Security fix

[catagits/Catalyst-Action-REST.git] / Changes

 Remove Storable and FreezeThaw from the list
 of serialization methods offered by default, and
 from the docs - they're totally unsafe :/

Tue 11 Dec 2012 22:04:00 GMT - Release 1.06
 Sort list of allowed methods. RT#81825

Mon  2 Jul 2012 20:13:00 BST - Release 1.05
 Bugfix get_allowed_methods list:
  * include HEAD
  * remove "not_implemented"

Sat  30 Jun 2012 10:25:00 BST - Release 1.04
 Bugfix to _dispatch_rest_method

Wed  28 Jun 2012 00:40:00 BST - Release 1.03
 Expose _get_allowed_methods to the API (wreis)

 Fix default OPTIONS handler: As the ->body is defined, then serialization
 won't happen and we don't get wrong responses. (wreis)

 Add default HEAD handler: auto dispatches to _GET method if it exists (wreis)

Tue  5 Jun 2012 22:23:00 BST - Release 1.02
 Fix forwarded REST methods, e.g. foo_GET to be more
 correctly displayed as a forward in the stats info.

 Make public response building methods for errors
 _unsupported_media_type and _serialize_bad_request which
 can be extended from an action-role to return custom
 error response.

Tue  29 May 2012 20:19:00 BST - Release 1.01
 Add Catalyst::Action::Deserialize::JSON::XS

 Fix JSON::XS useage to depend on JSON.pm v2.0, and rely on the
 fact that can be backed by XS code, by explicitly setting
 $ENV{'PERL_JSON_BACKEND'} = 2

Fri  13 Apr 2012 09:31:00 BST - Release 1.00
  Repack without auto_include to stop Module::Install inlining
  Test::More without Test::Builder. RT#76524

Tue  28 Feb 2012 09:09:00 GMT - Release 0.99
  Repack with new Module::Install to stop depending on an unnecessary
  ExtUtils::MakeMaker version.

Tue  21 Feb 2012 11:40:00 GMT - Release 0.98
  More fixes as per last release.

Tue  21 Feb 2012 09:58:00 GMT - Release 0.97
  Fix test with latest Catalyst version which passes _log into
  requests.

Mon  20 Jan 2012 11:22:00 GMT - Release 0.96
  Added fix for RT 63537 (from Gerv) and tests to check it.

Wed  04 Jan 2012 19:34:00 GMT - Release 0.95
  Fix regex for JSONP parameter name to be able to include the . character
  in Catalyst::Action::Serialize::JSONP. RT#73741

  Add optional location parameter to status_accepted handler. RT#73691 (ghenry)

Fri  09 Dec 2011 08:35:00 GMT - Release 0.94
  Add 403 Forbidden and 302 Not Found status methods to
  Catalyst::Controller::REST (Caleb Cushing)

Wed  12 Oct 2011 11:37:00 CDT - Release 0.93
  Add a "Callback" serializer/deserializer to allow for more customization in
  how the REST data is parsed/generated (bphillips)

Sat  01 Oct 2011 11:04:00 BST - Release 0.92
  Add a Catalyst::Action::DeserializeMultiPart, allowing one part of a multipart
  request to be deserialized as the REST data (allowing other parts to be used for
  file uploads, for example) (bphillips)

Thu  04 Aug 2011 14:37:21 CEST - Release 0.91
  For the deserialization action class, make the HTTP methods it operates on
  configurable on a per-action level (plu, rafl).

Fri  25 Feb 2011 13:56:00 GMT - Release 0.90
  Remove test which is no longer applicable and fails in the latest Catalyst
  release.

Mon  24 Jan 2011 21:57:42 GMT - Release 0.89
  All classes are now made immutable. (Dave Rolsky)

  Added a Catalyst::Action::REST::ForBrowsers class. This will try to dispatch
  GET requests to a foo_GET_html method before trying foo_GET. (Dave Rolsky)

Tue  11 Jan 2011 23:07:00 GMT - Release 0.88
  Fix documentation for overriding Serialize and Deserialize actions
  in Catalyst::Controller::REST.

  Avoid warning with empty response bodies and new Catalyst version
  (>= 5.80030)

  Returning a body of '' is now possible - Catalyst::Action::Serialize
  acts like Catalyst::Action::RenderView (>= 0.16) by using the has_body
  predicate in Catalyst::Response (>= 5.80030)

Wed  3 Nov 2010 19:46:00 GMT - Release 0.87

  Fix Request class role when used with new Moose and other request
  class roles.

Wed  1 Sept 2010 23:14:00 BST - Release 0.86

  Add rest_serializer_json_options config key useable to set options
  like relaxed => 1 to be passed to the JSON serializer (Ton Voon)

  Make Data::Dumper unserializer safer by using a Safe compartment (Ton Voon)

Thu 13 May 2010 10:09:19 CEST - Release 0.85

  Make Catalyst::Action::Serialize::View return directly rather than serializing
  a response for 3XX status codes. This stops back-compat breakage from the
  previous change (in 0.84), whilst also allowing actual data serializers
  to still handle 3XX.

  Fix docs in Catalyst::TraitFor::Request::REST::ForBrowsers. (RT#54983)

Thu  6 May 2010 09:27:56 BST - Release 0.84
  Revert always using a trait rather than Catalyst::Request::REST to improve
  debug messages.

  Add a status_multiple_choices helper method to the Controller base class.

  Allow 3XX responses to be serialized.

Mon  8 Feb 2010 22:17:12 GMT - Release 0.83
  Make it possible to deserialize a request with a DELETE method. This probably
  breaks 'strict' REST guidelines, but is useful for being able to delete multiple
  resources from a single call by providing a batch delete method.

  Remove JSONP from the list of default serializers (RT#54336)

  Fix MANIFEST (RT#54408)

Thu  4 Feb 2010 22:31:57 GMT - Release 0.82

  Integrated Catalyst::Request::REST::ForBrowsers as
  Catalyst::TraitFor::Request::ForBrowsers. (Dave Rolsky)

  Clarified docs so that they encourage the use of the request traits, rather
  than using Catalyst::Request::REST. (Dave Rolsky)

  When Catalyst::Action::REST or Controller::REST automatically add the trait,
  your request class will no longer end up getting set to
  Catalyst::Request::REST. Instead, creates an anon class with the appropriate
  role. (Dave Rolsky)

  Shut up log output from the tests. (Dave Rolsky)

  Added a $VERSION to every module, mostly to make sure that when people
  install Catalyst::Request::REST::ForBrowsers, they get the version in this
  distro. (Dave Rolsky)

  Change Catalyst::Action::Serialize, Catalyst::Action::Deserialize and
  Catalyst::Action::SerializeBase to be more Moose like.

  Fix JSON and JSON::XS to encode_blessed. (fREW)

  Fix Catalyst::Action::Serialize to use objects instead of classes. (fREW)

  Fix doc nits. (RT#53780)

Thu 14 Jan 20:56:00 GMT 2010 - Release 0.81

  Add a JSONP serialization type.

Sat 19 Dec 14:54:00 GMT 2009 - Release 0.80

  Convert all classes to Moose

  Change Catalyst::Request::REST to be a mostly empty class, with
  all the functionality in Catalyst::TraitFor::Request::REST

  Simplify _get_allowed_methods method (aristotle)

  Rework serializer return so that serializers throw an exception in
  the case of issues serializing the data (hobbs).

Fri 11 Dec 01:08:00 GMT 2009 - Release 0.79

  Cope with invalid (missing required q parameter) header like:
  application/json; charset="utf-8"

  Fix documentation to not mention deprecated things and generally be
  in better style.

  Make author information consistant and only in one module.

