vulnerability in ruby-actionpack.
Major changes:
- Improved compatibility with Ruby 1.9
- RailsXss plugin availability
- Fixes for the Nokogiri backend for XmlMini
Changes since 2.1.1:
* Allow metal to live in plugins #2045 [Matthew Rudy]
* Added metal [Josh Peek]
* Remove script/performance/request in favour of the performance
integration tests. [Pratik Naik]
* Add a rake task to apply a template to an existing application :
rake rails:template LOCATION=~/template.rb [Pratik Naik]
* Add "-m/--template" option to Rails generator to apply a template to
the generated application. [Jeremy McAnally]
* Extracted the process scripts (inspector, reaper, spawner) into the
plugin irs_process_scripts [David Heinemeier Hansson]
* Changed Rails.root to return a Pathname object
* Added view path support for engines [David Heinemeier Hansson]
* Added that config/routes.rb files in engine plugins are
automatically loaded (and reloaded when they change in dev mode)
[David Heinemeier Hansson]
* Added app/[models|controllers|helpers] to the load path for plugins
that has an app directory (go engines ;)) [David Heinemeier Hansson]
* Add config.preload_frameworks to load all frameworks at
startup. Default to false so Rails autoloads itself as it's
used. Turn this on for Passenger and JRuby. Also turned on by
config.threadsafe! [Jeremy Kemper]
* Add a rake task to generate dispatchers : rake
rails:generate_dispatchers [Pratik Naik]
* "rails <app>" will not generate public/dispatch.cgi/fcgi/rb files by
default now. Please use "--with-dispatchers" option if you need
them. [Yaroslav Markin, Pratik Naik]
* Added rake rails:update:application_controller to renamed
application.rb to application_controller.rb -- included in rake
rails:update so upgrading to 2.3 will automatically trigger it #1439
[kastner]
* Added Rails.backtrace_cleaner as an accessor for the
Rails::BacktraceCleaner instance used by the framework to cut down
on backtrace noise and config/initializers/backtrace_silencers.rb to
add your own (or turn them all off) [David Heinemeier Hansson]
* Switch from Test::Unit::TestCase to ActiveSupport::TestCase. [Jeremy Kemper]
* Added config.i18n settings gatherer to config/environment,
auto-loading of all locales in config/locales/*.rb,yml, and
config/locales/en.yml as a sample locale [David Heinemeier Hansson]
* BACKWARDS INCOMPATIBLE: Renamed application.rb to
application_controller.rb and removed all the special casing that
was in place to support the former. You must do this rename in your
own application when you upgrade to this version [David Heinemeier
Hansson]
* Fixed plugin generator so that generated unit tests would subclass
ActiveSupport::TestCase, also introduced a helper script to reduce
the needed require statements #1137 [Mathias Meyer]
* Update Prototype to 1.6.0.3 [sam]
* Fixed that sqlite would report "db/development.sqlite3 already
exists" whether true or not on db:create #614 [Antonio Cangiano]
* Added config.threadsafe! to toggle allow concurrency settings and
disable the dependency loader [Josh Peek]
* Turn cache_classes on by default [Josh Peek]
* Added configurable eager load paths. Defaults to app/models,
app/controllers, and app/helpers [Josh Peek]
* Introduce simple internationalization support. [Ruby i18n team]
* Make script/plugin install <plugin> -r <revision> option work with
git based plugins. #257. [Tim Pope Jakub Kuźma]. Example:
* Added Rails.initialized? flag [Josh Peek]
* Make rake test:uncommitted work with Git. [Tim Pope]
* Added Thin support to script/server. #488 [Bob Klosinski]
* Fix script/about in production mode. #370 [Cheah Chu Yeow, Xavier
Noria, David Krmpotic]
* Add the gem load paths before the framework is loaded, so certain
gems like RedCloth and BlueCloth can be frozen.
* Fix discrepancies with loading rails/init.rb from gems.
