f27e7ebc0e2a55a268631c78d49a5b70b06ad59a Michael Koziarski michael@koziarski.com http://github.com/rails/rails/commit/9415935902f120a9bac0bfce7129725a0db38ed3 9415935902f120a9bac0bfce7129725a0db38ed3

2009-10-07T13:31:20-07:00

Switch to on-by-default XSS escaping for rails. This consists of: * String#html_safe! a method to mark a string as 'safe' * ActionView::SafeBuffer a string subclass which escapes anything unsafe which is concatenated to it * Calls to String#html_safe! throughout the rails helpers * a 'raw' helper which lets you concatenate trusted HTML from non-safety-aware sources (e.g. presantized strings in the DB) * New ERB implementation based on erubis which uses a SafeBuffer instead of a String Hat tip to Django for the inspiration. 654d184caccfd7e1de4d60236fb7813bf1177d84 Michael Koziarski michael@koziarski.com 9b552fb300c4606fe517eadaa30708e9d75498a6 Yehuda Katz wycats@gmail.com http://github.com/rails/rails/commit/1310231c15742bf7d99e2f143d88b383c32782d3 1310231c15742bf7d99e2f143d88b383c32782d3

2009-08-15T12:32:02-07:00

2009-08-14T22:32:40-07:00

Got tests to pass with some more changes. * request.formats is much simpler now * For XHRs or Accept headers with a single item, we use the Accept header * For other requests, we use params[:format] or fallback to HTML * This is primarily to work around the fact that browsers provide completely broken Accept headers, so we have to whitelist the few cases we can specifically isolate and treat other requests as coming from the browser * For APIs, we can support single-item Accept headers, which disambiguates from the browsers * Requests to an action that only has an XML template from the browser will no longer find the template. This worked previously because most browsers provide a catch-all */*, but this was mostly accidental behavior. If you want to serve XML, either use the :xml format in links, or explicitly specify the XML template: render "template.xml". 7f32ae8257410a19e1b9d4b189cc65803879c8e3 Yehuda Katz wycats@gmail.com c1fcabb3505dd1595142e394d2dca71d62acf77c Jeremy Kemper jeremy@bitsweat.net http://github.com/rails/rails/commit/d3078b540ed154b6ea245de40e8de8bba642cd02 d3078b540ed154b6ea245de40e8de8bba642cd02

2009-06-08T15:07:52-07:00

2009-06-08T15:04:26-07:00

Explicitly qualify constants in BasicObjects 09ab8f39370638b648e0095247ddb23f0f2c2637 Jeremy Kemper jeremy@bitsweat.net 86fc43fd584726ba81b1a3b3e0a6f6000c1f4cc8 Jeremy Kemper jeremy@bitsweat.net http://github.com/rails/rails/commit/a6bf6f275c4fb25e5521faa148d2d2ea63a064b2 a6bf6f275c4fb25e5521faa148d2d2ea63a064b2

2009-06-08T14:08:04-07:00

Use as_json instead of rails_to_json 1969098bfe92e6cedf1b01e3676d3f12633fd4da Jeremy Kemper jeremy@bitsweat.net 1126a85aed576402d978e6f76eb393b6baaa9541 Yehuda Katz wycats@yehuda-katzs-macbookpro41.local http://github.com/rails/rails/commit/6b4da2ecacc28d7e50aa0e0123b5f4564d6e92c2 6b4da2ecacc28d7e50aa0e0123b5f4564d6e92c2

2009-06-02T21:43:54-07:00

Add explicit requirement in a few cases it was missing. TODO: Come up with the minimal core and remove all of these 25416ec6c0dbbd016cd00f975afd3c4bc3736eeb Yehuda Katz wycats@yehuda-katzs-macbookpro41.local e773d0e68ac64bd26d86860a9a8e0048e2b6bb48 Yehuda Katz + Carl Lerche ykatz+clerche@engineyard.com http://github.com/rails/rails/commit/6923b392b740f2346326634532b40cf24a0f26ef 6923b392b740f2346326634532b40cf24a0f26ef

2009-05-21T16:35:40-07:00

Added the :rjs render option 55a6486563e8d9a408c1dd8c7628e85c88af570e Yehuda Katz + Carl Lerche ykatz+clerche@engineyard.com 678385d307559b2b5737bb2b07f633d2b9a0802c Jeremy Kemper jeremy@bitsweat.net http://github.com/rails/rails/commit/ee46ffedb88f812467485167036c7d254d0ce757 ee46ffedb88f812467485167036c7d254d0ce757

