Unquoted query generated by through-association scope #1361

mrcljx · 2011-05-27T20:02:12Z

Through-association owner's primary key wasn't quoted. This generates invalid SQL if the record wasn't saved yet (i.e. the primary key's value is nil) and you try to access the relation (should return an empty result).

Real-world example of generated sql:

SELECT `tags`.*
  FROM `tags`
  INNER JOIN `taggings` ON `tags`.id = `taggings`.tag_id
  WHERE
    ((`taggings`.taggable_id = ) AND (`taggings`.taggable_type = 'Ticket'))
    AND (taggings.context = 'tags' AND taggings.tagger_id IS NULL)

this prevents test state from accumulating, resulting in leaked objects and slow tests due to overactive GC.

this can provide a significant performance boost during testing, by preventing the GC from running too frequently.

Signed-off-by: José Valim <jose.valim@gmail.com>

…s#5329 state:resolved]

… second" This reverts commit 35984f5.

This reverts commit 1e98920.

This reverts commit fd19ade.

…e' into 3-0-stable * jonleighton/deprecate_habtm_attributes-3-0-stable: Added deprecation warning for has_and_belongs_to_many associations where the join table has additional attributes other than the keys. Access to these attributes is removed in 3.1. Please use has_many :through instead.

… inadvertently causing javascript errors. This fixes CVE-2011-0446

… filesystems. This fixes CVE-2011-0449

This fixes CVE-2011-0448

Unfortunately the previous method of browser detection and XHR whitelisting is unable to prevent requests issued from some Flash animations and Java applets. To ease the work required to include the CSRF token in ajax requests rails now supports providing the token in a custom http header: X-CSRF-Token: ... This fixes CVE-2011-0447

…every ajax request.

Signed-off-by: Santiago Pastorino <santiago@wyeworks.com>

rails#6353 state:resolved] This handles the case where config.cache_classes is true and classes are loaded before the I18n load path has had a chance to be populated. Signed-off-by: Santiago Pastorino <santiago@wyeworks.com>

…rails#6353 state:resolved] Signed-off-by: Santiago Pastorino <santiago@wyeworks.com>

…apter also returns Time value

To make sure it will show block contents if it is placed after 'render :partial' [rails#5557 state:resolved] Signed-off-by: Santiago Pastorino <santiago@wyeworks.com>

…ing to a BigDecimal. [rails#6365 state:committed] Signed-off-by: Santiago Pastorino <santiago@wyeworks.com>

…ved] Signed-off-by: Santiago Pastorino <santiago@wyeworks.com>

…t have validation errors

fixes rails#796

… YAML 1.1 compatibility

…thod 'prerequisites' for nil:NilClass (from rspec)

This fixes rake for me in RefineryCMS.

…od from_xml

3 0 stable jruby jdom fixes

…lid SQL (id = ) if the record wasn't saved yet (i.e. the primary key's value is nil).

josevalim · 2011-05-27T20:05:09Z

It seems something is wrong with your pull request. :P

mrcljx · 2011-05-27T20:09:51Z

Whoops. Github exploded. Fixed the Pull-Request (now 1362). Sorry for the mess.

…ved]

jamis and others added 30 commits January 19, 2011 10:31

make TestCaseTest work for pre-1.9 rubies, too

fd19ade

scrub instance variables from test cases on teardown

1e98920

this prevents test state from accumulating, resulting in leaked objects and slow tests due to overactive GC.

rein in GC during tests by making them run (at most) once per second

35984f5

this can provide a significant performance boost during testing, by preventing the GC from running too frequently.

Added a testcase for bug [rails#5329]

b4bc49c

Signed-off-by: José Valim <jose.valim@gmail.com>

Solve SystemStackError when changing locale inside ActionMailer [rail…

46b23f8

…s#5329 state:resolved]

Revert "rein in GC during tests by making them run (at most) once per…

039b807

… second" This reverts commit 35984f5.

Revert "scrub instance variables from test cases on teardown"

e5664b5

This reverts commit 1e98920.

Revert "make TestCaseTest work for pre-1.9 rubies, too"

683cb50

This reverts commit fd19ade.

Bump mail version up

5f509c2

Fix gitignore to ignore tmp/ correctly, credit telemachus

54e72a5

Prepare for the 3.0.4 release

0cbf9b2

Fix AM tests

0448247

Be sure to javascript_escape the email address to prevent apostrophes…

e3dd210

… inadvertently causing javascript errors. This fixes CVE-2011-0446

Ensure render is case sensitive even on systems with case-insensitive…

6f80224

… filesystems. This fixes CVE-2011-0449

Use Mime::Type references.

ad9d21d

limit() should sanitize limit values

354da43

This fixes CVE-2011-0448

Make rails.js include the CSRF token in the X-CSRF-Token header with …

7b64ade

…every ajax request.

