Rails 1.2.4: Maintenance release
Posted by David October 05, 2007 @ 04:38 AM
This release contains additional deprecation notices, security fixes and some minor performance improvements. All users of 1.2.3 are advised to upgrade.
Deprecation Notices
If you intend to upgrade to 2.0 you should run your tests to and fix any errors that are displayed. The warnings will become errors with the release of 2.0.
If you’re using RESTful routing, pay special attention to the changes to route generation and recognition. The previous use of the semicolon in URLs has been replaced with a regular /. For instance /person/1;edit has become /person/1/edit. This change was made as several libraries, including mongrel, mistakenly treated semi-colons as query string seperators and some browsers and http libraries misbehaved.
Your old ;-based URLs will be continued to be recognized, though. They’re just no longer generated.
Security Enhancements
1.2.4 fixes several potential security issues:
- Session fixation attacks are mitigated by removing support for URL-based sessions
- Changed the JSON encoding algorithms to avoid otential XSS issues when using ActiveRecord::Base#to_json
- Potential Security and performance problems with XmlSimple have been fixed by disabling certain dangerous options by default.
Upgrade with the standard gem install rails command. Rails 1.2.4 serves as a drop-in replacement for 1.2.3.
Update: please see the latest 1.2.5 stable release
first comment
In the 2.0PR article it says to gem install with: gem install rails—source http://gems.rubyonrails.org
Doing this now installs 1.2.4 instead though. Any quick way to gem install 2.0PR, or do we need to use SVN instead?
@crayz: We’ll fix this up in a bit, for now use the rake approach to freeze.
“[...] This change was made as several libraries, including mongrel, mistakenly treated semi-colons as query string seperators and some browsers and http libraries misbehaved.”
Reading the URI spec, Rails got it wrong, not the several libraries, mongrel and some browsers. Its clear from the grammar that the param following the ”;” is part of the path, not part of the query string. See RFC 2396 Section 3.3 Path Component. If you expect to use a ”;” to separate query parameters, it must follow a ”?” per Section 3 and appendix A.
Its very un-cool to put incorrect information about spec-compliant libraries in your release announcement when Rails made the wrong choice to begin with.
After the update “rails
v” is still giving me 1.2.3 -I can see in the checkin history where the individual version numbers got bumped but don’t see this version changed anywhere. My update was successful…anyone else?@Eric: I think you have misread the post. It says mongrel mistakenly treated semi-colons as query string separators. Your reference to the RFC demonstrates that a semi-colon should not be considered part of the query string, but rather as part of the path.
Anyway thanks for the update rails core. Will check it out and run my tests.
dugg! ;)
@Adam: I don’t see where the spec defines any structure for the query string. Parsing it is up to the application, not the server.
One of the real problems here is that /person/1;edit and /person/1 are the same file according to spec. Trying to blame spec-compliant libraries for a change to mongrel isn’t cool.
eagerly awaiting rails 2.0 and thanks for replacing semicolons with forward slashes for restful routing, as it was difficult to explain the choice to new rails learners and user of rails 1.1.x
We want the new AWDWR book updated for rails 2.0!!!:)
Eric, it’s debatable and has been. Since you wish to, please take it to the mailing list.
Did asset_host not make it into 1.2.4? Using:
ActionController::Base.asset_host = “assets%d.fiddle.com”
Results in paths like:
src=”assets%d.fiddle.com/images/hello.png”
Chuck, that’s a Rails 2.0 feature.
I’m hoping this isn’t a silly question, but why was the semicolon chosen as the delimiter initially?
I remember being confused by the choice when it was initially announced, but don’t recall an explanation for the choice over doing something like what is discussed here.
I second Sklyblaze’s request for an updated version of AWDWR
I second Sklyblaze’s request for an updated version of AWDWR
I was just curious if there is a list of all the things deprecated within 1.2.4. If not, no worries then.
@Ryan: The semi colon is a ‘non hierarchical’ path separator. Which has the academically appealing property that:
http://example.com/people/1;edit
is a ‘peer’, rather than a child of
http://example.com/people/1
Which is academically clever, but basically unsupported in most libraries :)
If the semicolon issue is debatable, then why state in the Rails blog that Mongrel and other libraries and browsers’ behavior is mistaken? How about wording it in a neutral way that just says there isn’t consensus? Then everyone can save face.
