simple_calendar 3.1.0 → 3.1.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6648d821f8f764b1abac6ece0cdbe575a53696cb85c8057977505f3c61b26aa5
-  data.tar.gz: dacfc17b693c75f56cf9d104cc827ef9026980356a803c287931158816b1d510
+  metadata.gz: a1789f19b1f7e2ff7dfe9734bd1ef5a4ff45a76204c52f63155854fca76cc033
+  data.tar.gz: 7128d7d5d2f8a65d9377aafdd828edd8e30d8e7a2f56ca0f7ca7c95a81bb5928
 SHA512:
-  metadata.gz: 9050ae89085e40c8b3bb7af30c93ff913ea0cc5a6a1d07e1bee28c3126857c40b7ef28b58e1f8529e6712d941af4dba9aa73cf56d9b400bde172cf4b684e958a
-  data.tar.gz: d71601a640b7bcc4bba127b7b5ec3fa17ced71a481e15e280e2a39ed1f7306a535adfecd6fdabdb1ec4b74e5045828d55e637216043b1d08062bc07a9f63be6f
+  metadata.gz: acf827741610c4a259770cdf52da653156816c7bb75c31a1228b543ebcf5761b66c72b3594da14dd680c542947fd2b018629d0ccd089d7c685ef21704c30413a
+  data.tar.gz: 22f93c93d076483140e00c79ed33a8e194d3d1ad3624513fa7e9959be6107e5d1a7c5b9909464b98a1fbecfd3ec0a918293d51d12969aa9ff06f810992b6c051

data/lib/simple_calendar/calendar.rb

@@ -2,7 +2,14 @@ require "rails"
 
 module SimpleCalendar
   class Calendar
-    PARAM_KEY_BLACKLIST = :authenticity_token, :commit, :utf8, :_method, :script_name
+    # Besides form noise, this drops keys url_for treats as URL options instead of query
+    # params. Passing them through from the request would let a crafted link change the
+    # host, protocol, route, etc. of the Previous / Today / Next links (open redirect,
+    # javascript: XSS, 500s).
+    PARAM_KEY_BLACKLIST = :authenticity_token, :commit, :utf8, :_method, :script_name,
+      :host, :protocol, :port, :subdomain, :domain, :tld_length, :trailing_slash, :anchor,
+      :params, :only_path, :original_script_name, :relative_url_root, :user, :password,
+      :use_route, :_recall
 
     attr_accessor :view_context, :options
 
@@ -125,7 +132,7 @@ module SimpleCalendar
       if options.has_key?(:start_date)
         options.fetch(:start_date).to_date
       else
-        view_context.params.fetch(start_date_param, Date.current).to_date
+        start_date_from_params || Date.current
       end
     end
 
@@ -136,5 +143,13 @@ module SimpleCalendar
     def additional_days
       options.fetch(:number_of_days, 4) - 1
     end
+
+    private
+
+    def start_date_from_params
+      view_context.params[start_date_param].try(:to_date)
+    rescue ArgumentError # Date::Error inherits from ArgumentError
+      nil
+    end
   end
 end

data/lib/simple_calendar/version.rb

@@ -1,3 +1,3 @@
 module SimpleCalendar
-  VERSION = "3.1.0"
+  VERSION = "3.1.2"
 end

data/lib/simple_calendar/week_calendar.rb

@@ -1,16 +1,16 @@
 module SimpleCalendar
   class WeekCalendar < SimpleCalendar::Calendar
     def week_number
-      format = (Date.beginning_of_week == :sunday) ? "%U" : "%V"
-      start_date.beginning_of_week.strftime(format).to_i
+      week_number_for(start_date)
     end
 
     def number_of_weeks
       options.fetch(:number_of_weeks, 1)
     end
 
+    # Computed from the date, not week_number + n, so it wraps across a year boundary.
     def end_week
-      week_number + number_of_weeks - 1
+      week_number_for(date_range.last)
     end
 
     def date_range
@@ -23,5 +23,12 @@ module SimpleCalendar
     def url_for_previous_view
       view_context.url_for(@params.merge(start_date_param => (date_range.first - 1.day).iso8601))
     end
+
+    private
+
+    def week_number_for(date)
+      format = (Date.beginning_of_week == :sunday) ? "%U" : "%V"
+      date.beginning_of_week.strftime(format).to_i
+    end
   end
 end

metadata

@@ -1,13 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: simple_calendar
 version: !ruby/object:Gem::Version
-  version: 3.1.0
+  version: 3.1.2
 platform: ruby
 authors:
 - Chris Oliver
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2025-01-09 00:00:00.000000000 Z
+date: 2026-10-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -51,6 +52,7 @@ metadata:
   homepage_uri: https://github.com/excid3/simple_calendar
   source_code_uri: https://github.com/excid3/simple_calendar
   changelog_uri: https://github.com/excid3/simple_calendar/blob/main/CHANGELOG.md
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -65,7 +67,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.2
+rubygems_version: 3.5.22
+signing_key:
 specification_version: 4
 summary: A simple Rails calendar
 test_files: []