Rafael Mendonça França 0f3b7d1a31 Only accept actions without File::SEPARATOR in the name. ...

This will avoid directory traversal in implicit render.

Fixes: CVE-2014-0130

2014-05-05 11:37:34 -03:00

..

abstract_controller

Only accept actions without File::SEPARATOR in the name.

2014-05-05 11:37:34 -03:00

action_controller

Remove the use of String#% when formatting durations in log messages

2013-09-30 14:42:11 -07:00

action_dispatch

Deep Munge the parameters for GET and POST

2013-12-02 14:14:35 -08:00

action_pack

Preparing for 3.2.17 release

2014-02-18 15:16:57 -03:00

action_view

Use the reference for the mime type to get the format

2014-02-18 15:02:54 -03:00

sprockets

Fixed assets loading performance in 3.2.13

2013-03-20 16:13:30 +11:00

abstract_controller.rb

Refactor ActionMailer to not use hide_actions

2010-09-03 22:59:11 +02:00

action_controller.rb

Revert the serializers API as other alternatives are now also under discussion

2011-11-25 19:29:39 +00:00

action_dispatch.rb

Extract the rendering of public exceptions pages into a Rack app.

2011-12-16 10:45:59 +01:00

action_pack.rb

We're in 2011, let's update our license

2011-02-22 18:24:20 -02:00

action_view.rb

Fixes for using action view template in isolation.

2011-11-30 09:53:09 +01:00