rails 4.1.4 → 4.1.16

Sign up to get free protection for your applications and to get access to all the features.
Files changed (39) hide show
  1. checksums.yaml +4 -4
  2. data/guides/CHANGELOG.md +75 -0
  3. data/guides/bug_report_templates/action_controller_gem.rb +2 -2
  4. data/guides/bug_report_templates/action_controller_master.rb +2 -2
  5. data/guides/bug_report_templates/generic_gem.rb +15 -0
  6. data/guides/bug_report_templates/generic_master.rb +26 -0
  7. data/guides/code/getting_started/Rakefile +1 -1
  8. data/guides/code/getting_started/config/environment.rb +1 -1
  9. data/guides/code/getting_started/config/environments/development.rb +1 -1
  10. data/guides/code/getting_started/config/environments/production.rb +1 -1
  11. data/guides/code/getting_started/config/environments/test.rb +1 -1
  12. data/guides/code/getting_started/config/initializers/secret_token.rb +1 -1
  13. data/guides/code/getting_started/config/initializers/session_store.rb +1 -1
  14. data/guides/code/getting_started/config/routes.rb +1 -1
  15. data/guides/code/getting_started/config.ru +1 -1
  16. data/guides/source/3_1_release_notes.md +1 -1
  17. data/guides/source/4_1_release_notes.md +5 -5
  18. data/guides/source/_welcome.html.erb +2 -2
  19. data/guides/source/action_controller_overview.md +3 -3
  20. data/guides/source/action_view_overview.md +0 -8
  21. data/guides/source/active_record_querying.md +18 -6
  22. data/guides/source/active_record_validations.md +1 -1
  23. data/guides/source/active_support_core_extensions.md +1 -48
  24. data/guides/source/asset_pipeline.md +9 -7
  25. data/guides/source/command_line.md +8 -8
  26. data/guides/source/debugging_rails_applications.md +11 -11
  27. data/guides/source/engines.md +29 -8
  28. data/guides/source/getting_started.md +3 -4
  29. data/guides/source/i18n.md +3 -3
  30. data/guides/source/initialization.md +1 -1
  31. data/guides/source/layouts_and_rendering.md +8 -9
  32. data/guides/source/maintenance_policy.md +23 -4
  33. data/guides/source/migrations.md +43 -9
  34. data/guides/source/rails_on_rack.md +4 -5
  35. data/guides/source/routing.md +2 -2
  36. data/guides/source/security.md +2 -2
  37. data/guides/source/testing.md +1 -1
  38. data/guides/source/upgrading_ruby_on_rails.md +32 -3
  39. metadata +19 -17
checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA1:
3
- metadata.gz: b8fb2532951e8d68559a5ccc77dcbea0345f0f15
4
- data.tar.gz: 0da92b997baabfe85b105ac3c32c67622c848847
3
+ metadata.gz: a161623794a4621a5a9494ab5a7276dc31396e7d
4
+ data.tar.gz: d37862afe12df5f3a83f7403f0dc8f5f4ed88802
5
5
  SHA512:
6
- metadata.gz: ed91a443b2c26ac7b768e38d6ea0b57f56665bdcae281962c25668c4a4a090f221984c6c4304efe3482e88f88dbf9535a5cc4cf80d9b19f993b32480d1da0920
7
- data.tar.gz: 8d8df1f2e7b2a25c2bff50da0df0ce422b0a35854b0993d634921eefd19d1a1b79001d16fc3a9d2b8c7c42fb3072fdd3389ac04bb79cce2df2c9fc3692e1a591
6
+ metadata.gz: 783193071931a97f089e46b314eaaba449563cc341a4426f3d191adcccf023395319dd07c7c0138aee9da9e3c6c5591069b3dc40df05ed08b7b32e0aed09b3aa
7
+ data.tar.gz: a002c2cb1f7b9fd555674ccb759e2ef62e5645bec0a0e57d6fdf2c25a2a19046131cec5723264f8bc5f6a2abe18103bc7bbec79c9444e90cf10d135382c0cf26
data/guides/CHANGELOG.md CHANGED
@@ -1,3 +1,78 @@
1
+ ## Rails 4.1.16 (July 12, 2016) ##
2
+
3
+ * No changes.
4
+
5
+
6
+ ## Rails 4.1.15 (March 07, 2016) ##
7
+
8
+ * No changes.
9
+
10
+
11
+ ## Rails 4.1.14.2 (February 26, 2016) ##
12
+
13
+ * No changes.
14
+
15
+
16
+ ## Rails 4.1.14.1 (January 25, 2015) ##
17
+
18
+ * No changes.
19
+
20
+
21
+ ## Rails 4.1.14 (November 12, 2015) ##
22
+
23
+ * No changes.
24
+
25
+
26
+ ## Rails 4.1.13 (August 24, 2015) ##
27
+
28
+ * No changes.
29
+
30
+
31
+ ## Rails 4.1.12 (June 25, 2015) ##
32
+
33
+ * No changes.
34
+
35
+
36
+ ## Rails 4.1.11 (June 16, 2015) ##
37
+
38
+ * No changes.
39
+
40
+
41
+ ## Rails 4.1.10 (March 19, 2015) ##
42
+
43
+ * No changes.
44
+
45
+
46
+ ## Rails 4.1.9 (January 6, 2015) ##
47
+
48
+ * No changes.
49
+
50
+
51
+ ## Rails 4.1.8 (November 16, 2014) ##
52
+
53
+ * No changes.
54
+
55
+
56
+ ## Rails 4.1.7.1 (November 19, 2014) ##
57
+
58
+ * No changes.
59
+
60
+
61
+ ## Rails 4.1.7 (October 29, 2014) ##
62
+
63
+ * No changes.
64
+
65
+
66
+ ## Rails 4.1.6 (September 11, 2014) ##
67
+
68
+ * No changes.
69
+
70
+
71
+ ## Rails 4.1.5 (August 18, 2014) ##
72
+
73
+ * No changes.
74
+
75
+
1
76
  ## Rails 4.1.4 (July 2, 2014) ##
2
77
 
3
78
  * No changes.
@@ -7,8 +7,8 @@ require 'action_controller/railtie'
7
7
  class TestApp < Rails::Application
8
8
  config.root = File.dirname(__FILE__)
9
9
  config.session_store :cookie_store, key: 'cookie_store_key'
10
- config.secret_token = 'secret_token'
11
- config.secret_key_base = 'secret_key_base'
10
+ secrets.secret_token = 'secret_token'
11
+ secrets.secret_key_base = 'secret_key_base'
12
12
 
13
13
  config.logger = Logger.new($stdout)
14
14
  Rails.logger = config.logger
@@ -16,8 +16,8 @@ require 'action_controller/railtie'
16
16
  class TestApp < Rails::Application
17
17
  config.root = File.dirname(__FILE__)
18
18
  config.session_store :cookie_store, key: 'cookie_store_key'
19
- config.secret_token = 'secret_token'
20
- config.secret_key_base = 'secret_key_base'
19
+ secrets.secret_token = 'secret_token'
20
+ secrets.secret_key_base = 'secret_key_base'
21
21
 
