Rails 2.1.2: Security, other fixes

Posted by David October 23, 2008 @ 06:21 PM

Rails 2.1.2 includes the same two security fixes that we pushed out for 2.0.x recently. We’re talking about a backport of the offset/limit sanitization fix for Active Record and a fix against header-injection when using user-contributed strings in redirect_to (see Response Splitting for more information).

In addition, Rails 2.1.2 fixes the warning that users of RubyGems 1.3.0 were having with script/generate as well as a range of other minor fixes. Enjoy!

As always, you can install with:
gem install rails --version 2.1.2

Posted in Releases | 23 comments

Comments

  1. Dmitry on 23 Oct 19:16:

    Thanks David

  2. Norman Clarke on 23 Oct 20:17:

    Great timing. I’ve been looking forward to this release for a few weeks. :-)

  3. Denis on 23 Oct 20:53:

    I hope it is backwards-compatible…

  4. scott on 24 Oct 00:05:

    great, now where is 2.2?

  5. Jinzhu on 24 Oct 00:31:

    Prepare for Rails 2.2.0 [RC1]

    http://github.com/rails/rails/commit/57c31a380e0136607f3ce6ee568730ec1539e163

  6. jtara on 24 Oct 01:24:

    Um…. it looks like 2.2 has been erroneously put up on the Gem server along with 2.1.2!

    I just did a gem update, and got 2.2.

    Came here looking for release info, and there is none, other than this.

    Subsequently did a gem install rails—version 2.1.2 and got 2.1.2.

    “2.2” seems incomplete – no ri or rdoc, for example.

  7. DHH on 24 Oct 07:56:

    jtara, we’re still working on that RC1 gem. If you got it from gem update, it’s because you’ve added gems.rubyonrails.org - the beta gem server - to your gem sources. Doing that and using gem update is probably a bad combination.

  8. Paul Barry on 24 Oct 10:29:

    On my Ubuntu running ruby 1.8.6 (2007-09-24 patchlevel 111) [i486-linux], I get the following message when I try to generate a model: “undefined method `empty?’ for /_generator$/:Regexp” ... downgrading to 2.1.1 fixes this. Just so you know.

  9. DHH on 24 Oct 10:50:

    Paul, what version of RubyGems are you running?

  10. Born on 24 Oct 15:26:

    How can I install Rails 2.2.0 Beta?

  11. jtara on 24 Oct 19:00:

    Born, see (6) and (7). :)

  12. Paul Barry on 24 Oct 19:29:

    When I type: “gem -v” I get back 1.1.1, this is the rubygems that comes with Ubuntu.

  13. Tex on 24 Oct 22:37:

    Thank u very much !!!

  14. Luke Randall on 27 Oct 06:43:

    @Paul

    This seems to be caused by using an old version of RubyGems. See http://afreshcup.com/2008/10/25/rails-212-and-22rc1-update-your-rubygems/ for more information

  15. Torben on 28 Oct 09:25:

    Thank you very much. I use Ruby on Rails at university and your site help me a lot!

  16. Paul Barry on 29 Oct 09:14:

    Thanks Luke and David … my older RubyGems appears to be the problem. Regards, Paul.

  17. Dario on 01 Nov 22:32:

    I’m trying to update Rails to 2.1.2 but when I use:

    gem install rails—version 2.1.2

    then:

    Gem::manage_gems is deprecated and will be removed on or after March 2009.

  18. Dario on 02 Nov 18:29:

    I found the solution:

    http://blog.paulmoser.co.uk/index.php/2008/10/31/ruby-on-rails-on-ubuntu-804/

    I think this is a problem only for Ubuntu users.

  19. krishna on 08 Nov 06:01:

    I was installed rails 2.1.2 ,I want to install the gem actionwebservice 1.2.6 it is showing the error actionwebservice requires actionpack<=1.3.6>.how to solve this problem to access with soap. I studied that in rail 2.0 soap was removed. is it access in rails 2.1.2.please solve my doubt

  20. Luis Rojas on 08 Nov 23:05:

    Is it safe now to use Rails 2.1.2 with Ruby 1.8.7-p72 ?

    Thanks in advance

  21. Linwood Sparks on 13 Nov 02:08:

    r7e5yq2n4d2p3v30

  22. Esteban King on 13 Nov 03:01:

    d009blrqkg03h0jd

  23. Usman Ahmad on 21 Nov 13:46:

    Hi i have updated my application from rails 1.2.3 to rails 2.1.2, i am stuck in a very vague error that i am unable to access the constants defined in environment.rb in any of my models, this happens only when i run the application on production environment. Is there any change in constants scope in environment.rb in Rails 2.1.2? Any guidance will be much appreciated as its very annoying problem occurring only on production environment.