Next | Query returned 21 messages, browsing 11 to 20 | Previous

History of commit frequency

CVS Commit History:


   2022-10-10 05:36:51 by Takahiro Kambe | Files touched by this commit (32)
Log message:
Remove lines for Ruby 2.6.
   2022-09-10 14:44:34 by Takahiro Kambe | Files touched by this commit (1) | Package updated
Log message:
www/ruby-actionview70: update to 7.0.4

* Guard against ActionView::Helpers::FormTagHelper#field_name calls with nil
  object_name arguments. For example:

	<%= fields do |f| %>
	  <%= f.field_name :body %>
	<% end %>

  Sean Doyle

* Strings returned from strip_tags are correctly tagged html_safe?

  Because these strings contain no HTML elements and the basic entities are
  escaped, they are safe to be included as-is as PCDATA in HTML content.
  Tagging them as html-safe avoids double-escaping entities when being
  concatenated to a SafeBuffer during rendering.

  Fixes rails/rails-html-sanitizer#124

  Mike Dalessio
   2022-07-13 16:48:48 by Takahiro Kambe | Files touched by this commit (15) | Package updated
Log message:
www/ruby-rails70: update to 7.0.3.1

Rails 7.0.3.1 (2022-07-12) updates databases/ruby-activerecord70 only.

databases/ruby-activerecord70

* Change ActiveRecord::Coders::YAMLColumn default to safe_load

  This adds two new configuration options The configuration options are as
  follows:

	o config.active_storage.use_yaml_unsafe_load

  When set to true, this configuration option tells Rails to use the old
  "unsafe" YAML loading strategy, maintaining the existing behavior but
  leaving the possible escalation vulnerability in place.  Setting this
  option to true is *not* recommended, but can aid in upgrading.

	o config.active_record.yaml_column_permitted_classes

  The "safe YAML" loading method does not allow all classes to be
  deserialized by default.  This option allows you to specify classes deemed
  "safe" in your application.  For example, if your application uses Symbol
  and Time in serialized data, you can add Symbol and Time to the allowed
  list as follows:

	config.active_record.yaml_column_permitted_classes = [Symbol, Date, Time]

  [CVE-2022-32224]
   2022-06-07 17:17:54 by Takahiro Kambe | Files touched by this commit (1) | Package updated
Log message:
www/ruby-actionview70: update to 7.0.3

7.0.3 (2022-05-12)

* Ensure models passed to form_for attempt to call to_model.
   2022-05-05 05:40:27 by Takahiro Kambe | Files touched by this commit (1) | Package updated
Log message:
www/ruby-actionview70: update to 7.0.2.4

## Rails 7.0.2.4 (April 26, 2022) ##

*   Fix and add protections for XSS in `ActionView::Helpers` and `ERB::Util`.

    Escape dangerous characters in names of tags and names of attributes in the
    tag helpers, following the XML specification. Rename the option
    `:escape_attributes` to `:escape`, to simplify by applying the option to the
    whole tag.

    *Álvaro Martín Fraguas*
   2022-03-27 08:43:12 by Thomas Klausner | Files touched by this commit (13)
Log message:
rails 7.0 wants ruby 2.7+, mark it as such
   2022-03-27 08:30:00 by Thomas Klausner | Files touched by this commit (24)
Log message:
ruby*: fix rails version in COMMENT
   2022-03-13 16:15:05 by Takahiro Kambe | Files touched by this commit (14) | Package updated
Log message:
www/ruby-rails70: update to 7.0.2.3

Changes are in devel/ruby-activestorage70 only.

Rails 7.0.2.3 (March 08, 2022)

* Added image transformation validation via configurable allow-list.

  Variant now offers a configurable allow-list for
  transformation methods in addition to a configurable deny-list for arguments.

  [CVE-2022-21831]
   2022-02-13 08:42:47 by Takahiro Kambe | Files touched by this commit (1) | Package updated
Log message:
www/ruby-actionview70: update to 7.0.2

7.0.2 (2022-02-08)

* Ensure preload_link_tag preloads JavaScript modules correctly.

  Máximo Mussini

* Fix stylesheet_link_tag and similar helpers are being used to work in
  objects with a response method.

  dark-panda

7.0.2.1 (2022-02-11)

* No changes.

7.0.2.2 (2022-02-11)

* No changes.
   2022-01-16 15:06:39 by Takahiro Kambe | Files touched by this commit (1) | Package updated
Log message:
devel/ruby-actionview70: update to 7.0.1

7.0.1 (2021-01-06)

* Fix button_to to work with a hash parameter as URL.

  MingyuanQin

* Fix link_to with a model passed as an argument twice.

  Alex Ghiculescu

Next | Query returned 21 messages, browsing 11 to 20 | Previous