22
22
  config.logger = Logger.new($stdout)
23
23
  Rails.logger = config.logger
@@ -0,0 +1,15 @@
1
+ # Activate the gems you are reporting the issue against.
2
+ gem 'activesupport', '4.0.0'
3
+ require 'active_support'
4
+ require 'active_support/core_ext/object/blank'
5
+ require 'minitest/autorun'
6
+
7
+ # Ensure backward compatibility with Minitest 4
8
+ Minitest::Test = MiniTest::Unit::TestCase unless defined?(Minitest::Test)
9
+
10
+ class BugTest < Minitest::Test
11
+ def test_stuff
12
+ assert "zomg".present?
13
+ refute "".present?
14
+ end
15
+ end
@@ -0,0 +1,26 @@
1
+ unless File.exist?('Gemfile')
2
+ File.write('Gemfile', <<-GEMFILE)
3
+ source 'https://rubygems.org'
4
+ gem 'rails', github: 'rails/rails'
5
+ gem 'arel', github: 'rails/arel'
6
+ GEMFILE
7
+
8
+ system 'bundle'
9
+ end
10
+
11
+ require 'bundler'
12
+ Bundler.setup(:default)
13
+
14
+ require 'active_support'
15
+ require 'active_support/core_ext/object/blank'
16
+ require 'minitest/autorun'
17
+
18
+ # Ensure backward compatibility with Minitest 4
19
+ Minitest::Test = MiniTest::Unit::TestCase unless defined?(Minitest::Test)
20
+
21
+ class BugTest < Minitest::Test
22
+ def test_stuff
23
+ assert "zomg".present?
24
+ refute "".present?
25
+ end
26
+ end
@@ -3,4 +3,4 @@
3
3
 
4
4
  require File.expand_path('../config/application', __FILE__)
5
5
 
6
- Blog::Application.load_tasks
6
+ Rails.application.load_tasks
@@ -2,4 +2,4 @@
2
2
  require File.expand_path('../application', __FILE__)
3
3
 
4
4
  # Initialize the Rails application.
5
- Blog::Application.initialize!
5
+ Rails.application.initialize!
@@ -1,4 +1,4 @@
1
- Blog::Application.configure do
1
+ Rails.application.configure do
2
2
  # Settings specified here will take precedence over those in config/application.rb.
3
3
 
4
4
  # In the development environment your application's code is reloaded on
@@ -1,4 +1,4 @@
1
- Blog::Application.configure do
1
+ Rails.application.configure do
2
2
  # Settings specified here will take precedence over those in config/application.rb.
3
3
 
4
4
  # Code is not reloaded between requests.
@@ -1,4 +1,4 @@
1
- Blog::Application.configure do
1
+ Rails.application.configure do
2
2
  # Settings specified here will take precedence over those in config/application.rb.
3
3
 
4
4
  # The test environment is used exclusively to run your application's
@@ -9,4 +9,4 @@
9
9
 
10
10
  # Make sure your secret_key_base is kept private
11
11
  # if you're sharing your code publicly.
12
- Blog::Application.config.secret_key_base = 'e8aab50cec8a06a75694111a4cbaf6e22fc288ccbc6b268683aae7273043c69b15ca07d10c92a788dd6077a54762cbfcc55f19c3459f7531221b3169f8171a53'
12
+ Rails.application.config.secret_key_base = 'e8aab50cec8a06a75694111a4cbaf6e22fc288ccbc6b268683aae7273043c69b15ca07d10c92a788dd6077a54762cbfcc55f19c3459f7531221b3169f8171a53'
@@ -1,3 +1,3 @@
1
1
  # Be sure to restart your server when you modify this file.
2
2
 
3
- Blog::Application.config.session_store :cookie_store, key: '_blog_session'
3
+ Rails.application.config.session_store :cookie_store, key: '_blog_session'
@@ -1,4 +1,4 @@
1
- Blog::Application.routes.draw do
1
+ Rails.application.routes.draw do
2
2
  resources :posts do
3
3
  resources :comments
4
4
  end
@@ -1,4 +1,4 @@
1
1
  # This file is used by Rack-based servers to start the application.
2
2
 
3
3
  require ::File.expand_path('../config/environment', __FILE__)
4
- run Blog::Application
4
+ run Rails.application
@@ -169,7 +169,7 @@ Rails Architectural Changes
169
169
 
170
170
  The major change in Rails 3.1 is the Assets Pipeline. It makes CSS and JavaScript first-class code citizens and enables proper organization, including use in plugins and engines.
171
171
 
172
- The assets pipeline is powered by [Sprockets](https://github.com/sstephenson/sprockets) and is covered in the [Asset Pipeline](asset_pipeline.html) guide.
172
+ The assets pipeline is powered by [Sprockets](https://github.com/rails/sprockets) and is covered in the [Asset Pipeline](asset_pipeline.html) guide.
173
173
 
174
174
  ### HTTP Streaming
175
175
 
@@ -8,10 +8,10 @@ Highlights in Rails 4.1:
8
8
  * Action Pack variants
9
9
  * Action Mailer previews
10
10
 
11
- These release notes cover only the major changes. To know about various bug
12
- fixes and changes, please refer to the change logs or check out the
13
- [list of commits](https://github.com/rails/rails/commits/master) in the main
14
- Rails repository on GitHub.
11
+ These release notes cover only the major changes. To learn about various bug
12
+ fixes and changes, please refer to the change logs or check out the [list of
13
+ commits](https://github.com/rails/rails/commits/4-1-stable) in the main Rails
14
+ repository on GitHub.
15
15
 
16
16
  --------------------------------------------------------------------------------
17
17
 
@@ -157,7 +157,7 @@ By default, these preview classes live in `test/mailers/previews`.
157
157
  This can be configured using the `preview_path` option.
158
158
 
159
159
  See its
160
- [documentation](http://api.rubyonrails.org/v4.1.0/classes/ActionMailer/Base.html)
160
+ [documentation](http://api.rubyonrails.org/v4.1.0/classes/ActionMailer/Base.html#class-ActionMailer::Base-label-Previewing+emails)
161
161
  for a detailed write up.
162
162
 
163
163
  ### Active Record enums
@@ -15,10 +15,10 @@
15
15
  </p>
16
16
  <% end %>
17
17
  <p>
18
- The guides for Rails 4.0.x are available at <a href="http://guides.rubyonrails.org/v4.0.6/">http://guides.rubyonrails.org/v4.0.6/</a>.
18
+ The guides for Rails 4.0.x are available at <a href="http://guides.rubyonrails.org/v4.0.8/">http://guides.rubyonrails.org/v4.0.8/</a>.
19
19
  </p>
20
20
  <p>
21
- The guides for Rails 3.2.x are available at <a href="http://guides.rubyonrails.org/v3.2.18/">http://guides.rubyonrails.org/v3.2.18/</a>.
21
+ The guides for Rails 3.2.x are available at <a href="http://guides.rubyonrails.org/v3.2.19/">http://guides.rubyonrails.org/v3.2.19/</a>.
22
22
  </p>
23
23
  <p>
24
24
  The guides for Rails 2.3.x are available at <a href="http://guides.rubyonrails.org/v2.3.11/">http://guides.rubyonrails.org/v2.3.11/</a>.
@@ -364,21 +364,21 @@ If you need a different session storage mechanism, you can change it in the `con
364
364
  # Use the database for sessions instead of the cookie-based default,
365
365
  # which shouldn't be used to store highly confidential information
366
366
  # (create the session table with "rails g active_record:session_migration")
367
- # YourApp::Application.config.session_store :active_record_store
367
+ # Rails.application.config.session_store :active_record_store
368
368
  ```
369
369
 
370
370
  Rails sets up a session key (the name of the cookie) when signing the session data. These can also be changed in `config/initializers/session_store.rb`:
371
371
 
372
372
  ```ruby
373
373
  # Be sure to restart your server when you modify this file.
374
- YourApp::Application.config.session_store :cookie_store, key: '_your_app_session'
374
+ Rails.application.config.session_store :cookie_store, key: '_your_app_session'
375
375
  ```
376
376
 
377
377
  You can also pass a `:domain` key and specify the domain name for the cookie:
378
378
 
379
379
  ```ruby
380
380
  # Be sure to restart your server when you modify this file.
381
- YourApp::Application.config.session_store :cookie_store, key: '_your_app_session', domain: ".example.com"
381
+ Rails.application.config.session_store :cookie_store, key: '_your_app_session', domain: ".example.com"
382
382
  ```
383
383
 
384
384
  Rails sets up (for the CookieStore) a secret key used for signing the session data. This can be changed in `config/initializers/secret_token.rb`
@@ -1137,14 +1137,6 @@ If `@post.author_ids` is [1], this would return:
1137
1137
  <input name="post[author_ids][]" type="hidden" value="" />
1138
1138
  ```
1139
1139
 
