pkgsrc/www/ruby-actionpack32/distinfo

$NetBSD: distinfo,v 1.6 2012/08/12 12:40:00 taca Exp $

SHA1 (actionpack-3.2.8.gem) = ccc63cc2fcb3131b92d45cf5834aa629857d7258
RMD160 (actionpack-3.2.8.gem) = ec71996e73831ea346d8e060234a7f7a73881908
Size (actionpack-3.2.8.gem) = 379392 bytes
Update ruby-actionpack32 to 3.2.8. ## Rails 3.2.8 (Aug 9, 2012) ## * There is an XSS vulnerability in the strip_tags helper in Ruby on Rails, the helper doesn't correctly handle malformed html. As a result an attacker can execute arbitrary javascript through the use of specially crafted malformed html. Marek from Nethemba (www.nethemba.com) & Santiago Pastorino * When a "prompt" value is supplied to the `select_tag` helper, the "prompt" value is not escaped. If untrusted data is not escaped, and is supplied as the prompt value, there is a potential for XSS attacks. Vulnerable code will look something like this: select_tag("name", options, :prompt => UNTRUSTED_INPUT) Santiago Pastorino 2012-08-12 14:40:00 +02:00			$NetBSD: distinfo,v 1.6 2012/08/12 12:40:00 taca Exp $
Importing ruby-actionpack32 version 3.2.2. ## Rails 3.2.2 (unreleased) ## * Format lookup for partials is derived from the format in which the template is being rendered. Closes #5025 part 2 Santiago Pastorino * Use the right format when a partial is missing. Closes #5025. Santiago Pastorino * Default responder will now always use your overridden block in `respond_with` to render your response. Prem Sichanugrist * check_box helper with :disabled => true will generate a disabled hidden field to conform with the HTML convention where disabled fields are not submitted with the form. This is a behavior change, previously the hidden tag had a value of the disabled checkbox. Tadas Tamosauskas ## Rails 3.2.1 (January 26, 2012) ## * Documentation improvements. * Allow `form.select` to accept ranges (regression). Jeremy Walker * `datetime_select` works with -/+ infinity dates. Joe Van Dyk ## Rails 3.2.0 (January 20, 2012) ## * Setting config.assets.logger to false turn off Sprockets logger Guillermo Iguaran * Add `config.action_dispatch.default_charset` to configure default charset for ActionDispatch::Response. Carlos Antonio da Silva * Deprecate setting default charset at controller level, use the new `config.action_dispatch.default_charset` instead. Carlos Antonio da Silva * Deprecate ActionController::UnknownAction in favour of AbstractController::ActionNotFound. Carlos Antonio da Silva * Deprecate ActionController::DoubleRenderError in favour of AbstractController::DoubleRenderError. Carlos Antonio da Silva * Deprecate method_missing handling for not found actions, use action_missing instead. Carlos Antonio da Silva * Deprecate ActionController#rescue_action, ActionController#initialize_template_class, and ActionController#assign_shortcuts. These methods were not being used internally anymore and are going to be removed in Rails 4. Carlos Antonio da Silva * Add config.assets.logger to configure Sprockets logger Rafael França * Use a BodyProxy instead of including a Module that responds to close. Closes #4441 if Active Record is disabled assets are delivered correctly Santiago Pastorino * Rails initialization with initialize_on_precompile = false should set assets_dir Santiago Pastorino * Add font_path helper method Santiago Pastorino * Depends on rack ~> 1.4.0 Santiago Pastorino * Add :gzip option to `caches_page`. The default option can be configured globally using `page_cache_compression` Andrey Sitnik * The ShowExceptions middleware now accepts a exceptions application that is responsible to render an exception when the application fails. The application is invoked with a copy of the exception in `env["action_dispatch.exception"]` and with the PATH_INFO rewritten to the status code. José Valim * Add `button_tag` support to ActionView::Helpers::FormBuilder. This support mimics the default behavior of `submit_tag`. Example: <%= form_for @post do \|f\| %> <%= f.button %> <% end %> * Date helpers accept a new option, `:use_two_digit_numbers = true`, that renders select boxes for months and days with a leading zero without changing the respective values. For example, this is useful for displaying ISO8601-style dates such as '2011-08-01'. Lennart Fridén and Kim Persson * Make ActiveSupport::Benchmarkable a default module for ActionController::Base, so the #benchmark method is once again available in the controller context like it used to be DHH * Deprecated implied layout lookup in controllers whose parent had a explicit layout set: class ApplicationController layout "application" end class PostsController < ApplicationController end In the example above, Posts controller will no longer automatically look up for a posts layout. If you need this functionality you could either remove `layout "application"` from ApplicationController or explicitly set it to nil in PostsController. José Valim * Rails will now use your default layout (such as "layouts/application") when you specify a layout with `:only` and `:except` condition, and those conditions fail. Prem Sichanugrist For example, consider this snippet: class CarsController layout 'single_car', :only => :show end Rails