Mon 28 Sep 15:01:03 BST 2009 - Release 0.78

  Require Moose for the tests (RT#50066).

Thu 27 Aug 02:21:09 BST 2009 - Release 0.77

  Allow dispatching to Catalyst Actions, for use with ActionClasses
  etc - fREW

  Fix test if CATALYST_DEBUG environment variable is set

Fri Aug 21 21:20:52 BST 2009 - Release 0.76

  Added two new status response helpers (202 no content and 410 gone),
  and tests - Franck Cuny

Mon Aug 17 14:07:41 BST 2009 - Release 0.75

  Fix optional test failures in catalyst-action-serialize-accept.t

  Added a serializer for JSON::XS

  Made test independent of YAML::Syck bugs (dandv)

Wed Jul 22 23:49:16 BST 2009 (t0m) - Release 0.74

  Switch from NEXT to MRO::Compat (agladdish).

  Add display of additional REST actions in the stats, and also fix a warning
  in Catalyst 5.80 when you forward to another action from inside an
  action_FOO method (as it was confusing the stats).

  POD fixes

  Catalyst::Action::REST no longer @ISA Catalyst or Catalyst::Controller.

  Change constructor to call next::method instead of SUPER::

  Change method used to find the application class to be more correct

Sat Jun 27 20:20:09 EDT 2009 (hdp) - Release 0.73
  Packaging fixes

Thu Jun 25 14:52:29 EDT 2009 (hdp) - Release 0.72
  Refresh Module::Install

Sat Mar 28 09:16:09 PDT 2009 (hdp) - Release 0.71
  Fix RT#44641, missing documented 'end' action

Fri Mar 27 23:21:17 PDT 2009 (hdp) - Release 0.70
  Tests that use JSON were either not checking for the version or checking in a
  way that was a syntax error.

Thu Mar 26 14:16:03 PDT 2009 (hdp) - Release 0.69
  Fix RT#32342, deprecated config loses default map (hdp)
  Fix broken insertion of Catalyst::Request::REST for Action::REST (jshirley)

Wed Mar 25 22:33:38 PDT 2009 (hdp) - Release 0.68
  Remove prompt for ancient and deprecated Data::Denter from Makefile.PL
  Remove Data::Dump, which was entirely unused
  Stop tests from dying with Catalyst 5.80

Wed Mar 25 21:59:59 PDT 2009 (hdp) - Release 0.67
  (no changes from 0.67_01)

Wed Mar 25 09:36:00 PDT 2009 (hdp) - Release 0.67_01
  Fix RT#43840, improper app-level config handling
  Fix RT#42859, 'wrong' Catalyst dependency
  Fix RT#42025, stepping on custom request classes

Wed Aug 20 10:42:00 PST 2008 (jshirley) - Release 0.65
  Fully revamped tests to work without any JSON support
  Final removal of JSON::Syck
  Special thanks to jgoulah for helping test this release

Wed Aug 13 08:55:00 PST 2008 (jshirley) - Release 0.64
  New dist to fix issue with Module::Install

Wed Jul 09 11:16:00 PST 2008 (jshirley) - Release 0.63
  Changing from JSON::Syck to JSON/JSON::XS
  Refactored tests to be more applicable to current state of affairs

Wed Jul 02 07:53:00 PST 2008 (jshirley) - Release 0.62
  Reshipping with current Module::Install included due to error reports
    about failed installs


Mon Jun 30 12:28:00 PST 2008 (jshirley) - Release 0.61
  Support official application/json and carp about text/x-json
  Accepted patch from Luke Saunders for processing all accepted content types

Thu Jan  3 17:23:58 PST 2008 (adam) - Release 0.60
  Updated my contact information.
  Prepped for release.

Thu Jan  3 19:42:16 EST 2008
   Fixed RT#30498 - REST controller references Catalyst without
     loading it first.
   Fixed RT#32042 - Import of Params::Validate :all plays badly
     with subclasses that have their own validate()
   Fixed RT#30456 - Debug messages print even with debugging disabled

Thu Jan  3 08:54:09 PST 2008
   Fixed an issue where YAML::Syck versions 0.92 require $c->request->body to
     be stringified

Fri Dec 21 15:23:46 EDT 2007
   Updated the configuration specifiers to operate more in line with the way
   Catalyst expects.  Most notably component based configuration through
   "Controller::RestClass" now works.  "serialize" at the top level simply
   is suggested defaults that all REST classes inherit.

Wed Jul 04 11:17:20 EDT 2007
   Fixed 'default' serializer to set a valid Content-Type: header.  Fixes
   RT ticket 27949.  Note that behavior has changed -- the default
   serializer must now be specified as a content-type, not as a plugin
   name. (dmo@roaringpenguin.com)

Thu May 24 14:01:06 PDT 2007 (adam) - Release 0.41
   Moved a bogus $self->class to $c->component($self->class)

Fri Mar  9 14:13:29 PST 2007 (adam) - Release 0.40
   Refactored the Content-Type negotiation to live in Catalyst::Request::REST.  (drolsky)
   Added some useful debugging. (drolsky)
   Added a View serializer/deserializer, which simply calls the correct
   Catalyst view.  ('text/html' => [ 'View', 'TT' ]) (claco, adam)

Wed Dec  6 00:45:02 PST 2006 (adam) - Release 0.31
   Fixed a bug where we would report a blank content-type negotiation.
   Added Data::Dump as a dependency.

Tue Dec  5 13:02:08 PST 2006 (adam)
   Made the YAML::HTML view automatically append content-type=text/html on
     the resulting URLs.

Sun Dec  3 12:24:16 PST 2006 (adam) - Release 0.30
   Updated the Makefile to support optional installation of the different
     Serialization formats.
   Renamed some of the test cases, since the execution order doesn't
     matter.
   Fixed things so that not having a Serialization module returns 415.
   Fixed things so that failure to Deserialize sends the proper status.
   Refactored the Plugin loading to Catalyst::Action::SerializeBase.
   Updated the Documentation.
   Added a whole raft of serializers. (JSON, all the Data::Serializer
     supported ones, and XML::Simple)
   Added test cases.

Thu Nov 30 23:51:04 PST 2006 (adam)
   Refactored the Catalyst::Action::REST dispatch, so that the default
     method is called before any _METHOD handlers.  In addition, moved
     the 405 Not Implemented handler to be foo_not_implemented, instead
     of the default sub.  (daisuke++ pointed out the inconsistency and
     provided a patch, and I added the foo_not_implemented support)

   Added in automated OPTIONS handler, which constructs the allow
     header for you, just like the 405 handler.  Can be overridden
     with a normal _METHOD sub.

   Refactored Test::Rest, so that it uses closures to create the
     very similar $test->method() subs.

   Added tests for Catalyst::Action::REST.

Thu Nov 30 17:14:51 PST 2006 (adam) - Release 0.2
   Added documentation patch from Daisuke Maki (daisuke@endeworks.jp)
   Added dependency patch from Daisuke Maki (daisuke@endeworks.jp)

Sun Nov 19 16:24:20 PST 2006 (adam) - Release 0.1
   Added status_accepted (Code 202)
   Added a first pass at documentation.

Mon Oct 16 14:48:54 PDT 2006 (adam)
   Added in Test Suite
   Created Catalyst::Action::Serialize and Catalyst::Action::Deserialize
   Added Data::Serializer actions
   Added status_created helper method

Wed Oct 18 17:29:07 PDT 2006 (adam)
   Added more status_ helpers

Thu Oct 19 16:04:33 PDT 2006 (adam)
   Converted error helpers to return an object instead of plain-text.  It's
     a more consistent model than a text/plain error message.
   Added logging to 4xx status handlers