
               end
             end
           else

data/lib/padrino-core/cli/base.rb

@@ -6,17 +6,18 @@ module Padrino
     class Base < Thor
       include Thor::Actions
 
-      class_option :chdir, :type => :string, :aliases => "-c", :desc => "Change to dir before starting"
-      class_option :environment, :type => :string,  :aliases => "-e", :required => true, :default => :development, :desc => "Padrino Environment"
+      class_option :chdir, :type => :string, :aliases => "-c", :desc => "Change to dir before starting."
+      class_option :environment, :type => :string,  :aliases => "-e", :required => true, :default => :development, :desc => "Padrino Environment."
       class_option :help, :type => :boolean, :desc => "Show help usage"
 
-      desc "start", "Starts the Padrino application"
-      method_option :server,      :type => :string,  :aliases => "-a", :desc => "Rack Handler (default: autodetect)"
-      method_option :host,        :type => :string,  :aliases => "-h", :required => true, :default => "0.0.0.0", :desc => "Bind to HOST address"
-      method_option :port,        :type => :numeric, :aliases => "-p", :required => true, :default => 3000, :desc => "Use PORT"
-      method_option :daemonize,   :type => :boolean, :aliases => "-d", :desc => "Run daemonized in the background"
-      method_option :pid,         :type => :string,  :aliases => "-i", :desc => "File to store pid"
-      method_option :debug,       :type => :boolean,                   :desc => "Set debugging flags"
+      desc "start", "Starts the Padrino application (alternatively use 's')."
+      map "s" => :start
+      method_option :server,    :type => :string,  :aliases => "-a", :desc => "Rack Handler (default: autodetect)"
+      method_option :host,      :type => :string,  :aliases => "-h", :required => true, :default => '127.0.0.1', :desc => "Bind to HOST address."
+      method_option :port,      :type => :numeric, :aliases => "-p", :required => true, :default => 3000, :desc => "Use PORT."
+      method_option :daemonize, :type => :boolean, :aliases => "-d", :desc => "Run daemonized in the background."
+      method_option :pid,       :type => :string,  :aliases => "-i", :desc => "File to store pid."
+      method_option :debug,     :type => :boolean,                   :desc => "Set debugging flags."
       def start
         prepare :start
         require File.expand_path("../adapter", __FILE__)
@@ -24,12 +25,8 @@ module Padrino
         Padrino::Cli::Adapter.start(options)
       end
 
-      desc "s", "Starts the Padrino application"
-      def s
-        invoke :start
-      end
-
-      desc "stop", "Stops the Padrino application"
+      desc "stop", "Stops the Padrino application (alternatively use 'st')."
+      map "st" => :stop
       method_option :pid, :type => :string,  :aliases => "-p", :desc => "File to store pid", :default => 'tmp/pids/server.pid'
       def stop
         prepare :stop
@@ -37,7 +34,7 @@ module Padrino
         Padrino::Cli::Adapter.stop(options)
       end
 
-      desc "rake", "Execute rake tasks"
+      desc "rake", "Execute rake tasks."
       method_option :environment, :type => :string,  :aliases => "-e", :required => true, :default => :development
       method_option :list,        :type => :string,  :aliases => "-T", :desc => "Display the tasks (matching optional PATTERN) with descriptions, then exit."
       method_option :trace,       :type => :boolean, :aliases => "-t", :desc => "Turn on invoke/execute tracing, enable full backtrace."
@@ -51,12 +48,15 @@ module Padrino
         ARGV.concat(args)
         puts "=> Executing Rake #{ARGV.join(' ')} ..."
         load File.expand_path('../rake.rb', __FILE__)
-        require File.expand_path('config/boot.rb')
-        PadrinoTasks.init(true)
+        Rake.application.init
+        Rake.application.instance_variable_set(:@rakefile, __FILE__)
+        load File.expand_path('Rakefile')
+        Rake.application.top_level
       end
 
-      desc "console", "Boots up the Padrino application irb console"
-      def console
+      desc "console", "Boots up the Padrino application irb console (alternatively use 'c')."
+      map "c" => :console
+      def console(*args)
         prepare :console
         require File.expand_path("../../version", __FILE__)
         ARGV.clear
@@ -68,12 +68,8 @@ module Padrino
         IRB.start
       end
 
-      desc "c", "Boots up the Padrino application irb console"
-      def c(*args)
-        invoke(:console, args)
-      end
-
-      desc "generate", "Executes the Padrino generator with given options."
+      desc "generate", "Executes the Padrino generator with given options (alternatively use 'gen' or 'g')."
+      map ["gen", "g"] => :generate
       def generate(*args)
         # Build Padrino g as an alias of padrino-gen
         begin
@@ -90,23 +86,30 @@ module Padrino
         end
       end
 
-      desc "g", "Executes the Padrino generator with given options."
-      def g(*args)
-        invoke(:generate, args)
-      end
-
-      desc "gen", "Executes the Padrino generator with given options."
-      def gen(*args)
-        invoke(:generate, args)
-      end
-
-      desc "version", "Show current Padrino Version"
-      map "-v" => :version, "--version" => :version
+      desc "version", "Show current Padrino version."
+      map ["-v", "--version"] => :version
       def version
         require 'padrino-core/version'
         puts "Padrino v. #{Padrino.version}"
       end
 
+      desc "runner", "Run a piece of code in the Padrino application environment (alternatively use 'run' or 'r')."
+      map ["run", "r"] => :runner
+      def runner(*args)
+        prepare :runner
+
+        code_or_file = args.shift
+        abort "Please specify code or file" if code_or_file.nil?
+
+        require File.expand_path('config/boot.rb')
+
+        if File.exist?(code_or_file)
+          eval(File.read(code_or_file), nil, code_or_file)
+        else
+          eval(code_or_file)
+        end
+      end
+
       private
         def prepare(task)
           if options.help?