radiant 0.9.1 → 1.0.0.rc1

data/vendor/rails/actionpack/lib/action_controller/session/mem_cache_store.rb

@@ -1,6 +1,6 @@
 begin
   require_library_or_gem 'memcache'
-
+  require 'thread'
   module ActionController
     module Session
       class MemCacheStore < AbstractStore
@@ -43,6 +43,15 @@ begin
           rescue MemCache::MemCacheError, Errno::ECONNREFUSED
             return false
           end
+
+          def destroy(env)
+            if sid = current_session_id(env)
+              @pool.delete(sid)
+            end
+          rescue MemCache::MemCacheError, Errno::ECONNREFUSED
+            false
+          end
+
       end
     end
   end

data/vendor/rails/actionpack/lib/action_controller/test_process.rb

@@ -450,7 +450,7 @@ module ActionController #:nodoc:
     def xml_http_request(request_method, action, parameters = nil, session = nil, flash = nil)
       @request.env['HTTP_X_REQUESTED_WITH'] = 'XMLHttpRequest'
       @request.env['HTTP_ACCEPT'] =  [Mime::JS, Mime::HTML, Mime::XML, 'text/xml', Mime::ALL].join(', ')
-      returning __send__(request_method, action, parameters, session, flash) do
+      __send__(request_method, action, parameters, session, flash).tap do
         @request.env.delete 'HTTP_X_REQUESTED_WITH'
         @request.env.delete 'HTTP_ACCEPT'
       end

data/vendor/rails/actionpack/lib/action_controller/url_rewriter.rb

@@ -1,3 +1,5 @@
+require 'uri'
+
 module ActionController
   # In <b>routes.rb</b> one defines URL-to-controller mappings, but the reverse
   # is also possible: an URL can be generated from one of your routing definitions.
@@ -92,6 +94,14 @@ module ActionController
   #     end
   #   end
   module UrlWriter
+    RESERVED_PCHAR = ':@&=+$,;%'
+    SAFE_PCHAR = "#{URI::REGEXP::PATTERN::UNRESERVED}#{RESERVED_PCHAR}"
+    if RUBY_VERSION >= '1.9'
+      UNSAFE_PCHAR = Regexp.new("[^#{SAFE_PCHAR}]", false).freeze
+    else
+      UNSAFE_PCHAR = Regexp.new("[^#{SAFE_PCHAR}]", false, 'N').freeze
+    end
+
     def self.included(base) #:nodoc:
       ActionController::Routing::Routes.install_helpers(base)
       base.mattr_accessor :default_url_options
@@ -142,7 +152,7 @@ module ActionController
       end
       trailing_slash = options.delete(:trailing_slash) if options.key?(:trailing_slash)
       url << ActionController::Base.relative_url_root.to_s unless options[:skip_relative_url_root]
-      anchor = "##{CGI.escape options.delete(:anchor).to_param.to_s}" if options[:anchor]
+      anchor = "##{URI.escape(options.delete(:anchor).to_param.to_s, UNSAFE_PCHAR)}" if options[:anchor]
       generated = Routing::Routes.generate(options, {})
       url << (trailing_slash ? generated.sub(/\?|\z/) { "/" + $& } : generated)
       url << anchor if anchor

data/vendor/rails/actionpack/lib/action_pack/version.rb

@@ -2,7 +2,7 @@ module ActionPack #:nodoc:
   module VERSION #:nodoc:
     MAJOR = 2
     MINOR = 3
-    TINY  = 8
+    TINY  = 11
 
     STRING = [MAJOR, MINOR, TINY].join('.')
   end

data/vendor/rails/actionpack/lib/action_view/helpers.rb

@@ -6,6 +6,7 @@ module ActionView #:nodoc:
     autoload :BenchmarkHelper, 'action_view/helpers/benchmark_helper'
     autoload :CacheHelper, 'action_view/helpers/cache_helper'
     autoload :CaptureHelper, 'action_view/helpers/capture_helper'
+    autoload :CsrfHelper, 'action_view/helpers/csrf_helper'
     autoload :DateHelper, 'action_view/helpers/date_helper'
     autoload :DebugHelper, 'action_view/helpers/debug_helper'
     autoload :FormHelper, 'action_view/helpers/form_helper'
@@ -38,6 +39,7 @@ module ActionView #:nodoc:
     include BenchmarkHelper
     include CacheHelper
     include CaptureHelper
+    include CsrfHelper
     include DateHelper
     include DebugHelper
     include FormHelper