@semicolon issue:
Now it’s time to hurt your feelings as I upsets software industry fan Hey yo my man look at my hand they look human right? You think I’m a monster ill circus clown Not a specimen don’t look at me funny when I come around.
Leave me alone, leave me alone! (Politics, politics..)
Using rails:freeze:edge means we can’t use the 2.0 PR to create a new Rails project, right? It would be nice to be able to do so in order to see the defaults.
Love the additions to 2.0, thanks guys!
If you really need the gem, you could always check the latest at the rails repository:
gem query -n ‘^rails$’—remote—source http://gems.rubyonrails.org
Then fetch the appropriate version:
gem install rails -v 1.2.3.7707—source http://gems.rubyonrails.org
Obviously avoid updating the gem for now, since you’ll get 1.2.4 again.
Just a quick warning: if you’re on a 256MB VPS, running “sudo gem install rails” takes an hour or more, as it’s grinding the server to death.
I’ve killed mongrel, mysql and apache before, the gem process eats up to 340MB virtual and 210MB res, and the the server spends 99% of the time swapping memory (load average >4).
I can’t remember having seen this problem 3 months ago when initially setting up the server and installing rails 1.2.3.
Update to the post above: I’m now at 135 minutes and currently staring at “Installing ri documentation for activerecord-1.15.4…”. I assume all the other ri and rdoc install tasks will need at least one more hour, bringing me to a total of more than three hours (!) to upgrade to Rails-1.2.4.
This is insane.
I suspect I’m having a similar problem on my VPS. What are the memory requirements for this upgrade?
Thanks for this release!
I don’t use the generated document, so to install Rails:
gem install rails—no-rdoc—no-ri
The last time Rails had a security problem, you guys handled it pretty badly in terms of disclosure.
You then set up a rubyonrails-security Google Group, which lots of people joined, hoping you’d follow best practice around disclosure, going forward. You said you would.
But sadly not. You’ve released a new version of Rails that addresses security issues, but haven’t posted anything to the rubyonrails-security group.
You would do well to consider that being intuitively brilliant at web2.0 doesn’t make you intuitively brilliant at security release management, and that it might be wise to adhere to conventional wisdom in this area until you have a better idea.
Requiring systems managers and developers to read your blog to keep updated on security issues is not a better idea.
Ciao, Sheldon.
I want to upgrade my rails installation on vendor rails from 1.2.3 to 1.2.4 version:
1. gem update => installed rails 1.2.4 ok 2. delete vendor/rails from application 3. run rake rails:freeze:gems
Result: Freezing to the gems for Rails 1.2.4 rake aborted! uninitialized constant Gem::CommandManager::BuildCommand (See full trace by running task with—trace)
And now the trace:Someone can help me please ?
Try upgrading rubygems. Though according to earlier comments, make sure you have plenty of RAM too. This is partly why I don’t use rubygems much anymore …
Thanks Rick, you’re right ! I’ve upgraded to rubygems 0.9.4 and now rake rails:freeze:gems works !!! Thank u very much !!!
FYI: if you are using a commercial database (eg oracle), and upgrade to 1.2.4 you will also need to install the appropriate new activerecord-<db-name>-adapter gem.
Krishna, that’s for the upcoming Rails 2.0.
Rails 1.2.4 is a stable release and this step is not required.
For those looking for more information on the security fixes included in this release please see the rubyonrails-security group post at http://groups.google.com/group/rubyonrails-security/browse_thread/thread/239b034f4f808834 or http://www.rorsecurity.info/2007/10/10/rails-124-maintenance-release-security/
I’ve posted an upgrade guide that includes tips on how to track down deprecated code.
http://www.nullislove.com/2007/10/11/rails-version-124/
Excellent. Thanks to Michael for posting an advisory to the rubyonrails-security group.
How free software projects manage security issues is a big deal for a lot of people, and so this is important to Rails developers.
I know, it sounds crazy; customers who care about what’s under the hood. :-)
But it happens, and it’s happening more and more, as customers are more and more exposed to the open source environment.
Thanks, Sheldon.
Well Done. Hope the version 2.0 will come soon
Thank you for that release!