, :session_id=>"ce8b0752a6ab7c7af3cdb8a80e6b9e46"}
SignedSerializedCookie = "BAh7BzoIZm9vbzodU2Vzc2lvbkF1dG9sb2FkVGVzdDo6Rm9vBjoJQGJhciIIYmF6Og9zZXNzaW9uX2lkIiVjZThiMDc1MmE2YWI3YzdhZjNjZGI4YTgwZTZiOWU0Ng==--2bf3af1ae8bd4e52b9ac2099258ace0c380e601c"
-
+
def test_deserializes_unloaded_classes_on_get_id
with_test_route_set do
with_autoload_path "session_autoload_test" do
@@ -291,11 +289,11 @@ def test_deserializes_unloaded_classes_on_get_id
assert_equal 'id: ce8b0752a6ab7c7af3cdb8a80e6b9e46', response.body, "should auto-load unloaded class"
end
end
- end
-
+ end
+
def test_deserializes_unloaded_classes_on_get_value
with_test_route_set do
- with_autoload_path "session_autoload_test" do
+ with_autoload_path "session_autoload_test" do
cookies[SessionKey] = SignedSerializedCookie
get '/get_session_value'
assert_response :success
@@ -335,10 +333,12 @@ def with_test_route_set(options = {})
c.connect "/:action"
end
end
-
+
+ app = ActionController::Dispatcher.new
+
options = { :key => SessionKey, :secret => SessionSecret }.merge!(options)
- @integration_session = open_session(ActionController::Session::CookieStore.new(DispatcherApp, options))
-
+ @integration_session = open_session(ActionController::Session::CookieStore.new(app, options))
+
yield
end
end
diff --git a/actionpack/test/template/form_options_helper_test.rb b/actionpack/test/template/form_options_helper_test.rb
index e2df39b439d9c..33c202bede796 100644
--- a/actionpack/test/template/form_options_helper_test.rb
+++ b/actionpack/test/template/form_options_helper_test.rb
@@ -801,25 +801,50 @@ def test_grouped_collection_select_under_fields_for
)
end
- def test_select_escapes_options
+ def test_select_escapes_options_with_xss_enabled
+ @post = Post.new
assert_dom_equal(
'',
select_with_rails_xss('post', 'title', '')
)
+ assert_dom_equal(
+ '',
+ select_without_rails_xss('post', 'title', '')
+ )
end
- def test_select_escapes_prompt
+ def test_select_escapes_prompt_with_xss_enabled
+ @post = Post.new
assert_dom_equal(
'',
select_with_rails_xss('post', 'title', '', :prompt => '')
)
+ assert_dom_equal(
+ '',
+ select_without_rails_xss('post', 'title', '', :prompt => '')
+ )
end
- def test_select_include_blank
+ def test_select_escapes_include_blank_with_xss_enabled
+ @post = Post.new
assert_dom_equal(
'',
select_with_rails_xss('post', 'title', '', :include_blank => '')
)
+
+ assert_dom_equal(
+ '',
+ select_without_rails_xss('post', 'title', '', :include_blank => '')
+ )
+ end
+
+ def test_select_does_not_wrap_option_in_error_proc
+ @post = Post.new
+ @post.stubs(:errors).returns(stub('errors', :on => ['an error']))
+ assert_dom_equal(
+ '',
+ select_with_rails_xss('post', 'title', '', :include_blank => '')
+ )
end
private
@@ -833,4 +858,8 @@ def dummy_posts
def select_with_rails_xss(object, method, choices, options = {}, html_options = {})
RailsXssEmulation::InstanceTagWithRailsXss.new(object, method, self, options.delete(:object)).to_select_tag(choices, options, html_options)
end
+
+ def select_without_rails_xss(object, method, choices, options = {}, html_options = {})
+ ActionView::Helpers::InstanceTag.new(object, method, self, options.delete(:object)).to_select_tag(choices, options, html_options)
+ end
end
diff --git a/activerecord/LICENSE b/activerecord/LICENSE
index a33dc476de368..397d2681a640a 100644
--- a/activerecord/LICENSE
+++ b/activerecord/LICENSE
@@ -1,4 +1,4 @@
-The code in this project is based on Ruby on Rails 2.3.18
+The code in this project is based on Ruby on Rails 2.3
with additional changes by makandra GmbH.
Additional changes Copyright (c) 2013 makandra GmbH
@@ -7,10 +7,10 @@ with additional changes by makandra GmbH.
MIT license of Ruby on Rails 2.3.18 (found below) to any person
obtaining a copy of this software and associated documentation
files (the "Software"), except the right to publish, distribute,
- and/or sell copies of the Software before May 30, 2014.
+ and/or sell copies of the Software before February 05, 2016.
-The original code for Ruby on Rails 2.3.18 is licensed under the MIT license:
+The original code for Ruby on Rails 2.3 is licensed under the MIT license:
Copyright (c) 2004-2010 David Heinemeier Hansson
diff --git a/activerecord/Rakefile b/activerecord/Rakefile
index c1c18245212f5..794f422fe9908 100644
--- a/activerecord/Rakefile
+++ b/activerecord/Rakefile
@@ -6,10 +6,11 @@ require RAKEVERSION == '0.8.0' ? 'rake/gempackagetask' : 'rubygems/package_task'
require File.join(File.dirname(__FILE__), 'lib', 'active_record', 'version')
require File.expand_path(File.dirname(__FILE__)) + "/test/config"
+require File.expand_path('../../railslts-version/lib/railslts-version', __FILE__)
PKG_BUILD = ENV['PKG_BUILD'] ? '.' + ENV['PKG_BUILD'] : ''
PKG_NAME = 'activerecord'
-PKG_VERSION = ActiveRecord::VERSION::STRING + PKG_BUILD
+PKG_VERSION = RailsLts::VERSION::STRING + PKG_BUILD
PKG_FILE_NAME = "#{PKG_NAME}-#{PKG_VERSION}"
RELEASE_NAME = "REL #{PKG_VERSION}"
@@ -193,7 +194,7 @@ spec = Gem::Specification.new do |s|
s.files = s.files + Dir.glob( "#{dir}/**/*" ).delete_if { |item| item.include?( "\.svn" ) }
end
- s.add_dependency('activesupport', '= 2.3.18' + PKG_BUILD)
+ s.add_dependency('activesupport', "= #{PKG_VERSION}")
s.files.delete FIXTURES_ROOT + "/fixture_database.sqlite"
s.files.delete FIXTURES_ROOT + "/fixture_database_2.sqlite"
@@ -242,25 +243,3 @@ task :lines do
puts "Total: Lines #{total_lines}, LOC #{total_codelines}"
end
-
-
-# Publishing ------------------------------------------------------
-
-desc "Publish the beta gem"
-task :pgem => [:package] do
- require 'rake/contrib/sshpublisher'
- Rake::SshFilePublisher.new("gems.rubyonrails.org", "/u/sites/gems/gems", "pkg", "#{PKG_FILE_NAME}.gem").upload
- `ssh gems.rubyonrails.org '/u/sites/gems/gemupdate.sh'`
-end
-
-desc "Publish the release files to RubyForge."
