Permalink
Browse files

Merge branch 'master' of git@github.com:lifo/docrails

  • Loading branch information...
2 parents 3e60ea6 + cf4b244 commit 55901d7d86f5608c4a07386ca6378121eb8127cb @colinl colinl committed Jan 11, 2009
Showing with 3,444 additions and 1,453 deletions.
  1. +0 −1 actionmailer/test/abstract_unit.rb
  2. +4 −0 actionpack/CHANGELOG
  3. +1 −1 actionpack/Rakefile
  4. +1 −1 actionpack/lib/action_controller.rb
  5. +20 −10 actionpack/lib/action_controller/base.rb
  6. +6 −8 actionpack/lib/action_controller/dispatcher.rb
  7. +189 −2 actionpack/lib/action_controller/http_authentication.rb
  8. +89 −5 actionpack/lib/action_controller/integration.rb
  9. +21 −0 actionpack/lib/action_controller/middleware_stack.rb
  10. +22 −43 actionpack/lib/action_controller/request.rb
  11. +4 −3 actionpack/lib/action_controller/request_parser.rb
  12. +5 −3 actionpack/lib/action_controller/rescue.rb
  13. +6 −3 actionpack/lib/action_controller/response.rb
  14. +8 −2 actionpack/lib/action_controller/routing/route_set.rb
  15. +13 −9 actionpack/lib/action_controller/test_case.rb
  16. +20 −34 actionpack/lib/action_controller/test_process.rb
  17. +4 −5 actionpack/lib/action_controller/url_encoded_pair_parser.rb
  18. +1 −1 actionpack/lib/action_view/base.rb
  19. +153 −321 actionpack/lib/action_view/helpers/asset_tag_helper.rb
  20. +25 −4 actionpack/lib/action_view/helpers/benchmark_helper.rb
  21. +1 −1 actionpack/lib/action_view/inline_template.rb
  22. +1 −106 actionpack/lib/action_view/paths.rb
  23. +3 −6 actionpack/lib/action_view/renderable.rb
  24. +3 −4 actionpack/lib/action_view/renderable_partial.rb
  25. +81 −4 actionpack/lib/action_view/template.rb
  26. +3 −0 actionpack/lib/action_view/test_case.rb
  27. +0 −1 actionpack/test/abstract_unit.rb
  28. +3 −6 actionpack/test/controller/addresses_render_test.rb
  29. +10 −12 actionpack/test/controller/base_test.rb
  30. +3 −3 actionpack/test/controller/benchmark_test.rb
  31. +3 −6 actionpack/test/controller/capture_test.rb
  32. +3 −6 actionpack/test/controller/content_type_test.rb
  33. +3 −5 actionpack/test/controller/cookie_test.rb
  34. +1 −8 actionpack/test/controller/dispatcher_test.rb
  35. +6 −2 actionpack/test/controller/filters_test.rb
  36. +2 −6 actionpack/test/controller/flash_test.rb
  37. +73 −0 actionpack/test/controller/http_digest_authentication_test.rb
  38. +91 −3 actionpack/test/controller/integration_test.rb
  39. +36 −10 actionpack/test/controller/integration_upload_test.rb
  40. +1 −2 actionpack/test/controller/layout_test.rb
  41. +70 −0 actionpack/test/controller/middleware_stack_test.rb
  42. +120 −0 actionpack/test/controller/query_string_parsing_test.rb
  43. +6 −1 actionpack/test/controller/rack_test.rb
  44. +6 −1 actionpack/test/controller/render_test.rb
  45. +45 −0 actionpack/test/controller/request/json_params_parsing_test.rb
  46. +88 −0 actionpack/test/controller/request/xml_params_parsing_test.rb
  47. +3 −182 actionpack/test/controller/request_test.rb
  48. +27 −1 actionpack/test/controller/rescue_test.rb
  49. +60 −73 actionpack/test/controller/routing_test.rb
  50. +2 −1 actionpack/test/controller/send_file_test.rb
  51. +1 −0 actionpack/test/fixtures/multipart/hello.txt
  52. +20 −2 actionpack/test/template/asset_tag_helper_test.rb
  53. +50 −24 actionpack/test/template/benchmark_helper_test.rb
  54. +5 −4 actionpack/test/template/compiled_templates_test.rb
