kotovalexarian-likes-github/rails--rails
1
0
Fork 0
mirror of https://github.com/rails/rails.git synced 2022-11-09 12:12:34 -05:00
Code Releases Activity

Update upgrading guide regarding render :text

Browse source
This commit is contained in:
Prem Sichanugrist 2014-02-18 09:30:43 -05:00
parent 3047376870
commit ede0f8c62d
1 changed files with 19 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
guides/source/upgrading_ruby_on_rails.md
View file

@ -329,6 +329,25 @@ User.inactive
# SELECT "users".* FROM "users" WHERE "users"."state" = 'inactive'
```
### Rendering content from string
Rails 4.1 introduces `:plain`, `:html`, and `:body` options to `render`. Those
options are now the preferred way to render string-based content, as it allows
you to specify which content type you want the response sent as.
* `render :plain` will set the content type to `text/plain`
* `render :html` will set the content type to `text/html`
* `render :body` will *not* set the content type header.
From the security standpoint, if you don't expect to have any markup in your
response body, you should be using `render :plain` as most browsers will escape
unsafe content in the response for you.
We will be deprecating the use of `render :text` in a future version. So please
start using the more precise `:plain:`, `:html`, and `:body` options instead.
Using `render :text` may pose a security risk, as the content is sent as
`text/html`.
Upgrading from Rails 3.2 to Rails 4.0
-------------------------------------