Hello community,
here is the log from the commit of package rubygem-actionview-5.2 for
openSUSE:Factory checked in at 2018-08-12 20:53:16
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/rubygem-actionview-5.2 (Old)
and /work/SRC/openSUSE:Factory/.rubygem-actionview-5.2.new (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "rubygem-actionview-5.2"
Sun Aug 12 20:53:16 2018 rev:2 rq:628581 version:5.2.1
Changes:
--------
---
/work/SRC/openSUSE:Factory/rubygem-actionview-5.2/rubygem-actionview-5.2.changes
2018-07-18 22:47:14.792292458 +0200
+++
/work/SRC/openSUSE:Factory/.rubygem-actionview-5.2.new/rubygem-actionview-5.2.changes
2018-08-12 20:53:21.925222775 +0200
@@ -1,0 +2,34 @@
+Wed Aug 8 14:47:22 UTC 2018 - [email protected]
+
+- updated to version 5.2.1 (boo#1104209)
+
+ * Fix leak of `skip_default_ids` and `allow_method_names_outside_object`
options
+ to HTML attributes.
+
+ (Yurii Cherniavskyi)
+
+ * Fix issue with `button_to`'s `to_form_params`
+
+ `button_to` was throwing exception when invoked with `params` hash that
+ contains symbol and string keys. The reason for the exception was that
+ `to_form_params` was comparing the given symbol and string keys.
+
+ The issue is fixed by turning all keys to strings inside
+ `to_form_params` before comparing them.
+
+ (Georgi Georgiev)
+
+ * Fix JavaScript views rendering does not work with Firefox when using
+ Content Security Policy.
+
+ Fixes #32577.
+
+ (Yuji Yaginuma)
+
+ * Add the `nonce: true` option for `javascript_include_tag` helper to
+ support automatic nonce generation for Content Security Policy.
+ Works the same way as `javascript_tag nonce: true` does.
+
+ (Yaroslav Markin)
+
+-------------------------------------------------------------------
Old:
----
actionview-5.2.0.gem
New:
----
actionview-5.2.1.gem
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ rubygem-actionview-5.2.spec ++++++
--- /var/tmp/diff_new_pack.mw8tKs/_old 2018-08-12 20:53:22.421223781 +0200
+++ /var/tmp/diff_new_pack.mw8tKs/_new 2018-08-12 20:53:22.425223790 +0200
@@ -24,7 +24,7 @@
#
Name: rubygem-actionview-5.2
-Version: 5.2.0
+Version: 5.2.1
Release: 0
%define mod_name actionview
%define mod_full_name %{mod_name}-%{version}
++++++ actionview-5.2.0.gem -> actionview-5.2.1.gem ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/CHANGELOG.md new/CHANGELOG.md
--- old/CHANGELOG.md 2018-04-09 22:04:31.000000000 +0200
+++ new/CHANGELOG.md 2018-08-07 23:42:03.000000000 +0200
@@ -1,3 +1,35 @@
+## Rails 5.2.1 (August 07, 2018) ##
+
+* Fix leak of `skip_default_ids` and `allow_method_names_outside_object`
options
+ to HTML attributes.
+
+ *Yurii Cherniavskyi*
+
+* Fix issue with `button_to`'s `to_form_params`
+
+ `button_to` was throwing exception when invoked with `params` hash that
+ contains symbol and string keys. The reason for the exception was that
+ `to_form_params` was comparing the given symbol and string keys.
+
+ The issue is fixed by turning all keys to strings inside
+ `to_form_params` before comparing them.
+
+ *Georgi Georgiev*
+
+* Fix JavaScript views rendering does not work with Firefox when using
+ Content Security Policy.
+
+ Fixes #32577.
+
+ *Yuji Yaginuma*
+
+* Add the `nonce: true` option for `javascript_include_tag` helper to
+ support automatic nonce generation for Content Security Policy.
+ Works the same way as `javascript_tag nonce: true` does.
+
+ *Yaroslav Markin*
+
+
## Rails 5.2.0 (April 09, 2018) ##
* Pass the `:skip_pipeline` option in `image_submit_tag` when calling
`path_to_image`.