-task :release => [ :package ] do
- require 'rubyforge'
- require 'rake/contrib/rubyforgepublisher'
-
- packages = %w( gem tgz zip ).collect{ |ext| "pkg/#{PKG_NAME}-#{PKG_VERSION}.#{ext}" }
-
- rubyforge = RubyForge.new
- rubyforge.login
- rubyforge.add_release(PKG_NAME, PKG_NAME, "REL #{PKG_VERSION}", *packages)
-end
diff --git a/activerecord/activerecord.gemspec b/activerecord/activerecord.gemspec
index 262524e14feab..9084b49f82506 100644
--- a/activerecord/activerecord.gemspec
+++ b/activerecord/activerecord.gemspec
@@ -1,6 +1,8 @@
+require File.expand_path('../../railslts-version/lib/railslts-version', __FILE__)
+
Gem::Specification.new do |s|
s.name = 'activerecord'
- s.version = '2.3.18'
+ s.version = RailsLts::VERSION::STRING
s.summary = 'Implements the ActiveRecord pattern for ORM.'
s.description = 'Implements the ActiveRecord pattern (Fowler, PoEAA) for ORM. It ties database tables and classes together for business objects, like Customer or Subscription, that can find, save, and destroy themselves without resorting to manual SQL.'
@@ -13,5 +15,5 @@ Gem::Specification.new do |s|
s.rdoc_options = ['--main', 'README']
s.extra_rdoc_files = ['README']
- s.add_dependency 'activesupport', '= 2.3.18'
+ s.add_dependency 'activesupport', "= #{RailsLts::VERSION::STRING}"
end
diff --git a/activerecord/lib/active_record/base.rb b/activerecord/lib/active_record/base.rb
index 6b6d055b5a8c7..adebbe22ea0fc 100755
--- a/activerecord/lib/active_record/base.rb
+++ b/activerecord/lib/active_record/base.rb
@@ -517,7 +517,7 @@ def self.reset_subclasses #:nodoc:
@@timestamped_migrations = true
# Determine whether to store the full constant name including namespace when using STI
- class_attribute :store_full_sti_class
+ class_attribute :store_full_sti_class, :instance_writer => false
self.store_full_sti_class = false
# Stores the default scope for the class
@@ -1286,7 +1286,7 @@ def set_sequence_name(value = nil, &block)
alias :sequence_name= :set_sequence_name
# Turns the +table_name+ back into a class name following the reverse rules of +table_name+.
- def class_name(table_name = table_name) # :nodoc:
+ def class_name(table_name = table_name()) # :nodoc:
ActiveSupport::Deprecation.warn("ActiveRecord::Base#class_name is deprecated and will be removed in Rails 3.", caller)
# remove any prefix and/or suffix from the table name
diff --git a/activerecord/lib/active_record/connection_adapters/abstract/connection_specification.rb b/activerecord/lib/active_record/connection_adapters/abstract/connection_specification.rb
index 535498f16b528..1d1444cc04fcd 100644
--- a/activerecord/lib/active_record/connection_adapters/abstract/connection_specification.rb
+++ b/activerecord/lib/active_record/connection_adapters/abstract/connection_specification.rb
@@ -10,7 +10,7 @@ def initialize (config, adapter_method)
##
# :singleton-method:
# The connection handler
- class_attribute :connection_handler
+ class_attribute :connection_handler, :instance_writer => false
self.connection_handler = ConnectionAdapters::ConnectionHandler.new
# Returns the connection currently associated with the class. This can
diff --git a/activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb b/activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb
index a348318994743..fbf26b63f425b 100644
--- a/activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb
+++ b/activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb
@@ -352,9 +352,9 @@ def quote(value, column = nil) #:nodoc:
"'#{value.to_s}'"
elsif value.kind_of?(String) && column && column.sql_type =~ /^bit/
case value
- when /^[01]*$/
+ when /\A[01]*\z$/
"B'#{value}'" # Bit-string notation
- when /^[0-9A-F]*$/i
+ when /\A[0-9A-F]*\z$/i
"X'#{value}'" # Hexadecimal notation
end
else
diff --git a/activerecord/lib/active_record/dirty.rb b/activerecord/lib/active_record/dirty.rb
index 1db8fef676c81..0d17e4e915125 100644
--- a/activerecord/lib/active_record/dirty.rb
+++ b/activerecord/lib/active_record/dirty.rb
@@ -44,7 +44,7 @@ def self.included(base)
base.alias_method_chain :update, :dirty
base.alias_method_chain :reload, :dirty
- base.class_attribute :partial_updates
+ base.class_attribute :partial_updates, :instance_writer => false
base.partial_updates = true
base.send(:extend, ClassMethods)
diff --git a/activerecord/pkg/activerecord-2.3.18.gem b/activerecord/pkg/activerecord-2.3.18.gem
deleted file mode 100644
index 0f3dc7b9b709a..0000000000000
Binary files a/activerecord/pkg/activerecord-2.3.18.gem and /dev/null differ
diff --git a/activerecord/test/cases/nested_attributes_test.rb b/activerecord/test/cases/nested_attributes_test.rb
index f439f11c8a618..1ca7fe87756aa 100644
--- a/activerecord/test/cases/nested_attributes_test.rb
+++ b/activerecord/test/cases/nested_attributes_test.rb
@@ -111,6 +111,27 @@ def test_reject_if_with_indifferent_keys
pirate.ship_attributes = { :name => 'Hello Pearl' }
assert_difference('Ship.count') { pirate.save! }
end
+
+ # This test is all we can do for Rails 2.3 in regard to
+ # [CVE-2015-7577] Nested attributes rejection proc bypass in Active Record.
+ #
+ # In Rails 3+ you could skip over a :reject_if proc when the nested association
+ # had :allow_destroy => false and you're updating an existing record with :_destroy => 1.
+ # This might be used to change a record that the developer considers to be off limits
+ # due to the :reject_if condition.