2009-04-26T20:04:47-07:00

Now that we have a separate internal rails_to_json, use a separate circular reference stack instead of sticking it in the options hash 3a2024e2edff6a61822a12c6308a1d917fa683fe Jeremy Kemper jeremy@bitsweat.net 5cef0cbad2d1df013c74ab96c16cf7fd84040f46 Jeremy Kemper jeremy@bitsweat.net http://github.com/rails/rails/commit/678385d307559b2b5737bb2b07f633d2b9a0802c 678385d307559b2b5737bb2b07f633d2b9a0802c

2009-04-26T19:59:22-07:00

Use javascript_object_for 3133565fc3aa341ca7bb4466f55dc0db90e5d18d Jeremy Kemper jeremy@bitsweat.net be7e21a85c487b6f3bfc2e393387ada5cc52290d Jeremy Kemper jeremy@bitsweat.net http://github.com/rails/rails/commit/8d64085138b1a2ff36b94267d0236868b287610e 8d64085138b1a2ff36b94267d0236868b287610e

2009-04-26T15:18:33-07:00

Only Object to_json alias is needed. Prefer nil options. 928eba809df85dfe47195f05171d60af3dec6665 Jeremy Kemper jeremy@bitsweat.net da3a80dd4fadde9b3bd671c72b5bee737fb70e39 Jeremy Kemper jeremy@bitsweat.net http://github.com/rails/rails/commit/be7e21a85c487b6f3bfc2e393387ada5cc52290d be7e21a85c487b6f3bfc2e393387ada5cc52290d

2009-04-26T15:05:50-07:00

Qualify toplevel constant references since we're in a BasicObject 9495022d2696270520b8c95770b03b53a23a676b Jeremy Kemper jeremy@bitsweat.net bab2bfa69220ca1b6c7b56dccc79cf8e41245306 rick technoweenie@gmail.com http://github.com/rails/rails/commit/3c4c6bd0df598f865f49a983b4c65c415af4bcfc 3c4c6bd0df598f865f49a983b4c65c415af4bcfc

2009-04-23T00:08:40-07:00

* Add pluggable JSON backends with support for the JSON gem. [rick] Example: ActiveSupport::JSON.backend = "JSONGem" All internal Rails JSON encoding is now handled by ActiveSupport::JSON.encode(). Use of #to_json is not recommended, as it may clash with other libraries that overwrite it. However, you can recover Rails specific functionality if you really want to use #to_json. gem 'json' ActiveSupport::JSON.backend = "JSONGem" class ActiveRecord::Base alias to_json rails_to_json end 0984e610d94f22dfa70e95259f1a81e57e7f9db7 rick technoweenie@gmail.com 2036d3ba75da1a0f3061bf5a33c89e2b2eaff420 c877857d59554d78dbf45f5f9fcaafb8badec4e2 Carl Lerche & Yehuda Katz wycats@gmail.com http://github.com/rails/rails/commit/906aebceedb95d8caa6db6314bc90f605bdfaf2b 906aebceedb95d8caa6db6314bc90f605bdfaf2b

2009-04-13T15:18:45-07:00

Bring abstract_controller up to date with rails/master Resolved all the conflicts since 2.3.0 -> HEAD. Following is a list of commits that could not be applied cleanly or are obviated with the abstract_controller refactor. They all need to be revisited to ensure that fixes made in 2.3 do not reappear in 3.0: 2259ecf368e6a6715966f69216e3ee86bf1a82a7 AR not available * This will be reimplemented with ActionORM or equivalent 06182ea02e92afad579998aa80144588e8865ac3 implicitly rendering a js response should not use the default layout [#1844 state:resolved] * This will be handled generically 893e9eb99504705419ad6edac14d00e71cef5f12 Improve view rendering performance in development mode and reinstate template recompiling in production [#1909 state:resolved] * We will need to reimplement rails-dev-boost on top of the refactor; the changes here are very implementation specific and cannot be cleanly applied. The following commits are implicated: 199e750d46c04970b5e7684998d09405648ecbd4 3942cb406e1d5db0ac00e03153809cc8dc4cc4db f8ea9f85d4f1e3e6f3b5d895bef6b013aa4b0690 e3b166aab37ddc2fbab030b146eb61713b91bf55 ae9f258e03c9fd5088da12c1c6cd216cc89a01f7 44423126c6f6133a1d9cf1d0832b527e8711d40f 0cb020b4d6d838025859bd60fb8151c8e21b8e84 workaround for picking layouts based on wrong view_paths [#1974 state:resolved] * The specifics of this commit no longer apply. Since it is a two-line commit, we will reimplement this change. 8c5cc66a831aadb159f3daaffa4208064c30af0e make action_controller/layouts pick templates from the current instance's view_paths instead of the class view_paths [#1974 state:resolved] * This does not apply at all. It should be trivial to apply the feature to the reimplemented ActionController::Base. 87e8b162463f13bd50d27398f020769460a770e3 fix HTML fallback for explicit templates [#2052 state:resolved] * There were a number of patches related to this that simply compounded each other. Basically none of them apply cleanly, and the underlying issue needs to be revisited. After discussing the underlying problem with Koz, we will defer these fixes for further discussion. 5abc86bb6709b20df7cb5f4d1750b27c641dca4b Carl Lerche & Yehuda Katz wycats@gmail.com 822c41d69d9228c9912d29ac45155d3a16bb5c50 Jeremy Kemper jeremy@bitsweat.net http://github.com/rails/rails/commit/a3e67a15edcdcfd2fd84f078cb3e2c76d0226794 a3e67a15edcdcfd2fd84f078cb3e2c76d0226794

