README.rdoc in rack-1.3.10 vs README.rdoc in rack-1.4.0

- old
+ new

@@ -1,6 +1,6 @@ -= Rack, a modular Ruby webserver interface {<img src="https://secure.travis-ci.org/rack/rack.png" alt="Build Status" />}[http://travis-ci.org/rack/rack] {<img src="https://gemnasium.com/rack/rack.png" alt="Dependency Status" />}[https://gemnasium.com/rack/rack] += Rack, a modular Ruby webserver interface Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called @@ -25,15 +25,12 @@ These web servers include Rack handlers in their distributions: * Ebb * Fuzed * Glassfish v3 * Phusion Passenger (which is mod_rack for Apache and for nginx) -* Puma * Rainbows! * Unicorn -* unixrack -* uWSGI * Zbatery Any valid Rack app will run the same on all these handlers, without changing anything. @@ -133,16 +130,12 @@ == Running the tests Testing Rack requires the bacon testing framework: - bundle install --without extra # to be able to run the fast tests + gem install bacon -Or: - - bundle install # this assumes that you have installed native extensions! - There are two rake-based test tasks: rake test tests all the fast tests (no Handlers or Adapters) rake fulltest runs all the tests @@ -360,11 +353,11 @@ * Fix a DOS vector from MRI stdlib backport * July 16, 2011: Sixteenth public release 1.3.2 * Fix for Rails and rack-test, Rack::Utils#escape calls to_s -* September 16, 2011: Seventeenth public release 1.3.3 +* Not Yet Released: Seventeenth public release 1.3.3 * Fix bug with broken query parameters in Rack::ShowExceptions * Rack::Request#cookies no longer swallows exceptions on broken input * Prevents XSS attacks enabled by bug in Ruby 1.8's regexp engine * Rack::ConditionalGet handles broken If-Modified-Since helpers @@ -378,14 +371,10 @@ * Add some supporting files for travis-ci * October 17, 2011: Twentieth public release 1.3.5 * Fix annoying warnings caused by the backport in 1.3.4 -* December 28th, 2011: Twenty first public release: 1.1.3. - * Security fix. http://www.ocert.org/advisories/ocert-2011-003.html - Further information here: http://jruby.org/2011/12/27/jruby-1-6-5-1 - * December 28th, 2011: Twenty fourth public release 1.4.0 * Ruby 1.8.6 support has officially been dropped. Not all tests pass. * Raise sane error messages for broken config.ru * Allow combining run and map in a config.ru * Rack::ContentType will not set Content-Type for responses without a body @@ -401,118 +390,15 @@ * Added the Teapot status code * rackup now defaults to Thin instead of Mongrel (if installed) * Support added for HTTP_X_FORWARDED_SCHEME * Numerous bug fixes, including many fixes for new and alternate rubies -* January 22nd, 2012: Twenty fifth public release 1.4.1 - * Alter the keyspace limit calculations to reduce issues with nested params - * Add a workaround for multipart parsing where files contain unescaped "%" - * Added Rack::Response::Helpers#method_not_allowed? (code 405) - * Rack::File now returns 404 for illegal directory traversals - * Rack::File now returns 405 for illegal methods (non HEAD/GET) - * Rack::Cascade now catches 405 by default, as well as 404 - * Cookies missing '--' no longer cause an exception to be raised - * Various style changes and documentation spelling errors - * Rack::BodyProxy always ensures to execute its block - * Additional test coverage around cookies and secrets - * Rack::Session::Cookie can now be supplied either secret or old_secret - * Tests are no longer dependent on set order - * Rack::Static no longer defaults to serving index files - * Rack.release was fixed - -* January 6th, 2013: Twenty sixth public release 1.1.4 - * Add warnings when users do not provide a session secret - -* January 6th, 2013: Twenty seventh public release 1.2.6 - * Add warnings when users do not provide a session secret - * Fix parsing performance for unquoted filenames - -* January 6th, 2013: Twenty eighth public release 1.3.7 - * Add warnings when users do not provide a session secret - * Fix parsing performance for unquoted filenames - * Updated URI backports - * Fix URI backport version matching, and silence constant warnings - * Correct parameter parsing with empty values - * Correct rackup '-I' flag, to allow multiple uses - * Correct rackup pidfile handling - * Report rackup line numbers correctly - * Fix request loops caused by