+ #
+ # However, the Rails 2.3 API defines that :reject_if is never called for existing records,
+ # only for new records. Hence the developer cannot trust in any protection from :reject_if
+ # for existing record.
+ #
+ # The only (slightly awkward) test we can write for Rails 2.3 is that new records with
+ # :_destroy => true are immediately destroyed, even if :allow_destroy is false.
+ def test_reject_if_is_not_short_circuited_if_allow_destroy_is_false
+ Pirate.accepts_nested_attributes_for :ship, :reject_if => proc { |a| a[:name] == "The Golden Hind" }, :allow_destroy => false
+ pirate = Pirate.new(:catchphrase => "Arrr", :ship_attributes => { :name => "The Golden Hind", :_destroy => "1"})
+ assert_no_difference('Ship.count') { pirate.save! }
+ end
+
end
class TestNestedAttributesOnAHasOneAssociation < ActiveRecord::TestCase
diff --git a/activerecord/test/cases/quoting_test_postgresql.rb b/activerecord/test/cases/quoting_test_postgresql.rb
new file mode 100644
index 0000000000000..f6fb12e18c40f
--- /dev/null
+++ b/activerecord/test/cases/quoting_test_postgresql.rb
@@ -0,0 +1,46 @@
+require "cases/helper"
+require 'models/bird'
+
+module ActiveRecord
+ module ConnectionAdapters
+ class PostgreSQLAdapter
+ class QuotingTest < ActiveRecord::TestCase
+ def setup
+ @conn = ActiveRecord::Base.connection
+ end
+
+ def test_quote_true
+ c = PostgreSQLColumn.new(nil, 1, 'boolean')
+ assert_equal "'t'", @conn.quote(true, nil)
+ assert_equal "'t'", @conn.quote(true, c)
+ end
+
+ def test_quote_false
+ c = PostgreSQLColumn.new(nil, 1, 'boolean')
+ assert_equal "'f'", @conn.quote(false, nil)
+ assert_equal "'f'", @conn.quote(false, c)
+ end
+
+ def test_quote_range
+ # There is no range support on 2.3's PG adapter, but we still want to
+ # make sure that SQL injection is not possible since it was an issue
+ # on Rails 4.x.
+ # https://groups.google.com/d/msg/rubyonrails-security/wDxePLJGZdI/WP7EasCJTA4J
+ #
+ # Note that we can not test this using Connection#quote because
+ # ActiveRecord expands ranges into two bind variables that are
+ # quoted individually.
+ range = "1,2]'; SELECT * FROM users; --".."a"
+ sql = Bird.scoped(:conditions => { :name => range }).construct_finder_sql({})
+ expected_sql = %{SELECT * FROM "birds" WHERE ("birds"."name" BETWEEN '1,2]''; SELECT * FROM users; --' AND 'a') }
+ assert_equal expected_sql, sql
+ end
+
+ def test_quote_bit_string
+ c = PostgreSQLColumn.new(nil, 1, 'bit')
+ assert_equal nil, @conn.quote("'); SELECT * FORM users; /*\n01\n*/--", c)
+ end
+ end
+ end
+ end
+end
diff --git a/activeresource/LICENSE b/activeresource/LICENSE
index a33dc476de368..20854341a1479 100644
--- a/activeresource/LICENSE
+++ b/activeresource/LICENSE
@@ -1,4 +1,4 @@
-The code in this project is based on Ruby on Rails 2.3.18
+The code in this project is based on Ruby on Rails 2.3
with additional changes by makandra GmbH.
Additional changes Copyright (c) 2013 makandra GmbH
@@ -7,7 +7,7 @@ with additional changes by makandra GmbH.
MIT license of Ruby on Rails 2.3.18 (found below) to any person
obtaining a copy of this software and associated documentation
files (the "Software"), except the right to publish, distribute,
- and/or sell copies of the Software before May 30, 2014.
+ and/or sell copies of the Software before February 05, 2016.
The original code for Ruby on Rails 2.3.18 is licensed under the MIT license:
diff --git a/activeresource/Rakefile b/activeresource/Rakefile
index 7e707929e4848..afd2c198815b9 100644
--- a/activeresource/Rakefile
+++ b/activeresource/Rakefile
@@ -5,10 +5,11 @@ require 'rake/packagetask'
require RAKEVERSION == '0.8.0' ? 'rake/gempackagetask' : 'rubygems/package_task'
require File.join(File.dirname(__FILE__), 'lib', 'active_resource', 'version')
+require File.expand_path('../../railslts-version/lib/railslts-version', __FILE__)
PKG_BUILD = ENV['PKG_BUILD'] ? '.' + ENV['PKG_BUILD'] : ''
PKG_NAME = 'activeresource'
-PKG_VERSION = ActiveResource::VERSION::STRING + PKG_BUILD
+PKG_VERSION = RailsLts::VERSION::STRING + PKG_BUILD
PKG_FILE_NAME = "#{PKG_NAME}-#{PKG_VERSION}"
RELEASE_NAME = "REL #{PKG_VERSION}"
@@ -67,7 +68,7 @@ spec = Gem::Specification.new do |s|
s.files = s.files + Dir.glob( "#{dir}/**/*" ).delete_if { |item| item.include?( "\.svn" ) }
end
- s.add_dependency('activesupport', '= 2.3.18' + PKG_BUILD)
+ s.add_dependency('activesupport', "= #{PKG_VERSION}")
s.require_path = 'lib'
s.autorequire = 'active_resource'
@@ -112,24 +113,3 @@ task :lines do
puts "Total: Lines #{total_lines}, LOC #{total_codelines}"
end
-
-
-# Publishing ------------------------------------------------------
-
-desc "Publish the beta gem"
-task :pgem => [:package] do
- require 'rake/contrib/sshpublisher'
- Rake::SshFilePublisher.new("gems.rubyonrails.org", "/u/sites/gems/gems", "pkg", "#{PKG_FILE_NAME}.gem").upload
- `ssh gems.rubyonrails.org '/u/sites/gems/gemupdate.sh'`
-end
-
-desc "Publish the release files to RubyForge."
