upgrade vendored rails to 2.3.14

doc/README_DEVELOPERS

@@ -8,6 +8,8 @@ Tracks is using
 
 See README for links to the respective sites
 
+Also see the Development pages on the wiki for details on installing, upgrading, etc.
+
 2. Dependencies
 
 The dependencies are maintained by Tracks. For development we try not to vendor them

features/recurring_todos.feature

@@ -62,11 +62,26 @@ Feature: Manage recurring todos
     Then the pattern "I'm done" should be in the state list "active"
     And the state list "completed" should be empty
 
+  @selenium @wip
   Scenario: Following the recurring todo link of a todo takes me to the recurring todos page
-    Given this is a pending scenario
+    When I go to the home page
+    Then I should see the todo "run tests"
+    When I follow the recurring todo link of "run tests"
+    Then I should be on the repeating todos page
 
+  @selenium @wip
   Scenario: Deleting a recurring todo with ending pattern will show message
-    Given this is a pending scenario
+    When I go to the repeating todos page
+    And I mark the pattern "run tests" as complete
+    And I go to the home page
+    Then I should see "run tests"
+    When I delete the action "run tests"
+    Then I should see "@@message@@"
 
+  @selenium @wip
   Scenario: Deleting a recurring todo with active pattern will show new todo
-    Given this is a pending scenario
+    When I go to the home page
+    Then I should see "run tests"
+    When I delete the action "run tests"
+    Then I should see "@@message@@"
+    And I should see "run tests" in the context container for "test context"

features/step_definitions/recurring_todo_steps.rb

@@ -84,6 +84,14 @@
   wait_for_ajax
 end
 
+When /^I follow the recurring todo link of "([^"]*)"$/ do |action_description|
+  todo = @current_user.todos.find_by_description(action_description)
+  todo.should_not be_nil
+
+  recurring_todo_link = "div.todo_#{todo.id} div a.recurring_icon"
+  click_link recurring_todo_link
+end
+
 Then /^the state list "([^"]*)" should be empty$/ do |state|
   empty_id = "recurring-todos-empty-nd" if state.downcase == "active"
   empty_id = "completed-empty-nd" if state.downcase == "completed"

vendor/rails/actionmailer/Rakefile

@@ -54,7 +54,7 @@ spec = Gem::Specification.new do |s|
   s.rubyforge_project = "actionmailer"
   s.homepage = "http://www.rubyonrails.org"
 
-  s.add_dependency('actionpack', '= 2.3.12' + PKG_BUILD)
+  s.add_dependency('actionpack', '= 2.3.14' + PKG_BUILD)
 
   s.requirements << 'none'
   s.require_path = 'lib'

vendor/rails/actionmailer/lib/action_mailer/version.rb

@@ -2,7 +2,7 @@ module ActionMailer
   module VERSION #:nodoc:
     MAJOR = 2
     MINOR = 3
-    TINY  = 12
+    TINY  = 14
 
     STRING = [MAJOR, MINOR, TINY].join('.')
   end

vendor/rails/actionpack/CHANGELOG

@@ -1935,7 +1935,7 @@ superclass' view_paths.  [Rick Olson]
 
 * Update documentation for erb trim syntax. #5651 [[email protected]]
 
-* Pass :id => nil or :class => nil to error_messages_for to supress that html attribute. #3586 [[email protected], [email protected]]
+* Pass :id => nil or :class => nil to error_messages_for to supress that html attribute. #3586 [[email protected]]
 
 * Reset @html_document between requests so assert_tag works. #4810 [Jarkko Laine, [email protected]]
 
@@ -2532,7 +2532,7 @@ superclass' view_paths.  [Rick Olson]
 
 * Provide support for decimal columns to form helpers. Closes #5672. [Dave Thomas]
 
-* Pass :id => nil or :class => nil to error_messages_for to supress that html attribute. #3586 [[email protected], [email protected]]
+* Pass :id => nil or :class => nil to error_messages_for to supress that html attribute. #3586 [[email protected]]
 
 * Reset @html_document between requests so assert_tag works. #4810 [Jarkko Laine, [email protected]]
 

vendor/rails/actionpack/Rakefile

@@ -78,7 +78,7 @@ spec = Gem::Specification.new do |s|
 
   s.requirements << 'none'
 
-  s.add_dependency('activesupport', '= 2.3.12' + PKG_BUILD)
+  s.add_dependency('activesupport', '= 2.3.14' + PKG_BUILD)
   s.add_dependency('rack', '~> 1.1.0')
 
   s.require_path = 'lib'

vendor/rails/actionpack/lib/action_controller/response.rb

@@ -64,12 +64,13 @@ def location=(url) headers['Location'] = url end
     # the character set information will also be included in the content type
     # information.
     def content_type=(mime_type)
-      self.headers["Content-Type"] =
+      new_content_type =
         if mime_type =~ /charset/ || (c = charset).nil?
           mime_type.to_s
         else
           "#{mime_type}; charset=#{c}"
         end
+      self.headers["Content-Type"] = URI.escape(new_content_type, "\r\n")
     end
 
