Link [ pkgsrc | NetBSD | pkgsrc git mirror | PR fulltext-search | netbsd commit viewer ]


   
        usage: [branch:branch] [user:user] [path[@revision]] keyword [... [-excludekeyword [...]]] (e.g. branch:MAIN pkgtools/pkg)




switch to index mode

recent branches: MAIN (29m)  pkgsrc-2024Q1 (9d)  pkgsrc-2023Q4 (56d)  pkgsrc-2023Q2 (88d)  pkgsrc-2023Q3 (167d) 

2024-05-26 16:30:42 UTC Now

2021-07-04 06:24:47 UTC MAIN commitmail json YAML

www/ruby-rails52: update to 5.2.6

Ruby on Rails 5.2.6 (2021-05-05)

There are changes in www/ruby-actionpack52 only, including security fix.

Action Pack

* Accept base64_urlsafe CSRF tokens to make forward compatible.

  Base64 strict-encoded CSRF tokens are not inherently websafe, which
  makes them difficult to deal with.  For example, the common practice
  of sending the CSRF token to a browser in a client-readable cookie
  does not work properly out of the box: the value has to be
  url-encoded and decoded to survive transport.

  In this version, we generate Base64 urlsafe-encoded CSRF tokens,
  which are inherently safe to transport.  Validation accepts both
  urlsafe tokens, and strict-encoded tokens for backwards
  compatibility.

  How the tokes are encoded is controllr by the
  action_controller.urlsafe_csrf_tokens config.

  In Rails 5.2.5, the CSRF token format was accidentally changed to
  urlsafe-encoded.

  Atention: If you already upgraded your application to 5.2.5, set the
  config urlsafe_csrf_tokens to true, otherwise your form submission
  will start to fail during the deploy of this new version.

Rails.application.config.action_controller.urlsafe_csrf_tokens = true

  If you are upgrading from 5.2.4.x, you don't need to change this
  configuration.

  Scott Blum, Étienne Barrié

(taca)