data/vendor/rails/actionpack/lib/action_view/helpers/asset_tag_helper.rb

@@ -1,6 +1,7 @@
 require 'cgi'
 require 'action_view/helpers/url_helper'
 require 'action_view/helpers/tag_helper'
+require 'thread'
 
 module ActionView
   module Helpers #:nodoc:

data/vendor/rails/actionpack/lib/action_view/helpers/csrf_helper.rb

@@ -0,0 +1,14 @@
+module ActionView
+  # = Action View CSRF Helper
+  module Helpers
+    module CsrfHelper
+      # Returns a meta tag with the cross-site request forgery protection token
+      # for forms to use. Place this in your head.
+      def csrf_meta_tag
+        if protect_against_forgery?
+          %(<meta name="csrf-param" content="#{h(request_forgery_protection_token)}"/>\n<meta name="csrf-token" content="#{h(form_authenticity_token)}"/>).html_safe
+        end
+      end
+    end
+  end
+end

data/vendor/rails/actionpack/lib/action_view/helpers/form_helper.rb

@@ -665,7 +665,7 @@ module ActionView
       #
       # The HTML specification says unchecked check boxes are not successful, and
       # thus web browsers do not send them. Unfortunately this introduces a gotcha:
-      # if an Invoice model has a +paid+ flag, and in the form that edits a paid
+      # if an +Invoice+ model has a +paid+ flag, and in the form that edits a paid
       # invoice the user unchecks its check box, no +paid+ parameter is sent. So,
       # any mass-assignment idiom like
       #
@@ -673,12 +673,15 @@ module ActionView
       #
       # wouldn't update the flag.
       #
-      # To prevent this the helper generates a hidden field with the same name as
-      # the checkbox after the very check box. So, the client either sends only the
-      # hidden field (representing the check box is unchecked), or both fields.
-      # Since the HTML specification says key/value pairs have to be sent in the
-      # same order they appear in the form and Rails parameters extraction always
-      # gets the first occurrence of any given key, that works in ordinary forms.
+      # To prevent this the helper generates an auxiliary hidden field before
+      # the very check box. The hidden field has the same name and its
+      # attributes mimick an unchecked check box.
+      #
+      # This way, the client either sends only the hidden field (representing
+      # the check box is unchecked), or both fields. Since the HTML specification
+      # says key/value pairs have to be sent in the same order they appear in the
+      # form, and parameters extraction gets the last occurrence of any repeated
+      # key in the query string, that works for ordinary forms.
       #
       # Unfortunately that workaround does not work when the check box goes
       # within an array-like parameter, as in
@@ -689,22 +692,26 @@ module ActionView
       #   <% end %>
       #
       # because parameter name repetition is precisely what Rails seeks to distinguish
-      # the elements of the array.
+      # the elements of the array. For each item with a checked check box you
+      # get an extra ghost item with only that attribute, assigned to "0".
+      #
+      # In that case it is preferable to either use +check_box_tag+ or to use
+      # hashes instead of arrays.
       #
       # ==== Examples
       #   # Let's say that @post.validated? is 1:
       #   check_box("post", "validated")
-      #   # => <input type="checkbox" id="post_validated" name="post[validated]" value="1" />
-      #   #    <input name="post[validated]" type="hidden" value="0" />
+      #   # => <input name="post[validated]" type="hidden" value="0" />
+      #   #    <input type="checkbox" id="post_validated" name="post[validated]" value="1" />
       #
       #   # Let's say that @puppy.gooddog is "no":
       #   check_box("puppy", "gooddog", {}, "yes", "no")
-      #   # => <input type="checkbox" id="puppy_gooddog" name="puppy[gooddog]" value="yes" />
-      #   #    <input name="puppy[gooddog]" type="hidden" value="no" />
+      #   # => <input name="puppy[gooddog]" type="hidden" value="no" />
+      #   #    <input type="checkbox" id="puppy_gooddog" name="puppy[gooddog]" value="yes" />
       #
       #   check_box("eula", "accepted", { :class => 'eula_check' }, "yes", "no")
-      #   # => <input type="checkbox" class="eula_check" id="eula_accepted" name="eula[accepted]" value="yes" />
-      #   #    <input name="eula[accepted]" type="hidden" value="no" />
+      #   # => <input name="eula[accepted]" type="hidden" value="no" />
+      #   #    <input type="checkbox" class="eula_check" id="eula_accepted" name="eula[accepted]" value="yes" />
       #
       def check_box(object_name, method, options = {}, checked_value = "1", unchecked_value = "0")
         InstanceTag.new(object_name, method, self, options.delete(:object)).to_check_box_tag(options, checked_value, unchecked_value)