  55. +4 −3 actionpack/test/template/render_test.rb
  56. +2 −0 activerecord/CHANGELOG
  57. +1 −0 activerecord/lib/active_record.rb
  58. +2 −2 activerecord/lib/active_record/association_preload.rb
  59. +2 −2 activerecord/lib/active_record/associations.rb
  60. +4 −1 activerecord/lib/active_record/associations/association_proxy.rb
  61. +26 −6 activerecord/lib/active_record/base.rb
  62. +4 −0 activerecord/lib/active_record/connection_adapters/sqlite_adapter.rb
  63. +25 −0 activerecord/lib/active_record/dynamic_scope_match.rb
  64. +33 −0 activerecord/test/cases/associations/eager_test.rb
  65. +6 −0 activerecord/test/cases/associations/has_many_associations_test.rb
  66. +21 −1 activerecord/test/cases/named_scope_test.rb
  67. +7 −0 activesupport/CHANGELOG
  68. +2 −7 activesupport/lib/active_support/callbacks.rb
  69. +15 −0 activesupport/lib/active_support/core_ext/object/misc.rb
  70. +1 −1 activesupport/lib/active_support/json/decoding.rb
  71. +1 −1 activesupport/lib/active_support/testing/performance.rb
  72. +1 −1 activesupport/lib/active_support/time_with_zone.rb
  73. +2 −2 activesupport/lib/active_support/vendor.rb
  74. +3 −0 activesupport/lib/active_support/vendor/i18n-0.1.1/.gitignore
  75. +20 −0 activesupport/lib/active_support/vendor/i18n-0.1.1/MIT-LICENSE
  76. +20 −0 activesupport/lib/active_support/vendor/i18n-0.1.1/README.textile
  77. +5 −0 activesupport/lib/active_support/vendor/i18n-0.1.1/Rakefile
  78. +27 −0 activesupport/lib/active_support/vendor/i18n-0.1.1/i18n.gemspec
  79. +37 −37 activesupport/lib/active_support/vendor/{i18n-0.0.1 → i18n-0.1.1/lib}/i18n.rb
  80. +29 −29 activesupport/lib/active_support/vendor/{i18n-0.0.1 → i18n-0.1.1/lib}/i18n/backend/simple.rb
  81. +3 −3 activesupport/lib/active_support/vendor/{i18n-0.0.1 → i18n-0.1.1/lib}/i18n/exceptions.rb
  82. +5 −0 activesupport/lib/active_support/vendor/i18n-0.1.1/test/all.rb
  83. +100 −0 activesupport/lib/active_support/vendor/i18n-0.1.1/test/i18n_exceptions_test.rb
  84. +125 −0 activesupport/lib/active_support/vendor/i18n-0.1.1/test/i18n_test.rb
  85. +1 −0 activesupport/lib/active_support/vendor/i18n-0.1.1/test/locale/en.rb
  86. +3 −0 activesupport/lib/active_support/vendor/i18n-0.1.1/test/locale/en.yml
  87. +502 −0 activesupport/lib/active_support/vendor/i18n-0.1.1/test/simple_backend_test.rb
  88. +41 −1 activesupport/test/callbacks_test.rb
  89. +8 −0 activesupport/test/core_ext/object_ext_test.rb
  90. +9 −0 activesupport/test/core_ext/time_with_zone_test.rb
  91. +2 −1 activesupport/test/json/decoding_test.rb
  92. +8 −7 ci/ci_build.rb
  93. +11 −0 ci/ci_setup_notes.txt
  94. +2 −1 ci/cruise_config.rb
  95. +7 −1 ci/geminstaller.yml
  96. +73 −49 railties/doc/guides/html/activerecord_validations_callbacks.html
  97. +1 −1 railties/doc/guides/html/index.html
  98. +408 −149 railties/doc/guides/html/performance_testing.html
  99. +51 −28 railties/doc/guides/source/activerecord_validations_callbacks.txt
  100. +1 −1 railties/doc/guides/source/index.txt
  101. +320 −113 railties/doc/guides/source/performance_testing.txt
  102. +5 −4 railties/lib/initializer.rb
  103. +3 −2 railties/lib/rails/backtrace_cleaner.rb
  104. +1 −1 railties/lib/rails_generator/commands.rb
  105. +0 −1 railties/lib/test_help.rb
  106. +9 −0 railties/test/console_app_test.rb
  107. +4 −7 railties/test/error_page_test.rb
  108. +7 −42 railties/test/fcgi_dispatcher_test.rb
