radiant 0.6.9 → 0.7.0

data/vendor/rails/actionpack/lib/action_controller/request_forgery_protection.rb

@@ -13,33 +13,46 @@ module ActionController #:nodoc:
       base.extend(ClassMethods)
     end
     
+    # Protecting controller actions from CSRF attacks by ensuring that all forms are coming from the current web application, not a
+    # forged link from another site, is done by embedding a token based on the session (which an attacker wouldn't know) in all
+    # forms and Ajax requests generated by Rails and then verifying the authenticity of that token in the controller.  Only
+    # HTML/JavaScript requests are checked, so this will not protect your XML API (presumably you'll have a different authentication
+    # scheme there anyway).  Also, GET requests are not protected as these should be indempotent anyway.
+    #
+    # This is turned on with the <tt>protect_from_forgery</tt> method, which will check the token and raise an
+    # ActionController::InvalidAuthenticityToken if it doesn't match what was expected. You can customize the error message in
+    # production by editing public/422.html.  A call to this method in ApplicationController is generated by default in post-Rails 2.0
+    # applications.
+    #
+    # The token parameter is named <tt>authenticity_token</tt> by default. If you are generating an HTML form manually (without the
+    # use of Rails' <tt>form_for</tt>, <tt>form_tag</tt> or other helpers), you have to include a hidden field named like that and
+    # set its value to what is returned by <tt>form_authenticity_token</tt>. Same applies to manually constructed Ajax requests. To
+    # make the token available through a global variable to scripts on a certain page, you could add something like this to a view:
+    #
+    #   <%= javascript_tag "window._token = '#{form_authenticity_token}'" %>
+    #
+    # Request forgery protection is disabled by default in test environment.  If you are upgrading from Rails 1.x, add this to
+    # config/environments/test.rb:
+    #
+    #   # Disable request forgery protection in test environment
+    #   config.action_controller.allow_forgery_protection = false
+    # 
+    # == Learn more about CSRF (Cross-Site Request Forgery) attacks
+    #
+    # Here are some resources:
+    # * http://isc.sans.org/diary.html?storyid=1750
+    # * http://en.wikipedia.org/wiki/Cross-site_request_forgery
+    #
+    # Keep in mind, this is NOT a silver-bullet, plug 'n' play, warm security blanket for your rails application.
+    # There are a few guidelines you should follow:
+    # 
+    # * Keep your GET requests safe and idempotent.  More reading material:
+    #   * http://www.xml.com/pub/a/2002/04/24/deviant.html
+    #   * http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9.1.1
+    # * Make sure the session cookies that Rails creates are non-persistent.  Check in Firefox and look for "Expires: at end of session"
+    #
     module ClassMethods
-      # Protect a controller's actions from CSRF attacks by ensuring that all forms are coming from the current web application, not 
-      # a forged link from another site. This is done by embedding a token based on the session (which an attacker wouldn't know) in 
-      # all forms and Ajax requests generated by Rails and then verifying the authenticity of that token in the controller. Only
-      # HTML/JavaScript requests are checked, so this will not protect your XML API (presumably you'll have a different authentication
-      # scheme there anyway). Also, GET requests are not protected as these should be indempotent anyway.
-      #
-      # You turn this on with the #protect_from_forgery method, which will perform the check and raise 
-      # an ActionController::InvalidAuthenticityToken if the token doesn't match what was expected. And it will add 
-      # a _authenticity_token parameter to all forms that are automatically generated by Rails. You can customize the error message 
-      # given through public/422.html.
-      #
-      # Learn more about CSRF (Cross-Site Request Forgery) attacks:
-      #
-      # * http://isc.sans.org/diary.html?storyid=1750
-      # * http://en.wikipedia.org/wiki/Cross-site_request_forgery
-      #
-      # Keep in mind, this is NOT a silver-bullet, plug 'n' play, warm security blanket for your rails application.
-      # There are a few guidelines you should follow:
-      # 
-      # * Keep your GET requests safe and idempotent.  More reading material:
-      #   * http://www.xml.com/pub/a/2002/04/24/deviant.html
-      #   * http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9.1.1
-      # * Make sure the session cookies that Rails creates are non-persistent.  Check in Firefox and look for "Expires: at end of session"
-      #
-      # If you need to construct a request yourself, but still want to take advantage of forgery protection, you can grab the 
-      # authenticity_token using the form_authenticity_token helper method and make it part of the parameters yourself.
+      # Turn on request forgery protection. Bear in mind that only non-GET, HTML/JavaScript requests are checked.
       #
       # Example:
       #
@@ -54,18 +67,12 @@ module ActionController #:nodoc:
       #     skip_before_filter :verify_authenticity_token
       #   end
       #
-      # If you are upgrading from Rails 1.x, disable forgery protection to
-      # simplify your tests. Add this to config/environments/test.rb:
-      #
-      #   # Disable request forgery protection in test environment
-      #   config.action_controller.allow_forgery_protection = false
-      #
       # Valid Options:
       #
-      # * <tt>:only/:except</tt> - passed to the before_filter call.  Set which actions are verified.
-      # * <tt>:secret</tt> - Custom salt used to generate the form_authenticity_token.
+      # * <tt>:only/:except</tt> - Passed to the <tt>before_filter</tt> call.  Set which actions are verified.
+      # * <tt>:secret</tt> - Custom salt used to generate the <tt>form_authenticity_token</tt>.
       #   Leave this off if you are using the cookie session store.
-      # * <tt>:digest</tt> - Message digest used for hashing.  Defaults to 'SHA1'
+      # * <tt>:digest</tt> - Message digest used for hashing.  Defaults to 'SHA1'.
       def protect_from_forgery(options = {})
         self.request_forgery_protection_token ||= :authenticity_token
         before_filter :verify_authenticity_token, :only => options.delete(:only), :except => options.delete(:except)
@@ -92,17 +99,18 @@ module ActionController #:nodoc:
       end
     