1140
- #### country_options_for_select
1141
-
1142
- Returns a string of option tags for pretty much any country in the world.
1143
-
1144
- #### country_select
1145
-
1146
- Returns select and option tags for the given object and method, using country_options_for_select to generate the list of option tags.
1147
-
1148
1140
  #### option_groups_from_collection_for_select
1149
1141
 
1150
1142
  Returns a string of `option` tags, like `options_from_collection_for_select`, but groups them by `optgroup` tags based on the object relationships of the arguments.
@@ -754,14 +754,14 @@ The SQL that would be executed:
754
754
 
755
755
  ```sql
756
756
  SELECT * FROM posts WHERE id = 10
757
- SELECT * FROM comments WHERE article_id = 10 ORDER BY name
757
+ SELECT * FROM comments WHERE post_id = 10 ORDER BY name
758
758
  ```
759
759
 
760
760
  In case the `reorder` clause is not used, the SQL executed would be:
761
761
 
762
762
  ```sql
763
763
  SELECT * FROM posts WHERE id = 10
764
- SELECT * FROM comments WHERE article_id = 10 ORDER BY posted_at DESC
764
+ SELECT * FROM comments WHERE post_id = 10 ORDER BY posted_at DESC
765
765
  ```
766
766
 
767
767
  ### `reverse_order`
@@ -1143,18 +1143,30 @@ Even though Active Record lets you specify conditions on the eager loaded associ
1143
1143
  However if you must do this, you may use `where` as you would normally.
1144
1144
 
1145
1145
  ```ruby
1146
- Post.includes(:comments).where("comments.visible" => true)
1146
+ Post.includes(:comments).where(comments: { visible: true })
1147
1147
  ```
1148
1148
 
1149
- This would generate a query which contains a `LEFT OUTER JOIN` whereas the `joins` method would generate one using the `INNER JOIN` function instead.
1149
+ This would generate a query which contains a `LEFT OUTER JOIN` whereas the
1150
+ `joins` method would generate one using the `INNER JOIN` function instead.
1150
1151
 
1151
1152
  ```ruby
1152
1153
  SELECT "posts"."id" AS t0_r0, ... "comments"."updated_at" AS t1_r5 FROM "posts" LEFT OUTER JOIN "comments" ON "comments"."post_id" = "posts"."id" WHERE (comments.visible = 1)
1153
1154
  ```
1154
1155
 
1155
- If there was no `where` condition, this would generate the normal set of two queries.
1156
+ If there was no `where` condition, this would generate the normal set of two
1157
+ queries.
1158
+
1159
+ NOTE: Using `where` like this will only work when you pass it a Hash. For
1160
+ SQL-fragments you need use `references` to force joined tables:
1161
+
1162
+ ```ruby
1163
+ Post.includes(:comments).where("comments.visible = true").references(:comments)
1164
+ ```
1165
+
1166
+ If, in the case of this `includes` query, there were no comments for any posts,
1167
+ all the posts would still be loaded. By using `joins` (an INNER JOIN), the join
1168
+ conditions **must** match, otherwise no records will be returned.
1156
1169
 
1157
- If, in the case of this `includes` query, there were no comments for any posts, all the posts would still be loaded. By using `joins` (an INNER JOIN), the join conditions **must** match, otherwise no records will be returned.
1158
1170
 
1159
1171
  Scopes
1160
1172
  ------
@@ -871,7 +871,7 @@ should happen, an `Array` can be used. Moreover, you can apply both `:if` and
871
871
  ```ruby
872
872
  class Computer < ActiveRecord::Base
873
873
  validates :mouse, presence: true,
874
- if: ["market.retail?", :desktop?]
874
+ if: ["market.retail?", :desktop?],
875
875
  unless: Proc.new { |c| c.trackpad.present? }
876
876
  end
877
877
  ```
@@ -1281,7 +1281,7 @@ The method `squish` strips leading and trailing whitespace, and substitutes runs
1281
1281
 
1282
1282
  There's also the destructive version `String#squish!`.
1283
1283
 
1284
- Note that it handles both ASCII and Unicode whitespace like mongolian vowel separator (U+180E).
1284
+ Note that it handles both ASCII and Unicode whitespace.
1285
1285
 
1286
1286
  NOTE: Defined in `active_support/core_ext/string/filters.rb`.
1287
1287
 
@@ -3003,53 +3003,6 @@ The method `Range#overlaps?` says whether any two given ranges have non-void int
3003
3003
 
3004
3004
  NOTE: Defined in `active_support/core_ext/range/overlaps.rb`.
3005
3005
 
3006
- Extensions to `Proc`
3007
- --------------------
3008
-
3009
- ### `bind`
3010
-
3011
- As you surely know Ruby has an `UnboundMethod` class whose instances are methods that belong to the limbo of methods without a self. The method `Module#instance_method` returns an unbound method for example:
3012
-
3013
- ```ruby
3014
- Hash.instance_method(:delete) # => #<UnboundMethod: Hash#delete>
3015
- ```
3016
-
3017
- An unbound method is not callable as is, you need to bind it first to an object with `bind`:
3018
-
3019
- ```ruby
3020
- clear = Hash.instance_method(:clear)
3021
- clear.bind({a: 1}).call # => {}
3022
- ```
3023
-
3024
- Active Support defines `Proc#bind` with an analogous purpose:
3025
-
3026
- ```ruby
3027
- Proc.new { size }.bind([]).call # => 0
3028
- ```
3029
-
3030
- As you see that's callable and bound to the argument, the return value is indeed a `Method`.
3031
-
3032
- NOTE: To do so `Proc#bind` actually creates a method under the hood. If you ever see a method with a weird name like `__bind_1256598120_237302` in a stack trace you know now where it comes from.
3033
-
3034
- Action Pack uses this trick in `rescue_from` for example, which accepts the name of a method and also a proc as callbacks for a given rescued exception. It has to call them in either case, so a bound method is returned by `handler_for_rescue`, thus simplifying the code in the caller:
3035
-
3036
- ```ruby
3037
- def handler_for_rescue(exception)
3038
- _, rescuer = Array(rescue_handlers).reverse.detect do |klass_name, handler|
3039
- ...
3040
- end
3041
-
3042
- case rescuer
3043
- when Symbol
3044
- method(rescuer)
3045
- when Proc
3046
- rescuer.bind(self)
3047
- end
3048
- end
3049
- ```
3050
-
3051
- NOTE: Defined in `active_support/core_ext/proc.rb`.
3052
-
3053
3006
  Extensions to `Date`
3054
3007
  --------------------
3055
3008
 
@@ -208,7 +208,7 @@ information on how precompiling works.
208
208
  NOTE: You must have an ExecJS supported runtime in order to use CoffeeScript.
209
209
  If you are using Mac OS X or Windows, you have a JavaScript runtime installed in
210
210
  your operating system. Check
211
- [ExecJS](https://github.com/sstephenson/execjs#readme) documentation to know all
211
+ [ExecJS](https://github.com/rails/execjs#readme) documentation to know all
212
212
  supported JavaScript runtimes.
213
213
 