  109. +12 −12 railties/test/gem_dependency_test.rb
@@ -17,7 +17,6 @@
FIXTURE_LOAD_PATH = File.join(File.dirname(__FILE__), 'fixtures')
ActionMailer::Base.template_root = FIXTURE_LOAD_PATH
-ActionMailer::Base.template_root.load
class MockSMTP
def self.deliveries
View
@@ -1,5 +1,9 @@
*2.3.0 [Edge]*
+* Added :silence option to BenchmarkHelper#benchmark and turned log_level into a hash parameter and deprecated the old use [DHH]
+
+* Fixed the AssetTagHelper cache to use the computed asset host as part of the cache key instead of just assuming the its a string #1299 [DHH]
+
* Make ActionController#render(string) work as a shortcut for render :file/:template/:action => string. [#1435] [Pratik Naik] Examples:
# Instead of render(:action => 'other_action')
View
@@ -81,7 +81,7 @@ spec = Gem::Specification.new do |s|
s.requirements << 'none'
s.add_dependency('activesupport', '= 2.3.0' + PKG_BUILD)
- s.add_dependency('rack', '= 0.4.0')
+ s.add_dependency('rack', '>= 0.9.0')
s.require_path = 'lib'
s.autorequire = 'action_controller'
@@ -31,7 +31,7 @@
end
end
-gem 'rack', '~> 0.4.0'
+gem 'rack', '>= 0.9.0'
require 'rack'
module ActionController
@@ -382,6 +382,13 @@ class Base
attr_accessor :action_name
class << self
+ def call(env)
+ # HACK: For global rescue to have access to the original request and response
+ request = env["action_controller.rescue.request"] ||= Request.new(env)
+ response = env["action_controller.rescue.response"] ||= Response.new
+ process(request, response)
+ end
+
# Factory for the standard create, process loop where the controller is discarded after processing.
def process(request, response) #:nodoc:
new.process(request, response)
@@ -862,7 +869,7 @@ def render(options = nil, extra_options = {}, &block) #:doc:
validate_render_arguments(options, extra_options, block_given?)
if options.nil?
- options = { :template => default_template.filename, :layout => true }
+ options = { :template => default_template, :layout => true }
elsif options == :update
options = extra_options.merge({ :update => true })
elsif options.is_a?(String) || options.is_a?(Symbol)
@@ -1118,16 +1125,16 @@ def stale?(options)
end
# Sets the etag, last_modified, or both on the response and renders a
- # "304 Not Modified" response if the request is already fresh.
+ # "304 Not Modified" response if the request is already fresh.
#
# Example:
#
# def show
# @article = Article.find(params[:id])
# fresh_when(:etag => @article, :last_modified => @article.created_at.utc)
# end
- #
- # This will render the show template if the request isn't sending a matching etag or
+ #
+ # This will render the show template if the request isn't sending a matching etag or
# If-Modified-Since header and just a "304 Not Modified" response if there's a match.
def fresh_when(options)
options.assert_valid_keys(:etag, :last_modified)
@@ -1232,7 +1239,7 @@ def log_processing
log_processing_for_parameters
end
end
-
+
def log_processing_for_request_id
request_id = "\n\nProcessing #{self.class.name}\##{action_name} "
request_id << "to #{params[:format]} " if params[:format]
@@ -1244,7 +1251,7 @@ def log_processing_for_request_id
def log_processing_for_parameters
parameters = respond_to?(:filter_parameters) ? filter_parameters(params) : params.dup
parameters = parameters.except!(:controller, :action, :format, :_method)
-
+
logger.info " Parameters: #{parameters.inspect}" unless parameters.empty?