will use 'layouts/single_car' when a request comes in `:show` action, and use 'layouts/application' (or 'layouts/cars', if exists) when a request comes in for any other actions. * form_for with +:as+ option uses "#{action}_#{as}" as css class and id: Before: form_for(@user, :as => 'client') # => "<form class="client_new">..." Now: form_for(@user, :as => 'client') # => "<form class="new_client">..." Vasiliy Ermolovich * Allow rescue responses to be configured through a railtie as in `config.action_dispatch.rescue_responses`. Please look at ActiveRecord::Railtie for an example José Valim * Allow fresh_when/stale? to take a record instead of an options hash DHH * Assets should use the request protocol by default or default to relative if no request is available Jonathan del Strother * Log "Filter chain halted as CALLBACKNAME rendered or redirected" every time a before callback halts José Valim * You can provide a namespace for your form to ensure uniqueness of id attributes on form elements. The namespace attribute will be prefixed with underscore on the generate HTML id. Vasiliy Ermolovich Example: <%= form_for(@offer, :namespace => 'namespace') do \|f\| %> <%= f.label :version, 'Version' %>: <%= f.text_field :version %> <% end %> * Refactor ActionDispatch::ShowExceptions. The controller is responsible for choosing to show exceptions when `consider_all_requests_local` is false. It's possible to override `show_detailed_exceptions?` in controllers to specify which requests should provide debugging information on errors. The default value is now false, meaning local requests in production will no longer show the detailed exceptions page unless `show_detailed_exceptions?` is overridden and set to `request.local?`. * Responders now return 204 No Content for API requests without a response body (as in the new scaffold) José Valim * Added ActionDispatch::RequestId middleware that'll make a unique X-Request-Id header available to the response and enables the ActionDispatch::Request#uuid method. This makes it easy to trace requests from end-to-end in the stack and to identify individual requests in mixed logs like Syslog DHH * Limit the number of options for select_year to 1000. Pass the :max_years_allowed option to set your own limit. Libo Cannici * Passing formats or handlers to render :template and friends is deprecated. For example: Nick Sutterer & José Valim render :template => "foo.html.erb" Instead, you can provide :handlers and :formats directly as option: render :template => "foo", :formats => [:html, :js], :handlers => :erb * Changed log level of warning for missing CSRF token from :debug to :warn. Mike Dillon * content_tag_for and div_for can now take the collection of records. It will also yield the record as the first argument if you set a receiving argument in your block Prem Sichanugrist So instead of having to do this: @items.each do \|item\| content_tag_for(:li, item) do Title: <%= item.title %> end end You can now do this: content_tag_for(:li, @items) do \|item\| Title: <%= item.title %> end * send_file now guess the mime type Esad Hajdarevic * Mime type entries for PDF, ZIP and other formats were added Esad Hajdarevic * Generate hidden input before select with :multiple option set to true. This is useful when you rely on the fact that when no options is set, the state of select will be sent to rails application. Without hidden field nothing is sent according to HTML spec Bogdan Gusiev * Refactor ActionController::TestCase cookies Andrew White Assigning cookies for test cases should now use cookies[], e.g: cookies[:email] = 'user@example.com' get :index assert_equal 'user@example.com', cookies[:email] To clear the cookies, use clear, e.g: cookies.clear get :index assert_nil cookies[:email] We now no longer write out HTTP_COOKIE and the cookie jar is persistent between requests so if you need to manipulate the environment for your test you need to do it before the cookie jar is created. * ActionController::ParamsWrapper on ActiveRecord models now only wrap attr_accessible attributes if they were set, if not, only the attributes returned by the class method attribute_names will be wrapped. This fixes the wrapping of nested attributes by adding them to attr_accessible. 2012-03-18 07:47:54 +01:00
Update ruby-actionpack32 to 3.2.8. ## Rails 3.2.8 (Aug 9, 2012) ## * There is an XSS vulnerability in the strip_tags helper in Ruby on Rails, the helper doesn't correctly handle malformed html. As a result an attacker can execute arbitrary javascript through the use of specially crafted malformed html. Marek from Nethemba (www.nethemba.com) & Santiago Pastorino * When a "prompt" value is supplied to the `select_tag` helper, the "prompt" value is not escaped. If untrusted data is not escaped, and is supplied as the prompt value, there is a potential for XSS attacks. Vulnerable code will look something like this: select_tag("name", options, :prompt => UNTRUSTED_INPUT) Santiago Pastorino 2012-08-12 14:40:00 +02:00			`SHA1 (actionpack-3.2.8.gem) = ccc63cc2fcb3131b92d45cf5834aa629857d7258`
			`RMD160 (actionpack-3.2.8.gem) = ec71996e73831ea346d8e060234a7f7a73881908`
			`Size (actionpack-3.2.8.gem) = 379392 bytes`