In the current router DSL, using the +match+ DSL
method will match all verbs for the path to the
specified endpoint.
In the vast majority of cases, people are
currently using +match+ when they actually mean
+get+. This introduces security implications.
This commit disallows calling +match+ without
an HTTP verb constraint by default. To explicitly
match all verbs, this commit also adds a
:via => :all option to +match+.
Closes#5964
mounted_helpers are a bit similar to url_helpers. They're automatically
included in controllers for Rails.application and each of mounted
Engines. Mounted helper allows to call url_for and named helpers for
given application.
Given Blog::Engine mounted as blog_engine, there are 2 helpers defined:
app and blog_engine. You can call routes for app and engine using those
helpers:
app.root_url
app.url_for(:controller => "foo")
blog_engine.posts_path
blog_engine.url_for(@post)
* added more tests for prefix generation
* fixed bug with generating host for both prefix and url
* refactored url_for method
* organized tests for prefix generation
It's based specifying application's script_name with:
Rails.application.default_url_options = {:script_name => "/foo"}
default_url_options method is delegated to routes. If router
used to generate url differs from the router passed via env
it always overwrites :script_name with this value.
This requires knowledge about original SCRIPT_NAME and
the parent router. It should be pass through the env
as ORIGIAL_SCRIPT_NAME and action_dispatch.parent_routes
This technique is here to allow using routes from Engine in Application
and vice versa. When using Engine routes inside Application it should
generate prefix based on mount point. When using Engine routes inside
Engine it should use env['SCRIPT_NAME']. In any other case it should
generate prefix as env should not be even available.
