{"push_id":1455718048,"size":57,"distinct_size":57,"ref":"refs/heads/3-2-stable","head":"b44a6ddf31e72921b7ca7dec2438918272ff835d","before":"0ace05101b91d669f51fa7c98242881352c53916","commits":[{"sha":"4cdeabe0be1ee967e79d66f59fab926cd95cd75b","author":{"name":"eileencodes","email":"707c9cbace6a6803e8005e53f8194409d6a9d8e6@gmail.com"},"message":"Regression test for rendering file from absolute path\n\nTest that we are not allowing you to grab a file with an absolute path\noutside of your application directory. This is dangerous because it\ncould be used to retrieve files from the server like `/etc/passwd`.","distinct":true,"url":"https://api.github.com/repos/ifad/rails/commits/4cdeabe0be1ee967e79d66f59fab926cd95cd75b"},{"sha":"0ed2791781b6369b1ac67ce40652153069dc7d19","author":{"name":"eileencodes","email":"707c9cbace6a6803e8005e53f8194409d6a9d8e6@gmail.com"},"message":"Fix hash syntax for 1.8.7\n\nRails 3.2 supports 1.8.7 but 1.8.7 does not support the new hash syntax.","distinct":true,"url":"https://api.github.com/repos/ifad/rails/commits/0ed2791781b6369b1ac67ce40652153069dc7d19"},{"sha":"c005f067757976da76ca09deab7a65b2af6a0e65","author":{"name":"eileencodes","email":"707c9cbace6a6803e8005e53f8194409d6a9d8e6@gmail.com"},"message":"Run `file.close` before unlinking for travis\n\nThis works on OSX but for some reason travis is throwing a\n```\n  1) Error:\nExpiresInRenderTest#test_dynamic_render_with_absolute_path:\nNoMethodError: undefined method `unlink' for nil:NilClass\n```\nLooking at other tests in Railties the file has a name and we close\nit before unlinking, so I'm going to try that.","distinct":true,"url":"https://api.github.com/repos/ifad/rails/commits/c005f067757976da76ca09deab7a65b2af6a0e65"},{"sha":"b22aff49301e8c8a5206c46baf6bb468a0d7f2d9","author":{"name":"Aaron Patterson","email":"bd85a5e1e22acab07dfb17c9ff05b41f9f3fc5d5@gmail.com"},"message":"Generated engines should protect from forgery\n\nGenerated engines should call `protect_from_forgery`.  If this method\nisn't called, then the Engine could be susceptible to XSS attacks.\nThanks @tomekr for reporting this to us!\n\nConflicts:\n\trailties/lib/rails/generators/rails/plugin/templates/app/controllers/%namespaced_name%/application_controller.rb.tt\n\trailties/test/generators/plugin_generator_test.rb","distinct":true,"url":"https://api.github.com/repos/ifad/rails/commits/b22aff49301e8c8a5206c46baf6bb468a0d7f2d9"},{"sha":"9ef54c65062dea38dfdf0f451c025f7733360d9f","author":{"name":"Arthur Neves","email":"5ba7737314edc4e28e238b476fe140959ec02850@gmail.com"},"message":"Complete work on 3.2 for render_data_leak patch.\n\nRender could leak access to external files before this patch.\nA previous patch(CVE-2016-0752), attempted to fix this. However the tests\nwere miss-placed outside the TestCase subclass, so they were not running.\n\nWe should allow :file to be outside rails root, but anything else must\nbe inside the rails view directory.\n\nThe implementation has changed a bit though. Now the patch is more\nsimilar with the 4.x series patches.\nNow `render 'foo/bar'`, will add a special key in the options\nhash, and not use the :file one, so when we look up that file, we\ndon't set the fallbacks, and only lookup a template, to constraint the\nfolders that can be accessed.