     # Returns the response's content MIME type, or nil if content type has been set.

vendor/rails/actionpack/lib/action_controller/vendor/html-scanner/html/node.rb

@@ -162,7 +162,7 @@ def parse(parent, line, pos, content, strict=true)
           end
 
           closing = ( scanner.scan(/\//) ? :close : nil )
-          return Text.new(parent, line, pos, content) unless name = scanner.scan(/[-:\w\x00-\x09\x0b-\x0c\x0e-\x1f]+/)
+          return Text.new(parent, line, pos, content) unless name = scanner.scan(/[^\s!>\/]+/)
           name.downcase!
 
           unless closing

vendor/rails/actionpack/lib/action_pack/version.rb

@@ -2,7 +2,7 @@ module ActionPack #:nodoc:
   module VERSION #:nodoc:
     MAJOR = 2
     MINOR = 3
-    TINY  = 12
+    TINY  = 14
 
     STRING = [MAJOR, MINOR, TINY].join('.')
   end

vendor/rails/actionpack/test/controller/content_type_test.rb

@@ -46,6 +46,11 @@ def render_default_content_types_for_respond_to
       format.rss  { render :text   => "hello world!", :content_type => Mime::XML }
     end
   end
+
+  def render_content_type_from_user_input
+    response.content_type= params[:hello]
+    render :text=>"hello"
+  end
 
   def rescue_action(e) raise end
 end
@@ -129,6 +134,11 @@ def test_change_for_rxml
     assert_equal Mime::HTML, @response.content_type
     assert_equal "utf-8", @response.charset
   end
+
+  def test_user_supplied_value
+    get :render_content_type_from_user_input, :hello=>"hello/world\r\nAttack: true"
+    assert_equal "hello/world%0D%0AAttack: true", @response.content_type
+  end
 end
 
 class AcceptBasedContentTypeTest < ActionController::TestCase

vendor/rails/actionpack/test/controller/html-scanner/sanitizer_test.rb

@@ -5,6 +5,13 @@ def setup
     @sanitizer = nil # used by assert_sanitizer
   end
 
+  def test_strip_tags_with_quote
+    sanitizer = HTML::FullSanitizer.new
+    string    = '<" <img src="trollface.gif" onload="alert(1)"> hi'
+
+    assert_equal ' hi', sanitizer.sanitize(string)
+  end
+
   def test_strip_tags
     sanitizer = HTML::FullSanitizer.new
     assert_equal("<<<bad html", sanitizer.sanitize("<<<bad html"))

vendor/rails/activerecord/Rakefile

@@ -192,7 +192,7 @@ spec = Gem::Specification.new do |s|
     s.files = s.files + Dir.glob( "#{dir}/**/*" ).delete_if { |item| item.include?( "\.svn" ) }
   end
 
-  s.add_dependency('activesupport', '= 2.3.12' + PKG_BUILD)
+  s.add_dependency('activesupport', '= 2.3.14' + PKG_BUILD)
 
   s.files.delete FIXTURES_ROOT + "/fixture_database.sqlite"
   s.files.delete FIXTURES_ROOT + "/fixture_database_2.sqlite"

vendor/rails/activerecord/lib/active_record/connection_adapters/mysql_adapter.rb

@@ -238,7 +238,7 @@ def quote(value, column = nil)
       end
 
       def quote_column_name(name) #:nodoc:
-        @quoted_column_names[name] ||= "`#{name}`"
+        @quoted_column_names[name] ||= "`#{name.to_s.gsub('`', '``')}`"
       end
 
       def quote_table_name(name) #:nodoc:

vendor/rails/activerecord/lib/active_record/connection_adapters/sqlite_adapter.rb

@@ -162,7 +162,7 @@ def quote_string(s) #:nodoc:
       end
 
       def quote_column_name(name) #:nodoc:
-        %Q("#{name}")
+        %Q("#{name.to_s.gsub('"', '""')}")
       end
 
 

vendor/rails/activerecord/lib/active_record/validations.rb

@@ -333,7 +333,6 @@ def to_xml(options={})
     end
 
     def generate_message(attribute, message = :invalid, options = {})
-      ActiveSupport::Deprecation.warn("ActiveRecord::Errors#generate_message has been deprecated. Please use ActiveRecord::Error.new().to_s.")
       Error.new(@base, attribute, message, options).to_s
     end
   end

vendor/rails/activerecord/lib/active_record/version.rb

@@ -2,7 +2,7 @@ module ActiveRecord
   module VERSION #:nodoc:
     MAJOR = 2
     MINOR = 3
-    TINY  = 12
+    TINY  = 14
 
     STRING = [MAJOR, MINOR, TINY].join('.')
   end

vendor/rails/activerecord/test/cases/base_test.rb

@@ -79,6 +79,23 @@ class TopicWithProtectedContentAndAccessibleAuthorName < ActiveRecord::Base
 class BasicsTest < ActiveRecord::TestCase
   fixtures :topics, :companies, :developers, :projects, :computers, :accounts, :minimalistics, 'warehouse-things', :authors, :categorizations, :categories, :posts
 