end
@@ -1343,9 +1350,12 @@ def process_cleanup
end
Base.class_eval do
- include Flash, Filters, Layout, Benchmarking, Rescue, MimeResponds, Helpers
- include Cookies, Caching, Verification, Streaming
- include SessionManagement, HttpAuthentication::Basic::ControllerMethods
- include RecordIdentifier, RequestForgeryProtection, Translation
+ [ Filters, Layout, Benchmarking, Rescue, Flash, MimeResponds, Helpers,
+ Cookies, Caching, Verification, Streaming, SessionManagement,
+ HttpAuthentication::Basic::ControllerMethods, RecordIdentifier,
+ RequestForgeryProtection, Translation
+ ].each do |mod|
+ include mod
+ end
end
end
@@ -8,6 +8,8 @@ def define_dispatcher_callbacks(cache_classes)
# Development mode callbacks
before_dispatch :reload_application
after_dispatch :cleanup_application
+
+ ActionView::Helpers::AssetTagHelper.cache_asset_timestamps = false
end
if defined?(ActiveRecord)
@@ -60,11 +62,10 @@ def initialize(output = $stdout, request = nil, response = nil)
def dispatch
begin
run_callbacks :before_dispatch
- controller = Routing::Routes.recognize(@request)
- controller.process(@request, @response).to_a
+ Routing::Routes.call(@env)
rescue Exception => exception
if controller ||= (::ApplicationController rescue Base)
- controller.process_with_exception(@request, @response, exception).to_a
+ controller.call_with_exception(@env, exception).to_a
else
raise exception
end
@@ -83,8 +84,7 @@ def call(env)
end
def _call(env)
- @request = Request.new(env)
- @response = Response.new
+ @env = env
dispatch
end
@@ -93,7 +93,6 @@ def reload_application
run_callbacks :prepare_dispatch
Routing::Routes.reload
- ActionView::Helpers::AssetTagHelper::AssetTag::Cache.clear
end
# Cleanup the application by clearing out loaded classes so they can
@@ -110,8 +109,7 @@ def flush_logger
def checkin_connections
# Don't return connection (and peform implicit rollback) if this request is a part of integration test
- # TODO: This callback should have direct access to env
- return if @request.key?("rack.test")
+ return if @env.key?("rack.test")
ActiveRecord::Base.clear_active_connections!
end
end
@@ -55,7 +55,31 @@ module HttpAuthentication
# end
# end
#
- #
+ # Simple Digest example. Note the block must return the user's password so the framework
+ # can appropriately hash it to check the user's credentials. Returning nil will cause authentication to fail.
+ #
+ # class PostsController < ApplicationController
+ # Users = {"dhh" => "secret"}
+ #
+ # before_filter :authenticate, :except => [ :index ]
+ #
+ # def index
+ # render :text => "Everyone can see me!"
+ # end
+ #
+ # def edit
+ # render :text => "I'm only accessible if you know the password"
+ # end
+ #
+ # private
+ # def authenticate
+ # authenticate_or_request_with_http_digest(realm) do |user_name|
+ # Users[user_name]
+ # end
+ # end
+ # end
+ #
+ #
# In your integration tests, you can do something like this:
#
# def test_access_granted_from_xml
@@ -108,7 +132,10 @@ def authorization(request)
end
def decode_credentials(request)
- ActiveSupport::Base64.decode64(authorization(request).split.last || '')
+ # Properly decode credentials spanning a new-line
+ auth = authorization(request)
+ auth.slice!('Basic ')
+ ActiveSupport::Base64.decode64(auth || '')
end
def encode_credentials(user_name, password)
@@ -120,5 +147,165 @@ def authentication_request(controller, realm)
controller.__send__ :render, :text => "HTTP Basic: Access denied.\n", :status => :unauthorized
end
end
+
+ module Digest
+ extend self
+
+ module ControllerMethods
+ def authenticate_or_request_with_http_digest(realm = "Application", &password_procedure)
+ begin
+ authenticate_with_http_digest!(realm, &password_procedure)
+ rescue ActionController::HttpAuthentication::Error => e
+ msg = e.message
+ msg = "#{msg} expected '#{e.expected}' was '#{e.was}'" unless e.expected.nil?