       def verifiable_request_format?
-        request.format.html? || request.format.js?
+        request.content_type.nil? || request.content_type.verify_request?
       end
     
-      # Sets the token value for the current session.  Pass a :secret option in #protect_from_forgery to add a custom salt to the hash.
+      # Sets the token value for the current session.  Pass a <tt>:secret</tt> option
+      # in +protect_from_forgery+ to add a custom salt to the hash.
       def form_authenticity_token
-        @form_authenticity_token ||= if request_forgery_protection_options[:secret]
+        @form_authenticity_token ||= if !session.respond_to?(:session_id)
+          raise InvalidAuthenticityToken, "Request Forgery Protection requires a valid session.  Use #allow_forgery_protection to disable it, or use a valid session."
+        elsif request_forgery_protection_options[:secret]
           authenticity_token_from_session_id
         elsif session.respond_to?(:dbman) && session.dbman.respond_to?(:generate_digest)
           authenticity_token_from_cookie_session
-        elsif session.nil?
-          raise InvalidAuthenticityToken, "Request Forgery Protection requires a valid session.  Use #allow_forgery_protection to disable it, or use a valid session."
         else
           raise InvalidAuthenticityToken, "No :secret given to the #protect_from_forgery call.  Set that or use a session store capable of generating its own keys (Cookie Session Store)."
         end

data/vendor/rails/actionpack/lib/action_controller/request_profiler.rb

@@ -13,20 +13,21 @@ module ActionController
 
       def initialize(script_path)
         @quiet = false
-        define_run_method(File.read(script_path))
+        define_run_method(script_path)
         reset!
       end
 
-      def benchmark(n)
+      def benchmark(n, profiling = false)
         @quiet = true
         print '  '
+
         result = Benchmark.realtime do
           n.times do |i|
-            run
-            print i % 10 == 0 ? 'x' : '.'
-            $stdout.flush
+            run(profiling)
+            print_progress(i)
           end
         end
+
         puts
         result
       ensure
@@ -38,8 +39,33 @@ module ActionController
       end
 
       private
-        def define_run_method(script)
-          instance_eval "def run; #{script}; end", __FILE__, __LINE__
+        def define_run_method(script_path)
+          script = File.read(script_path)
+
+          source = <<-end_source
+            def run(profiling = false)
+              if profiling
+                RubyProf.resume do
+                  #{script}
+                end
+              else
+                #{script}
+              end
+
+              old_request_count = request_count
+              reset!
+              self.request_count = old_request_count
+            end
+          end_source
+
+          instance_eval source, script_path, 1
+        end
+
+        def print_progress(i)
+          print "\n  " if i % 60 == 0
+          print ' ' if i % 10 == 0
+          print '.'
+          $stdout.flush
         end
     end
 
@@ -72,21 +98,22 @@ module ActionController
     def profile(sandbox)
       load_ruby_prof
 
-      results = RubyProf.profile { benchmark(sandbox) }
+      benchmark(sandbox, true)
+      results = RubyProf.stop
 
       show_profile_results results
       results
     end
 
-    def benchmark(sandbox)
+    def benchmark(sandbox, profiling = false)
       sandbox.request_count = 0
-      elapsed = sandbox.benchmark(options[:n]).to_f
+      elapsed = sandbox.benchmark(options[:n], profiling).to_f
       count = sandbox.request_count.to_i
       puts '%.2f sec, %d requests, %d req/sec' % [elapsed, count, count / elapsed]
     end
 
     def warmup(sandbox)
-      Benchmark.realtime { sandbox.run }
+      Benchmark.realtime { sandbox.run(false) }
     end
 
     def default_options
@@ -98,8 +125,9 @@ module ActionController
       OptionParser.new do |opt|
         opt.banner = "USAGE: #{$0} [options] [session script path]"
 
-        opt.on('-n', '--times [0000]', 'How many requests to process. Defaults to 100.') { |v| options[:n] = v.to_i }
+        opt.on('-n', '--times [100]', 'How many requests to process. Defaults to 100.') { |v| options[:n] = v.to_i if v }
         opt.on('-b', '--benchmark', 'Benchmark instead of profiling') { |v| options[:benchmark] = v }
+        opt.on('-m', '--measure [mode]', 'Which ruby-prof measure mode to use: process_time, wall_time, cpu_time, allocations, or memory. Defaults to process_time.') { |v| options[:measure] = v }
         opt.on('--open [CMD]', 'Command to open profile results. Defaults to "open %s &"') { |v| options[:open] = v }
         opt.on('-h', '--help', 'Show this help') { puts opt; exit }
 
@@ -116,8 +144,11 @@ module ActionController
     protected
       def load_ruby_prof
         begin
+          gem 'ruby-prof', '>= 0.6.1'
           require 'ruby-prof'
-          #RubyProf.measure_mode = RubyProf::ALLOCATED_OBJECTS
+          if mode = options[:measure]
+            RubyProf.measure_mode = RubyProf.const_get(mode.upcase)
+          end
         rescue LoadError
           abort '`gem install ruby-prof` to use the profiler'
         end

data/vendor/rails/actionpack/lib/action_controller/rescue.rb

@@ -26,7 +26,7 @@ module ActionController #:nodoc:
 
