Good news everyone! Rails version 3.2.8 has been released.
This version contains three important security fixes, please upgrade immediately.
One of security fixes impacts all users and is related to HTML escaping code. The other two fixes impacts people using select_tag’s prompt option and strip_tags helper from ActionPack.
We are also removing all the deprecation warnings that we introduced in 3.2.x. We have decided to stop introducing API deprecations in all point releases going forward. From now on, it’ll only happen in majors/minors.
Action Mailer
Action Pack
html_escape should escape single quotes. Santiago Pastorino
Reverted the deprecation of :confirm
. Rafael Mendonça França
Reverted the deprecation of :disable_with
. Rafael Mendonça França
Reverted the deprecation of :mouseover
option to image_tag
. Rafael Mendonça França
Reverted the deprecation of button_to_function
and link_to_function
helpers. Rafael Mendonça França
Active Model
Active Record
Do not set RAILS_ENV to “development” when using db:test:prepare
and related rake tasks.
This was causing the truncation of the development database data when using RSpec.
In RC2 was fixed again when using config.active_record.schema_format = :sql
Rafael Mendonça França
Do not consider the numeric attribute as changed if the old value is zero and the new value is not a string. Fixes #7237. Rafael Mendonça França
Removes the deprecation of update_attribute
. fxn
Reverted the deprecation of composed_of
. Rafael Mendonça França
Reverted the deprecation of *_sql
association options. They will
be deprecated in 4.0 instead. Jon Leighton
Do not eager load AR session store. ActiveRecord::SessionStore depends on the abstract store in Action Pack. Eager loading this class would break client code that eager loads Active Record standalone. Fixes #7160
Xavier Noria
Do not set RAILS_ENV to “development” when using db:test:prepare
and related rake tasks.
This was causing the truncation of the development database data when using RSpec.
Fixes #7175.
Rafael Mendonça França
Active Resource
Active Support
Fix ActiveSupport integration with Mocha > 0.12.1. Mike Gunderloy
Reverted the deprecation of ActiveSupport::JSON::Variable. Rafael Mendonça França
Railties
:data => { :confirm => "Text" }
syntax instead of :confirm
. Rafael Mendonça FrançaYou can find an exhaustive list of changes on github.
Thanks to everyone!