\n\nCVE-2016-2097","distinct":true,"url":"https://api.github.com/repos/ifad/rails/commits/9ef54c65062dea38dfdf0f451c025f7733360d9f"},{"sha":"0c2cee7b2f3103338757bb20268ac4d781a8baff","author":{"name":"Arthur Neves","email":"5ba7737314edc4e28e238b476fe140959ec02850@gmail.com"},"message":"Don't allow render(params) in view/controller\n\n`render(params)` is dangerous and could be a vector for attackers.\n\nDon't allow calls to render passing params on views or controllers.\n\nOn a controller or view, we should not allow something like `render\nparams[:id]` or `render params`.\nThat could be problematic, because an attacker could pass input that\ncould lead to a remote code execution attack.\n\nThis patch is also compatible when using strong parameters.\n\nCVE-2016-2098","distinct":true,"url":"https://api.github.com/repos/ifad/rails/commits/0c2cee7b2f3103338757bb20268ac4d781a8baff"},{"sha":"489f004d09b086a19de1b229eb71a8a07b142504","author":{"name":"Rafael Mendonça França","email":"34336d1352eb57c00d6c738f78075df0d11314db@gmail.com"},"message":"Add bundle check to release task","distinct":true,"url":"https://api.github.com/repos/ifad/rails/commits/489f004d09b086a19de1b229eb71a8a07b142504"},{"sha":"e9b80674d9159fa069b1ff6332e95d3f51bd39a8","author":{"name":"Rafael Mendonça França","email":"34336d1352eb57c00d6c738f78075df0d11314db@gmail.com"},"message":"Preparing for 3.2.22.2 release","distinct":true,"url":"https://api.github.com/repos/ifad/rails/commits/e9b80674d9159fa069b1ff6332e95d3f51bd39a8"},{"sha":"83b95b8b70d5b2b84999250cc2b4a6155d8db0d7","author":{"name":"Arthur Neves","email":"5ba7737314edc4e28e238b476fe140959ec02850@gmail.com"},"message":"Add missing require to file","distinct":true,"url":"https://api.github.com/repos/ifad/rails/commits/83b95b8b70d5b2b84999250cc2b4a6155d8db0d7"},{"sha":"d27ee1603916240caf287a7cc40de043ba3be2e2","author":{"name":"Arthur Neves","email":"5ba7737314edc4e28e238b476fe140959ec02850@gmail.com"},"message":"fix 1.8 hash syntax","distinct":true,"url":"https://api.github.com/repos/ifad/rails/commits/d27ee1603916240caf287a7cc40de043ba3be2e2"},{"sha":"f31edcd475adabc8b4485ddb9c35ab612cad12a5","author":{"name":"Rafael Mendonça França","email":"34336d1352eb57c00d6c738f78075df0d11314db@gmail.com"},"message":"Require hash_with_indifferent_access before using it","distinct":true,"url":"https://api.github.com/repos/ifad/rails/commits/f31edcd475adabc8b4485ddb9c35ab612cad12a5"},{"sha":"e3cbe8c879a9e9749a5f8db374df0fc7cec258c9","author":{"name":"Arthur Neves","email":"5ba7737314edc4e28e238b476fe140959ec02850@gmail.com"},"message":"update rendering comment\n\n[skip ci]","distinct":true,"url":"https://api.github.com/repos/ifad/rails/commits/e3cbe8c879a9e9749a5f8db374df0fc7cec258c9"},{"sha":"21cbefead0b90f23bed9768f7190839abe287c31","author":{"name":"Tyler Distad","email":"84b80f19b673dba2433a2594b3357cb2e0a0e45d@gmail.com"},"message":"Associations do not call `.to_proc` on Hash\n\n  Fixes #25010","distinct":true,"url":"https://api.github.com/repos/ifad/rails/commits/21cbefead0b90f23bed9768f7190839abe287c31"},{"sha":"3845379378ab99157e3412a1c7342b09e2c681ac","author":{"name":"Andrew Carpenter","email":"6b7c097d961f68685fc978cf91eeae17be6cbb45@criticaljuncture.org"},"message":"ensure