-task :release => [ :package ] do
- `rubyforge login`
-
- for ext in %w( gem tgz zip )
- release_command = "rubyforge add_release #{PKG_NAME} #{PKG_NAME} 'REL #{PKG_VERSION}' pkg/#{PKG_NAME}-#{PKG_VERSION}.#{ext}"
- puts release_command
- system(release_command)
- end
-end
diff --git a/activeresource/activeresource.gemspec b/activeresource/activeresource.gemspec
index b66a8205528fe..87d746d6d8e21 100644
--- a/activeresource/activeresource.gemspec
+++ b/activeresource/activeresource.gemspec
@@ -1,6 +1,8 @@
+require File.expand_path('../../railslts-version/lib/railslts-version', __FILE__)
+
Gem::Specification.new do |s|
s.name = 'activeresource'
- s.version = '2.3.18'
+ s.version = RailsLts::VERSION::STRING
s.summary = 'Think Active Record for web resources.'
s.description = 'Wraps web resources in model classes that can be manipulated through XML over REST.'
@@ -13,5 +15,5 @@ Gem::Specification.new do |s|
s.rdoc_options = ['--main', 'README']
s.extra_rdoc_files = ['README']
- s.add_dependency 'activesupport', '= 2.3.18'
+ s.add_dependency 'activesupport', "= #{RailsLts::VERSION::STRING}"
end
diff --git a/activeresource/pkg/activeresource-2.3.18.gem b/activeresource/pkg/activeresource-2.3.18.gem
deleted file mode 100644
index 586d5268e7b3c..0000000000000
Binary files a/activeresource/pkg/activeresource-2.3.18.gem and /dev/null differ
diff --git a/activesupport/LICENSE b/activesupport/LICENSE
index a33dc476de368..397d2681a640a 100644
--- a/activesupport/LICENSE
+++ b/activesupport/LICENSE
@@ -1,4 +1,4 @@
-The code in this project is based on Ruby on Rails 2.3.18
+The code in this project is based on Ruby on Rails 2.3
with additional changes by makandra GmbH.
Additional changes Copyright (c) 2013 makandra GmbH
@@ -7,10 +7,10 @@ with additional changes by makandra GmbH.
MIT license of Ruby on Rails 2.3.18 (found below) to any person
obtaining a copy of this software and associated documentation
files (the "Software"), except the right to publish, distribute,
- and/or sell copies of the Software before May 30, 2014.
+ and/or sell copies of the Software before February 05, 2016.
-The original code for Ruby on Rails 2.3.18 is licensed under the MIT license:
+The original code for Ruby on Rails 2.3 is licensed under the MIT license:
Copyright (c) 2004-2010 David Heinemeier Hansson
diff --git a/activesupport/Rakefile b/activesupport/Rakefile
index b0b77a8711e13..1dd3f6ed2ef34 100644
--- a/activesupport/Rakefile
+++ b/activesupport/Rakefile
@@ -2,10 +2,11 @@ require 'rake/testtask'
require RAKEVERSION == '0.8.0' ? 'rake/gempackagetask' : 'rubygems/package_task'
require File.join(File.dirname(__FILE__), 'lib', 'active_support', 'version')
+require File.expand_path('../../railslts-version/lib/railslts-version', __FILE__)
PKG_BUILD = ENV['PKG_BUILD'] ? '.' + ENV['PKG_BUILD'] : ''
PKG_NAME = 'activesupport'
-PKG_VERSION = ActiveSupport::VERSION::STRING + PKG_BUILD
+PKG_VERSION = RailsLts::VERSION::STRING + PKG_BUILD
PKG_FILE_NAME = "#{PKG_NAME}-#{PKG_VERSION}"
RELEASE_NAME = "REL #{PKG_VERSION}"
@@ -65,25 +66,6 @@ package_task.new(spec) do |p|
p.need_zip = true
end
-desc "Publish the beta gem"
-task :pgem => [:package] do
- require 'rake/contrib/sshpublisher'
- Rake::SshFilePublisher.new("gems.rubyonrails.org", "/u/sites/gems/gems", "pkg", "#{PKG_FILE_NAME}.gem").upload
- `ssh gems.rubyonrails.org '/u/sites/gems/gemupdate.sh'`
-end
-
-desc "Publish the release files to RubyForge."
-task :release => [ :package ] do
- require 'rubyforge'
- require 'rake/contrib/rubyforgepublisher'
-
- packages = %w( gem tgz zip ).collect{ |ext| "pkg/#{PKG_NAME}-#{PKG_VERSION}.#{ext}" }
-
- rubyforge = RubyForge.new
- rubyforge.login
- rubyforge.add_release(PKG_NAME, PKG_NAME, "REL #{PKG_VERSION}", *packages)
-end
-
namespace :tzinfo do
desc "Update bundled tzinfo gem. Only copies the subset of classes and definitions required to support Rails time zone features."
task :update => ['tzinfo:copy_classes', 'tzinfo:copy_definitions'] do
diff --git a/activesupport/activesupport.gemspec b/activesupport/activesupport.gemspec
index 7c326dd7ded92..d56bdb1603b28 100644
--- a/activesupport/activesupport.gemspec
+++ b/activesupport/activesupport.gemspec
@@ -1,6 +1,8 @@
+require File.expand_path('../../railslts-version/lib/railslts-version', __FILE__)
+
Gem::Specification.new do |s|
s.name = 'activesupport'
- s.version = '2.3.18'
+ s.version = RailsLts::VERSION::STRING
s.summary = 'Support and utility classes used by the Rails framework.'
s.description = 'Utility library which carries commonly used classes and goodies from the Rails framework'
diff --git a/activesupport/lib/active_support/message_verifier.rb b/activesupport/lib/active_support/message_verifier.rb
index 60587b9043073..eafe1dd10c5f0 100644
--- a/activesupport/lib/active_support/message_verifier.rb
+++ b/activesupport/lib/active_support/message_verifier.rb
@@ -73,7 +73,7 @@ def secure_compare(a, b)
def generate_digest(data)
require 'openssl' unless defined?(OpenSSL)
- OpenSSL::HMAC.hexdigest(OpenSSL::Digest::Digest.new(@digest), @secret, data)
+ OpenSSL::HMAC.hexdigest(OpenSSL::Digest.new(@digest), @secret, data)
end
end
end
diff --git a/activesupport/lib/active_support/xml_mini.rb b/activesupport/lib/active_support/xml_mini.rb
index ccd1349491169..23e023d3b9cca 100644
--- a/activesupport/lib/active_support/xml_mini.rb
+++ b/activesupport/lib/active_support/xml_mini.rb
@@ -8,6 +8,9 @@ module XmlMini
extend self
attr_reader :backend
+ attr_accessor :depth
+ self.depth = 100
+
delegate :parse, :to => :backend
def backend=(name)
diff --git a/activesupport/lib/active_support/xml_mini/jdom.rb b/activesupport/lib/active_support/xml_mini/jdom.rb
index d795d556909e6..d499af6281ac6 100644
--- a/activesupport/lib/active_support/xml_mini/jdom.rb
+++ b/activesupport/lib/active_support/xml_mini/jdom.rb
@@ -35,7 +35,7 @@ def parse(string)
xml_string_reader = StringReader.new(string)
xml_input_source = InputSource.new(xml_string_reader)
doc = @dbf.new_document_builder.parse(xml_input_source)
- merge_element!({}, doc.document_element)
+ merge_element!({}, doc.document_element, XmlMini.depth)
end
end
@@ -48,21 +48,22 @@ def parse(string)
# element::
# XML element to merge into hash
def merge_element!(hash, element)
- merge!(hash, element.tag_name, collapse(element))
+ raise 'Document too deep!' if depth == 0
+ merge!(hash, element.tag_name, collapse(element, depth))
end
# Actually converts an XML document element into a data structure.
#
# element::
# The document element to be collapsed.
- def collapse(element)
+ def collapse(element, depth)
hash = get_attributes(element)
child_nodes = element.child_nodes
if child_nodes.length > 0
for i in 0...child_nodes.length
child = child_nodes.item(i)
- merge_element!(hash, child) unless child.node_type == Node.TEXT_NODE
+ merge_element!(hash, child, depth - 1) unless child.node_type == Node.TEXT_NODE
end
merge_texts!(hash, element) unless empty_content?(element)
hash
diff --git a/activesupport/lib/active_support/xml_mini/rexml.rb b/activesupport/lib/active_support/xml_mini/rexml.rb
index a8fdeca9671ed..1700a6e7f1ec0 100644
--- a/activesupport/lib/active_support/xml_mini/rexml.rb
+++ b/activesupport/lib/active_support/xml_mini/rexml.rb
@@ -15,7 +15,7 @@ module XmlMini_REXML #:nodoc:
def parse(string)
require 'rexml/document' unless defined?(REXML::Document)
doc = REXML::Document.new(string)
- merge_element!({}, doc.root)
+ merge_element!({}, doc.root, XmlMini.depth)
end
private
@@ -25,19 +25,20 @@ def parse(string)
# Hash to merge the converted element into.
# element::
# XML element to merge into hash
- def merge_element!(hash, element)
- merge!(hash, element.name, collapse(element))
+ def merge_element!(hash, element, depth)
+ raise REXML::ParseException, "The document is too deep" if depth == 0
+ merge!(hash, element.name, collapse(element, depth))
end
# Actually converts an XML document element into a data structure.
#
# element::
# The document element to be collapsed.
- def collapse(element)
+ def collapse(element, depth)
hash = get_attributes(element)
if element.has_elements?
- element.each_element {|child| merge_element!(hash, child) }
+ element.each_element {|child| merge_element!(hash, child, depth - 1) }
merge_texts!(hash, element) unless empty_content?(element)
hash
else
diff --git a/activesupport/pkg/activesupport-2.3.18.gem b/activesupport/pkg/activesupport-2.3.18.gem
deleted file mode 100644
index 6b3d85f26f4d9..0000000000000
Binary files a/activesupport/pkg/activesupport-2.3.18.gem and /dev/null differ
diff --git a/activesupport/test/core_ext/file_test.rb b/activesupport/test/core_ext/file_test.rb
index eedc6b592b2a5..45193581df633 100644
--- a/activesupport/test/core_ext/file_test.rb
+++ b/activesupport/test/core_ext/file_test.rb
@@ -23,6 +23,10 @@ def test_atomic_write_doesnt_write_when_block_raises
end
def test_atomic_write_preserves_file_permissions
+ if Dir.pwd.starts_with?('/vagrant')
+ $stderr.puts "Can't test file permissions on a vagrant share"
+ return
+ end
contents = "Atomic Text"
File.open(file_name, "w", 0755) do |file|
file.write(contents)
@@ -44,6 +48,10 @@ def test_atomic_write_preserves_file_permissions
end
def test_atomic_write_preserves_default_file_permissions
+ if Dir.pwd.starts_with?('/vagrant')
+ $stderr.puts "Can't test file permissions on a vagrant share"
+ return
+ end
contents = "Atomic Text"
File.atomic_write(file_name, Dir.pwd) do |file|
file.write(contents)
diff --git a/activesupport/test/json/encoding_test.rb b/activesupport/test/json/encoding_test.rb
index b8bc22652edff..cdb68d9b68039 100644
--- a/activesupport/test/json/encoding_test.rb
+++ b/activesupport/test/json/encoding_test.rb
@@ -78,6 +78,13 @@ def test_hash_encoding
assert_equal %({\"a\":\"b\",\"c\":\"d\"}), sorted_json
end
+ def test_hash_keys_encoding
+ ActiveSupport.escape_html_entities_in_json = true
+ assert_equal "{\"\\u003C\\u003E\":\"\\u003C\\u003E\"}", ActiveSupport::JSON.encode("<>" => "<>")
+ ensure
+ ActiveSupport.escape_html_entities_in_json = false
+ end
+
def test_utf8_string_encoded_properly_when_kcode_is_utf8
with_kcode 'UTF8' do
result = ActiveSupport::JSON.encode('€2.99')
diff --git a/activesupport/test/xml_mini/jdom_engine_test.rb b/activesupport/test/xml_mini/jdom_engine_test.rb
index b745228994a55..4f7be109e7c92 100644
--- a/activesupport/test/xml_mini/jdom_engine_test.rb
+++ b/activesupport/test/xml_mini/jdom_engine_test.rb
@@ -141,11 +141,27 @@ def test_children_with_non_adjacent_text
eoxml
end
+ def test_maximum_document_depth
+ attack_xml = ''
+ excessive_depth = 150
+ excessive_depth.times do
+ attack_xml << ''
+ end
+ excessive_depth.times do
+ attack_xml << ''
+ end
+ assert_raise RuntimeError do
+ XmlMini.parse(attack_xml)
+ end
+ end
+
private
+
def assert_equal_rexml(xml)
hash = XmlMini.with_backend('REXML') { XmlMini.parse(xml) }
assert_equal(hash, XmlMini.parse(xml))
end
+
end
else
diff --git a/activesupport/test/xml_mini/rexml_engine_test.rb b/activesupport/test/xml_mini/rexml_engine_test.rb
index a412d8ca05690..2331498948007 100644
--- a/activesupport/test/xml_mini/rexml_engine_test.rb
+++ b/activesupport/test/xml_mini/rexml_engine_test.rb
@@ -12,4 +12,19 @@ def test_set_rexml_as_backend
XmlMini.backend = 'REXML'
assert_equal XmlMini_REXML, XmlMini.backend
end
+
+ def test_maximum_document_depth
+ attack_xml = ''
+ excessive_depth = 150
+ excessive_depth.times do
+ attack_xml << ''
+ end
+ excessive_depth.times do
+ attack_xml << ''
+ end
+ assert_raise REXML::ParseException do
+ XmlMini.parse(attack_xml)
+ end
+ end
+
end
diff --git a/dist/railslts.tar.gz b/dist/railslts.tar.gz
deleted file mode 100644
index babe35dd02431..0000000000000
Binary files a/dist/railslts.tar.gz and /dev/null differ
diff --git a/dist/railslts/install b/dist/railslts/install
deleted file mode 100755
index 72d8f5c7fe243..0000000000000
--- a/dist/railslts/install
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/bin/sh
-
-echo "Installing Rails LTS gems..."