     DEFAULT_RESCUE_TEMPLATE = 'diagnostics'
     DEFAULT_RESCUE_TEMPLATES = {
-      'ActionController::MissingTemplate' => 'missing_template',
+      'ActionView::MissingTemplate'       => 'missing_template',
       'ActionController::RoutingError'    => 'routing_error',
       'ActionController::UnknownAction'   => 'unknown_action',
       'ActionView::TemplateError'         => 'template_error'
@@ -58,33 +58,35 @@ module ActionController #:nodoc:
       # Rescue exceptions raised in controller actions.
       #
       # <tt>rescue_from</tt> receives a series of exception classes or class
-      # names, and a trailing :with option with the name of a method or a Proc
-      # object to be called to handle them. Alternatively a block can be given.
+      # names, and a trailing <tt>:with</tt> option with the name of a method
+      # or a Proc object to be called to handle them. Alternatively a block can
+      # be given.
       #
       # Handlers that take one argument will be called with the exception, so
       # that the exception can be inspected when dealing with it.
       #
       # Handlers are inherited. They are searched from right to left, from
       # bottom to top, and up the hierarchy. The handler of the first class for
-      # which exception.is_a?(klass) holds true is the one invoked, if any.
+      # which <tt>exception.is_a?(klass)</tt> holds true is the one invoked, if
+      # any.
       #
-      # class ApplicationController < ActionController::Base
-      #   rescue_from User::NotAuthorized, :with => :deny_access # self defined exception
-      #   rescue_from ActiveRecord::RecordInvalid, :with => :show_errors
+      #   class ApplicationController < ActionController::Base
+      #     rescue_from User::NotAuthorized, :with => :deny_access # self defined exception
+      #     rescue_from ActiveRecord::RecordInvalid, :with => :show_errors
       #
-      #   rescue_from 'MyAppError::Base' do |exception|
-      #     render :xml => exception, :status => 500
-      #   end
-      #
-      #   protected
-      #     def deny_access
-      #       ...
+      #     rescue_from 'MyAppError::Base' do |exception|
+      #       render :xml => exception, :status => 500
       #     end
       #
-      #     def show_errors(exception)
-      #       exception.record.new_record? ? ...
-      #     end
-      # end
+      #     protected
+      #       def deny_access
+      #         ...
+      #       end
+      #
+      #       def show_errors(exception)
+      #         exception.record.new_record? ? ...
+      #       end
+      #   end
       def rescue_from(*klasses, &block)
         options = klasses.extract_options!
         unless options.has_key?(:with)
@@ -153,7 +155,7 @@ module ActionController #:nodoc:
       # If the file doesn't exist, the body of the response will be left empty.
       def render_optional_error_file(status_code)
         status = interpret_status(status_code)
-        path = "#{RAILS_ROOT}/public/#{status[0,3]}.html"
+        path = "#{Rails.public_path}/#{status[0,3]}.html"
         if File.exist?(path)
           render :file => path, :status => status
         else
@@ -165,7 +167,7 @@ module ActionController #:nodoc:
       # method if you wish to redefine the meaning of a local request to
       # include remote IP addresses or other criteria.
       def local_request? #:doc:
-        request.remote_addr == LOCALHOST and request.remote_ip == LOCALHOST
+        request.remote_addr == LOCALHOST && request.remote_ip == LOCALHOST
       end
 
       # Render detailed diagnostics for unhandled exceptions rescued from
@@ -197,10 +199,8 @@ module ActionController #:nodoc:
     private
       def perform_action_with_rescue #:nodoc:
         perform_action_without_rescue
-      rescue Exception => exception  # errors from action performed
-        return if rescue_action_with_handler(exception)
-        
-        rescue_action(exception)
+      rescue Exception => exception
+        rescue_action_with_handler(exception) || rescue_action(exception)
       end
 
       def rescues_path(template_name)

data/vendor/rails/actionpack/lib/action_controller/resources.rb

@@ -44,13 +44,14 @@ module ActionController
   module Resources
     class Resource #:nodoc:
       attr_reader :collection_methods, :member_methods, :new_methods
-      attr_reader :path_prefix, :name_prefix
+      attr_reader :path_prefix, :name_prefix, :path_segment
       attr_reader :plural, :singular
       attr_reader :options
 
       def initialize(entities, options)
         @plural   ||= entities
         @singular ||= options[:singular] || plural.to_s.singularize
+        @path_segment = options.delete(:as) || @plural
 
         @options = options
 
@@ -75,11 +76,13 @@ module ActionController
       end
 
       def path
-        @path ||= "#{path_prefix}/#{plural}"
+        @path ||= "#{path_prefix}/#{path_segment}"
       end
 
       def new_path
-        @new_path ||= "#{path}/new"
+        new_action = self.options[:path_names][:new] if self.options[:path_names]
+        new_action ||= Base.resources_path_names[:new]
+        @new_path ||= "#{path}/#{new_action}"
       end
 