2009-03-08T13:41:51-07:00

Prototype helpers support the onCreate callback. [#1074 state:committed] 3448d28396582cc6f51dd412acf63963c938449c Jeremy Kemper jeremy@bitsweat.net cc0b5fa9930dcc60914e21b518b3c54109243cfa Yehuda Katz wycats@gmail.com http://github.com/rails/rails/commit/eb9af20b7cc0e374277cf330bdd404f9daab28ec eb9af20b7cc0e374277cf330bdd404f9daab28ec

2009-01-22T14:18:10-08:00

Begin unifying the interface between ActionController and ActionView ba05a906690684e442ed92db3e63e295f0dd133e Joshua Peek josh@joshpeek.com 276ea48de96a0c4242139ec9323eefb6f254c2a1 Frederick Cheung frederick.cheung@gmail.com http://github.com/rails/rails/commit/40247a8cbb1ec735ccd4d8490043345b86af31cc 40247a8cbb1ec735ccd4d8490043345b86af31cc

2008-12-21T07:55:52-08:00

2008-12-21T04:12:42-08:00

Remove observe_field :on option as prototype no longer supports it [#1088 state:resolved] 7f0bb13121089127a265ff37bd603e2fe29d86cb Pratik Naik pratiknaik@gmail.com a76351093c014029a8c9ec7c9c341dde11c57f4d Joshua Peek josh@joshpeek.com http://github.com/rails/rails/commit/8aeed003f562fe9199614d013163c89b5182cd33 8aeed003f562fe9199614d013163c89b5182cd33

2008-11-24T10:17:07-08:00

2008-11-24T10:14:45-08:00

prototype and scripty helpers require json 3ecb15bacd08154420073952361422e09043d55a Joshua Peek josh@joshpeek.com 8e50f0f96ef53ee8cc7ffa86ce0e71cc357b2b6c Tarmo Tänav tarmo@itech.ee http://github.com/rails/rails/commit/51b986619d88f7ba98be7d271188785cbbb541a0 51b986619d88f7ba98be7d271188785cbbb541a0

2008-10-06T16:12:20-07:00

2008-10-06T07:35:21-07:00

Implement submit_to_remote as a wrapper around a more generic button_to_remote Removed the "return false" from submit_to_remote onclick end as button input elements have no default behavior to cancel. Signed-off-by: Pratik Naik <pratiknaik@gmail.com> e0fbc752ec252c8a1bef0a5cd96db9a3dd999fa3 Pratik Naik pratiknaik@gmail.com 10fe6a6d8940300dd6698ec38e9c9573404e687d Pratik Naik pratiknaik@gmail.com http://github.com/rails/rails/commit/6ef35461dc7148ce37ed602d65a24f6c883fd044 6ef35461dc7148ce37ed602d65a24f6c883fd044

2008-09-03T09:58:47-07:00

Merge docrails c190505eaa8b98b4fcae4403bdd4776957d07785 Pratik Naik pratiknaik@gmail.com cb25c4e5849dc3b803784ad985ea1cb4e43b0c74 miloops miloops@gmail.com http://github.com/rails/rails/commit/367a55e1b8deb87e7388cb97b2ac8c28a0796c89 367a55e1b8deb87e7388cb97b2ac8c28a0796c89

2008-08-30T16:35:25-07:00

2008-08-30T15:49:32-07:00

Allow prototype functions to receive position parameter as a symbol. [#887 state:resolved] Signed-off-by: Jeremy Kemper <jeremy@bitsweat.net> 22f27274a97f77185f85187f8593727191a324be Jeremy Kemper jeremy@bitsweat.net 5a6e20b60702fbe86fa84c1b7b5a25f33cec5945 Tarmo Tänav tarmo@itech.ee http://github.com/rails/rails/commit/6450d6ca76603bc5d1b1a6cdcb77e33e35f53d83 6450d6ca76603bc5d1b1a6cdcb77e33e35f53d83