-gem install --no-ri --no-rdoc pkg/activesupport*.gem && \
-gem install --no-ri --no-rdoc pkg/activerecord*.gem && \
-gem install --no-ri --no-rdoc pkg/actionpack*.gem && \
-gem install --no-ri --no-rdoc pkg/actionmailer*.gem && \
-gem install --no-ri --no-rdoc pkg/activeresource*.gem && \
-gem install --no-ri --no-rdoc pkg/rails*.gem
-echo "Rails LTS gems installed."
-
diff --git a/dist/railslts/pkg/actionmailer.gem b/dist/railslts/pkg/actionmailer.gem
deleted file mode 120000
index 6c630326496f1..0000000000000
--- a/dist/railslts/pkg/actionmailer.gem
+++ /dev/null
@@ -1 +0,0 @@
-../../../actionmailer/pkg/actionmailer-2.3.18.gem
\ No newline at end of file
diff --git a/dist/railslts/pkg/actionpack.gem b/dist/railslts/pkg/actionpack.gem
deleted file mode 120000
index e1cda67213253..0000000000000
--- a/dist/railslts/pkg/actionpack.gem
+++ /dev/null
@@ -1 +0,0 @@
-../../../actionpack/pkg/actionpack-2.3.18.gem
\ No newline at end of file
diff --git a/dist/railslts/pkg/activerecord.gem b/dist/railslts/pkg/activerecord.gem
deleted file mode 120000
index cb405e52c2cae..0000000000000
--- a/dist/railslts/pkg/activerecord.gem
+++ /dev/null
@@ -1 +0,0 @@
-../../../activerecord/pkg/activerecord-2.3.18.gem
\ No newline at end of file
diff --git a/dist/railslts/pkg/activeresource.gem b/dist/railslts/pkg/activeresource.gem
deleted file mode 120000
index a5ddfc98904e4..0000000000000
--- a/dist/railslts/pkg/activeresource.gem
+++ /dev/null
@@ -1 +0,0 @@
-../../../activeresource/pkg/activeresource-2.3.18.gem
\ No newline at end of file
diff --git a/dist/railslts/pkg/activesupport.gem b/dist/railslts/pkg/activesupport.gem
deleted file mode 120000
index eff54acce359a..0000000000000
--- a/dist/railslts/pkg/activesupport.gem
+++ /dev/null
@@ -1 +0,0 @@
-../../../activesupport/pkg/activesupport-2.3.18.gem
\ No newline at end of file
diff --git a/dist/railslts/pkg/rails.gem b/dist/railslts/pkg/rails.gem
deleted file mode 120000
index 2abf7e761a483..0000000000000
--- a/dist/railslts/pkg/rails.gem
+++ /dev/null
@@ -1 +0,0 @@
-../../../railties/pkg/rails-2.3.18.gem
\ No newline at end of file
diff --git a/pushgems.rb b/pushgems.rb
deleted file mode 100755
index 784aa5de68960..0000000000000
--- a/pushgems.rb
+++ /dev/null
@@ -1,14 +0,0 @@
-#!/usr/bin/env ruby
-
-unless ARGV.first == "no_build"
- build_number = Time.now.strftime("%Y%m%d%H%M%S").to_i
-end
-
-%w( activeresource actionmailer actionpack activerecord railties activesupport ).each do |pkg|
- puts "Pushing: #{pkg} (#{build_number})"
- if build_number
- `cd #{pkg} && rm -rf pkg && PKG_BUILD=#{build_number} rake pgem && cd ..`
- else
- `cd #{pkg} && rm -rf pkg && rake pgem && cd ..`
- end
-end
\ No newline at end of file
diff --git a/rails.gemspec b/rails.gemspec
new file mode 100644
index 0000000000000..e7b606ee53508
--- /dev/null
+++ b/rails.gemspec
@@ -0,0 +1,22 @@
+require File.expand_path('../railslts-version/lib/railslts-version', __FILE__)
+
+Gem::Specification.new do |s|
+ s.name = 'rails'
+ s.version = RailsLts::VERSION::STRING
+ s.summary = 'Full-stack web application framework.'
+ s.description = 'Ruby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration.'
+
+ s.author = 'David Heinemeier Hansson'
+ s.email = 'david@loudthinking.com'
+ s.homepage = 'http://www.rubyonrails.org'
+
+ s.files = [ "README.md", "LICENSE" ]
+
+ s.add_dependency 'activesupport', "= #{RailsLts::VERSION::STRING}"
+ s.add_dependency 'activerecord', "= #{RailsLts::VERSION::STRING}"
+ s.add_dependency 'actionpack', "= #{RailsLts::VERSION::STRING}"
+ s.add_dependency 'actionmailer', "= #{RailsLts::VERSION::STRING}"
+ s.add_dependency 'activeresource', "= #{RailsLts::VERSION::STRING}"
+ s.add_dependency 'railties', "= #{RailsLts::VERSION::STRING}"
+ s.add_dependency 'railslts-version', "= #{RailsLts::VERSION::STRING}"
+end
diff --git a/railslts-version/Rakefile b/railslts-version/Rakefile
new file mode 100644
index 0000000000000..fcba1ba0517c0
--- /dev/null
+++ b/railslts-version/Rakefile
@@ -0,0 +1,11 @@
+require "bundler/gem_tasks"
+
+task :package => :build do
+ # Building gems from the project root expects all subprojects
+ # to have a :package task. Since the task from bundler/gem_tasks
+ # is named :build, we simply delegate by depending on :build.
