This is an automated email from the ASF dual-hosted git repository.
jamesfredley pushed a change to branch 8.0.x
in repository https://gitbox.apache.org/repos/asf/grails-core.git
from 1628a9c31f Merge pull request #16141 from
jamesfredley/docs/grails-7-plugin-compatibility
add e2926e0316 Harden bindData against mass assignment
add 6c85e2be2b Make mass-assignment deny-by-default opt-in for 8.0
add c63d39a8c5 Merge remote-tracking branch 'origin/8.0.x' into
fix/binddata-mass-assignment
add 6ea7998aa1 Resolve inherited bindData allowlist for proxy subclasses
add a000d32858 Make data binding deny-by-default to prevent mass assignment
add 56a9b27e90 Bind typed arrays through the allowlist and resolve domain
elements
add 8e042314f3 Merge origin/8.0.x into fix/binddata-mass-assignment
add 419695afb7 Restore permissive binding default and honor bindable false
in all modes
add f1bdc751b3 test: add bindable constraints for model properties in
HalJsonRenderer and JsonRenderer specs
add 4c9062e77b Resolve legacyBindableDefault from the raw configuration
value
add 08bf7818e2 Drop the bindable constraints added to the renderer spec
models
add d5335f4a9e Merge branch '8.0.x' into fix/binddata-mass-assignment
add cd4202bfa7 Merge branch '8.0.x' into fix/binddata-mass-assignment
add cdedbb2ff3 Merge branch '8.0.x' into fix/binddata-mass-assignment
add 73a0555772 Address jdaugherty review feedback for opt-in secure binding
add 23625ea24c Merge branch '8.0.x' into fix/binddata-mass-assignment
add 21e715ce3d Address data binding review feedback
add b89e6a02dd Merge branch '8.0.x' into fix/binddata-mass-assignment
add dad867634c Merge branch '8.0.x' into fix/binddata-mass-assignment
new 11ebb5a8cd Merge pull request #15947 from
apache/fix/binddata-mass-assignment
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../main/groovy/grails/artefact/Controller.groovy | 8 +-
.../compiler/web/ControllerActionTransformer.java | 102 ++-
.../src/main/groovy/grails/config/Settings.groovy | 2 +
.../grails/databinding/SimpleDataBinder.groovy | 46 +-
.../grails/databinding/SimpleDataBinderSpec.groovy | 36 +
.../META-INF/spring-configuration-metadata.json | 6 +
.../guide/theWebLayer/controllers/dataBinding.adoc | 4 +-
grails-doc/src/en/guide/upgrading.adoc | 13 +
grails-doc/src/en/ref/Constraints/bindable.adoc | 5 +-
grails-doc/src/en/ref/Controllers/bindData.adoc | 30 +-
.../web/databinding/GrailsWebDataBinderSpec.groovy | 310 +++++++-
...ngHelperDomainClassSpecialPropertiesSpec.groovy | 100 ++-
.../web/commandobjects/CommandObjectsSpec.groovy | 29 +
.../grails/web/servlet/BindDataMethodTests.groovy | 785 +++++++++++++++++++++
.../groovy/grails/web/databinding/BindAllowed.java | 12 +-
.../grails/web/databinding/DataBinder.groovy | 5 +
.../grails/web/databinding/DataBindingUtils.java | 347 ++++++++-
.../web/databinding/GrailsWebDataBinder.groovy | 391 +++++++++-
.../DataBindingEventMulticastListener.groovy | 4 +
.../databinding/DefaultASTDatabindingHelper.java | 107 ++-
.../web/databinding/DenyByDefaultConfigSpec.groovy | 103 +++
21 files changed, 2384 insertions(+), 61 deletions(-)
copy grails-gsp/grails-taglib/src/main/groovy/grails/gsp/Tag.java =>
grails-web-databinding/src/main/groovy/grails/web/databinding/BindAllowed.java
(86%)
create mode 100644
grails-web-databinding/src/test/groovy/grails/web/databinding/DenyByDefaultConfigSpec.groovy