+  def test_column_names_are_escaped
+    conn      = ActiveRecord::Base.connection
+    classname = conn.class.name[/[^:]*$/]
+    badchar   = {
+      'SQLite3Adapter'    => '"',
+      'MysqlAdapter'      => '`',
+      'Mysql2Adapter'     => '`',
+      'PostgreSQLAdapter' => '"',
+      'OracleAdapter'     => '"',
+    }.fetch(classname) {
+      raise "need a bad char for #{classname}"
+    }
+
+    quoted = conn.quote_column_name "foo#{badchar}bar"
+    assert_equal("#{badchar}foo#{badchar * 2}bar#{badchar}", quoted)
+  end
+
   def test_table_exists
     assert !NonExistentTable.table_exists?
     assert Topic.table_exists?

vendor/rails/activeresource/Rakefile

@@ -66,7 +66,7 @@ spec = Gem::Specification.new do |s|
     s.files = s.files + Dir.glob( "#{dir}/**/*" ).delete_if { |item| item.include?( "\.svn" ) }
   end
 
-  s.add_dependency('activesupport', '= 2.3.12' + PKG_BUILD)
+  s.add_dependency('activesupport', '= 2.3.14' + PKG_BUILD)
 
   s.require_path = 'lib'
 

vendor/rails/activeresource/lib/active_resource/version.rb

@@ -2,7 +2,7 @@ module ActiveResource
   module VERSION #:nodoc:
     MAJOR = 2
     MINOR = 3
-    TINY  = 12
+    TINY  = 14
 
     STRING = [MAJOR, MINOR, TINY].join('.')
   end

vendor/rails/activesupport/lib/active_support/core_ext/string/output_safety.rb

@@ -19,7 +19,7 @@ def html_escape(s)
       if s.html_safe?
         s
       else
-        s.gsub(/[&"><]/) { |special| HTML_ESCAPE[special] }.html_safe
+        s.to_s.gsub(/&/, "&amp;").gsub(/\"/, "&quot;").gsub(/>/, "&gt;").gsub(/</, "&lt;").html_safe
       end
     end
 

vendor/rails/activesupport/lib/active_support/ordered_hash.rb

@@ -130,14 +130,18 @@ def shift
       end
 
       def merge!(other_hash)
-        other_hash.each {|k,v| self[k] = v }
+        if block_given?
+          other_hash.each { |k, v| self[k] = key?(k) ? yield(k, self[k], v) : v }
+        else
+          other_hash.each { |k, v| self[k] = v }
+        end
         self
       end
 
       alias_method :update, :merge!
 
-      def merge(other_hash)
-        dup.merge!(other_hash)
+      def merge(other_hash, &block)
+        dup.merge!(other_hash, &block)
       end
 
       # When replacing with another hash, the initial order of our keys must come from the other hash -ordered or not.

vendor/rails/activesupport/lib/active_support/version.rb

@@ -2,7 +2,7 @@ module ActiveSupport
   module VERSION #:nodoc:
     MAJOR = 2
     MINOR = 3
-    TINY  = 12
+    TINY  = 14
 
     STRING = [MAJOR, MINOR, TINY].join('.')
   end

vendor/rails/railties/Rakefile

@@ -313,11 +313,11 @@ spec = Gem::Specification.new do |s|
   EOF
 
   s.add_dependency('rake', '>= 0.8.3')
-  s.add_dependency('activesupport',    '= 2.3.12' + PKG_BUILD)
-  s.add_dependency('activerecord',     '= 2.3.12' + PKG_BUILD)
-  s.add_dependency('actionpack',       '= 2.3.12' + PKG_BUILD)
-  s.add_dependency('actionmailer',     '= 2.3.12' + PKG_BUILD)
-  s.add_dependency('activeresource',   '= 2.3.12' + PKG_BUILD)
+  s.add_dependency('activesupport',    '= 2.3.14' + PKG_BUILD)
+  s.add_dependency('activerecord',     '= 2.3.14' + PKG_BUILD)
+  s.add_dependency('actionpack',       '= 2.3.14' + PKG_BUILD)
+  s.add_dependency('actionmailer',     '= 2.3.14' + PKG_BUILD)
+  s.add_dependency('activeresource',   '= 2.3.14' + PKG_BUILD)
 
   s.rdoc_options << '--exclude' << '.'
 

vendor/rails/railties/lib/rails/version.rb

@@ -2,7 +2,7 @@ module Rails
   module VERSION #:nodoc:
     MAJOR = 2
     MINOR = 3
-    TINY  = 12
+    TINY  = 14
 
     STRING = [MAJOR, MINOR, TINY].join('.')
   end

vendor/rails/railties/lib/tasks/documentation.rake

@@ -1,3 +1,5 @@
+begin
+  require 'rdoc/task'
 namespace :doc do
   desc "Generate documentation for the application. Set custom template with TEMPLATE=/path/to/rdoc/template.rb or title with TITLE=\"Custom Title\""
   RDoc::Task.new("app") { |rdoc|
@@ -86,3 +88,6 @@ namespace :doc do
     end
   end
 end
+rescue LoadError
+  $stderr.puts 'Please install RDoc 2.4.2+ to generate documentation.'
+end