data/vendor/rails/actionpack/lib/action_view/helpers/form_options_helper.rb

@@ -481,7 +481,7 @@ module ActionView
         end
 
         zone_options += options_for_select(convert_zones[zones], selected)
-        zone_options
+        zone_options.html_safe
       end
 
       private

data/vendor/rails/actionpack/lib/action_view/helpers/form_tag_helper.rb

@@ -440,7 +440,7 @@ module ActionView
 
       private
         def html_options_for_form(url_for_options, options, *parameters_for_url)
-          returning options.stringify_keys do |html_options|
+          options.stringify_keys.tap do |html_options|
             html_options["enctype"] = "multipart/form-data" if html_options.delete("multipart")
             html_options["action"]  = url_for(url_for_options, *parameters_for_url)
           end

data/vendor/rails/actionpack/lib/action_view/helpers/prototype_helper.rb

@@ -653,7 +653,7 @@ module ActionView
         # <script> tag.
         module GeneratorMethods
           def to_s #:nodoc:
-            returning javascript = @lines * $/ do
+            (@lines * $/).tap do |javascript|
               if ActionView::Base.debug_rjs
                 source = javascript.dup
                 javascript.replace "try {\n#{source}\n} catch (e) "
@@ -981,8 +981,8 @@ module ActionView
             end
 
             def record(line)
-              returning line = "#{line.to_s.chomp.gsub(/\;\z/, '')};" do
-                self << line
+              "#{line.to_s.chomp.gsub(/\;\z/, '')};".tap do |_line|
+                self << _line
               end
             end
 

data/vendor/rails/actionpack/lib/action_view/helpers/text_helper.rb

@@ -532,9 +532,14 @@ module ActionView
         end
 
         AUTO_LINK_RE = %r{
-            ( https?:// | www\. )
+            (?: ([\w+.:-]+:)// | www\. )
             [^\s<]+
-          }x unless const_defined?(:AUTO_LINK_RE)
+          }x
+
+        # regexps for determining context, used high-volume
+        AUTO_LINK_CRE = [/<[^>]+$/, /^[^>]*>/, /<a\b.*?>/i, /<\/a>/i]
+
+        AUTO_EMAIL_RE = /[\w.!#\$%+-]+@[\w-]+(?:\.[\w-]+)+/
 
         BRACKETS = { ']' => '[', ')' => '(', '}' => '{' }
 
@@ -543,26 +548,26 @@ module ActionView
         def auto_link_urls(text, html_options = {})
           link_attributes = html_options.stringify_keys
           text.gsub(AUTO_LINK_RE) do
-            href = $&
-            punctuation = ''
-            left, right = $`, $'
-            # detect already linked URLs and URLs in the middle of a tag
-            if left =~ /<[^>]+$/ && right =~ /^[^>]*>/
+            scheme, href = $1, $&
+            punctuation = []
+
+            if auto_linked?($`, $')
               # do not change string; URL is already linked
               href
             else
               # don't include trailing punctuation character as part of the URL
-              if href.sub!(/[^\w\/-]$/, '') and punctuation = $& and opening = BRACKETS[punctuation]
-                if href.scan(opening).size > href.scan(punctuation).size
-                  href << punctuation
-                  punctuation = ''
+              while href.sub!(/[^\w\/-]$/, '')
+                punctuation.push $&
+                if opening = BRACKETS[punctuation.last] and href.scan(opening).size > href.scan(punctuation.last).size
+                  href << punctuation.pop
+                  break
                 end
               end
 
               link_text = block_given?? yield(href) : href
-              href = 'http://' + href unless href =~ %r{^[a-z]+://}i
+              href = 'http://' + href unless scheme
 
-              content_tag(:a, h(link_text), link_attributes.merge('href' => href)) + punctuation
+              content_tag(:a, h(link_text), link_attributes.merge('href' => href)) + punctuation.reverse.join('')
             end
           end
         end
@@ -570,11 +575,10 @@ module ActionView
         # Turns all email addresses into clickable links.  If a block is given,
         # each email is yielded and the result is used as the link text.
         def auto_link_email_addresses(text, html_options = {})
-          body = text.dup
-          text.gsub(/([\w\.!#\$%\-+.]+@[A-Za-z0-9\-]+(\.[A-Za-z0-9\-]+)+)/) do
-            text = $1
+          text.gsub(AUTO_EMAIL_RE) do
+            text = $&
 