tag/content_tag escapes \" in attribute vals\n\nMany helpers mark content as HTML-safe without escaping double quotes -- including `sanitize`. Regardless of whether or not the attribute values are HTML-escaped, we want to be sure they don't include double quotes, as that can cause XSS issues. For example: `content_tag(:div, \"foo\", title: sanitize('\" onmouseover=\"alert(1);//'))`\n\nCVE-2016-6316","distinct":true,"url":"https://api.github.com/repos/ifad/rails/commits/3845379378ab99157e3412a1c7342b09e2c681ac"},{"sha":"8b0deac388442b1ccddcd99a1a433113c7767677","author":{"name":"Aaron Patterson","email":"bd85a5e1e22acab07dfb17c9ff05b41f9f3fc5d5@gmail.com"},"message":"bumping version","distinct":true,"url":"https://api.github.com/repos/ifad/rails/commits/8b0deac388442b1ccddcd99a1a433113c7767677"},{"sha":"ed037e292db145b96d8fa58de8bf869e51b71999","author":{"name":"Carlos Antonio da Silva","email":"0623380b1be514d872865ba89a2dcbffdacb365d@gmail.com"},"message":"Include missing module in tag_helper\n\nSince 6857415187810f1289068a448268264d0cf0844f we are using #safe_join to\njoin the content when an Array is given, so we must include the dependent\nmodule here to make sure it's available when this module is used alone.\n\nThis was making Simple Form tests to fail with current master due to the\nmissing dependency.","distinct":true,"url":"https://api.github.com/repos/ifad/rails/commits/ed037e292db145b96d8fa58de8bf869e51b71999"},{"sha":"7a48273cbc76f94fd879b2af4ff237c4a45c1edf","author":{"name":"Aaron Patterson","email":"bd85a5e1e22acab07dfb17c9ff05b41f9f3fc5d5@gmail.com"},"message":"bumping version","distinct":true,"url":"https://api.github.com/repos/ifad/rails/commits/7a48273cbc76f94fd879b2af4ff237c4a45c1edf"},{"sha":"56ab0ed2564d61cc43bef927d6bab2866f3e420a","author":{"name":"Mike Virata-Stone","email":"da354865b22660838d6e449dbdab5b758d6dfeaf@on-site.com"},"message":"Remove dead code and ensure values are strings before calling gsub","distinct":true,"url":"https://api.github.com/repos/ifad/rails/commits/56ab0ed2564d61cc43bef927d6bab2866f3e420a"},{"sha":"0228f928f2d4aa1cada923bd6d49d08c7e670027","author":{"name":"Xavier Noria","email":"5e3232fa282d62879f4d272988bc29cc90768552@hashref.com"},"message":"adds a couple of missing requires","distinct":true,"url":"https://api.github.com/repos/ifad/rails/commits/0228f928f2d4aa1cada923bd6d49d08c7e670027"},{"sha":"7e5678c5e0d9753819cd452769956a63f01fa3d7","author":{"name":"Johnny Shields","email":"365ea314a4811d97a30202806907cf732733bbe5@gmail.com"},"message":"Fix failing tests on 3-2-stable branch:\n- Set sudo: false in .travis.yml which uses latest travis engine and fixes some failing specs\n- Use older version of gems in Gemfile if RUBY_VERSION < '1.9.3' (no change to .gemspec)\n- Fix two cases of hash rockets in tests (required for Ruby 1.8.7)\n- Skip failing test \"test_ensure_that_migration_tasks_work_with_mountable_option\" which breaks due to Bundler no longer accepting the default generated .gemspec format.\n- Skip railties specs on Ruby 1.8.7 (mark as an allowed failure.)","distinct":true,"url":"https://api.github.com/repos/ifad/rails/commits/7e5678c5e0d9753819cd452769956a63f01fa3d7"}]}
{"actor":{"display_login":"vjt"}}