* Plugins check for the gem init path (rails/init.rb) before the
standard plugin init path (init.rb) [Jacek Becela]
* Changed all generated tests to use the test/do declaration style
[David Heinemeier Hansson]
* Wrapped Rails.env in StringInquirer so you can do
Rails.env.development? [David Heinemeier Hansson]
* Fixed that RailsInfoController wasn't considering all requests local
in development mode (Edgard Castro) [#310 state:resolved]
Changes:
* All 2xx requests are considered successful [Josh Peek]
* Deprecate the limited follow_redirect in functional tests. If you
wish to follow redirects, use integration tests. [Michael Koziarski]
* Fixed that AssetTagHelper#compute_public_path shouldn't cache the
asset_host along with the source or per-request proc's won't run
[DHH]
* Deprecate define_javascript_functions, javascript_include_tag and
friends are much better [Michael Koziarski]
* Fix polymorphic_url with singleton resources. #461 [Tammer Saleh]
* Deprecate ActionView::Base.erb_variable. Use the concat helper
method instead of appending to it directly. [Jeremy Kemper]
* Fixed Request#remote_ip to only raise hell if the HTTP_CLIENT_IP and
HTTP_X_FORWARDED_FOR doesn't match (not just if they're both
present) [Mark Imbriaco, Bradford Folkens]
Changes:
* Backport: allow array and hash query parameters. Array route parameters are
converted/to/a/path as before. #6765, #7047, #7462 [bgipsy, Jeremy McAnally,
Dan Kubb, brendan, Diego Algorta Casamayou]
* Fix in place editor's setter action with non-string fields. #7418 [Andreas]
* Only accept session ids from cookies, prevents session fixation attacks.
* Change the resource seperator from ; to / change the generated routes to use
the new-style named routes. e.g. new_group_user_path(@group) instead of
group_new_user_path(@group). [pixeltrix]
* Integration tests: introduce methods for other HTTP methods. #6353 [caboose]
* Improve performance of action caching. Closes#8231 [skaes]
* Fix errors with around_filters which do not yield, restore 1.1 behaviour
with after filters. Closes#8891 [skaes]
* Allow you to delete cookies with options. Closes#3685
* Deprecate pagination. Install the classic_pagination plugin for forward
compatibility, or move to the superior will_paginate plugin. #8157
* Fix filtered parameter logging with nil parameter values. #8422 [choonkeat]
* Integration tests: alias xhr to xml_http_request and add a request_method
argument instead of always using POST. #7124
* Document caches_action. #5419 [Jarkko Laine]
* observe_form always sends the serialized form. #5271
* Update UrlWriter to accept :anchor parameter. Closes#6771. [octopod]
* Replace the current block/continuation filter chain handling by an
implementation based on a simple loop. Closes#8226 [Stefan Kaes]
* Return the string representation from an Xml Builder when rendering a
partial. #5044 [tpope]
* Cleaned up, corrected, and mildly expanded ActionPack documentation. Closes
#7190 [jeremymcanally]
* Small collection of ActionController documentation cleanups. Closes#7319
* Performance: patch cgi/session/pstore to require digest/md5 once rather than
per #initialize. #7583 [Stefan Kaes]
* Deprecation: verification with :redirect_to => :named_route shouldn't be
deprecated. #7525 [Justin French]
Changes:
* Apply [5709] to stable.
* session_enabled? works with session :off.
* Performance: patch cgi/session to require digest/md5 once rather than per
#cre ate_new_id.
Action Pack splits the response to a web request into a controller
part (performing the logic) and a view part (rendering a template).
This two-step approach is known as an action, which will normally
create, read, update, or delete (CRUD for short) some sort of model
part (often backed by a database) before choosing either to render a
template or redirecting to another action.
Action Pack implements these actions as public methods on Action
Controllers and uses Action Views to implement the template rendering.
Action Controllers are then responsible for handling all the actions
relating to a certain part of an application. This grouping usually
consists of actions for lists and for CRUDs revolving around a single
(or a few) model objects. So ContactController would be responsible
for listing contacts, creating, deleting, and updating contacts. A
WeblogController could be responsible for both posts and comments.
Action View templates are written using embedded Ruby in tags mingled
in with the HTML. To avoid cluttering the templates with code, a
bunch of helper classes provide common behavior for forms, dates, and
strings. And it's easy to add specific helpers to keep the separation
as the application evolves.