Binary files old/checksums.yaml.gz and new/checksums.yaml.gz differ
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/lib/action_view/digestor.rb
new/lib/action_view/digestor.rb
--- old/lib/action_view/digestor.rb 2018-04-09 22:04:31.000000000 +0200
+++ new/lib/action_view/digestor.rb 2018-08-07 23:42:03.000000000 +0200
@@ -45,9 +45,8 @@
# Create a dependency tree for template named +name+.
def tree(name, finder, partial = false, seen = {})
logical_name = name.gsub(%r|/_|, "/")
- finder.formats = [finder.rendered_format] if finder.rendered_format
- if template = finder.disable_cache { finder.find_all(logical_name, [],
partial, []).first }
+ if template = find_template(finder, logical_name, [], partial, [])
finder.rendered_format ||= template.formats.first
if node = seen[template.identifier] # handle cycles in the tree
@@ -69,6 +68,17 @@
seen[name] ||= Missing.new(name, logical_name, nil)
end
end
+
+ private
+ def find_template(finder, *args)
+ finder.disable_cache do
+ if format = finder.rendered_format
+ finder.find_all(*args, formats: [format]).first ||
finder.find_all(*args).first
+ else
+ finder.find_all(*args).first
+ end
+ end
+ end
end
class Node
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/lib/action_view/gem_version.rb
new/lib/action_view/gem_version.rb
--- old/lib/action_view/gem_version.rb 2018-04-09 22:04:31.000000000 +0200
+++ new/lib/action_view/gem_version.rb 2018-08-07 23:42:03.000000000 +0200
@@ -9,7 +9,7 @@
module VERSION
MAJOR = 5
MINOR = 2
- TINY = 0
+ TINY = 1
PRE = nil
STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/lib/action_view/helpers/asset_tag_helper.rb
new/lib/action_view/helpers/asset_tag_helper.rb
--- old/lib/action_view/helpers/asset_tag_helper.rb 2018-04-09
22:04:31.000000000 +0200
+++ new/lib/action_view/helpers/asset_tag_helper.rb 2018-08-07
23:42:03.000000000 +0200
@@ -55,6 +55,8 @@
# that path.
# * <tt>:skip_pipeline</tt> - This option is used to bypass the asset
pipeline
# when it is set to true.
+ # * <tt>:nonce<tt> - When set to true, adds an automatic nonce value if
+ # you have Content Security Policy enabled.
#
# ==== Examples
#
@@ -79,6 +81,9 @@
#
# javascript_include_tag "http://www.example.com/xmlhr.js";
# # => <script src="http://www.example.com/xmlhr.js";></script>
+ #
+ # javascript_include_tag "http://www.example.com/xmlhr.js";, nonce: true
+ # # => <script src="http://www.example.com/xmlhr.js";
nonce="..."></script>
def javascript_include_tag(*sources)
options = sources.extract_options!.stringify_keys
path_options = options.extract!("protocol", "extname", "host",
"skip_pipeline").symbolize_keys
@@ -90,6 +95,9 @@
tag_options = {
"src" => href
}.merge!(options)
+ if tag_options["nonce"] == true
+ tag_options["nonce"] = content_security_policy_nonce
+ end
content_tag("script".freeze, "", tag_options)
}.join("\n").html_safe
@@ -105,7 +113,7 @@
# to "screen", so you must explicitly set it to "all" for the
stylesheet(s) to
# apply to all media types.
#
- # If the server supports Early Hints header links for these assets will
be
+ # If the server supports Early Hints header links for these assets will
be
# automatically pushed.
#
# stylesheet_link_tag "style"
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/lib/action_view/helpers/form_helper.rb
new/lib/action_view/helpers/form_helper.rb
--- old/lib/action_view/helpers/form_helper.rb 2018-04-09 22:04:31.000000000
+0200
+++ new/lib/action_view/helpers/form_helper.rb 2018-08-07 23:42:03.000000000
+0200
@@ -1658,6 +1658,7 @@
@nested_child_index = {}
@object_name, @object, @template, @options = object_name, object,
template, options
@default_options = @options ? @options.slice(:index, :namespace,
:skip_default_ids, :allow_method_names_outside_object) : {}
+ @default_html_options = @default_options.except(:skip_default_ids,
:allow_method_names_outside_object)
convert_to_legacy_options(@options)
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/lib/action_view/helpers/form_options_helper.rb