+ raise msg if e.fatal?
+ request_http_digest_authentication(realm, msg)
+ end
+ end
+
+ # Authenticate using HTTP Digest, throwing ActionController::HttpAuthentication::Error on failure.
+ # This allows more detailed analysis of authentication failures
+ # to be relayed to the client.
+ def authenticate_with_http_digest!(realm = "Application", &login_procedure)
+ HttpAuthentication::Digest.authenticate(self, realm, &login_procedure)
+ end
+
+ # Authenticate with HTTP Digest, returns true or false
+ def authenticate_with_http_digest(realm = "Application", &login_procedure)
+ HttpAuthentication::Digest.authenticate(self, realm, &login_procedure) rescue false
+ end
+
+ # Render output including the HTTP Digest authentication header
+ def request_http_digest_authentication(realm = "Application", message = nil)
+ HttpAuthentication::Digest.authentication_request(self, realm, message)
+ end
+
+ # Add HTTP Digest authentication header to result headers
+ def http_digest_authentication_header(realm = "Application")
+ HttpAuthentication::Digest.authentication_header(self, realm)
+ end
+ end
+
+ # Raises error unless authentictaion succeeds, returns true otherwise
+ def authenticate(controller, realm, &password_procedure)
+ raise Error.new(false), "No authorization header found" unless authorization(controller.request)
+ validate_digest_response(controller, realm, &password_procedure)
+ true
+ end
+
+ def authorization(request)
+ request.env['HTTP_AUTHORIZATION'] ||
+ request.env['X-HTTP_AUTHORIZATION'] ||
+ request.env['X_HTTP_AUTHORIZATION'] ||
+ request.env['REDIRECT_X_HTTP_AUTHORIZATION']
+ end
+
+ # Raises error unless the request credentials response value matches the expected value.
+ def validate_digest_response(controller, realm, &password_procedure)
+ credentials = decode_credentials(controller.request)
+
+ # Check the nonce, opaque and realm.
+ # Ignore nc, as we have no way to validate the number of times this nonce has been used
+ validate_nonce(controller.request, credentials[:nonce])
+ raise Error.new(false, realm, credentials[:realm]), "Realm doesn't match" unless realm == credentials[:realm]
+ raise Error.new(true, opaque(controller.request), credentials[:opaque]),"Opaque doesn't match" unless opaque(controller.request) == credentials[:opaque]
+
+ password = password_procedure.call(credentials[:username])
+ raise Error.new(false), "No password" if password.nil?
