Commit Graph

43183 Commits

Author SHA1 Message Date
Aaron Patterson 859ca4474e use secure string comparisons for basic auth username / password
this will avoid timing attacks against applications that use basic auth.

Conflicts:
	activesupport/lib/active_support/security_utils.rb

CVE-2015-7576
2016-01-22 14:56:47 -08:00
Rafael França a96c7233b1 Merge pull request #22968 from rabbitt/bugfix/rails41-logger-threadsafety
4.1 Backport of LoggerSilence#silence Threadsafety patch (see: PR #20507)
2016-01-15 14:31:02 -02:00
Carl P. Corliss e713069f20 4.1 Backport of LoggerSilence#silence Threadsafety patch (see: PR #20507)
- Uses Logger instance defined level if no custom local log level defined
- Keeps track of local log level per logger instance + thread id
- Prevents memory leakage by removing local level hash key/value on #silence method exit
- Test case for threadsafety issue added (and passes with these changes), based @rdubya's tests
- Fixes #20490 and supersedes https://github.com/rails/rails/pull/16885
2016-01-07 18:20:45 -05:00
Robin Dupret 766a0cd7de Avoid relying on error messages when rescuing
When we are rescuing from an error, it's a brittle approach to do checks
with regular expressions on the raised message because it may change in
in the future and error messages are different across implementations.

The NameError API could be improved at the MRI level but for now we need
to rely on its #name. A #== check will only pass for top level constants
or only when the last constant of the path is missing so we need to rely
on #include? instead. For instance:

    begin
      Namespace::Foo
    rescue NameError => e
      e.name # => :Namespace
    end

However, if the name-space already exists, only the name of the first
missing constant in the path is returned (e.g. for Math::PHI, the name
would be :PHI). JRuby will return a fully qualified name (:"Math::PHI").

We need to keep the == check for 1.9 compatibility since const_get will
raise a NameError with a name attribute set to the given string if it's
one of "::" or "".

See http://git.io/jnSN7g for further information.
2015-12-25 18:17:19 -02:00
Arthur Neves 7fd06ee2d2 Dont check bundler output on plugin generator test 2015-12-25 18:09:05 -02:00
Rafael Mendonça França 1703dd70a6 Bundle update 2015-12-25 18:09:01 -02:00
Rafael França d6fbf8774d Merge pull request #22792 from maclover7/patch-3
Add Ruby 2.3.0 to Travis matrix
2015-12-25 14:54:31 -02:00
Rafael França 7310a6d5c8 Merge pull request #22543 from datanoise/master
Fixed typo in mysql client parameter
2015-12-09 19:40:52 -02:00
Rafael Mendonça França 689df94716 Merge branch '4-1-14' into 4-1-stable 2015-11-17 17:02:34 -02:00
yui-knk 32ca78a670 Make `AR::SpawnMethods#merge!` to check an arg is a Proc
From Ruby ( 2.3.0dev trunk 52520), `Hash#to_proc` is defined
(fbe967ec02),
and many tests have been failed with
`ArgumentError: wrong number of arguments (given 0, expected 1)`.
Because we call `Hash#to_proc` with no args in `#merge!`.

This commit changes order of conditionals to not call `Hash#to_proc`.

(cherry picked from commit a98475c2df)
2015-11-17 14:05:36 +00:00
Rafael Mendonça França e694ac5fbc Preparing for 4.1.14 release 2015-11-12 15:17:28 -02:00
Rafael Mendonça França 84ef6032e5 Ignore Gemfile.lock in the release task 2015-11-12 15:12:27 -02:00
Christoph 4696e0d439 Fix week_field returning invalid value
According to the W3 spec[1] the value should use a 1-based index
and not a 0-based index for the week number.

[1]: http://www.w3.org/TR/html-markup/datatypes.html#form.data.week

(cherry picked from commit 60dabb156f)
2015-11-10 12:43:21 +00:00
Rafael Mendonça França 96c4b1a131 Preparing for 4.1.14.rc2 release 2015-11-05 00:53:25 -02:00
Rafael Mendonça França bfff3c7192 Add bundle check to release task 2015-11-05 00:52:35 -02:00
Andrew White 7df77cf87e Fix tests for cd900f1
Backport additional changes from merge commit 9f4cefd
2015-11-04 12:34:41 +00:00
Andrew White 3c02257838 Fix tests for cd900f1
Backport additional changes from merge commit 9f4cefd
2015-11-04 12:21:57 +00:00
Andrew White 667373eb80 Remove deprecated pg_dump -i flag
Backport of f383552
2015-11-04 12:00:06 +00:00
Andrew White cd900f10a7 Remove deprecated pg_dump -i flag
Backport of f383552
2015-11-04 11:55:42 +00:00
Rafael Mendonça França 4986709fe0 Make sure mail_to work with nil and SafeBuffer 2015-11-03 20:01:20 -02:00
Rafael Mendonça França c8b69cde98 Make sure mail_to work with nil and SafeBuffer 2015-11-03 20:01:06 -02:00
Rafael Mendonça França 23df880908 Update the gem versions 2015-10-30 17:55:48 -02:00
Rafael Mendonça França 7ecac3e9f8 Prepare to 4.1.14.rc1 2015-10-30 17:34:57 -02:00
Rafael Mendonça França a76d1d7a9d Add tasks to automatize CHANGELOG headers 2015-10-30 17:33:31 -02:00
Rafael Mendonça França d0b60f3cd8 Add version constraint to database gem in generated application
We are using the same version constraint in the database adapters so
when a new version of the adapter that doesn't work with the version of
rails is released we don't break new applications.
2015-10-29 22:18:31 -02:00
Rafael Mendonça França 233091c0ec Don't use mysql2 0.4 in our tests. 2015-10-29 18:30:01 -02:00
Rafael Mendonça França 55084747ec Merge pull request #18383 from scambra/habtm-with-where-includes-16032-for-master
Includes HABTM returns correct size now
2015-10-27 22:23:03 -02:00
yuuji.yaginuma 13dfc8fbdc fix application_controller require_dependency path generated by the scaffold generator
This is follow up to #6643.
In #6643, the controller generator only had been fixed, in this commit to fix the scaffold generator.

