Rails Ruby on Rails → 2.3.6

Closed Tickets

• ✔ #3448 Button_to does not return an HTML-safe string 2-3-stable patch xss ✓committed
• ✔ #3018 Introduce notion of 'html_safe?' to Strings in preparation for on-by-default XSS no tags ✓resolved
• ✔ #3520 Add inverse polymorphic association support activerecord inverse_of patch tested ✓resolved
• ✔ #2338 ActionMailer Mailer Views and Content Type 2-3-stable actionmailer layout multipart ✓duplicate
• ✔ #3533 Backport :inverse_of from 3.0 to 2.3.x backport inverse_of ✓resolved
• ✔ #3952 link_to XSS problem 2.3.x html_safe link_to ✓resolved
• ✔ #3185 Docs and tests for the Errors.each_error method 2.3.x active_record i18n patch ✓committed
• ✔ #3535 New XSS protections breaks yaml string xss yaml ✓committed
• ✔ #3450 Field_set_tag doesn't escape the legend patch xss ✓wontfix
• ✔ #3449 Label tag doesn't escape its input patch xss ✓wontfix
• ✔ #4241 [PATCH] ActionView::SafeBuffer should be there for backwards compatibility 2.3.6 actionpack activesupport patch ✓committed
• ✔ #3513 :inverse_of not honored when replacing a has_one association activerecord inverse_of patch tested ✓resolved
• ✔ #2993 First request will always have an empty body due to delayed load of action_controller/cgi_process no tags ✓resolved