{"shas":[["66dee26930048a0134f339d20d237a32ced2770d","48ba4ecae63ea24f8d312932c7aa65ddae608243@sap.com","Fixed session ID fixation for ActiveRecord::SessionStore\n\nI have found that Rails will take an invalid session ID specified by the\nclient and materialize a session based on that session ID. This means\nthat it is possible, among other things, for a client to use an\narbitrarily weak session ID or for a client to resurrect a previous used\nsession ID. In other words, we cannot guarantee that all session IDs are\ngenerated by the server and that they are (statistically) unique through\ntime.\n\nThe fix is to always generate a new session ID in #get_session if an\nexisting session cannot be found under the incoming session ID.\n\nAlso added new tests that make sure that an invalid session ID is never\nmaterialized into a new session, regardless of whether it comes in via a\ncookie or a URL parameter (when :cookie_only => false).","Joseph Wong"],["88e6c062423638df667869292050802d674bc0fa","48ba4ecae63ea24f8d312932c7aa65ddae608243@sap.com","Fix for SqlBypass session store\n\nTwo issues fixed:\n1) connection_pool is not defined - needed by SessionStore#drop_table!\nand create_table! since c94651f\n\n2) initialization of connection to the default of AR::Base.connection\nonly occurred at the singleton level - the instance level method defined\nby cattr_accessor did not have this logic","Joseph Wong"],["4735e2ec656163e7400274e237ed37dff5e3fbb6","792d28329de7ed446c01b83f731a071248ffeaf4@wyeworks.com","Merge pull request #2041 from SAP-Oxygen/master-session-id-patch-with-test\n\nFixed session ID fixation for ActiveRecord::SessionStore (for master)","Santiago Pastorino"],["8cf45150dec7f30009d006e52c646acf6b615f89","792d28329de7ed446c01b83f731a071248ffeaf4@wyeworks.com","Merge pull request #2042 from SAP-Oxygen/master-sqlbypass-patch\n\nFix for SqlBypass session store (for master)","Santiago Pastorino"],["8f0e0b63f526967fc13c78eedb5c3a28a8f6ee75","0c2436ea76ed86e37cc05f66dea18d48ef390882@gmail.com","assets.cache_store now defaults to filesystem. You will want to share tmp/assets_cache between deploys.","José Valim"],["704ee0df65b6ae9f39bbd4c7b3ed697a4039efd8","0c2436ea76ed86e37cc05f66dea18d48ef390882@gmail.com","Use cache/assets instead.","José Valim"],["5aeba9e6fc9cdd5502614f7d19c5ce1876e9859c","fbf32645451a58774c664dce2f72f8d1330e0cd3@pivotallabs.com","Let ActiveModel instances define partial paths.\n\nDeprecate ActiveModel::Name#partial_path. Now you \nshould call #to_path directly on ActiveModel\ninstances.","Grant Hutchins & Peter Jaros"],["d5453985585f76b5dad04e2ac47e7c2247d21762","fbf32645451a58774c664dce2f72f8d1330e0cd3@pivotallabs.com","Cache ActionView::Helpers::FormBuilder#to_path","Grant Hutchins & Peter Jaros"],["bd7746ad37f220193245781e89aaa0b4ac85cf75","fbf32645451a58774c664dce2f72f8d1330e0cd3@pivotallabs.com","Fix leak in ActiveModel::Conversion#to_path cache.\n\nAlso, remove dead code from AV::PartialRenderer.","Grant Hutchins & Peter Jaros"],["6d18262a08e7f05d2903f46b083b8f369be1f7e8","5117c10eb825655497d1cf2e85c52963109949e1@gmail.com","Cache PartialRenderer#partial_name by object path.","Peter Jaros"]],"ref":"refs/heads/to_path","size":10,"head":"6d18262a08e7f05d2903f46b083b8f369be1f7e8","push_id":36522462}