new/lib/action_view/helpers/form_options_helper.rb
--- old/lib/action_view/helpers/form_options_helper.rb 2018-04-09
22:04:31.000000000 +0200
+++ new/lib/action_view/helpers/form_options_helper.rb 2018-08-07
23:42:03.000000000 +0200
@@ -820,7 +820,7 @@
#
# Please refer to the documentation of the base helper for details.
def select(method, choices = nil, options = {}, html_options = {},
&block)
- @template.select(@object_name, method, choices,
objectify_options(options), @default_options.merge(html_options), &block)
+ @template.select(@object_name, method, choices,
objectify_options(options), @default_html_options.merge(html_options), &block)
end
# Wraps ActionView::Helpers::FormOptionsHelper#collection_select for
form builders:
@@ -832,7 +832,7 @@
#
# Please refer to the documentation of the base helper for details.
def collection_select(method, collection, value_method, text_method,
options = {}, html_options = {})
- @template.collection_select(@object_name, method, collection,
value_method, text_method, objectify_options(options),
@default_options.merge(html_options))
+ @template.collection_select(@object_name, method, collection,
value_method, text_method, objectify_options(options),
@default_html_options.merge(html_options))
end
# Wraps ActionView::Helpers::FormOptionsHelper#grouped_collection_select
for form builders:
@@ -844,7 +844,7 @@
#
# Please refer to the documentation of the base helper for details.
def grouped_collection_select(method, collection, group_method,
group_label_method, option_key_method, option_value_method, options = {},
html_options = {})
- @template.grouped_collection_select(@object_name, method, collection,
group_method, group_label_method, option_key_method, option_value_method,
objectify_options(options), @default_options.merge(html_options))
+ @template.grouped_collection_select(@object_name, method, collection,
group_method, group_label_method, option_key_method, option_value_method,
objectify_options(options), @default_html_options.merge(html_options))
end
# Wraps ActionView::Helpers::FormOptionsHelper#time_zone_select for form
builders:
@@ -856,7 +856,7 @@
#
# Please refer to the documentation of the base helper for details.
def time_zone_select(method, priority_zones = nil, options = {},
html_options = {})
- @template.time_zone_select(@object_name, method, priority_zones,
objectify_options(options), @default_options.merge(html_options))
+ @template.time_zone_select(@object_name, method, priority_zones,
objectify_options(options), @default_html_options.merge(html_options))
end
# Wraps ActionView::Helpers::FormOptionsHelper#collection_check_boxes
for form builders:
@@ -868,7 +868,7 @@
#
# Please refer to the documentation of the base helper for details.
def collection_check_boxes(method, collection, value_method,
text_method, options = {}, html_options = {}, &block)
- @template.collection_check_boxes(@object_name, method, collection,
value_method, text_method, objectify_options(options),
@default_options.merge(html_options), &block)
+ @template.collection_check_boxes(@object_name, method, collection,
value_method, text_method, objectify_options(options),
@default_html_options.merge(html_options), &block)
end
# Wraps ActionView::Helpers::FormOptionsHelper#collection_radio_buttons
for form builders:
@@ -880,7 +880,7 @@
#
# Please refer to the documentation of the base helper for details.
def collection_radio_buttons(method, collection, value_method,
text_method, options = {}, html_options = {}, &block)
- @template.collection_radio_buttons(@object_name, method, collection,
value_method, text_method, objectify_options(options),
@default_options.merge(html_options), &block)
+ @template.collection_radio_buttons(@object_name, method, collection,
value_method, text_method, objectify_options(options),
@default_html_options.merge(html_options), &block)
end
end
end
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/lib/action_view/helpers/rendering_helper.rb
new/lib/action_view/helpers/rendering_helper.rb
--- old/lib/action_view/helpers/rendering_helper.rb 2018-04-09
22:04:31.000000000 +0200
+++ new/lib/action_view/helpers/rendering_helper.rb 2018-08-07
23:42:03.000000000 +0200
@@ -13,7 +13,6 @@
# * <tt>:partial</tt> - See <tt>ActionView::PartialRenderer</tt>.
# * <tt>:file</tt> - Renders an explicit template file (this used to be
the old default), add :locals to pass in those.
# * <tt>:inline</tt> - Renders an inline template similar to how it's
done in the controller.
- # * <tt>:text</tt> - Renders the text passed in out.
