Fix possible XSS vulnerability with the translate method in controllers
CVE-2024-26143
Active Job
No changes.
Action Mailer
No changes.
Action Cable
No changes.
Active Storage
Disables the session in ActiveStorage::Blobs::ProxyController
and ActiveStorage::Representations::ProxyController
in order to allow caching by default in some CDNs as CloudFlare
Disables the session in ActiveStorage::Blobs::ProxyController
and ActiveStorage::Representations::ProxyController
in order to allow caching by default in some CDNs as CloudFlare
Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.
All Depfu comment commands
@depfu rebase
Rebases against your default branch and redoes this update
@depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@depfu cancel merge
Cancels automatic merging of this PR
@depfu close
Closes this PR and deletes the branch
@depfu reopen
Restores the branch and reopens this PR (if it's closed)
@depfu pause
Ignores all future updates for this dependency and closes this PR
@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)
Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.
What changed?
✳️ rails (7.0.8 → 7.0.8.1) · Repo
Release Notes
7.0.8.1
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 4 commits:
Preparing for 7.0.8.1 release
update changelog
fix XSS vulnerability when using translation
Merge pull request #48869 from brunoprietog/disable-session-active-storage-proxy-controllers
↗️ actioncable (indirect, 7.0.8 → 7.0.8.1) · Repo · Changelog
Release Notes
7.0.8.1 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 4 commits:
Preparing for 7.0.8.1 release
update changelog
fix XSS vulnerability when using translation
Merge pull request #48869 from brunoprietog/disable-session-active-storage-proxy-controllers
↗️ actionmailbox (indirect, 7.0.8 → 7.0.8.1) · Repo · Changelog
↗️ actionmailer (indirect, 7.0.8 → 7.0.8.1) · Repo · Changelog
Release Notes
7.0.8.1 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 4 commits:
Preparing for 7.0.8.1 release
update changelog
fix XSS vulnerability when using translation
Merge pull request #48869 from brunoprietog/disable-session-active-storage-proxy-controllers
↗️ actionpack (indirect, 7.0.8 → 7.0.8.1) · Repo · Changelog
Release Notes
7.0.8.1 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 4 commits:
Preparing for 7.0.8.1 release
update changelog
fix XSS vulnerability when using translation
Merge pull request #48869 from brunoprietog/disable-session-active-storage-proxy-controllers
↗️ actiontext (indirect, 7.0.8 → 7.0.8.1) · Repo · Changelog
Release Notes
7.0.8.1 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 4 commits:
Preparing for 7.0.8.1 release
update changelog
fix XSS vulnerability when using translation
Merge pull request #48869 from brunoprietog/disable-session-active-storage-proxy-controllers
↗️ actionview (indirect, 7.0.8 → 7.0.8.1) · Repo · Changelog
Release Notes
7.0.8.1 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 4 commits:
Preparing for 7.0.8.1 release
update changelog
fix XSS vulnerability when using translation
Merge pull request #48869 from brunoprietog/disable-session-active-storage-proxy-controllers
↗️ activejob (indirect, 7.0.8 → 7.0.8.1) · Repo · Changelog
Release Notes
7.0.8.1 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 4 commits:
Preparing for 7.0.8.1 release
update changelog
fix XSS vulnerability when using translation
Merge pull request #48869 from brunoprietog/disable-session-active-storage-proxy-controllers
↗️ activemodel (indirect, 7.0.8 → 7.0.8.1) · Repo · Changelog
Release Notes
7.0.8.1 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 4 commits:
Preparing for 7.0.8.1 release
update changelog
fix XSS vulnerability when using translation
Merge pull request #48869 from brunoprietog/disable-session-active-storage-proxy-controllers
↗️ activerecord (indirect, 7.0.8 → 7.0.8.1) · Repo · Changelog
Release Notes
7.0.8.1 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 4 commits:
Preparing for 7.0.8.1 release
update changelog
fix XSS vulnerability when using translation
Merge pull request #48869 from brunoprietog/disable-session-active-storage-proxy-controllers
↗️ activestorage (indirect, 7.0.8 → 7.0.8.1) · Repo · Changelog
Release Notes
7.0.8.1 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 4 commits:
Preparing for 7.0.8.1 release
update changelog
fix XSS vulnerability when using translation
Merge pull request #48869 from brunoprietog/disable-session-active-storage-proxy-controllers
↗️ activesupport (indirect, 7.0.8 → 7.0.8.1) · Repo · Changelog
Release Notes
7.0.8.1 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 4 commits:
Preparing for 7.0.8.1 release
update changelog
fix XSS vulnerability when using translation
Merge pull request #48869 from brunoprietog/disable-session-active-storage-proxy-controllers
↗️ rack (indirect, 2.2.8 → 2.2.8.1) · Repo · Changelog
Release Notes
2.2.8.1
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 4 commits:
bump version
Avoid 2nd degree polynomial regexp in MediaType
Return an empty array when ranges are too large
Fixing ReDoS in header parsing
↗️ railties (indirect, 7.0.8 → 7.0.8.1) · Repo · Changelog
Release Notes
7.0.8.1 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by 4 commits:
Preparing for 7.0.8.1 release
update changelog
fix XSS vulnerability when using translation
Merge pull request #48869 from brunoprietog/disable-session-active-storage-proxy-controllers
Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with
@depfu rebase
.All Depfu comment commands