Subject: CVS commit: pkgsrc
From: Takahiro Kambe
Date: 2021-07-04 08:24:47
Message id: 20210704062447.411A1FA95@cvs.NetBSD.org

Log Message:
www/ruby-rails52: update to 5.2.6

Ruby on Rails 5.2.6 (2021-05-05)

There are changes in www/ruby-actionpack52 only, including security fix.

Action Pack

* Accept base64_urlsafe CSRF tokens to make forward compatible.

  Base64 strict-encoded CSRF tokens are not inherently websafe, which
  makes them difficult to deal with.  For example, the common practice
  of sending the CSRF token to a browser in a client-readable cookie
  does not work properly out of the box: the value has to be
  url-encoded and decoded to survive transport.

  In this version, we generate Base64 urlsafe-encoded CSRF tokens,
  which are inherently safe to transport.  Validation accepts both
  urlsafe tokens, and strict-encoded tokens for backwards
  compatibility.

  How the tokes are encoded is controllr by the
  action_controller.urlsafe_csrf_tokens config.

  In Rails 5.2.5, the CSRF token format was accidentally changed to
  urlsafe-encoded.

  Atention: If you already upgraded your application to 5.2.5, set the
  config urlsafe_csrf_tokens to true, otherwise your form submission
  will start to fail during the deploy of this new version.

	Rails.application.config.action_controller.urlsafe_csrf_tokens = true

  If you are upgrading from 5.2.4.x, you don't need to change this
  configuration.

  Scott Blum, Étienne Barrié

Files:
RevisionActionfile
1.8modifypkgsrc/www/ruby-rails52/distinfo
1.8modifypkgsrc/www/ruby-actionview52/distinfo
1.8modifypkgsrc/www/ruby-actionpack52/distinfo
1.8modifypkgsrc/www/ruby-actioncable52/distinfo
1.8modifypkgsrc/mail/ruby-actionmailer52/distinfo
1.101modifypkgsrc/lang/ruby/rails.mk
1.8modifypkgsrc/devel/ruby-railties52/distinfo
1.8modifypkgsrc/devel/ruby-activesupport52/distinfo
1.8modifypkgsrc/devel/ruby-activestorage52/distinfo
1.8modifypkgsrc/devel/ruby-activemodel52/distinfo
1.8modifypkgsrc/devel/ruby-activejob52/distinfo
1.8modifypkgsrc/databases/ruby-activerecord52/distinfo