+ expected = expected_response(controller.request.env['REQUEST_METHOD'], controller.request.url, credentials, password)
+ raise Error.new(false, expected, credentials[:response]), "Invalid response" unless expected == credentials[:response]
+ end
+
+ # Returns the expected response for a request of +http_method+ to +uri+ with the decoded +credentials+ and the expected +password+
+ def expected_response(http_method, uri, credentials, password)
+ ha1 = ::Digest::MD5.hexdigest([credentials[:username], credentials[:realm], password].join(':'))
+ ha2 = ::Digest::MD5.hexdigest([http_method.to_s.upcase,uri].join(':'))
+ ::Digest::MD5.hexdigest([ha1,credentials[:nonce], credentials[:nc], credentials[:cnonce],credentials[:qop],ha2].join(':'))
+ end
+
+ def encode_credentials(http_method, credentials, password)
+ credentials[:response] = expected_response(http_method, credentials[:uri], credentials, password)
+ "Digest " + credentials.sort_by {|x| x[0].to_s }.inject([]) {|a, v| a << "#{v[0]}='#{v[1]}'" }.join(', ')
+ end
+
+ def decode_credentials(request)
+ authorization(request).to_s.gsub(/^Digest\s+/,'').split(',').inject({}) do |hash, pair|
+ key, value = pair.split('=', 2)
+ hash[key.strip.to_sym] = value.to_s.gsub(/^"|"$/,'').gsub(/'/, '')
+ hash
+ end
+ end
+
+ def authentication_header(controller, realm)
+ controller.headers["WWW-Authenticate"] = %(Digest realm="#{realm}", qop="auth", algorithm=MD5, nonce="#{nonce(controller.request)}", opaque="#{opaque(controller.request)}")
+ end
+
+ def authentication_request(controller, realm, message = "HTTP Digest: Access denied")
+ authentication_header(controller, realm)
+ controller.send! :render, :text => message, :status => :unauthorized
+ end
+
+ # Uses an MD5 digest based on time to generate a value to be used only once.
+ #
+ # A server-specified data string which should be uniquely generated each time a 401 response is made.
+ # It is recommended that this string be base64 or hexadecimal data.
+ # Specifically, since the string is passed in the header lines as a quoted string, the double-quote character is not allowed.
+ #
+ # The contents of the nonce are implementation dependent.
+ # The quality of the implementation depends on a good choice.
+ # A nonce might, for example, be constructed as the base 64 encoding of
+ #
+ # => time-stamp H(time-stamp ":" ETag ":" private-key)
+ #
+ # where time-stamp is a server-generated time or other non-repeating value,
+ # ETag is the value of the HTTP ETag header associated with the requested entity,
+ # and private-key is data known only to the server.
+ # With a nonce of this form a server would recalculate the hash portion after receiving the client authentication header and
+ # reject the request if it did not match the nonce from that header or
+ # if the time-stamp value is not recent enough. In this way the server can limit the time of the nonce's validity.
+ # The inclusion of the ETag prevents a replay request for an updated version of the resource.
+ # (Note: including the IP address of the client in the nonce would appear to offer the server the ability
+ # to limit the reuse of the nonce to the same client that originally got it.
+ # However, that would break proxy farms, where requests from a single user often go through different proxies in the farm.
+ # Also, IP address spoofing is not that hard.)
+ #
+ # An implementation might choose not to accept a previously used nonce or a previously used digest, in order to
+ # protect against a replay attack. Or, an implementation might choose to use one-time nonces or digests for
+ # POST or PUT requests and a time-stamp for GET requests. For more details on the issues involved see Section 4
+ # of this document.
+ #
+ # The nonce is opaque to the client.
+ def nonce(request, time = Time.now)
+ session_id = request.is_a?(String) ? request : request.session.session_id
+ t = time.to_i
+ hashed = [t, session_id]
+ digest = ::Digest::MD5.hexdigest(hashed.join(":"))
+ Base64.encode64("#{t}:#{digest}").gsub("\n", '')
+ end
+
+ def validate_nonce(request, value)
+ t = Base64.decode64(value).split(":").first.to_i
+ raise Error.new(true), "Stale Nonce" if (t - Time.now.to_i).abs > 10 * 60
+ n = nonce(request, t)
+ raise Error.new(true, value, n), "Bad Nonce" unless n == value
+ end
+
+ # Opaque based on digest of session_id
+ def opaque(request)
+ session_id = request.is_a?(String) ? request : request.session.session_id
+ @opaque ||= Base64.encode64(::Digest::MD5::hexdigest(session_id)).gsub("\n", '')
+ end
+ end
+
+ class Error < RuntimeError
+ attr_accessor :expected, :was
+ def initialize(fatal = false, expected = nil, was = nil)
+ @fatal = fatal
+ @expected = expected
+ @was = was
+ end
+
+ def fatal?; @fatal; end
+ end
end
end
Oops, something went wrong.

0 comments on commit 55901d7

Please sign in to comment.