Commit 753cb00d authored by Antonio Terceiro's avatar Antonio Terceiro

Imported Upstream version 4.1.5

parent 7aa78b75
## Rails 4.1.5 (August 18, 2014) ##
* No changes.
## Rails 4.1.4 (July 2, 2014) ##
* No changes.
......
......@@ -7,7 +7,7 @@ def self.gem_version
module VERSION
MAJOR = 4
MINOR = 1
TINY = 4
TINY = 5
PRE = nil
STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
......
......@@ -7,7 +7,7 @@ def self.gem_version
module VERSION
MAJOR = 4
MINOR = 1
TINY = 4
TINY = 5
PRE = nil
STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
......
## Rails 4.1.5 (August 18, 2014) ##
* No changes.
## Rails 4.1.4 (July 2, 2014) ##
* No changes.
......
......@@ -7,7 +7,7 @@ def self.gem_version
module VERSION
MAJOR = 4
MINOR = 1
TINY = 4
TINY = 5
PRE = nil
STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
......
## Rails 4.1.5 (August 18, 2014) ##
* No changes.
## Rails 4.1.4 (July 2, 2014) ##
* No changes.
......
......@@ -23,5 +23,6 @@ def sanitize_for_mass_assignment(attributes)
attributes
end
end
alias :sanitize_forbidden_attributes :sanitize_for_mass_assignment
end
end
......@@ -7,7 +7,7 @@ def self.gem_version
module VERSION
MAJOR = 4
MINOR = 1
TINY = 4
TINY = 5
PRE = nil
STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
......
## Rails 4.1.5 (August 18, 2014) ##
* No changes.
## Rails 4.1.4 (July 2, 2014) ##
* Fix regression added from the latest security fix.
......
......@@ -7,7 +7,7 @@ def self.gem_version
module VERSION
MAJOR = 4
MINOR = 1
TINY = 4
TINY = 5
PRE = nil
STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
......
require 'active_support/core_ext/array/wrap'
require 'active_model/forbidden_attributes_protection'
module ActiveRecord
module QueryMethods
extend ActiveSupport::Concern
include ActiveModel::ForbiddenAttributesProtection
# WhereChain objects act as placeholder for queries in which #where does not have any parameter.
# In this case, #where must be chained with #not to return a new relation.
class WhereChain
......@@ -561,7 +564,10 @@ def where!(opts = :chain, *rest) # :nodoc:
if opts == :chain
WhereChain.new(self)
else
references!(PredicateBuilder.references(opts)) if Hash === opts
if Hash === opts
opts = sanitize_forbidden_attributes(opts)
references!(PredicateBuilder.references(opts))
end
self.where_values += build_where(opts, rest)
self
......@@ -711,7 +717,13 @@ def create_with(value)
end
def create_with!(value) # :nodoc:
self.create_with_value = value ? create_with_value.merge(value) : {}
if value
value = sanitize_forbidden_attributes(value)
self.create_with_value = create_with_value.merge(value)
else
self.create_with_value = {}
end
self
end
......
......@@ -66,4 +66,34 @@ def test_blank_attributes_should_not_raise
person = Person.new
assert_nil person.assign_attributes(ProtectedParams.new({}))
end
def test_create_with_checks_permitted
params = ProtectedParams.new(first_name: 'Guille', gender: 'm')
assert_raises(ActiveModel::ForbiddenAttributesError) do
Person.create_with(params).create!
end
end
def test_create_with_works_with_params_values
params = ProtectedParams.new(first_name: 'Guille')
person = Person.create_with(first_name: params[:first_name]).create!
assert_equal 'Guille', person.first_name
end
def test_where_checks_permitted
params = ProtectedParams.new(first_name: 'Guille', gender: 'm')
assert_raises(ActiveModel::ForbiddenAttributesError) do
Person.where(params).create!
end
end
def test_where_works_with_params_values
params = ProtectedParams.new(first_name: 'Guille')
person = Person.where(first_name: params[:first_name]).create!
assert_equal 'Guille', person.first_name
end
end
## Rails 4.1.5 (August 18, 2014) ##
* No changes.
## Rails 4.1.4 (July 2, 2014) ##
* No changes.
......
......@@ -7,7 +7,7 @@ def self.gem_version
module VERSION
MAJOR = 4
MINOR = 1
TINY = 4
TINY = 5
PRE = nil
STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
......
## Rails 4.1.5 (August 18, 2014) ##
* No changes.
## Rails 4.1.4 (July 2, 2014) ##
* No changes.
......
## Rails 4.1.5 (August 18, 2014) ##
* Check attributes passed to `create_with` and `where`.
Fixes CVE-2014-3514.
*Rafael Mendonça França*
## Rails 4.1.4 (July 2, 2014) ##
* No changes.
......
......@@ -7,7 +7,7 @@ def self.gem_version
module VERSION
MAJOR = 4
MINOR = 1
TINY = 4
TINY = 5
PRE = nil
STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
......
......@@ -7,7 +7,7 @@ def self.gem_version
module VERSION
MAJOR = 4
MINOR = 1
TINY = 4
TINY = 5
PRE = nil
STRING = [MAJOR, MINOR, TINY, PRE].compact.join(".")
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment