4 ms·

For people applying the security patches, please beware that Rails 3.2.11 has broken some things (I've been having issues related to bad JSON parsing). Fortuna

• mjbellantoni 14y ago
  I believe I am also seeing these issues in 3.1.10.
• ches 14y ago
  This bit me too, upgrading an app from 3.2.8: https://github.com/rails/rails/issues/8269 https://github.com/rails/rails/issues/8269
• adamonduty 14y ago
  For this very reason I patched a version of Rails 3.2.8 with the following patch files distributed by the ror-security mailing list[1]: 3-2-dynamic_finder_injection.patch 3-2-null_array_param.patch 3-2-xml_parsing.patch The changelogs didn't cleanly apply but everything else did. In your Gemfile, gem 'rails', :git => 'git://github.com/adamonduty/rails', :branch => '3.2.8_with_security_patches' This will install version 3.2.8a. If you get a bundler error "NoMethodError: undefined method [] for nil:NilClass", try upgrading your rubygems-bundler gem to version 1.1.0. See https://github.com/adamonduty/rails/tree/3.2.8_with_security_patches https://github.com/adamonduty/rails/tree/3.2.8_with_security... for the commits. Given the number of changes and known issues in 3.2.9, I don't understand why the core team didn't perform a similar release. [1] https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security https://groups.google.com/forum/?fromgroups=#!topic/rubyonra...