- 29 11月, 2018 5 次提交
-
-
由 Rafael Mendonça França 提交于
-
由 Rafael França 提交于
Allow spaces in postgres table names
-
由 Rafael Mendonça França 提交于
The error can be reproduced with require "bundler/setup" require "action_controller" AbstractController::ActionNotFound
-
由 Rafael França 提交于
Patch load error in case GemSpecError
-
由 Eileen M. Uchitelle 提交于
Fix `ArgumentError` when uploading to amazon s3
-
- 28 11月, 2018 7 次提交
-
-
由 yuuji.yaginuma 提交于
Since 06ab7b27, `GCSServiceTest#test_signed_URL_response_headers` is broken. https://travis-ci.org/rails/rails/jobs/460454477#L7084-L7087 This seems to be due to lack of `content_type` at upload. This is solved by specifying `conten_type`. However, since the same content is also tested with `test_upload_with_content_type`, it will be duplicated content, so I think that can remove `test_signed_URL_response_headers`.
-
由 yuuji.yaginuma 提交于
-
由 Rafael Mendonça França 提交于
-
由 Rafael França 提交于
Additional types of ResultSet should not contain keys of #attributes_to_define_after_schema_loads
-
由 Rafael Mendonça França 提交于
-
由 Rosa Gutierrez 提交于
* Force content-type to binary on service urls for relevant content types We have a list of content types that must be forcibly served as binary, but in practice this only means to serve them as attachment always. We should also set the Content-Type to the configured binary type. As a bonus: add text/cache-manifest to the list of content types to be served as binary by default. * Store content-disposition and content-type in GCS Forcing these in the service_url when serving the file works fine for S3 and Azure, since these services include params in the signature. However, GCS specifically excludes response-content-disposition and response-content-type from the signature, which means an attacker can modify these and have files that should be served as text/plain attachments served as inline HTML for example. This makes our attempt to force specific files to be served as binary and as attachment can be easily bypassed. The only way this can be forced in GCS is by storing content-disposition and content-type in the object metadata. * Update GCS object metadata after identifying blob In some cases we create the blob and upload the data before identifying the content-type, which means we can't store that in GCS right when uploading. In these, after creating the attachment, we enqueue a job to identify the blob, and set the content-type. In other cases, files are uploaded to the storage service via direct upload link. We create the blob before the direct upload, which happens independently from the blob creation itself. We then mark the blob as identified, but we have already the content-type we need without having put it in the service. In these two cases, then, we need to update the metadata in the GCS service. * Include content-type and disposition in the verified key for disk service This prevents an attacker from modifying these params in the service signed URL, which is particularly important when we want to force them to have specific values for security reasons. * Allow only a list of specific content types to be served inline This is different from the content types that must be served as binary in the sense that any content type not in this list will be always served as attachment but with its original content type. Only types in this list are allowed to be served either inline or as attachment. Apart from forcing this in the service URL, for GCS we need to store the disposition in the metadata. Fix CVE-2018-16477.
-
由 Rafael Mendonça França 提交于
Trusting any GlobaID object when deserializing jobs can allow attackers to access information that should not be accessible to them. Fix CVE-2018-16476.
-
- 27 11月, 2018 1 次提交
-
-
由 Rafael Mendonça França 提交于
Closes #34530.
-
- 26 11月, 2018 1 次提交
-
-
由 Gannon McGibbon 提交于
Updating the Testing Guide to Reflect Emails Enqueued With ActiveJob
-
- 25 11月, 2018 3 次提交
-
-
由 Tom Rossi 提交于
-
由 George Claghorn 提交于
Closes #32193.
-
由 Tasos Maschalidis 提交于
-
- 24 11月, 2018 1 次提交
-
-
由 Rafael França 提交于
Pluralized enum raises error when attempting to modify
-
- 23 11月, 2018 1 次提交
-
-
由 Rafael França 提交于
`atomic_write`: Ensure correct permission when `tmpdir` is the same as `dirname`.
-
- 22 11月, 2018 1 次提交
-
-
由 Ryuta Kamizono 提交于
Fixing an issue when parsing an opclass by allowing indexed column in indexdef to be wrapped up by double quotes
-
- 21 11月, 2018 1 次提交
-
-
由 Aaron Patterson 提交于
Fix handling of duplicates for `replace` on has_many-through
-
- 20 11月, 2018 1 次提交
-
-
由 Rafael Mendonça França 提交于
Permit of ActionController::Parameters for ActiveJob Serializable Argument
-
- 17 11月, 2018 3 次提交
-
-
由 Rafael França 提交于
Re-add changes_applied doc
-
由 Rafael França 提交于
Replace cache_key with cache_key_with_version on caching_with_rails g…
-
由 tnantoka 提交于
-
- 14 11月, 2018 3 次提交
-
-
由 Rafael Mendonça França 提交于
-
由 Rafael França 提交于
Reset Capybara sessions if failed system test screenshot raising an exception
-
由 Rafael França 提交于
Fix ignored options in the `#added?` method
-
- 02 11月, 2018 2 次提交
-
-
由 Gannon McGibbon 提交于
Restore HashWithIndifferentAccess support to ActiveJob::Arguments.deserialize.
-
由 Rafael França 提交于
Make ActiveSupport HashWithIndifferentAccess#to_options and alias for HashWithIndifferentAccess#symbolize_keys
-
- 01 11月, 2018 2 次提交
-
-
由 Ryuta Kamizono 提交于
-
由 Rafael França 提交于
Backport `update_columns` bug fix to 5-2-stable
-
- 31 10月, 2018 2 次提交
-
-
由 Sean Griffin 提交于
b63701e2 moved the assignment before the query, but we need to capture our old id before assignment in case we are assigning the id.
-
由 Sean Griffin 提交于
Previosly, `update_columns` would just take whatever keys you gave it and tried to run the update query. Most likely this would result in an error from the database. However, if the column actually did exist, but was in `ignored_columns`, this would result in the method returning successfully when it should have raised, and an attribute that should not exist written to `@attributes`.
-
- 29 10月, 2018 2 次提交
-
-
由 Xavier Noria 提交于
-
由 Jan Habermann 提交于
If you require `nokogiri` from `app/models/user.rb`, dependencies.rb does not mark `Nokogiri` as an autoloaded constant, as expected. But the logic to detect these non-autoloaded constants is incomplete. See the tests defined in the patch for some cases incorrectly handled.
-
- 27 10月, 2018 1 次提交
-
-
由 Ryuta Kamizono 提交于
Ignore empty condition on #construct_relation_for_exists
-
- 25 10月, 2018 2 次提交
-
-
由 Rafael França 提交于
Include deserialized arguments in jobs returned by AJ test helpers
-
由 Rafael França 提交于
Lazy checking whether or not values in IN clause are boundable
-
- 24 10月, 2018 1 次提交
-
-
由 Rafael Mendonça França 提交于
What is important to tell is that the database configuration could not be loaded. Fixes #34296.
-