+end
+
+task :test do
+ RailsLts::VERSION::STRING =~ /^2\.3\.\d+\.\d+$/ or raise 'Unexpected version string'
+end
diff --git a/railslts-version/lib/railslts-version.rb b/railslts-version/lib/railslts-version.rb
new file mode 100644
index 0000000000000..ab791b445ea48
--- /dev/null
+++ b/railslts-version/lib/railslts-version.rb
@@ -0,0 +1,19 @@
+module RailsLts
+ module VERSION
+ # Because of the we way we're requiring this files in .gemspecs,
+ # it might be loaded multiple times when installing over Git.
+ unless defined?(STRING)
+
+ MAJOR = 2
+ MINOR = 3
+ TINY = 18
+ LTS = 15
+ STRING = [MAJOR, MINOR, TINY, LTS].join('.')
+
+ def self.to_s
+ STRING
+ end
+
+ end
+ end
+end
diff --git a/railslts-version/railslts-version.gemspec b/railslts-version/railslts-version.gemspec
new file mode 100644
index 0000000000000..2d918ba751eb7
--- /dev/null
+++ b/railslts-version/railslts-version.gemspec
@@ -0,0 +1,23 @@
+# coding: utf-8
+lib = File.expand_path('../lib', __FILE__)
+$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
+require 'railslts-version'
+
+Gem::Specification.new do |spec|
+ spec.name = "railslts-version"
+ spec.version = RailsLts::VERSION::STRING
+ spec.authors = ["Arne Hartherz"]
+ spec.email = ["arne.hartherz@makandra.de"]
+ spec.summary = "Gem to track your current Rails LTS version."
+ spec.description = "Note that this gem will neither install nor upgrade Rails LTS for you. Visit https://railslts.com/ to find out more about Rails LTS."
+ spec.homepage = "https://railslts.com/"
+ spec.license = "MIT"
+
+ spec.files = `git ls-files -z`.split("\x0")
+ spec.executables = spec.files.grep(%r{^bin/}) { |f| File.basename(f) }
+ spec.test_files = spec.files.grep(%r{^(test|spec|features)/})
+ spec.require_paths = ["lib"]
+
+ spec.add_development_dependency "bundler", "~> 1.5"
+ spec.add_development_dependency "rake"
+end
diff --git a/railties/LICENSE b/railties/LICENSE
index a33dc476de368..397d2681a640a 100644
--- a/railties/LICENSE
+++ b/railties/LICENSE
@@ -1,4 +1,4 @@
-The code in this project is based on Ruby on Rails 2.3.18
+The code in this project is based on Ruby on Rails 2.3
with additional changes by makandra GmbH.
Additional changes Copyright (c) 2013 makandra GmbH
@@ -7,10 +7,10 @@ with additional changes by makandra GmbH.
MIT license of Ruby on Rails 2.3.18 (found below) to any person
obtaining a copy of this software and associated documentation
files (the "Software"), except the right to publish, distribute,
- and/or sell copies of the Software before May 30, 2014.
+ and/or sell copies of the Software before February 05, 2016.
-The original code for Ruby on Rails 2.3.18 is licensed under the MIT license:
+The original code for Ruby on Rails 2.3 is licensed under the MIT license:
Copyright (c) 2004-2010 David Heinemeier Hansson
diff --git a/railties/Rakefile b/railties/Rakefile
index 066aba4853d27..fd20ce2414059 100644
--- a/railties/Rakefile
+++ b/railties/Rakefile
@@ -6,10 +6,11 @@ require 'date'
require 'rbconfig'
require File.join(File.dirname(__FILE__), 'lib/rails', 'version')
+require File.expand_path('../../railslts-version/lib/railslts-version', __FILE__)
PKG_BUILD = ENV['PKG_BUILD'] ? '.' + ENV['PKG_BUILD'] : ''
PKG_NAME = 'rails'
-PKG_VERSION = Rails::VERSION::STRING + PKG_BUILD
+PKG_VERSION = RailsLts::VERSION::STRING + PKG_BUILD
PKG_FILE_NAME = "#{PKG_NAME}-#{PKG_VERSION}"
PKG_DESTINATION = ENV["RAILS_PKG_DESTINATION"] || "../#{PKG_NAME}"
@@ -308,21 +309,14 @@ PKG_FILES = FileList[
spec = Gem::Specification.new do |s|
s.platform = Gem::Platform::RUBY
- s.name = 'rails'
+ s.name = 'railties'
s.version = PKG_VERSION
- s.summary = "Web-application framework with template engine, control-flow layer, and ORM."
- s.description = <<-EOF
- Rails is a framework for building web-application using CGI, FCGI, mod_ruby, or WEBrick
- on top of either MySQL, PostgreSQL, SQLite, DB2, SQL Server, or Oracle with eRuby- or Builder-based templates.
- EOF
+ s.summary = 'Tools for creating, working with, and running Rails applications.'
+ s.description = 'Rails internals: application bootup, plugins, generators, and rake tasks.'
s.add_dependency('rake', '>= 0.8.3')
- s.add_dependency('activesupport', '= 2.3.18' + PKG_BUILD)
- s.add_dependency('activerecord', '= 2.3.18' + PKG_BUILD)
- s.add_dependency('actionpack', '= 2.3.18' + PKG_BUILD)
- s.add_dependency('actionmailer', '= 2.3.18' + PKG_BUILD)
- s.add_dependency('activeresource', '= 2.3.18' + PKG_BUILD)
- s.add_dependency('railslts-version', '= 2.3.18.10')
+ s.add_dependency('activesupport', "= #{RailsLts::VERSION::STRING}")
+ s.add_dependency('actionpack', "= #{RailsLts::VERSION::STRING}")
s.rdoc_options << '--exclude' << '.'
s.has_rdoc = false
@@ -336,7 +330,6 @@ spec = Gem::Specification.new do |s|
s.author = "David Heinemeier Hansson"
s.email = "david@loudthinking.com"
s.homepage = "http://www.rubyonrails.org"
- s.rubyforge_project = "rails"
end
package_task = RAKEVERSION == '0.8.0' ? Rake::GemPackageTask : Gem::PackageTask
diff --git a/railties/lib/rails/rack/static.rb b/railties/lib/rails/rack/static.rb
index f07c6beb5e4db..3c4eb3f024961 100644
--- a/railties/lib/rails/rack/static.rb
+++ b/railties/lib/rails/rack/static.rb
@@ -15,13 +15,13 @@ def call(env)
method = env['REQUEST_METHOD']
if FILE_METHODS.include?(method)
- if file_exist?(path)
+ if file_exist_within_root?(path)
return @file_server.call(env)
else
cached_path = directory_exist?(path) ? "#{path}/index" : path
cached_path += ::ActionController::Base.page_cache_extension
- if file_exist?(cached_path)
+ if file_exist_within_root?(cached_path)
env['PATH_INFO'] = cached_path
return @file_server.call(env)
end
@@ -32,8 +32,26 @@ def call(env)
end
private
- def file_exist?(path)
- full_path = File.join(@file_server.root, ::Rack::Utils.unescape(path))
+
+ PATH_SEPS = Regexp.union(*[::File::SEPARATOR, ::File::ALT_SEPARATOR].compact)
+
+ def clean_path_info(path_info)
+ parts = path_info.split PATH_SEPS
+
+ clean = []
+
+ parts.each do |part|
+ next if part.empty? || part == '.'
