| Age | Commit message (Collapse) | Author |
|---|
|
Builder escapes by default; the three feed templates no longer call
CGI.escapeHTML. This fixes two sites that never escaped at all: the tag
feed's externally supplied :tag segment, interpolated into its title, self
link and id, and dc:creator in the RDF template.
Subscribers see one difference: quotes and apostrophes arrive raw, which is
valid in element text.
config/initializers/xmlparser.rb, which redefined Builder::XmlBase#_escape
as the identity function, is gone. XML::Node#replace_with went with it, no
callers.
|
|
It reopened Integer and Float to work around duration arithmetic under Ruby
2.4 and Rails 3.2, and has been shadowing ActiveSupport's own helpers ever
since. Its months were exactly 30 days and its years 365.25, both differing
from ActiveSupport's constants, and it built Duration parts as an array of
pairs rather than a hash, recording weeks as days and hours and minutes as
seconds
|
|
It rewrote the method to work around Enumerable#sum refusing a String seed
under Ruby 2.4, and has been obsolete since Rails 3.2 was left behind. It
kept shadowing the adapter, dropping the collation, ctype, locale and
locale_provider options Rails 8 supports
|
|
- Collapse page headers into one action row with an optional hint
- limit will_paginate to one row
|
|
|
|
|
|
Enforced at restore via a login-time stamp, written only at genuine
logins so the limit stays absolute rather than sliding. The cookie
name rotation logs everyone out once at deploy. Second-factor users
are deliberately not treated worse than password-only ones.
|
|
|
|
|
|
|
|
|
|
|
|
- dark-mode restore now travels nonced, the admin constants likewise
- AUTH_TOKEN deleted in favour of the csrf meta tag
- new report collector at /csp_reports
|
|
Vendors the Tabler outline/filled icon sets via rails_icons' sync
mechanism rather than a hand-rolled SVG set or a webfont -- this app
had no icon system of any kind before. Icons are committed like any
other static asset; re-syncing is only needed when adding an icon
that isn't vendored yet, via the new `make sync_icons` target.
|
|
search_vector is populated by a raw Postgres trigger created via
execute() in a migration -- invisible to schema.rb, which only
represents structure Rails understands. Any database rebuilt from
schema.rb rather than replayed migrations (test, a fresh db:setup,
disaster recovery) silently lost full-text search entirely, with no
error -- NULL @@ anything is never true in Postgres.
Page.ensure_search_vector_trigger!, called from an after_initialize
initializer, reinstalls the trigger via CREATE OR REPLACE on every
boot, in every environment. Idempotent and cheap.
|
|
- Bump Rails to 8.1.3 (Ruby unchanged at 3.2.11, new gemset rails8-upgrade)
- config.load_defaults 8.1; merge app:update diffs for all environment files
- Remove routing-filter 0.7.0; replace with native scope '(:locale)' in
routes.rb and default_url_options in ApplicationController
- Delete config/initializers/routing_filter_rails71_patch.rb
- Replace vendored TinyMCE 3.x (~200 files) with tinymce-rails ~> 8.3;
migrate admin_interface.js from jQuery .tinymce()/advanced theme to
tinymce.init(); add config/tinymce.yml; note: TinyMCE 7+ is GPL
- rails-i18n ~> 8.0 added explicitly (previously indirect dependency)
- awesome_nested_set, acts-as-taggable-on pinned to git main/master
(gemspec activerecord < 8.1 ceiling; no functional incompatibility;
repin to version once upstream releases updated gemspecs)
- globalize ~> 7.0, libxml-ruby ~> 5.0, nokogiri ~> 1.18, pg ~> 1.5
- sass-rails, coffee-rails, uglifier moved from :assets group to main
(Sprockets 4 convention; :assets group no longer meaningful)
- Node: head, draft, lock_owner marked belongs_to optional: true
- Page: node, user, editor marked belongs_to optional: true
- Static assets in public/images/ and public/javascripts/ referenced via
plain HTML tags; Rails 8 load_defaults raises on pipeline helpers for
undeclared assets
- sessions_controller_test.rb: remove stale require and dead rescue_action
- users_controller_test.rb: assert button[type=submit] not input[type=submit]
(Rails 8 button_to renders <button> not <input>)
- test_helper.rb: node.reload after children.create! (awesome_nested_set
3.9.0 does not refresh parent in memory after callback)
- 129 runs, 339 assertions, 3 failures, 0 errors — identical baseline to 7.2
|
|
|
|
- Remove safe_path helper and content_path shim from link_helper.rb
- Update all safe_path call sites in views to use named route helpers directly
- Fix Globalize fallbacks via config.i18n.fallbacks in application.rb, remove i18n initializer
- Stub Node.search returning none (search disabled pending PostgreSQL upgrade)
- Replace to_s(:db) with to_fs(:db) in node.rb, nodes_helper.rb, link_helper.rb, admin view
- Move LockedByAnotherUser to app/models/locked_by_another_user.rb for Zeitwerk autoloading
- Fix config/environments/test.rb: config.assets removed, cache_classes → enable_reloading,
test_order removed, minitest pinned to ~> 5.25
- Fix config/environments/development.rb: cache_classes → enable_reloading
- Park search vector migration in doc/ pending PostgreSQL and plpgsql availability
|
|
- Bump Rails to 7.2.3, Ruby to 3.2.11 (new gemset rails7-upgrade)
- pg pinned to 1.4.6 (bridge: Ruby 3.2 compatible, PostgreSQL 9.6 tolerant)
- acts-as-taggable-on → 12.x (Rails 7.2 + Ruby 3.2 support)
- awesome_nested_set → 3.7.0 (Rails 7.2 support, avoids 3.9.0 lft/rgt bug)
- globalize → 7.0 (Rails 7.x required)
- libxml-ruby → 5.x (Ruby 3.2 required)
- unicorn → 6.x; fix unicorn.rb: RAILS_ROOT→Rails.root, RAILS_ENV→ENV,
File.exists?→File.exist?