non-stale nonces with time limits - * Fix reloader on Windows - * Prevent infinite recursions from Response#to_ary - * Various middleware better conforms to the body close specification - * Updated language for the body close specification - * Additional notes regarding ECMA escape compatibility issues - * Fix the parsing of multiple ranges in range headers - -* January 6th, 2013: Twenty ninth public release 1.4.2 - * Add warnings when users do not provide a session secret - * Fix parsing performance for unquoted filenames - * Updated URI backports - * Fix URI backport version matching, and silence constant warnings - * Correct parameter parsing with empty values - * Correct rackup '-I' flag, to allow multiple uses - * Correct rackup pidfile handling - * Report rackup line numbers correctly - * Fix request loops caused by non-stale nonces with time limits - * Fix reloader on Windows - * Prevent infinite recursions from Response#to_ary - * Various middleware better conforms to the body close specification - * Updated language for the body close specification - * Additional notes regarding ECMA escape compatibility issues - * Fix the parsing of multiple ranges in range headers - * Prevent errors from empty parameter keys - * Added PATCH verb to Rack::Request - * Various documentation updates - * Fix session merge semantics (fixes rack-test) - * Rack::Static :index can now handle multiple directories - * All tests now utilize Rack::Lint (special thanks to Lars Gierth) - * Rack::File cache_control parameter is now deprecated, and removed by 1.5 - * Correct Rack::Directory script name escaping - * Rack::Static supports header rules for sophisticated configurations - * Multipart parsing now works without a Content-Length header - * New logos courtesy of Zachary Scott! - * Rack::BodyProxy now explicitly defines #each, useful for C extensions - * Cookies that are not URI escaped no longer cause exceptions - -* January 7th, 2013: Thirtieth public release 1.3.8 - * Security: Prevent unbounded reads in large multipart boundaries - -* January 7th, 2013: Thirty first public release 1.4.3 - * Security: Prevent unbounded reads in large multipart boundaries - -* January 13th, 2013: Thirty second public release 1.4.4, 1.3.9, 1.2.7, 1.1.5 - * [SEC] Rack::Auth::AbstractRequest no longer symbolizes arbitrary strings - * Fixed erroneous test case in the 1.3.x series - -* February 7th, Thirty fifth public release 1.1.6, 1.2.8, 1.3.10 - * Fix CVE-2013-0263, timing attack against Rack::Session::Cookie - -* February 7th, Thirty fifth public release 1.4.5 - * Fix CVE-2013-0263, timing attack against Rack::Session::Cookie - * Fix CVE-2013-0262, symlink path traversal in Rack::File - -* February 7th, Thirty fifth public release 1.5.2 - * Fix CVE-2013-0263, timing attack against Rack::Session::Cookie - * Fix CVE-2013-0262, symlink path traversal in Rack::File - * Add various methods to Session for enhanced Rails compatibility - * Request#trusted_proxy? now only matches whole stirngs - * Add JSON cookie coder, to be default in Rack 1.6+ due to security concerns - * URLMap host matching in environments that don't set the Host header fixed - * Fix a race condition that could result in overwritten pidfiles - * Various documentation additions - == Contact Please post bugs, suggestions and patches to the bug tracker at <http://github.com/rack/rack/issues>. -Please post security related bugs and suggestions to the core team at -<https://groups.google.com/group/rack-core> or rack-core@googlegroups.com. Due -to wide usage of the library, it is strongly preferred that we manage timing in -order to provide viable patches at the time of disclosure. Your assistance in -this matter is greatly appreciated. - Mailing list archives are available at <http://groups.google.com/group/rack-devel>. Git repository (send Git patches to the mailing list): * http://github.com/rack/rack @@ -584,10 +470,10 @@ IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. == Links -Rack:: <http://rack.github.com/> +Rack:: <http://rack.rubyforge.org/> Official Rack repositories:: <http://github.com/rack> Rack Bug Tracking:: <http://github.com/rack/rack/issues> rack-devel mailing list:: <http://groups.google.com/group/rack-devel> Rack's Rubyforge project:: <http://rubyforge.org/projects/rack>