214
214
  You can also disable generation of controller specific asset files by adding the
@@ -765,7 +765,7 @@ typical manifest file looks like:
765
765
  "digest":"12b3c7dd74d2e9df37e7cbb1efa76a6d"},"application-1c5752789588ac18d7e1a50b1f0fd4c2.css":{"logical_path":"application.css","mtime":"2013-07-26T22:56:17-07:00","size":1591,
766
766
  "digest":"1c5752789588ac18d7e1a50b1f0fd4c2"},"favicon-a9c641bf2b81f0476e876f7c5e375969.ico":{"logical_path":"favicon.ico","mtime":"2013-07-26T23:00:10-07:00","size":1406,
767
767
  "digest":"a9c641bf2b81f0476e876f7c5e375969"},"my_image-231a680f23887d9dd70710ea5efd3c62.png":{"logical_path":"my_image.png","mtime":"2013-07-26T23:00:27-07:00","size":6646,
768
- "digest":"231a680f23887d9dd70710ea5efd3c62"}},"assets"{"application.js":
768
+ "digest":"231a680f23887d9dd70710ea5efd3c62"}},"assets":{"application.js":
769
769
  "application-723d1be6cc741a3aabb1cec24276d681.js","application.css":
770
770
  "application-1c5752789588ac18d7e1a50b1f0fd4c2.css",
771
771
  "favicon.ico":"favicona9c641bf2b81f0476e876f7c5e375969.ico","my_image.png":
@@ -793,9 +793,11 @@ For Apache:
793
793
  # `mod_expires` to be enabled.
794
794
  <Location /assets/>
795
795
  # Use of ETag is discouraged when Last-Modified is present
796
- Header unset ETag FileETag None
796
+ Header unset ETag
797
+ FileETag None
797
798
  # RFC says only cache for 1 year
798
- ExpiresActive On ExpiresDefault "access plus 1 year"
799
+ ExpiresActive On
800
+ ExpiresDefault "access plus 1 year"
799
801
  </Location>
800
802
  ```
801
803
 
@@ -943,7 +945,7 @@ gem.
943
945
  ```ruby
944
946
  config.assets.css_compressor = :yui
945
947
  ```
946
- The other option for compressing CSS if you have the sass-rails gem installed is
948
+ The other option for compressing CSS if you have the sass-rails gem installed is
947
949
 
948
950
  ```ruby
949
951
  config.assets.css_compressor = :sass
@@ -967,7 +969,7 @@ The following line invokes `uglifier` for JavaScript compression.
967
969
  config.assets.js_compressor = :uglifier
968
970
  ```
969
971
 
970
- NOTE: You will need an [ExecJS](https://github.com/sstephenson/execjs#readme)
972
+ NOTE: You will need an [ExecJS](https://github.com/rails/execjs#readme)
971
973
  supported runtime in order to use `uglifier`. If you are using Mac OS X or
972
974
  Windows you have a JavaScript runtime installed in your operating system.
973
975
 
@@ -1018,7 +1020,7 @@ The X-Sendfile header is a directive to the web server to ignore the response
1018
1020
  from the application, and instead serve a specified file from disk. This option
1019
1021
  is off by default, but can be enabled if your server supports it. When enabled,
1020
1022
  this passes responsibility for serving the file to the web server, which is
1021
- faster. Have a look at [send_file](http://api.rubyonrails.org/classes/ActionController/DataStreaming.html#method-i-send_file)
1023
+ faster. Have a look at [send_file](http://api.rubyonrails.org/classes/ActionController/DataStreaming.html#method-i-send_file)
1022
1024
  on how to use this feature.
1023
1025
 
1024
1026
  Apache and nginx support this option, which can be enabled in
@@ -62,7 +62,7 @@ With no further work, `rails server` will run our new shiny Rails app:
62
62
  $ cd commandsapp
63
63
  $ bin/rails server
64
64
  => Booting WEBrick
65
- => Rails 4.0.0 application starting in development on http://0.0.0.0:3000
65
+ => Rails 4.1.4 application starting in development on http://0.0.0.0:3000
66
66
  => Call with -d to detach
67
67
  => Ctrl-C to shutdown server
68
68
  [2013-08-07 02:00:01] INFO WEBrick 1.3.1
@@ -290,7 +290,7 @@ If you wish to test out some code without changing any data, you can do that by
290
290
 
291
291
  ```bash
292
292
  $ bin/rails console --sandbox
293
- Loading development environment in sandbox (Rails 4.0.0)
293
+ Loading development environment in sandbox (Rails 4.1.4)
294
294
  Any modifications you make will be rolled back on exit
295
295
  irb(main):001:0>
296
296
  ```
@@ -377,13 +377,13 @@ About your application's environment
377
377
  Ruby version 1.9.3 (x86_64-linux)
378
378
  RubyGems version 1.3.6
379
379
  Rack version 1.3
380
- Rails version 4.1.1
380
+ Rails version 4.1.4
381
381
  JavaScript Runtime Node.js (V8)
382
- Active Record version 4.1.1
383
- Action Pack version 4.1.1
384
- Action View version 4.1.1
385
- Action Mailer version 4.1.1
386
- Active Support version 4.1.1
382
+ Active Record version 4.1.4
383
+ Action Pack version 4.1.4
384
+ Action View version 4.1.4
385
+ Action Mailer version 4.1.4
386
+ Active Support version 4.1.4
387
387
  Middleware Rack::Sendfile, ActionDispatch::Static, Rack::Lock, #<ActiveSupport::Cache::Strategy::LocalCache::Middleware:0x007ffd131a7c88>, Rack::Runtime, Rack::MethodOverride, ActionDispatch::RequestId, Rails::Rack::Logger, ActionDispatch::ShowExceptions, ActionDispatch::DebugExceptions, ActionDispatch::RemoteIp, ActionDispatch::Reloader, ActionDispatch::Callbacks, ActiveRecord::Migration::CheckPending, ActiveRecord::ConnectionAdapters::ConnectionManagement, ActiveRecord::QueryCache, ActionDispatch::Cookies, ActionDispatch::Session::CookieStore, ActionDispatch::Flash, ActionDispatch::ParamsParser, Rack::Head, Rack::ConditionalGet, Rack::ETag
388
388
  Application root /home/foobar/commandsapp
389
389
  Environment development
@@ -210,7 +210,7 @@ logger.tagged("BCX") { logger.tagged("Jason") { logger.info "Stuff" } } # Logs "
210
210
  ```
211
211
 
212
212
  ### Impact of Logs on Performance
213
- Logging will always have a small impact on performance of your rails app,
213
+ Logging will always have a small impact on performance of your rails app,
214
214
  particularly when logging to disk.However, there are a few subtleties:
215
215
 
216
216
  Using the `:debug` level will have a greater performance penalty than `:fatal`,
@@ -224,20 +224,20 @@ Another potential pitfall is that if you have many calls to `Logger` like this
224
224
  logger.debug "Person attributes hash: #{@person.attributes.inspect}"
225
225
  ```
226
226
 
227
- In the above example, There will be a performance impact even if the allowed
228
- output level doesn't include debug. The reason is that Ruby has to evaluate
229
- these strings, which includes instantiating the somewhat heavy `String` object
227
+ In the above example, There will be a performance impact even if the allowed
228
+ output level doesn't include debug. The reason is that Ruby has to evaluate
229
+ these strings, which includes instantiating the somewhat heavy `String` object
230
230
  and interpolating the variables, and which takes time.
231
- Therefore, it's recommended to pass blocks to the logger methods, as these are
232
- only evaluated if the output level is the same or included in the allowed level
231
+ Therefore, it's recommended to pass blocks to the logger methods, as these are
232
+ only evaluated if the output level is the same or included in the allowed level
233
233
  (i.e. lazy loading). The same code rewritten would be:
234
234
 
235
235
  ```ruby
236
236
  logger.debug {"Person attributes hash: #{@person.attributes.inspect}"}
237
237
  ```
238
238
 
239
- The contents of the block, and therefore the string interpolation, is only
240
- evaluated if debug is enabled. This performance savings is only really
239
+ The contents of the block, and therefore the string interpolation, is only
240
+ evaluated if debug is enabled. This performance savings is only really
241
241
  noticeable with large amounts of logging, but it's a good practice to employ.
242
242
 
243
243
  Debugging with the `debugger` gem
@@ -279,12 +279,12 @@ Make sure you have started your web server with the option `--debugger`:
279
279
  ```bash
280
280
  $ rails server --debugger
281
281
  => Booting WEBrick
282
- => Rails 4.1.1 application starting on http://0.0.0.0:3000
282
+ => Rails 4.1.4 application starting on http://0.0.0.0:3000
283
283
  => Debugger enabled
284
284
  ...
285
285
  ```
286
286
 
287
- TIP: In development mode, you can dynamically `require \'debugger\'` instead of restarting the server, even if it was started without `--debugger`.
287
+ TIP: In development mode, you can dynamically `require 'debugger'` instead of restarting the server, even if it was started without `--debugger`.
288
288
 
289
289
  ### The Shell
290
290
 
@@ -535,7 +535,7 @@ TIP: You can use the debugger while using `rails console`. Just remember to `req
535
535
 
536
536
  ```
537
537
  $ rails console
538
- Loading development environment (Rails 4.1.1)
538
+ Loading development environment (Rails 4.1.4)
539
539
  >> require "debugger"
540
540
  => []
541
541
  >> author = Author.first
@@ -590,11 +590,11 @@ This is the final step required to get the new comment form working. Displaying
590
590
  the comments, however, is not quite right yet. If you were to create a comment
591
591
  right now, you would see this error:
592
592
 
