rails_admin 2.0.1 → 2.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4e762b5bdac4e8a36a97a7c202d8a44313d3bc832a52841fc23ffbf01fc585b0
-  data.tar.gz: 9059efd9fba737bc94817e0613f62c276551ae37dfc14f79e8fb8def21bfbdcf
+  metadata.gz: b602512e6e725b80b4710d009beb60fffc8089f20a677579174f5af05ed7a728
+  data.tar.gz: b983654e17ee5f1a15bab17d2d5afbba7f06eb7d8b6f4be92112f5e9ad41ddf7
 SHA512:
-  metadata.gz: ca9f568f3c3e8e2a7b63ad2d64de0d89944db6f6735376714a2d019a60d592c7a80e8c3c0b2a9ce606f390dadc630d7478a1471b3e90b4283091b063b30001dd
-  data.tar.gz: fc5afc47e02d74b54c868c77cbf4b45217e5d2f9396e2c9e5c34ed1d2b7c2e4dfd3040657e7d21930ed5ee61599dd5ccbbd128c464f7ff2cb228e9e712d73761
+  metadata.gz: d2ec664fd9c217fd62d3ca65af5718e095f8de4ac3919ea0fe29b2e8d203e984583dd11877aa1ff8c40e2e8a696e55f304f24312da87da08051ba0a2bc33c99a
+  data.tar.gz: d2350c08e53ba3ed67e65bdd75863f4fd02b7c26ace2fdcafae81363b6567d6c5db52bcb2631224d0f5d291e46a9e577187fdcdc4bbc6e96613083dd8266b948

data/README.md

@@ -16,6 +16,12 @@
 
 RailsAdmin is a Rails engine that provides an easy-to-use interface for managing your data.
 
+## Announcements
+
+### [Action required] Security issue
+
+**RailsAdmin 2.0.1, 2.0.0 and up to 1.4.2 have been reported to have XSS vulnerability.** We strongly recommend that you upgrade RailsAdmin to 2.0.2 (and higher) or 1.4.3 as soon as possible, if you are on those versions. See [d72090ec](https://github.com/sferik/rails_admin/commit/d72090ec6a07c3b9b7b48ab50f3d405f91ff4375) for the detail.
+
 ## Getting started
 
 * Check out [the docs][docs].
@@ -93,6 +99,7 @@ This library aims to support and is [tested against][travis] the following Ruby
 * Ruby 2.4
 * Ruby 2.5
 * Ruby 2.6
+* Ruby 2.7
 * [JRuby][]
 
 [jruby]: http://jruby.org/

data/app/assets/javascripts/rails_admin/ra.nested-form-hooks.js

@@ -11,7 +11,9 @@
   $(document).on('nested:fieldAdded', 'form', function(content) {
     var controls, field, nav, new_tab, one_to_one, parent_group, toggler;
     field = content.field.addClass('tab-pane').attr('id', 'unique-id-' + (new Date().getTime()));
-    new_tab = $('<li><a data-toggle="tab" href="#' + field.attr('id') + '">' + field.children('.object-infos').data('object-label') + '</a></li>');
+    new_tab = $('<li></li>').append(
+        $('<a></a>').attr('data-toggle', 'tab').attr('href', '#' + field.attr('id')).text(field.children('.object-infos').data('object-label'))
+    )
     parent_group = field.closest('.control-group');
     controls = parent_group.children('.controls');
     one_to_one = controls.data('nestedone') !== void 0;
@@ -27,7 +29,7 @@
     content.select(':hidden').show('slow');
     toggler.addClass('active').removeClass('disabled').children('i').addClass('icon-chevron-down').removeClass('icon-chevron-right');
     if (one_to_one) {
-      controls.find('.add_nested_fields').removeClass('add_nested_fields').html(field.children('.object-infos').data('object-label'));
+      controls.find('.add_nested_fields').removeClass('add_nested_fields').text(field.children('.object-infos').data('object-label'));
     }
   });
 