- Add puma for development server
- Remove dead initializers: assets.rb, ruby2.rb, backtrace_silencers.rb,
new_rails_defaults.rb
- Fix File.exists? → File.exist? in page.rb and authors_importer.rb
- Add routing_filter_rails71_patch.rb (restores params[:locale] on Rails 7.1+)
|
|
- routing-filter 0.6.3 -> 0.7.0 (Rails 6.1 compatibility)
- RSS named routes rss_xml/rss_rdf added
- RouteWithParams workarounds: will_paginate_patch, content_path shim, safe_path helper
- Paperclip removed, replaced with FileAttachment concern (preserves URL scheme)
- Assets resource moved to /admin/assets (Sprockets middleware conflict)
- ApplicationRecord base class added, all models migrated
- Strong parameters added to Assets, Occurrences, Events, MenuItems controllers
- update_attributes -> update throughout
- render :nothing -> head :ok/:not_found throughout
- language_selector rewritten (removes :overwrite_params)
- Environment files updated for Rails 6.1 (eager_load, public_file_server, ActionMailer)
- Arel::Visitors::DepthFirst and Integer/Float duration patches removed from test_helper
- AssetsController tests added (10 tests covering upload, variants, destroy, auth)
- ImageMagick geometry: 460x250! for headline crop (not # which is invalid in IM6)
129 runs, 311 assertions, 5 failures (all pre-existing), 0 errors
|
|
- Bump rails 4.2.11.3 → 5.2.8.1, ruby 2.4.10 → 2.5.8
- Upgrade acts-as-taggable-on ~> 3.5 → ~> 6.0
- Upgrade exception_notification ~> 4.4 → ~> 4.5
- Upgrade globalize ~> 5.0 → ~> 5.2.0
- Upgrade pg ~> 0.17 → ~> 1.0
- Upgrade sass-rails ~> 4.0 → ~> 5.0
- Upgrade libxml-ruby to ~> 3.2 (5.x requires Ruby 3.2+)
- Pin awesome_nested_set ~> 3.4.0 (3.9 has lft/rgt update bug)
- Add rails-controller-testing gem
- Add assets initializer for jquery precompile
- Add acts_as_taggable missing indexes migration
- Set eager_load, serve_static_files, active_record settings
|
|
- Converted plugins to gems (Gemfile)
- Updated config structure (application.rb, boot.rb, environment.rb)
- Converted routes to Rails 3 DSL
- Converted named_scope to scope throughout models
- Converted find(:all, :conditions) to where() chains
- Fixed has_many :order to use ordering scope
- Updated session store and secret token configuration
- Fixed exception_notification middleware configuration
- Patched Ruby 2.4 / Rails 3.2 incompatibilities:
- Integer/Float duration arithmetic (ActiveSupport)
- Arel visit_Integer for PostgreSQL adapter
- create_database String/Integer coercion
- ActionController consider_all_requests_local
- Migrated taggings schema for acts-as-taggable-on
- Replaced dynamic_form gem with custom form_error_messages helper
- Fixed Rails 3 block helper syntax (form_for, form_tag, fields_for)
- Fixed admin layout yield
- Updated test suite for Rails 3 APIs
|
|
|
|
|
|
|
|
|
|
|
|
* http basic auth and login from cookie have been removed
* no it does not work yet, it's so f*cking secure, it won't even let legitimate users login
|
|
which use the new translation facilities.
backend mostly.
|
|
|