593
- ```
593
+ ```
594
594
  Missing partial blorgh/comments/comment with {:handlers=>[:erb, :builder],
595
595
  :formats=>[:html], :locale=>[:en, :en]}. Searched in: *
596
596
  "/Users/ryan/Sites/side_projects/blorgh/test/dummy/app/views" *
597
- "/Users/ryan/Sites/side_projects/blorgh/app/views"
597
+ "/Users/ryan/Sites/side_projects/blorgh/app/views"
598
598
  ```
599
599
 
600
600
  The engine is unable to find the partial required for rendering the comments.
@@ -828,12 +828,12 @@ $ bin/rake blorgh:install:migrations
828
828
  Notice that only _one_ migration was copied over here. This is because the first
829
829
  two migrations were copied over the first time this command was run.
830
830
 
831
- ```
831
+ ```
832
832
  NOTE Migration [timestamp]_create_blorgh_posts.rb from blorgh has been
833
833
  skipped. Migration with the same name already exists. NOTE Migration
834
834
  [timestamp]_create_blorgh_comments.rb from blorgh has been skipped. Migration
835
835
  with the same name already exists. Copied migration
836
- [timestamp]_add_author_id_to_blorgh_posts.rb from blorgh
836
+ [timestamp]_add_author_id_to_blorgh_posts.rb from blorgh
837
837
  ```
838
838
 
839
839
  Run the migration using:
@@ -1036,22 +1036,43 @@ functionality, especially controllers. This means that if you were to make a
1036
1036
  typical `GET` to a controller in a controller's functional test like this:
1037
1037
 
1038
1038
  ```ruby
1039
- get :index
1039
+ module Blorgh
1040
+ class FooControllerTest < ActionController::TestCase
1041
+ def test_index
1042
+ get :index
1043
+ ...
1044
+ end
1045
+ end
1046
+ end
1040
1047
  ```
1041
1048
 
1042
1049
  It may not function correctly. This is because the application doesn't know how
1043
1050
  to route these requests to the engine unless you explicitly tell it **how**. To
1044
- do this, you must also pass the `:use_route` option as a parameter on these
1045
- requests:
1051
+ do this, you must set the `@routes` instance variable to the engine's route set
1052
+ in your setup code:
1046
1053
 
1047
1054
  ```ruby
1048
- get :index, use_route: :blorgh
1055
+ module Blorgh
1056
+ class FooControllerTest < ActionController::TestCase
1057
+ setup do
1058
+ @routes = Engine.routes
1059
+ end
1060
+
1061
+ def test_index
1062
+ get :index
1063
+ ...
1064
+ end
1065
+ end
1066
+ end
1049
1067
  ```
1050
1068
 
1051
1069
  This tells the application that you still want to perform a `GET` request to the
1052
1070
  `index` action of this controller, but you want to use the engine's route to get
1053
1071
  there, rather than the application's one.
1054
1072
 
1073
+ This also ensures that the engine's URL helpers will work as expected in your
1074
+ tests.
1075
+
1055
1076
  Improving engine functionality
1056
1077
  ------------------------------
1057
1078
 
@@ -70,8 +70,7 @@ Creating a New Rails Project
70
70
 
71
71
  The best way to use this guide is to follow each step as it happens, no code or
72
72
  step needed to make this example application has been left out, so you can
73
- literally follow along step by step. You can get the complete code
74
- [here](https://github.com/rails/docrails/tree/master/guides/code/getting_started).
73
+ literally follow along step by step.
75
74
 
76
75
  By following along with this guide, you'll create a Rails project called
77
76
  `blog`, a
@@ -200,7 +199,7 @@ gem to the generated `Gemfile` in a commented line for new apps and you can
200
199
  uncomment if you need it. `therubyrhino` is the recommended runtime for JRuby
201
200
  users and is added by default to the `Gemfile` in apps generated under JRuby.
202
201
  You can investigate about all the supported runtimes at
203
- [ExecJS](https://github.com/sstephenson/execjs#readme).
202
+ [ExecJS](https://github.com/rails/execjs#readme).
204
203
 
205
204
  This will fire up WEBrick, a web server distributed with Ruby by default. To see
206
205
  your application in action, open a browser window and navigate to
@@ -344,7 +343,7 @@ resource. Here's what `config/routes.rb` should look like after the
344
343
  _article resource_ is declared.
345
344
 