       def member_path
@@ -188,7 +191,7 @@ module ActionController
     #     end
     #   end
     #
-    # Along with the routes themselves, #resources generates named routes for use in
+    # Along with the routes themselves, +resources+ generates named routes for use in
     # controllers and views. <tt>map.resources :messages</tt> produces the following named routes and helpers:
     #
     #   Named Route   Helpers
@@ -205,7 +208,7 @@ module ActionController
     #   edit_message  edit_message_url(id), hash_for_edit_message_url(id),
     #                 edit_message_path(id), hash_for_edit_message_path(id)
     #
-    # You can use these helpers instead of #url_for or methods that take #url_for parameters. For example:
+    # You can use these helpers instead of +url_for+ or methods that take +url_for+ parameters. For example:
     #
     #   redirect_to :controller => 'messages', :action => 'index'
     #   # and
@@ -226,17 +229,53 @@ module ActionController
     #
     #   <% form_for :message, @message, :url => message_path(@message), :html => {:method => :put} do |f| %>
     #
-    # The #resources method accepts the following options to customize the resulting routes:
-    # * <tt>:collection</tt> - add named routes for other actions that operate on the collection.
+    # or
+    #
+    #   <% form_for @message do |f| %>
+    #
+    # which takes into account whether <tt>@message</tt> is a new record or not and generates the
+    # path and method accordingly.
+    #
+    # The +resources+ method accepts the following options to customize the resulting routes:
+    # * <tt>:collection</tt> - Add named routes for other actions that operate on the collection.
     #   Takes a hash of <tt>#{action} => #{method}</tt>, where method is <tt>:get</tt>/<tt>:post</tt>/<tt>:put</tt>/<tt>:delete</tt>
-    #   or <tt>:any</tt> if the method does not matter.  These routes map to a URL like /messages/rss, with a route of rss_messages_url.
-    # * <tt>:member</tt> - same as :collection, but for actions that operate on a specific member.
-    # * <tt>:new</tt> - same as :collection, but for actions that operate on the new resource action.
-    # * <tt>:controller</tt> - specify the controller name for the routes.
-    # * <tt>:singular</tt> - specify the singular name used in the member routes.
-    # * <tt>:requirements</tt> - set custom routing parameter requirements.
-    # * <tt>:conditions</tt> - specify custom routing recognition conditions.  Resources sets the :method value for the method-specific routes.
-    # * <tt>:path_prefix</tt> - set a prefix to the routes with required route variables.
+    #   or <tt>:any</tt> if the method does not matter.  These routes map to a URL like /messages/rss, with a route of +rss_messages_url+.
+    # * <tt>:member</tt> - Same as <tt>:collection</tt>, but for actions that operate on a specific member.
+    # * <tt>:new</tt> - Same as <tt>:collection</tt>, but for actions that operate on the new resource action.
+    # * <tt>:controller</tt> - Specify the controller name for the routes.
+    # * <tt>:singular</tt> - Specify the singular name used in the member routes.
+    # * <tt>:requirements</tt> - Set custom routing parameter requirements.
+    # * <tt>:conditions</tt> - Specify custom routing recognition conditions.  Resources sets the <tt>:method</tt> value for the method-specific routes.
+    # * <tt>:as</tt> - Specify a different resource name to use in the URL path. For example:
+    #     # products_path == '/productos'
+    #     map.resources :products, :as => 'productos' do |product|
+    #       # product_reviews_path(product) == '/productos/1234/comentarios'
+    #       product.resources :product_reviews, :as => 'comentarios'
+    #     end
+    #
+    # * <tt>:has_one</tt> - Specify nested resources, this is a shorthand for mapping singleton resources beneath the current.
+    # * <tt>:has_many</tt> - Same has <tt>:has_one</tt>, but for plural resources.
+    #
+    #   You may directly specify the routing association with +has_one+ and +has_many+ like:
+    #
+    #     map.resources :notes, :has_one => :author, :has_many => [:comments, :attachments]
+    #
+    #   This is the same as:
+    #
+    #     map.resources :notes do |notes|
+    #       notes.resource  :author
+    #       notes.resources :comments
+    #       notes.resources :attachments
+    #     end
+    #
+    # * <tt>:path_names</tt> - Specify different names for the 'new' and 'edit' actions. For example:
+    #     # new_products_path == '/productos/nuevo'
+    #     map.resources :products, :as => 'productos', :path_names => { :new => 'nuevo', :edit => 'editar' }
+    #
+    #   You can also set default action names from an environment, like this:
+    #     config.action_controller.resources_path_names = { :new => 'nuevo', :edit => 'editar' }
+    #
+    # * <tt>:path_prefix</tt> - Set a prefix to the routes with required route variables.
     #
     #   Weblog comments usually belong to a post, so you might use resources like:
     #
@@ -249,7 +288,7 @@ module ActionController
     #       article.resources :comments
     #     end
     #
-    #   The comment resources work the same, but must now include a value for :article_id.
+    #   The comment resources work the same, but must now include a value for <tt>:article_id</tt>.
     #
     #     article_comments_url(@article)
     #     article_comment_url(@article, @comment)
@@ -257,13 +296,13 @@ module ActionController
     #     article_comments_url(:article_id => @article)
     #     article_comment_url(:article_id => @article, :id => @comment)
     #
-    # * <tt>:name_prefix</tt> - define a prefix for all generated routes, usually ending in an underscore.
+    # * <tt>:name_prefix</tt> - Define a prefix for all generated routes, usually ending in an underscore.
     #   Use this if you have named routes that may clash.
     #
     #     map.resources :tags, :path_prefix => '/books/:book_id', :name_prefix => 'book_'
     #     map.resources :tags, :path_prefix => '/toys/:toy_id',   :name_prefix => 'toy_'
     #
-    # You may also use :name_prefix to override the generic named routes in a nested resource:
+    # You may also use <tt>:name_prefix</tt> to override the generic named routes in a nested resource:
     # 
     #   map.resources :articles do |article|
     #     article.resources :comments, :name_prefix => nil
@@ -304,7 +343,7 @@ module ActionController
     #   # --> GET /categories/7/messages/1
     #   #     has named route "category_message"
     #
-    # The #resources method sets HTTP method restrictions on the routes it generates. For example, making an
+    # The +resources+ method sets HTTP method restrictions on the routes it generates. For example, making an
     # HTTP POST on <tt>new_message_url</tt> will raise a RoutingError exception. The default route in
     # <tt>config/routes.rb</tt> overrides this and allows invalid HTTP methods for resource routes.
     def resources(*entities, &block)
@@ -325,7 +364,7 @@ module ActionController
     #
     # See map.resources for general conventions.  These are the main differences:
     # * A singular name is given to map.resource.  The default controller name is still taken from the plural name.
-    # * To specify a custom plural name, use the :plural option.  There is no :singular option.
+    # * To specify a custom plural name, use the <tt>:plural</tt> option.  There is no <tt>:singular</tt> option.
     # * No default index route is created for the singleton resource controller.
     # * When nesting singleton resources, only the singular name is used as the path prefix (example: 'account/messages/1')
     #
@@ -367,7 +406,7 @@ module ActionController
     #     end
     #   end
     #
-    # Along with the routes themselves, #resource generates named routes for
+    # Along with the routes themselves, +resource+ generates named routes for
     # use in controllers and views. <tt>map.resource :account</tt> produces
     # these named routes and helpers:
     #
@@ -485,8 +524,12 @@ module ActionController
         resource.member_methods.each do |method, actions|
           actions.each do |action|
             action_options = action_options_for(action, resource, method)
-            map.named_route("#{action}_#{resource.name_prefix}#{resource.singular}", "#{resource.member_path}#{resource.action_separator}#{action}", action_options)
-            map.named_route("formatted_#{action}_#{resource.name_prefix}#{resource.singular}", "#{resource.member_path}#{resource.action_separator}#{action}.:format",action_options)
+
+            action_path = resource.options[:path_names][action] if resource.options[:path_names].is_a?(Hash)
+            action_path ||= Base.resources_path_names[action] || action
+
+            map.named_route("#{action}_#{resource.name_prefix}#{resource.singular}", "#{resource.member_path}#{resource.action_separator}#{action_path}", action_options)
+            map.named_route("formatted_#{action}_#{resource.name_prefix}#{resource.singular}", "#{resource.member_path}#{resource.action_separator}#{action_path}.:format",action_options)
           end
         end