+ part == '..' ? clean.pop : clean << part
+ end
+
+ clean.unshift '/' if parts.empty? || parts.first.empty?
+
+ ::File.join(*clean)
+ end
+
+ def file_exist_within_root?(path)
+ full_path = File.join(@file_server.root, clean_path_info(::Rack::Utils.unescape(path)))
File.file?(full_path) && File.readable?(full_path)
end
diff --git a/railties/pkg/rails-2.3.18.gem b/railties/pkg/rails-2.3.18.gem
deleted file mode 100644
index f49ce64115339..0000000000000
Binary files a/railties/pkg/rails-2.3.18.gem and /dev/null differ
diff --git a/railties/railties.gemspec b/railties/railties.gemspec
index 83007a7fd83cd..c80a098cb2b5d 100644
--- a/railties/railties.gemspec
+++ b/railties/railties.gemspec
@@ -1,8 +1,10 @@
+require File.expand_path('../../railslts-version/lib/railslts-version', __FILE__)
+
Gem::Specification.new do |s|
- s.name = 'rails'
- s.version = '2.3.18'
- s.summary = 'Web-application framework with template engine, control-flow layer, and ORM.'
- s.description = "Rails is a framework for building web-application using CGI, FCGI, mod_ruby, or WEBrick\non top of either MySQL, PostgreSQL, SQLite, DB2, SQL Server, or Oracle with eRuby- or Builder-based templates."
+ s.name = 'railties'
+ s.version = RailsLts::VERSION::STRING
+ s.summary = 'Tools for creating, working with, and running Rails applications.'
+ s.description = 'Rails internals: application bootup, plugins, generators, and rake tasks.'
s.author = 'David Heinemeier Hansson'
s.email = 'david@loudthinking.com'
@@ -14,10 +16,6 @@ Gem::Specification.new do |s|
s.rdoc_options = ['--exclude', '.']
s.add_dependency 'rake', '>= 0.8.3'
- s.add_dependency 'activesupport', '= 2.3.18'
- s.add_dependency 'activerecord', '= 2.3.18'
- s.add_dependency 'actionpack', '= 2.3.18'
- s.add_dependency 'actionmailer', '= 2.3.18'
- s.add_dependency 'activeresource', '= 2.3.18'
- s.add_dependency 'railslts-version', '= 2.3.18.10'
+ s.add_dependency 'activesupport', "= #{RailsLts::VERSION::STRING}"
+ s.add_dependency 'actionpack', "= #{RailsLts::VERSION::STRING}"
end
diff --git a/railties/test/rack_static_test.rb b/railties/test/rack_static_test.rb
index b1bcef97fe7ed..6f0cad9204f89 100644
--- a/railties/test/rack_static_test.rb
+++ b/railties/test/rack_static_test.rb
@@ -5,12 +5,18 @@
require 'fileutils'
class RackStaticTest < ActiveSupport::TestCase
+
def setup
+ @non_public_path = "#{RAILS_ROOT}/non_public_file.html"
FileUtils.cp_r "#{RAILS_ROOT}/fixtures/public", "#{RAILS_ROOT}/public"
+ File.open(@non_public_path, 'w') do |file|
+ file.puts "non public content"
+ end
end
def teardown
FileUtils.rm_rf "#{RAILS_ROOT}/public"
+ FileUtils.rm(@non_public_path)
end
DummyApp = lambda { |env|
@@ -40,6 +46,38 @@ def teardown
assert_equal "/foo/index.html", get("/foo")
end
+ test "does not betray the existance of files outside root" do
+ path = "../non_public_file.html"
+ assert File.exist?(File.join(RAILS_ROOT, 'public', path))
+ assert_equal get("/nofile"), get(path)
+ end
+
+ test "does not betray the existance of unreadable files" do
+ begin
+ filename = 'unreadable.html.erb'
+ target = File.join(RAILS_ROOT, 'public', filename)
+ FileUtils.touch target
+ File.expects(:readable?).with(target).returns(false).at_least_once
+ assert File.exist? target
+ assert !File.readable?(target)
+ path = "/#{filename}"
+ assert_equal get("/nofile"), get(path)
+ ensure
+ File.unlink target
+ end
+ end
+
+ test "does not betray the existance of files outside root when using alternate path separators" do
+ if Dir.pwd.starts_with?('/vagrant')
+ $stderr.puts "Can't test file permissions on a vagrant share"
+ return
+ end
+ filename = 'non_public_file.html'
+ assert File.exist?(File.join(RAILS_ROOT, filename))
+ path = "/%5C..%2F#{filename}"
+ assert_equal get("/nofile"), get(path)
+ end
+
private
def get(path)
Rack::MockRequest.new(App).request("GET", path).body
diff --git a/release.rb b/release.rb
deleted file mode 100755
index e8e6c01c35575..0000000000000
--- a/release.rb
+++ /dev/null
@@ -1,25 +0,0 @@
-#!/usr/bin/env ruby
-
-VERSION = ARGV.first
-PACKAGES = %w(activesupport activerecord actionpack actionmailer activeresource)
-
-# Copy source
-`mkdir release`
-(PACKAGES + %w(railties)).each do |p|
- `cp -R #{p} release/#{p}`
-end
-
-# Create Rails packages
-`cd release/railties && rake template=jamis package`
-
-# Upload documentation
-`cd release/rails/doc/api && scp -r * davidhh@wrath.rubyonrails.com:public_html/api`
-
-# Upload packages
-(PACKAGES + %w(railties)).each do |p|
- `cd release/#{p} && echo "Releasing #{p}" && rake release`
-end
-
-# Upload rails tgz/zip
-`rubyforge add_release rails rails 'REL #{VERSION}' release/rails-#{VERSION}.tgz`
-`rubyforge add_release rails rails 'REL #{VERSION}' release/rails-#{VERSION}.zip`
\ No newline at end of file