346
345
  ```ruby
347
- Blog::Application.routes.draw do
346
+ Rails.application.routes.draw do
348
347
 
349
348
  resources :articles
350
349
 
@@ -310,7 +310,7 @@ You most probably have something like this in one of your applications:
310
310
 
311
311
  ```ruby
312
312
  # config/routes.rb
313
- Yourapp::Application.routes.draw do
313
+ Rails.application.routes.draw do
314
314
  root to: "home#index"
315
315
  end
316
316
  ```
@@ -438,11 +438,11 @@ TIP: Right now you might need to add some more date/time formats in order to mak
438
438
 
439
439
  ### Inflection Rules For Other Locales
440
440
 
441
- Rails 4.0 allows you to define inflection rules (such as rules for singularization and pluralization) for locales other than English. In `config/initializers/inflections.rb`, you can define these rules for multiple locales. The initializer contains a default example for specifying additional rules for English; follow that format for other locales as you see fit.
441
+ Rails allows you to define inflection rules (such as rules for singularization and pluralization) for locales other than English. In `config/initializers/inflections.rb`, you can define these rules for multiple locales. The initializer contains a default example for specifying additional rules for English; follow that format for other locales as you see fit.
442
442
 
443
443
  ### Localized Views
444
444
 
445
- Rails 2.3 introduces another convenient localization feature: localized views (templates). Let's say you have a _BooksController_ in your application. Your _index_ action renders content in `app/views/books/index.html.erb` template. When you put a _localized variant_ of this template: `index.es.html.erb` in the same directory, Rails will render content in this template, when the locale is set to `:es`. When the locale is set to the default locale, the generic `index.html.erb` view will be used. (Future Rails versions may well bring this _automagic_ localization to assets in `public`, etc.)
445
+ Let's say you have a _BooksController_ in your application. Your _index_ action renders content in `app/views/books/index.html.erb` template. When you put a _localized variant_ of this template: `index.es.html.erb` in the same directory, Rails will render content in this template, when the locale is set to `:es`. When the locale is set to the default locale, the generic `index.html.erb` view will be used. (Future Rails versions may well bring this _automagic_ localization to assets in `public`, etc.)
446
446
 
447
447
  You can make use of this feature, e.g. when working with a large amount of static content, which would be clumsy to put inside YAML or Ruby dictionaries. Bear in mind, though, that any change you would like to do later to the template must be propagated to all of them.
448
448
 
@@ -526,7 +526,7 @@ The rest of `config/application.rb` defines the configuration for the
526
526
  initialized. When `config/application.rb` has finished loading Rails and defined
527
527
  the application namespace, we go back to `config/environment.rb`,
528
528
  where the application is initialized. For example, if the application was called
529
- `Blog`, here we would find `Blog::Application.initialize!`, which is
529
+ `Blog`, here we would find `Rails.application.initialize!`, which is
530
530
  defined in `rails/application.rb`
531
531
 
532
532
  ### `railties/lib/rails/application.rb`
@@ -175,23 +175,22 @@ render template: "products/show"
175
175
 
176
176
  #### Rendering an Arbitrary File
177
177
 
178
- The `render` method can also use a view that's entirely outside of your application (perhaps you're sharing views between two Rails applications):
179
-
180
- ```ruby
181
- render "/u/apps/warehouse_app/current/app/views/products/show"
182
- ```
183
-
184
- Rails determines that this is a file render because of the leading slash character. To be explicit, you can use the `:file` option (which was required on Rails 2.2 and earlier):
178
+ The `render` method can also use a view that's entirely outside of your application:
185
179
 
186
180
  ```ruby
187
181
  render file: "/u/apps/warehouse_app/current/app/views/products/show"
188
182
  ```
189
183
 
190
- The `:file` option takes an absolute file-system path. Of course, you need to have rights to the view that you're using to render the content.
184
+ The `:file` option takes an absolute file-system path. Of course, you need to have rights
185
+ to the view that you're using to render the content.
186
+
187
+ NOTE: Using the `:file` option in combination with users input can lead to security problems
188
+ since an attacker could use this action to access security sensitive files in your file system.
191
189
 
192
190
  NOTE: By default, the file is rendered without using the current layout. If you want Rails to put the file into the current layout, you need to add the `layout: true` option.
193
191
 
194
- TIP: If you're running Rails on Microsoft Windows, you should use the `:file` option to render a file, because Windows filenames do not have the same format as Unix filenames.
192
+ TIP: If you're running Rails on Microsoft Windows, you should use the `:file` option to
193
+ render a file, because Windows filenames do not have the same format as Unix filenames.
195
194
 
196
195
  #### Wrapping it up
197
196
 
@@ -3,10 +3,29 @@ Maintenance Policy for Ruby on Rails
3
3
 
4
4
  Support of the Rails framework is divided into four groups: New features, bug
5
5
  fixes, security issues, and severe security issues. They are handled as
6
- follows, all versions in x.y.z format
6
+ follows, all versions in `X.Y.Z` format.
7
7
 
8
8
  --------------------------------------------------------------------------------
9
9
 
10
+ Rails follows a shifted version of [semver](http://semver.org/):
11
+
12
+ **Patch `Z`**
13
+
14
+ Only bug fixes, no API changes, no new features.
15
+ Except as necessary for security fixes.
16
+
17
+ **Minor `Y`**
18
+
19
+ New features, may contain API changes (Serve as major versions of Semver).
20
+ Breaking changes are paired with deprecation notices in the previous minor
21
+ or major release.
22
+
23
+ **Major `X`**
24
+
25
+ New features, will likely contain API changes. The difference between Rails'
26
+ minor and major releases is the magnitude of breaking changes, and usually
27
+ reserved for special occasions.
28
+
10
29
  New Features
11
30
  ------------
12
31
 
@@ -20,7 +39,7 @@ Only the latest release series will receive bug fixes. When enough bugs are
20
39
  fixed and its deemed worthy to release a new gem, this is the branch it happens
21
40
  from.
22
41
 
23
- **Currently included series:** 4.1.z, 4.0.z
42
+ **Currently included series:** `4.1.Z`, `4.0.Z`.
24
43
 
25
44
  Security Issues
26
45
  ---------------
@@ -35,7 +54,7 @@ be built from 1.2.2, and then added to the end of 1-2-stable. This means that
35
54
  security releases are easy to upgrade to if you're running the latest version
36
55
  of Rails.
37
56
 
38
- **Currently included series:** 4.1.z, 4.0.z
57
+ **Currently included series:** `4.1.Z`, `4.0.Z`.
39
58
 
40
59
  Severe Security Issues
41
60
  ----------------------
@@ -44,7 +63,7 @@ For severe security issues we will provide new versions as above, and also the
44
63
  last major release series will receive patches and new versions. The
45
64
  classification of the security issue is judged by the core team.
46
65
 
47
- **Currently included series:** 4.1.z, 4.0.z, 3.2.z
66
+ **Currently included series:** `4.1.Z`, `4.0.Z`, `3.2.Z`.
48
67
 
49
68
  Unsupported Release Series
50
69
  --------------------------
@@ -292,16 +292,10 @@ end
292
292
 
293
293
  You can append as many column name/type pairs as you want.
294
294
 
295
- ### Supported Type Modifiers
295
+ ### Passing Modifiers
296
296
 
297
- You can also specify some options just after the field type between curly
298
- braces. You can use the following modifiers:
299
-
300
- * `limit` Sets the maximum size of the `string/text/binary/integer` fields.
301
- * `precision` Defines the precision for the `decimal` fields, representing the total number of digits in the number.
302
- * `scale` Defines the scale for the `decimal` fields, representing the number of digits after the decimal point.
303
- * `polymorphic` Adds a `type` column for `belongs_to` associations.
304
- * `null` Allows or disallows `NULL` values in the column.
297
+ Some commonly used [type modifiers](#column-modifiers) can be passed directly on
298
+ the command line. They are enclosed by curly braces and follow the field type:
305
299
 
306
300
  For instance, running:
307
301
 
@@ -320,6 +314,8 @@ class AddDetailsToProducts < ActiveRecord::Migration
320
314
  end
321
315
  ```
322
316
 
317
+ TIP: Have a look at the generators help output for further details.
318
+
323
319
  Writing a Migration
324
320
  -------------------
325
321
 
@@ -414,6 +410,44 @@ end
414
410
  removes the `description` and `name` columns, creates a `part_number` string
415
411
  column and adds an index on it. Finally it renames the `upccode` column.
416
412
 
413
+ ### Changing Columns
414
+
415
+ Like the `remove_column` and `add_column` Rails provides the `change_column`
416
+ migration method.
417
+
418
+ ```ruby
419
+ change_column :products, :part_number, :text
420
+ ```
421
+
422
+ This changes the column `part_number` on products table to be a `:text` field.
423
+
424
+ Besides `change_column`, the `change_column_null` and `change_column_default`
425
+ methods are used specifically to change the null and default values of a
426
+ column.
427
+
428
+ ```ruby
429
+ change_column_null :products, :name, false
430
+ change_column_default :products, :approved, false
431
+ ```
432
+
433
+ This sets `:name` field on products to a `NOT NULL` column and the default
434
+ value of the `:approved` field to false.
435
+
436
+ ### Column Modifiers
437
+
438
+ Column modifiers can be applied when creating or changing a column:
439
+
440
+ * `limit` Sets the maximum size of the `string/text/binary/integer` fields.
441
+ * `precision` Defines the precision for the `decimal` fields, representing the total number of digits in the number.
442
+ * `scale` Defines the scale for the `decimal` fields, representing the number of digits after the decimal point.
443
+ * `polymorphic` Adds a `type` column for `belongs_to` associations.
444
+ * `null` Allows or disallows `NULL` values in the column.
445
+ * `default` Allows to set a default value on the column. NOTE: If using a dynamic value (such as date), the default will only be calculated the first time (e.g. on the date the migration is applied.)
446
+ * `index` Adds an index for the column.
447
+
448
+ Some adapters may support additional options; see the adapter specific API docs
449
+ for further information.
450
+
417
451
  ### When Helpers aren't Enough
418
452
 
