Mathijs Kwik

The description of the bug in the changelog is wrong. Look at the code before the patch, it has: "return false if callback(:before_save) == false" in it. So the...

@Alex

Ok, but 'that domain' would happen to be the rails-site right? so an attacker can't set that. In case I want to enable it for my site, I should already ma...

Flash can forge every kind of request they want, but as far as I know (don't have any reference, and I don't know flash, so I must have picked it up somewhere) ...

Interesting question, I can't answer that.

For example, this existing test is no longer valid if we're only going to worry about non-ajax html forms:

I think ...

Well, you are right, checking for an empty content format + DELETE + request format XML is the thing that needs to get fixed now.

But looking at the problem fro...

I responded to your post at http://rails.lighthouseapp.com/p...

I don't think this ticket should be re-opened, let's discuss the issue there.

Matthew,

Please read the thread you linked to entirely (especially my may-1st post).

The reason why we changed to content-type instead of accept-header is simpl...

I would like to have substitution+sanitizing features on :joins.

class Post
  belongs_to :user
  named_scope :by_admins, {
    :joins => 'inner join users as...

When using find_or_initialize_by on an association, newly created objects don't get added to the association-array. This is the case when using build on an asso...

When building an object through an association, the resulting object isn't bound to the proxy owner if the proxy owner is a new record. If the proxy owner is al...