data/app/assets/javascripts/rails_admin/ra.widgets.js

@@ -137,7 +137,11 @@
         toggler = field.find('> .controls > .btn-group > .toggler');
         tab_content.children('.fields:not(.tab-pane)').addClass('tab-pane').each(function() {
           $(this).attr('id', 'unique-id-' + (new Date().getTime()) + Math.floor(Math.random() * 100000));
-          nav.append('<li><a data-toggle="tab" href="#' + this.id + '">' + $(this).children('.object-infos').data('object-label') + '</a></li>');
+          nav.append(
+              $('<li></li>').append(
+                  $('<a></a>').attr('data-toggle', 'tab').attr('href', '#' + this.id).text($(this).children('.object-infos').data('object-label'))
+              )
+          );
         });
         if (nav.find("> li.active").length === 0) {
           nav.find("> li > a[data-toggle='tab']:first").tab('show');
@@ -165,8 +169,12 @@
         tab_content = field.find("> .tab-content");
         toggler = field.find('> .controls > .btn-group > .toggler');
         tab_content.children(".fields:not(.tab-pane)").addClass('tab-pane active').each(function() {
-          field.find('> .controls .add_nested_fields').removeClass('add_nested_fields').html($(this).children('.object-infos').data('object-label'));
-          nav.append('<li><a data-toggle="tab" href="#' + this.id + '">' + $(this).children('.object-infos').data('object-label') + '</a></li>');
+          field.find('> .controls .add_nested_fields').removeClass('add_nested_fields').text($(this).children('.object-infos').data('object-label'));
+          nav.append(
+              $('<li></li>').append(
+                  $('<a></a>').attr('data-toggle', 'tab').attr('href', '#' + this.id).text($(this).children('.object-infos').data('object-label'))
+              )
+          );
         });
         first_tab = nav.find("> li > a[data-toggle='tab']:first");
         first_tab.tab('show');

data/app/views/rails_admin/main/index.html.haml

@@ -53,7 +53,7 @@
           %button.btn.btn-primary{type: 'submit', :'data-disable-with' => '<i class="icon-white icon-refresh"></i> '.html_safe + t('admin.misc.refresh')}
             %i.icon-white.icon-refresh
             = t('admin.misc.refresh')
-          %button#remove_filter.btn.btn-info{title: "Reset filters"}
+          %button#remove_filter.btn.btn-info{title: t('admin.misc.reset_filters')}
             %i.icon-white.icon-remove
       - if export_action
         %span{style: 'float:right'}= link_to wording_for(:link, export_action), export_path(params.except('set').except('page')), class: 'btn btn-info'

data/config/locales/rails_admin.en.yml

@@ -29,6 +29,7 @@ en:
     misc:
       search: "Search"
       filter: "Filter"
+      reset_filters: "Reset filters"
       refresh: "Refresh"
       show_all: "Show all"
       add_filter: "Add filter"

data/lib/rails_admin/adapters/active_record/abstract_object.rb

@@ -23,8 +23,8 @@ module RailsAdmin
           object.save(options)
         end
 
-        def method_missing(name, *args, &block)
-          object.send(name, *args, &block)
+        def method_missing(method_name, *args, &block)
+          object.send(method_name, *args, &block)
         end
       end
     end

data/lib/rails_admin/config/lazy_model.rb

@@ -56,12 +56,12 @@ module RailsAdmin
         @model
       end
 
-      def method_missing(method, *args, &block)
-        target.send(method, *args, &block)
+      def method_missing(method_name, *args, &block)
+        target.send(method_name, *args, &block)
       end
 
-      def respond_to?(method, include_private = false)
-        super || target.respond_to?(method, include_private)
+      def respond_to?(method_name, include_private = false)
+        super || target.respond_to?(method_name, include_private)
       end
     end
   end

data/lib/rails_admin/config/model.rb

@@ -100,8 +100,8 @@ module RailsAdmin
 
       # Act as a proxy for the base section configuration that actually
       # store the configurations.
-      def method_missing(m, *args, &block)
-        send(:base).send(m, *args, &block)
+      def method_missing(method_name, *args, &block)
+        send(:base).send(method_name, *args, &block)
       end
     end
   end

data/lib/rails_admin/config/proxyable/proxy.rb

@@ -17,18 +17,18 @@ module RailsAdmin
           self
         end
 
-        def method_missing(name, *args, &block)
-          if @object.respond_to?(name)
+        def method_missing(method_name, *args, &block)
+          if @object.respond_to?(method_name)
             reset = @object.bindings
             begin
               @object.bindings = @bindings
-              response = @object.__send__(name, *args, &block)
+              response = @object.__send__(method_name, *args, &block)
             ensure
               @object.bindings = reset
             end
             response
           else
-            super(name, *args, &block)
+            super(method_name, *args, &block)
           end
         end
       end

data/lib/rails_admin/extension.rb

@@ -33,7 +33,7 @@ module RailsAdmin
     (AUTHORIZATION_ADAPTERS.values + AUDITING_ADAPTERS.values).each do |klass|
       begin
         klass.setup if klass.respond_to? :setup
-      rescue # rubocop:disable Lint/HandleExceptions
+      rescue # rubocop:disable Lint/HandleExceptions, Style/RescueStandardError
         # ignore errors
       end
     end

data/lib/rails_admin/version.rb

@@ -2,7 +2,7 @@ module RailsAdmin
   class Version
     MAJOR = 2
     MINOR = 0
-    PATCH = 1
+    PATCH = 2
     PRE = nil
 
     class << self

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails_admin
 version: !ruby/object:Gem::Version
-  version: 2.0.1
+  version: 2.0.2
 platform: ruby
 authors:
 - Erik Michaels-Ober
@@ -12,7 +12,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-12-31 00:00:00.000000000 Z
+date: 2020-03-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: builder