419
453
  If the helpers provided by Active Record aren't enough you can use the `execute`
@@ -27,10 +27,9 @@ Rails on Rack
27
27
 
28
28
  ### Rails Application's Rack Object
29
29
 
30
- `ApplicationName::Application` is the primary Rack application object of a Rails
30
+ `Rails.application` is the primary Rack application object of a Rails
31
31
  application. Any Rack compliant web server should be using
32
- `ApplicationName::Application` object to serve a Rails
33
- application. `Rails.application` refers to the same application object.
32
+ `Rails.application` object to serve a Rails application.
34
33
 
35
34
  ### `rails server`
36
35
 
@@ -141,7 +140,7 @@ use ActionDispatch::ParamsParser
141
140
  use Rack::Head
142
141
  use Rack::ConditionalGet
143
142
  use Rack::ETag
144
- run MyApp::Application.routes
143
+ run Rails.application.routes
145
144
  ```
146
145
 
147
146
  The default middlewares shown here (and some others) are each summarized in the [Internal Middlewares](#internal-middleware-stack) section, below.
@@ -201,7 +200,7 @@ use ActionDispatch::Static
201
200
  use #<ActiveSupport::Cache::Strategy::LocalCache::Middleware:0x00000001c304c8>
202
201
  use Rack::Runtime
203
202
  ...
204
- run Blog::Application.routes
203
+ run Rails.application.routes
205
204
  ```
206
205
 
207
206
  If you want to remove session related middleware, do the following:
@@ -709,7 +709,7 @@ class BlacklistConstraint
709
709
  end
710
710
  end
711
711
 
712
- TwitterClone::Application.routes.draw do
712
+ Rails.application.routes.draw do
713
713
  get '*path', to: 'blacklist#index',
714
714
  constraints: BlacklistConstraint.new
715
715
  end
@@ -718,7 +718,7 @@ end
718
718
  You can also specify constraints as a lambda:
719
719
 
720
720
  ```ruby
721
- TwitterClone::Application.routes.draw do
721
+ Rails.application.routes.draw do
722
722
  get '*path', to: 'blacklist#index',
723
723
  constraints: lambda { |request| Blacklist.retrieve_ips.include?(request.remote_ip) }
724
724
  end
@@ -356,7 +356,7 @@ Refer to the Injection section for countermeasures against XSS. It is _recommend
356
356
 
357
357
  **CSRF** Cross-Site Request Forgery (CSRF), also known as Cross-Site Reference Forgery (XSRF), is a gigantic attack method, it allows the attacker to do everything the administrator or Intranet user may do. As you have already seen above how CSRF works, here are a few examples of what attackers can do in the Intranet or admin interface.
358
358
 
359
- A real-world example is a [router reconfiguration by CSRF](http://www.h-online.com/security/Symantec-reports-first-active-attack-on-a-DSL-router--/news/102352). The attackers sent a malicious e-mail, with CSRF in it, to Mexican users. The e-mail claimed there was an e-card waiting for them, but it also contained an image tag that resulted in a HTTP-GET request to reconfigure the user's router (which is a popular model in Mexico). The request changed the DNS-settings so that requests to a Mexico-based banking site would be mapped to the attacker's site. Everyone who accessed the banking site through that router saw the attacker's fake web site and had their credentials stolen.
359
+ A real-world example is a [router reconfiguration by CSRF](http://www.h-online.com/security/news/item/Symantec-reports-first-active-attack-on-a-DSL-router-735883.html). The attackers sent a malicious e-mail, with CSRF in it, to Mexican users. The e-mail claimed there was an e-card waiting for them, but it also contained an image tag that resulted in a HTTP-GET request to reconfigure the user's router (which is a popular model in Mexico). The request changed the DNS-settings so that requests to a Mexico-based banking site would be mapped to the attacker's site. Everyone who accessed the banking site through that router saw the attacker's fake web site and had their credentials stolen.
360
360
 
361
361
  Another example changed Google Adsense's e-mail address and password by. If the victim was logged into Google Adsense, the administration interface for Google advertisements campaigns, an attacker could change their credentials.

362
362
 
@@ -841,7 +841,7 @@ It is recommended to _use RedCloth in combination with a whitelist input filter_
841
841
 
842
842
  NOTE: _The same security precautions have to be taken for Ajax actions as for "normal" ones. There is at least one exception, however: The output has to be escaped in the controller already, if the action doesn't render a view._
843
843
 
844
- If you use the [in_place_editor plugin](http://dev.rubyonrails.org/browser/plugins/in_place_editing), or actions that return a string, rather than rendering a view, _you have to escape the return value in the action_. Otherwise, if the return value contains a XSS string, the malicious code will be executed upon return to the browser. Escape any input value using the h() method.
844
+ If you use the [in_place_editor plugin](https://rubygems.org/gems/in_place_editing), or actions that return a string, rather than rendering a view, _you have to escape the return value in the action_. Otherwise, if the return value contains a XSS string, the malicious code will be executed upon return to the browser. Escape any input value using the h() method.
845
845
 
846
846
  ### Command Line Injection
847
847
 
@@ -712,7 +712,7 @@ class UserFlowsTest < ActionDispatch::IntegrationTest
712
712
  https!(false)
713
713
  get "/posts/all"
714
714
  assert_response :success
715
- assert assigns(:products)
715
+ assert assigns(:posts)
716
716
  end
717
717
  end
718
718
  ```
@@ -3,6 +3,8 @@ A Guide for Upgrading Ruby on Rails
3
3
 
4
4
  This guide provides steps to be followed when you upgrade your applications to a newer version of Ruby on Rails. These steps are also available in individual release guides.
5
5
 
6
+ --------------------------------------------------------------------------------
7
+
6
8
  General Advice
7
9
  --------------
8
10
 
@@ -210,6 +212,16 @@ If your application depends on one of these features, you can get them back by
210
212
  adding the [`activesupport-json_encoder`](https://github.com/rails/activesupport-json_encoder)
211
213
  gem to your Gemfile.
212
214
 
215
+ #### JSON representation of Time objects
216
+
217
+ `#as_json` for objects with time component (`Time`, `DateTime`, `ActiveSupport::TimeWithZone`)
218
+ now returns millisecond precision by default. If you need to keep old behavior with no millisecond
219
+ precision, set the following in an initializer:
220
+
221
+ ```
222
+ ActiveSupport::JSON::Encoding.time_precision = 0
223
+ ```
224
+
213
225
  ### Usage of `return` within inline callback blocks
214
226
 
215
227
  Previously, Rails allowed inline callback blocks to use `return` this way:
@@ -265,7 +277,7 @@ included in the newly introduced `ActiveRecord::FixtureSet.context_class`, in
265
277
  `test_helper.rb`.
266
278
 
267
279
  ```ruby
268
- class FixtureFileHelpers
280
+ module FixtureFileHelpers
269
281
  def file_sha(path)
270
282
  Digest::SHA2.hexdigest(File.read(Rails.root.join('test/fixtures', path)))
271
283
  end
@@ -401,6 +413,20 @@ symbol access is no longer supported. This is also the case for
401
413
  `store_accessors` based on top of `json` or `hstore` columns. Make sure to use
402
414
  string keys consistently.
403
415
 
416
+ ### Explicit block use for `ActiveSupport::Callbacks`
417
+
418
+ Rails 4.1 now expects an explicit block to be passed when calling
419
+ `ActiveSupport::Callbacks.set_callback`. This change stems from
420
+ `ActiveSupport::Callbacks` being largely rewritten for the 4.1 release.
421
+
422
+ ```ruby
423
+ # Previously in Rails 4.0
424
+ set_callback :save, :around, ->(r, &block) { stuff; result = block.call; stuff }
425
+
426
+ # Now in Rails 4.1
427
+ set_callback :save, :around, ->(r, block) { stuff; result = block.call; stuff }
428
+ ```
429
+
404
430
  Upgrading from Rails 3.2 to Rails 4.0
405
431
  -------------------------------------
406
432
 
@@ -472,7 +498,7 @@ being used, you can update your form to use the `PUT` method instead:
472
498
  <%= form_for [ :update_name, @user ], method: :put do |f| %>
473
499
  ```
474
500
 