2008-08-29T16:22:01-07:00

2008-08-29T16:08:16-07:00

Added button_to_remote helper Ticket originally from http://dev.rubyonrails.org/ticket/3641 Signed-off-by: Jeremy Kemper <jeremy@bitsweat.net> cfe8467e3a16c5a90a4e6aa09a2e99319966bcff Jeremy Kemper jeremy@bitsweat.net cd91a8d3adb70e573ab8d0d733a966db5eff1e1d Joshua Peek josh@joshpeek.com http://github.com/rails/rails/commit/6ec07e0737c3099056fc11fe43f4f19dde3770a6 6ec07e0737c3099056fc11fe43f4f19dde3770a6

2008-08-26T14:17:58-07:00

Store application and other context specific helper modules in ActionView::Base#helpers 7911a26c4ed148c706951a301a1ebdc2e46af8e2 Joshua Peek josh@joshpeek.com c111522d5b8cd108756240a0348d515d6acee46c Joshua Peek josh@joshpeek.com http://github.com/rails/rails/commit/229eedfda87a7706dbb5e3e51af8707b3adae375 229eedfda87a7706dbb5e3e51af8707b3adae375

2008-08-26T10:17:55-07:00

2008-08-26T10:14:21-07:00

Cache JavaScriptGenerator's helper module set on the template 1a782151632dd80c8a18c3960536bdf8643debe3 Joshua Peek josh@joshpeek.com ba0d621695c372464383b56d2f33a7b892ed6aa5 Joshua Peek josh@joshpeek.com http://github.com/rails/rails/commit/f2d8d13c6495f2a9b3bbf3b50d869c0e5b25c207 f2d8d13c6495f2a9b3bbf3b50d869c0e5b25c207

2008-08-25T19:50:26-07:00

2008-08-25T19:44:21-07:00

Performance: Cache modules that extend the view context for JavaScriptGenerator 03154d7843617fe745a9316c6a010dc7944c5f0f Joshua Peek josh@joshpeek.com cb68b21a52a12b0773f0b4dac1c9c673c93ba355 miloops miloops@gmail.com http://github.com/rails/rails/commit/f3da46effae9f23f6ea473f7296e9c0c9bb49fce f3da46effae9f23f6ea473f7296e9c0c9bb49fce

2008-07-31T12:28:12-07:00

2008-07-31T12:09:18-07:00

In javascript helpers option[:type] = :synchronous should work as described in docs. Signed-off-by: Michael Koziarski <michael@koziarski.com> 308a7248051c36a2ca39f3559f84c96c70e8f550 Michael Koziarski michael@koziarski.com c8e80f6389b45134c0514dde6736488cf5507765 miloops miloops@gmail.com http://github.com/rails/rails/commit/eaab895f83276674891227c656df9b4cebc50200 eaab895f83276674891227c656df9b4cebc50200

2008-07-30T01:42:32-07:00

2008-07-22T07:13:38-07:00

Prototype helpers should generate Element.insert instead of Insertion.new, which has been deprecated in Prototype 1.6. 04abcb82319b12701ca8690dc829a9fe6b375e98 Jeremy Kemper jeremy@bitsweat.net f7d08acd5e0650658383e3d3f86d6ff5b49e9030 Pratik Naik pratiknaik@gmail.com http://github.com/rails/rails/commit/0432d151647f2178ddee79979827d552447c251f 0432d151647f2178ddee79979827d552447c251f

2008-07-16T05:01:23-07:00

2008-07-16T05:00:36-07:00

Merge with docrails. 7c772cd260eb051cd7b80cf91468555f03db9e11 Pratik Naik pratiknaik@gmail.com fbef982e4b906b879240a35a1ecff447007da6b2 Jeremy Kemper jeremy@bitsweat.net http://github.com/rails/rails/commit/ecc054352512cac8c0895c78c5f3d043046dcfec ecc054352512cac8c0895c78c5f3d043046dcfec

2008-07-15T18:42:22-07:00

JavaScriptGenerator should only sets output_buffer for the duration of the update block f912cb8d90909eb829a7f7aec9f0d021bcad2790 Jeremy Kemper jeremy@bitsweat.net 4f72feb84c25b54f66c7192c788b7fd965f2d493 Joshua Peek josh@joshpeek.com http://github.com/rails/rails/commit/aca246ab25497bb6787d2e18680e9f73ad13d223 aca246ab25497bb6787d2e18680e9f73ad13d223