(cherry picked from commit 2e8146909a)
2015-09-20 16:54:15 +01:00
Rafael Mendonça França e5ba382ccb Merge pull request #21402 from k0kubun/ruby20-url-helper
Fix mail_to to work well with Ruby 2.0
2015-08-28 02:42:58 -03:00
Rafael Mendonça França fbba4ad7c8 Fix Gemfile.lock 2015-08-27 23:47:15 -03:00
Rafael Mendonça França af68f1f4dd Merge branch '4-1-13' into 4-1-stable 2015-08-24 15:05:41 -03:00
Rafael Mendonça França 10ac0155b1 Preparing for 4.1.13 release 2015-08-24 14:57:52 -03:00
Rafael Mendonça França f2607bfd7b Allow release when CHANGELOG is changed 2015-08-24 14:57:26 -03:00
Rafael Mendonça França 099a9181fc Preparing for 4.1.13.rc1 release 2015-08-14 12:09:28 -03:00
Rafael Mendonça França 3d37fb89f5 Don't reorder binds if we don't have any
Fixes #18469.
2015-08-13 20:53:39 -03:00
Yves Senn 46f0be2276 Catch possible `NameError` in Ruby 2.2.1. Closes #19297
This patch was necessary due to a bug in Ruby 2.2.1:
https://bugs.ruby-lang.org/issues/10969

A minimal reproduction script can be found here:
https://gist.github.com/senny/9864a138defa322ed807
2015-08-11 17:21:58 +02:00
Matthew Draper a616b1e523 Merge pull request #20516 from kares/patch-2
change AR clear order in ActionDisplatch::Reloader hook
2015-08-05 09:03:26 +09:30
Rafael Mendonça França 039cba7c51 Merge pull request #21112 from kamipo/fix_mysql2_version
Should use `server_info[:version]` instead of `info[:version]`
2015-08-04 20:30:52 -03:00
Rafael Mendonça França 9ea6df05f9 Merge pull request #21007 from clayton-shopify/fix-mailto-encoding
Encode the email address as prescribed in RFC 6068 section 2.
2015-07-24 17:32:03 -03:00
Sean Griffin a078cbd959 Fix a state leak in `autosave_association_test`
The test added in 85465ed3e6 was passing
when the file was run on its own, but failing when the entire suite was
run since this test modifies the class and doesn't clean up.
2015-07-19 15:42:44 -06:00
Sean Griffin 77f6b10906 Always perform validations on nested attribute associations
Collection associations would have already been validated, but singular
associations were not.

Fixes #18735.
2015-07-19 15:38:40 -06:00
Sean Griffin c397534927 Don't redefine autosave association callbacks in nested attrs
These callbacks will already have been defined when the association was
built. The check against `reflection.autosave` happens at call time, not
at define time, so simply modifying the reflection is sufficient.

Fixes #18704
2015-07-19 15:38:40 -06:00
Rafael Mendonça França 089ad5fd35 Remove JRuby and Rubinius from the travis matrix
This will save Travis some precious resource since it will not need to
run 18 jobs for these Ruby implementations on every push or pull
request.

We do care about these implementations but we should fix the build
locally before having it running on travis. We would love to have
someone working on this but right now it is not our reality.
2015-07-13 17:08:39 -03:00
yuuji.yaginuma 7fab41c883 remove reference to `country_options_for_select` and `country_select` from guide [ci skip]
these methods were removed in 2d27b82d4c
2015-07-05 12:26:19 +02:00
Matthew Draper 11bb30320d `bundle update` for sprockets version mismatch 2015-06-28 21:26:31 +09:30
Rafael Mendonça França 37aa84af5a Merge branch '4-1-12' into 4-1-stable 2015-06-25 18:26:22 -03:00
Rafael Mendonça França adfda00f06 Preparing for 4.1.12 release 2015-06-25 18:24:01 -03:00
Rafael Mendonça França 68d3245496 Preparing for 4.1.12.rc1 release 2015-06-22 11:03:27 -03:00
Rafael Mendonça França 741a3e86bc Autoload ActiveRecord::RecordInvalid
Fixes #20626
2015-06-18 18:39:24 -03:00
Rafael Mendonça França 906311d0cd Merge branch '4-1-10-sec' into 4-1-stable 2015-06-16 17:17:50 -03:00