-            if body.match(/<a\b[^>]*>(.*)(#{Regexp.escape(text)})(.*)<\/a>/)
+            if auto_linked?($`, $')
               text
             else
               display_text = (block_given?) ? yield(text) : text
@@ -582,6 +586,12 @@ module ActionView
             end
           end
         end
+
+        # Detects already linked context or position in the middle of a tag
+        def auto_linked?(left, right)
+          (left =~ AUTO_LINK_CRE[0] and right =~ AUTO_LINK_CRE[1]) or
+            (left.rindex(AUTO_LINK_CRE[2]) and $' !~ AUTO_LINK_CRE[3])
+        end
     end
   end
 end

data/vendor/rails/actionpack/lib/action_view/helpers/url_helper.rb

@@ -471,7 +471,8 @@ module ActionView
         email_address_obfuscated.gsub!(/\./, html_options.delete("replace_dot")) if html_options.has_key?("replace_dot")
 
         if encode == "javascript"
-          "document.write('#{content_tag("a", name || email_address_obfuscated.html_safe, html_options.merge({ "href" => "mailto:"+email_address+extras }))}');".each_byte do |c|
+          html = content_tag("a", name || email_address_obfuscated.html_safe, html_options.merge({ "href" => "mailto:"+html_escape(email_address)+extras }))
+          "document.write('#{escape_javascript(html)}');".each_byte do |c|
             string << sprintf("%%%x", c)
           end
           "<script type=\"#{Mime::JS}\">eval(decodeURIComponent('#{string}'))</script>"

data/vendor/rails/actionpack/lib/action_view/locale/en.yml

@@ -63,37 +63,37 @@
       half_a_minute: "half a minute"
       less_than_x_seconds:
         one:   "less than 1 second"
-        other: "less than {{count}} seconds"
+        other: "less than %{count} seconds"
       x_seconds:
         one:   "1 second"
-        other: "{{count}} seconds"
+        other: "%{count} seconds"
       less_than_x_minutes:
         one:   "less than a minute"
-        other: "less than {{count}} minutes"
+        other: "less than %{count} minutes"
       x_minutes:
         one:   "1 minute"
-        other: "{{count}} minutes"
+        other: "%{count} minutes"
       about_x_hours:
         one:   "about 1 hour"
-        other: "about {{count}} hours"
+        other: "about %{count} hours"
       x_days:
         one:   "1 day"
-        other: "{{count}} days"
+        other: "%{count} days"
       about_x_months:
         one:   "about 1 month"
-        other: "about {{count}} months"
+        other: "about %{count} months"
       x_months:
         one:   "1 month"
-        other: "{{count}} months"
+        other: "%{count} months"
       about_x_years:
         one:   "about 1 year"
-        other: "about {{count}} years"
+        other: "about %{count} years"
       over_x_years:
         one:   "over 1 year"
-        other: "over {{count}} years"
+        other: "over %{count} years"
       almost_x_years:
         one:   "almost 1 year"
-        other: "almost {{count}} years"
+        other: "almost %{count} years"
     prompts:
       year:   "Year"
       month:  "Month"
@@ -106,12 +106,12 @@
     errors:
       template:
         header:
-          one:    "1 error prohibited this {{model}} from being saved"
-          other:  "{{count}} errors prohibited this {{model}} from being saved"
+          one:    "1 error prohibited this %{model} from being saved"
+          other:  "%{count} errors prohibited this %{model} from being saved"
         # The variable :count is also available
         body: "There were problems with the following fields:"
 
   support:
     select:
       # default value for :prompt => true in FormOptionsHelper
-      prompt: "Please select"
+      prompt: "Please select"

data/vendor/rails/actionpack/lib/action_view/renderable_partial.rb

@@ -27,7 +27,7 @@ module ActionView
     def render_partial(view, object = nil, local_assigns = {}, as = nil)
       object ||= local_assigns[:object] || local_assigns[variable_name]
 