2008-07-15T12:43:52-07:00

2008-07-15T12:41:38-07:00

Get buffer for fragment cache from template's @output_buffer ad107ae39feb55960a4f6faf084b3ad8bc56cbec Joshua Peek josh@joshpeek.com 84af99e78dbf65b7faa92313acf8457cb0c2b510 David Heinemeier Hansson david@loudthinking.com http://github.com/rails/rails/commit/6b61e95dc8d717b4500ab623816863c0bb707e2b 6b61e95dc8d717b4500ab623816863c0bb707e2b

2008-07-09T07:13:24-07:00

Changed PrototypeHelper#submit_to_remote to PrototypeHelper#button_to_remote to stay consistent with link_to_remote (submit_to_remote still works as an alias) (clemens) [#8994 status:closed] 24c6a89bdecc107bb639665792e1e290c1563277 David Heinemeier Hansson david@loudthinking.com 53bcbfbdc1eed45cc6615e59d36baf018ab43d96 df8154c845f8fb251c58f1fd882cc221cfdcbbc2 Jeremy Kemper jeremy@bitsweat.net http://github.com/rails/rails/commit/e7f1556d0e75c635212273cc5e3cfd113456ff29 e7f1556d0e75c635212273cc5e3cfd113456ff29

2008-06-05T13:25:33-07:00

Merge branch 'master' into erbout 39e81a1fa01bacb18eb2c396d845ebcd815055b9 Jeremy Kemper jeremy@bitsweat.net 82e96eb294ae21528c3e05e91c05c7ee5222afbd Sean Huber sean.huber@cox.net http://github.com/rails/rails/commit/30a0ebb3eb9fd4c8e4401bcaa4887eb1ce95defa 30a0ebb3eb9fd4c8e4401bcaa4887eb1ce95defa

2008-06-04T05:32:53-07:00

2008-05-29T10:49:38-07:00

Add RJS#page.reload. [#277 state:resolved] Signed-off-by: Pratik Naik <pratiknaik@gmail.com> 2d0a36512d6c956b7e64e0e70c78c4da2181917d Pratik Naik pratiknaik@gmail.com 0bdb7d353b4ac6f5470884360f9a480a16bd709c Jeremy Kemper jeremy@bitsweat.net http://github.com/rails/rails/commit/4d4c8e298f5396e6b8ace0a10d7f991594aace2d 4d4c8e298f5396e6b8ace0a10d7f991594aace2d

2008-06-02T21:32:50-07:00

2008-06-02T13:49:14-07:00

Don't pass block binding to concat 2a5d4704d307ff2469de6226c9c2fbb691e75e32 Jeremy Kemper jeremy@bitsweat.net 6277fd91133a3566333612857510d74de60d67f4 Pratik Naik pratiknaik@gmail.com http://github.com/rails/rails/commit/98dc582742779081e71e697fcdf8d9ae2b421b16 98dc582742779081e71e697fcdf8d9ae2b421b16

2008-05-25T04:29:00-07:00

Merge docrails. Signed-off-by: Pratik Naik <pratiknaik@gmail.com> f5680eef86e689a10d0f75434ba6a4e94829e439 Pratik Naik pratiknaik@gmail.com c1c1d6c2ea72424dfae0b5ee1991d904dcf0f252 Frederick Cheung frederick.cheung@gmail.com http://github.com/rails/rails/commit/17d1319c480e58e28641b243da50ae5e5eab89dc 17d1319c480e58e28641b243da50ae5e5eab89dc

2008-05-19T02:30:56-07:00

2008-05-17T11:12:36-07:00

Ensure observe_field encodes value parameter. [#216 state:resolved] Signed-off-by: Pratik Naik <pratiknaik@gmail.com> 511ad2ba892080ec6bd05b9e3659dd326bb18906 Pratik Naik pratiknaik@gmail.com 3fee2378edd45188e41a7d14d4ca0a88280b541e Andre Arko andre@arko.net http://github.com/rails/rails/commit/d16fbe53b202d52b5ef12526941ed50da2daf38f d16fbe53b202d52b5ef12526941ed50da2daf38f

2008-05-13T10:33:33-07:00

2008-05-12T23:54:21-07:00

Fix remote_function to escape apostrophes inside the remote url passed to Ajax.Update. [#180 state:resolved] Signed-off-by: Pratik Naik <pratiknaik@gmail.com> ff6233fa6cdef47d53d6b2cb6a4c4addf6c4e8ad Pratik Naik pratiknaik@gmail.com