rails

mirror of https://github.com/github/rails.git synced 2026-04-26 03:00:59 -04:00

Go to file

Michael Koziarski 80da8eb43d Merge the prerequisites for on-by-default XSS escaping into rails.

This consists of:

* String#html_safe! a method to mark a string as 'safe'
* ActionView::SafeBuffer a string subclass which escapes anything unsafe which is concatenated to it
* Calls to String#html_safe! throughout the rails helpers
* a 'raw' helper which lets you concatenate trusted HTML from non-safety-aware sources (e.g. presantized strings in the DB)

Note, this does *not* give you on-by-default XSS escaping in 2.3 applications.  To get that you'll need to install a plugin:

http://github.com/nzkoz/rails_xss

2009-10-08 13:59:21 +13:00

actionmailer

Reduce specificity of logging test to avoid dependency on the system clock

2009-09-29 17:10:01 -07:00

actionpack

Merge the prerequisites for on-by-default XSS escaping into rails.

2009-10-08 13:59:21 +13:00

activemodel

Merge docrails

2009-03-16 11:28:36 +00:00

activerecord

Use indifferent access attributes instead of stringifying them