475
- For more on PATCH and why this change was made, see [this post](http://weblog.rubyonrails.org/2012/2/25/edge-rails-patch-is-the-new-primary-http-method-for-updates/)
501
+ For more on PATCH and why this change was made, see [this post](http://weblog.rubyonrails.org/2012/2/26/edge-rails-patch-is-the-new-primary-http-method-for-updates/)
476
502
  on the Rails blog.
477
503
 
478
504
  #### A note about media types
@@ -515,7 +541,7 @@ file (in `config/application.rb`):
515
541
  ```ruby
516
542
  # Require the gems listed in Gemfile, including any gems
517
543
  # you've limited to :test, :development, or :production.
518
- Bundler.require(:default, Rails.env)
544
+ Bundler.require(*Rails.groups)
519
545
  ```
520
546
 
521
547
  ### vendor/plugins
@@ -532,6 +558,9 @@ Rails 4.0 no longer supports loading plugins from `vendor/plugins`. You must rep
532
558
 
533
559
  * Rails 4.0 has changed `serialized_attributes` and `attr_readonly` to class methods only. You shouldn't use instance methods since it's now deprecated. You should change them to use class methods, e.g. `self.serialized_attributes` to `self.class.serialized_attributes`.
534
560
 
561
+ * When using the default coder, assigning `nil` to a serialized attribute will save it
562
+ to the database as `NULL` instead of passing the `nil` value through YAML (`"--- \n...\n"`).
563
+
535
564
  * Rails 4.0 has removed `attr_accessible` and `attr_protected` feature in favor of Strong Parameters. You can use the [Protected Attributes gem](https://github.com/rails/protected_attributes) for a smooth upgrade path.
536
565
 
537
566
  * If you are not using Protected Attributes, you can remove any options related to
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: rails
3
3
  version: !ruby/object:Gem::Version
4
- version: 4.1.4
4
+ version: 4.1.16
5
5
  platform: ruby
6
6
  authors:
7
7
  - David Heinemeier Hansson
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2014-07-02 00:00:00.000000000 Z
11
+ date: 2016-07-12 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: activesupport
@@ -16,98 +16,98 @@ dependencies:
16
16
  requirements:
17
17
  - - '='
18
18
  - !ruby/object:Gem::Version
19
- version: 4.1.4
19
+ version: 4.1.16
20
20
  type: :runtime
21
21
  prerelease: false
22
22
  version_requirements: !ruby/object:Gem::Requirement
23
23
  requirements:
24
24
  - - '='
25
25
  - !ruby/object:Gem::Version
26
- version: 4.1.4
26
+ version: 4.1.16
27
27
  - !ruby/object:Gem::Dependency
28
28
  name: actionpack
29
29
  requirement: !ruby/object:Gem::Requirement
30
30
  requirements:
31
31
  - - '='
32
32
  - !ruby/object:Gem::Version
33
- version: 4.1.4
33
+ version: 4.1.16
34
34
  type: :runtime
35
35
  prerelease: false
36
36
  version_requirements: !ruby/object:Gem::Requirement
37
37
  requirements:
38
38
  - - '='
39
39
  - !ruby/object:Gem::Version
40
- version: 4.1.4
40
+ version: 4.1.16
41
41
  - !ruby/object:Gem::Dependency
42
42
  name: actionview
43
43
  requirement: !ruby/object:Gem::Requirement
44
44
  requirements:
45
45
  - - '='
46
46
  - !ruby/object:Gem::Version
47
- version: 4.1.4
47
+ version: 4.1.16
48
48
  type: :runtime
49
49
  prerelease: false
50
50
  version_requirements: !ruby/object:Gem::Requirement
51
51
  requirements:
52
52
  - - '='
53
53
  - !ruby/object:Gem::Version
54
- version: 4.1.4
54
+ version: 4.1.16
55
55
  - !ruby/object:Gem::Dependency
56
56
  name: activemodel
57
57
  requirement: !ruby/object:Gem::Requirement
58
58
  requirements:
59
59
  - - '='
60
60
  - !ruby/object:Gem::Version
61
- version: 4.1.4
61
+ version: 4.1.16
62
62
  type: :runtime
63
63
  prerelease: false
64
64
  version_requirements: !ruby/object:Gem::Requirement
65
65
  requirements:
66
66
  - - '='
67
67
  - !ruby/object:Gem::Version
68
- version: 4.1.4
68
+ version: 4.1.16
69
69
  - !ruby/object:Gem::Dependency
70
70
  name: activerecord
71
71
  requirement: !ruby/object:Gem::Requirement
72
72
  requirements:
73
73
  - - '='
74
74
  - !ruby/object:Gem::Version
75
- version: 4.1.4
75
+ version: 4.1.16
76
76
  type: :runtime
77
77
  prerelease: false
78
78
  version_requirements: !ruby/object:Gem::Requirement
79
79
  requirements:
80
80
  - - '='
81
81
  - !ruby/object:Gem::Version
82
- version: 4.1.4
82
+ version: 4.1.16
83
83
  - !ruby/object:Gem::Dependency
84
84
  name: actionmailer
85
85
  requirement: !ruby/object:Gem::Requirement
86
86
  requirements:
87
87
  - - '='
88
88
  - !ruby/object:Gem::Version
89
- version: 4.1.4
89
+ version: 4.1.16
90
90
  type: :runtime
91
91
  prerelease: false
92
92
  version_requirements: !ruby/object:Gem::Requirement
93
93
  requirements:
94
94
  - - '='
95
95
  - !ruby/object:Gem::Version
96
- version: 4.1.4
96
+ version: 4.1.16
97
97
  - !ruby/object:Gem::Dependency
98
98
  name: railties
99
99
  requirement: !ruby/object:Gem::Requirement
100
100
  requirements:
101
101
  - - '='
102
102
  - !ruby/object:Gem::Version
103
- version: 4.1.4
103
+ version: 4.1.16
104
104
  type: :runtime
105
105
  prerelease: false
106
106
  version_requirements: !ruby/object:Gem::Requirement
107
107
  requirements:
108
108
  - - '='
109
109
  - !ruby/object:Gem::Version
110
- version: 4.1.4
110
+ version: 4.1.16
111
111
  - !ruby/object:Gem::Dependency
112
112
  name: bundler
113
113
  requirement: !ruby/object:Gem::Requirement
@@ -294,6 +294,8 @@ files:
294
294
  - guides/bug_report_templates/action_controller_master.rb
295
295
  - guides/bug_report_templates/active_record_gem.rb
296
296
  - guides/bug_report_templates/active_record_master.rb
297
+ - guides/bug_report_templates/generic_gem.rb
298
+ - guides/bug_report_templates/generic_master.rb
297
299
  - guides/code/getting_started/Gemfile
298
300
  - guides/code/getting_started/Gemfile.lock
299
301
  - guides/code/getting_started/README.rdoc
@@ -452,7 +454,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
452
454
  version: 1.8.11
453
455
  requirements: []
454
456
  rubyforge_project:
455
- rubygems_version: 2.3.0
457
+ rubygems_version: 2.4.5.1
456
458
  signing_key:
457
459
  specification_version: 4
458
460
  summary: Full-stack web application framework.