Make before_type_cast available for datetime fields

c8b7606

Signed-off-by: Santiago Pastorino <santiago@wyeworks.com>

before_type_cast on Datetime tests for Mysql2Adapter

4e6a102

Signed-off-by: Santiago Pastorino <santiago@wyeworks.com>

Ensure I18n setup is only executed once if triggered on eager loading […

effb582

…rails#6353 state:resolved] Signed-off-by: Santiago Pastorino <santiago@wyeworks.com>

fix for test_read_attributes_before_type_cast_on_datetime - Oracle ad…

8a73ebb

…apter also returns Time value

Add a test for 'render :layout'

53b0235

To make sure it will show block contents if it is placed after 'render :partial' [rails#5557 state:resolved] Signed-off-by: Santiago Pastorino <santiago@wyeworks.com>

The type_cast_calculated_value method will trust DB types before cast…

068527b

…ing to a BigDecimal. [rails#6365 state:committed] Signed-off-by: Santiago Pastorino <santiago@wyeworks.com>

Fixing ordering of HABTM association deletion [rails#6191 state:resol…

e142159

…ved] Signed-off-by: Santiago Pastorino <santiago@wyeworks.com>

git am is better here

d00ed5a

Remove stupid mistake

f2d0257

Prepare for the 3.0.4 release

1081ea6

tenderlove and others added 26 commits May 24, 2011 11:27

adding a test for create! with invalid associations

f0c09f7

add tests surrounding behavior of save and save! for associations tha…

1c079c5

…t have validation errors

rescue record invalid exceptions and return false from the save method.

79abb70

fixes rails#796

make open_log private

2649db7

Gem::Specification#has_rdoc= is deprecated since rubygems 1.7.0

352daff

default_executable is deprecated since rubygems 1.7.0

79ed700

fixing psych support in big decimal, fixing tests to support YAML 1.1

929e5c4

prefering psych as the yaml parser if possible, fixing assertions for…

f55a171

… YAML 1.1 compatibility

load psych by default if possible

8e6b757

require Psych if possible, use Psych output when enabled

03f0f3c

load and prefer psych as the YAML parser when it is available

e4594f7

use ! " " YAML string literal syntax rather than removing both quotes

5856fc5

add Psych::SyntaxError to the list of rescued YAML exceptions

cae1d46

updating changelogs

eecbc10

bumping to 3.0.8.rc1

8b0806e

This fixes rake for me in RefineryCMS. Otherwise, I get: undefined me…

9e88b87

…thod 'prerequisites' for nil:NilClass (from rspec)

Merge pull request rails#1317 from parndt/3-0-stable

072e1ca

This fixes rake for me in RefineryCMS.

adding a test for rails#1322

579d044

quoting id columns when doing hm:t joins. fixes rails#1322

179a8a4

Loading active_support/core_ext/hash/conversions fixed Undefined meth…

56097c0

…od from_xml

Using java_import instead of import. Need with rake 0.9.0 #jruby

993bd32

Loading files if PLATFORM available. #jruby

4c330d6

Merge pull request rails#1351 from arunagw/3-0-stable-jruby-jdom-fixes

2ca0ae9

3 0 stable jruby jdom fixes

extend with Rake::DSL in case of rake 0.9.0. fixes rails#1322

57958cb

bumping to 3.0.8.rc2

d756525

Through-association owner's primary key wasn't quoted. Generates inva…

152c41d

…lid SQL (id = ) if the record wasn't saved yet (i.e. the primary key's value is nil).

josevalim closed this May 27, 2011

jake3030 pushed a commit to jake3030/rails that referenced this pull request Jun 28, 2011

TimeZone: Caracas GMT offset changed to -4:30 [rails#1361 state:resol…

02df503

…ved]

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Unquoted query generated by through-association scope #1361

Unquoted query generated by through-association scope #1361

mrcljx commented May 27, 2011

josevalim commented May 27, 2011

mrcljx commented May 27, 2011

Unquoted query generated by through-association scope #1361

Unquoted query generated by through-association scope #1361

Conversation

mrcljx commented May 27, 2011

josevalim commented May 27, 2011

mrcljx commented May 27, 2011