-      if object.nil? && view.respond_to?(:controller)
+      if object.nil? && !local_assigns_key?(local_assigns) && view.respond_to?(:controller)
         ivar = :"@#{variable_name}"
         object =
           if view.controller.instance_variable_defined?(ivar)
@@ -43,5 +43,11 @@ module ActionView
 
       render_template(view, local_assigns)
     end
+
+    private
+
+      def local_assigns_key?(local_assigns)
+        local_assigns.key?(:object) || local_assigns.key?(variable_name)
+      end
   end
 end

data/vendor/rails/actionpack/lib/action_view/template.rb

@@ -45,8 +45,8 @@ module ActionView #:nodoc:
       end
 
       def self.new_and_loaded(path)
-        returning new(path) do |path|
-          path.load!
+        new(path).tap do |_path|
+          _path.load!
         end
       end
 

data/vendor/rails/actionpack/test/abstract_unit.rb

@@ -58,4 +58,21 @@ class DummyMutex
   end
 end
 
+class ActionController::IntegrationTest < ActiveSupport::TestCase
+  def with_autoload_path(path)
+    path = File.join(File.dirname(__FILE__), "fixtures", path)
+    if ActiveSupport::Dependencies.autoload_paths.include?(path)
+      yield
+    else
+      begin
+        ActiveSupport::Dependencies.autoload_paths << path
+        yield
+      ensure
+        ActiveSupport::Dependencies.autoload_paths.reject! {|p| p == path}
+        ActiveSupport::Dependencies.clear
+      end
+    end
+  end
+end
+
 ActionController::Reloader.default_lock = DummyMutex.new

data/vendor/rails/actionpack/test/activerecord/active_record_store_test.rb

@@ -22,7 +22,6 @@ class ActiveRecordStoreTest < ActionController::IntegrationTest
     end
 
     def get_session_id
-      session[:foo]
       render :text => "#{request.session_options[:id]}"
     end
 
@@ -45,23 +44,27 @@ class ActiveRecordStoreTest < ActionController::IntegrationTest
     ActiveRecord::SessionStore.session_class.drop_table!
   end
 
-  def test_setting_and_getting_session_value
-    with_test_route_set do
-      get '/set_session_value'
-      assert_response :success
-      assert cookies['_session_id']
-
-      get '/get_session_value'
-      assert_response :success
-      assert_equal 'foo: "bar"', response.body
-
-      get '/set_session_value', :foo => "baz"
-      assert_response :success
-      assert cookies['_session_id']
-
-      get '/get_session_value'
-      assert_response :success
-      assert_equal 'foo: "baz"', response.body
+  %w{ session sql_bypass }.each do |class_name|
+    define_method("test_setting_and_getting_session_value_with_#{class_name}_store") do
+      with_store class_name do
+        with_test_route_set do
+          get '/set_session_value'
+          assert_response :success
+          assert cookies['_session_id']
+
+          get '/get_session_value'
+          assert_response :success
+          assert_equal 'foo: "bar"', response.body
+
+          get '/set_session_value', :foo => "baz"
+          assert_response :success
+          assert cookies['_session_id']
+
+          get '/get_session_value'
+          assert_response :success
+          assert_equal 'foo: "baz"', response.body
+        end
+      end
     end
   end
 
@@ -107,6 +110,38 @@ class ActiveRecordStoreTest < ActionController::IntegrationTest
     end
   end
 
+  def test_getting_session_value
+    with_test_route_set do
+      get '/set_session_value'
+      assert_response :success
+      assert cookies['_session_id']
+
+      get '/get_session_value'
+      assert_response :success
+      assert_equal nil, headers['Set-Cookie'], "should not resend the cookie again if session_id cookie is already exists"
+      session_id = cookies["_session_id"]
+
+      get '/call_reset_session'
+      assert_response :success
+      assert_not_equal [], headers['Set-Cookie']
+
+      cookies["_session_id"] = session_id # replace our new session_id with our old, pre-reset session_id
+
+      get '/get_session_value'
+      assert_response :success
+      assert_equal 'foo: nil', response.body, "data for this session should have been obliterated from the database"
+    end
+  end
+
+  def test_getting_from_nonexistent_session
+    with_test_route_set do
+      get '/get_session_value'
+      assert_response :success
+      assert_equal 'foo: nil', response.body
+      assert_nil cookies['_session_id'], "should only create session on write, not read"
+    end
+  end
+
   def test_prevents_session_fixation
     with_test_route_set do
       get '/set_session_value'
@@ -171,4 +206,16 @@ class ActiveRecordStoreTest < ActionController::IntegrationTest
         yield
       end
     end
+
+    def with_store(class_name)
+      begin
+        session_class = ActiveRecord::SessionStore.session_class
+        ActiveRecord::SessionStore.session_class = "ActiveRecord::SessionStore::#{class_name.camelize}".constantize
+        yield
+      rescue
+        ActiveRecord::SessionStore.session_class = session_class
+        raise
+      end
+    end
+
 end