# * <tt>:plain</tt> - Renders the text passed in out. Setting the content
# type as <tt>text/plain</tt>.
# * <tt>:html</tt> - Renders the HTML safe string passed in out,
otherwise
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/lib/action_view/helpers/tags/select.rb
new/lib/action_view/helpers/tags/select.rb
--- old/lib/action_view/helpers/tags/select.rb 2018-04-09 22:04:32.000000000
+0200
+++ new/lib/action_view/helpers/tags/select.rb 2018-08-07 23:42:03.000000000
+0200
@@ -8,7 +8,7 @@
@choices = block_given? ? template_object.capture { yield || "" } :
choices
@choices = @choices.to_a if @choices.is_a?(Range)
- @html_options = html_options.except(:skip_default_ids,
:allow_method_names_outside_object)
+ @html_options = html_options
super(object_name, method_name, template_object, options)
end
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/lib/action_view/helpers/url_helper.rb
new/lib/action_view/helpers/url_helper.rb
--- old/lib/action_view/helpers/url_helper.rb 2018-04-09 22:04:32.000000000
+0200
+++ new/lib/action_view/helpers/url_helper.rb 2018-08-07 23:42:03.000000000
+0200
@@ -634,7 +634,7 @@
# suitable for use as the names and values of form input fields:
#
# to_form_params(name: 'David', nationality: 'Danish')
- # # => [{name: :name, value: 'David'}, {name: 'nationality', value:
'Danish'}]
+ # # => [{name: 'name', value: 'David'}, {name: 'nationality', value:
'Danish'}]
#
# to_form_params(country: {name: 'Denmark'})
# # => [{name: 'country[name]', value: 'Denmark'}]
@@ -666,7 +666,7 @@
params.push(*to_form_params(value, array_prefix))
end
else
- params << { name: namespace, value: attribute.to_param }
+ params << { name: namespace.to_s, value: attribute.to_param }
end
params.sort_by { |pair| pair[:name] }
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/lib/assets/compiled/rails-ujs.js
new/lib/assets/compiled/rails-ujs.js
--- old/lib/assets/compiled/rails-ujs.js 2018-04-09 22:04:32.000000000
+0200
+++ new/lib/assets/compiled/rails-ujs.js 2018-08-07 23:42:03.000000000
+0200
@@ -262,7 +262,7 @@
} catch (error) {}
} else if (type.match(/\b(?:java|ecma)script\b/)) {
script = document.createElement('script');
- script.nonce = cspNonce();
+ script.setAttribute('nonce', cspNonce());
script.text = response;
document.head.appendChild(script).parentNode.removeChild(script);
} else if (type.match(/\b(xml|html|svg)\b/)) {
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/metadata new/metadata
--- old/metadata 2018-04-09 22:04:31.000000000 +0200
+++ new/metadata 2018-08-07 23:42:03.000000000 +0200
@@ -1,14 +1,14 @@
--- !ruby/object:Gem::Specification
name: actionview
version: !ruby/object:Gem::Version
- version: 5.2.0
+ version: 5.2.1
platform: ruby
authors:
- David Heinemeier Hansson
autorequire:
bindir: bin
cert_chain: []
-date: 2018-04-09 00:00:00.000000000 Z
+date: 2018-08-07 00:00:00.000000000 Z
dependencies:
- !ruby/object:Gem::Dependency
name: activesupport
@@ -16,14 +16,14 @@
requirements:
- - '='
- !ruby/object:Gem::Version
- version: 5.2.0
+ version: 5.2.1
type: :runtime
prerelease: false
version_requirements: !ruby/object:Gem::Requirement
requirements:
- - '='
- !ruby/object:Gem::Version
- version: 5.2.0
+ version: 5.2.1
- !ruby/object:Gem::Dependency
name: builder
requirement: !ruby/object:Gem::Requirement
@@ -92,28 +92,28 @@
requirements:
- - '='
- !ruby/object:Gem::Version
- version: 5.2.0
+ version: 5.2.1
type: :development
prerelease: false
version_requirements: !ruby/object:Gem::Requirement
requirements:
- - '='
- !ruby/object:Gem::Version
- version: 5.2.0
+ version: 5.2.1
- !ruby/object:Gem::Dependency
name: activemodel
requirement: !ruby/object:Gem::Requirement
requirements:
- - '='
- !ruby/object:Gem::Version
- version: 5.2.0
+ version: 5.2.1
type: :development
prerelease: false
version_requirements: !ruby/object:Gem::Requirement
requirements:
- - '='
- !ruby/object:Gem::Version
- version: 5.2.0
+ version: 5.2.1
description: Simple, battle-tested conventions and helpers for building web
pages.
email: [email protected]
executables: []
@@ -230,8 +230,8 @@
licenses:
- MIT
metadata:
- source_code_uri: https://github.com/rails/rails/tree/v5.2.0/actionview
- changelog_uri:
https://github.com/rails/rails/blob/v5.2.0/actionview/CHANGELOG.md
+ source_code_uri: https://github.com/rails/rails/tree/v5.2.1/actionview
+ changelog_uri:
https://github.com/rails/rails/blob/v5.2.1/actionview/CHANGELOG.md
post_install_message:
rdoc_options: []
require_paths:
