Labyricorn/liquid
1
0
Fork 0
mirror of https://github.com/Shopify/liquid.git synced 2026-09-20 03:10:39 -07:00
Code Issues Packages Projects Releases Wiki Activity

Cherry pick security fix (#274) to 2-6-stable

Browse Source
This commit is contained in:
Florian Weingarten
2014-01-10 11:22:28 -05:00
parent 442041206f
commit eb409ff237
3 changed files with 16 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
History.md
+7 -1
View File
@@ -3,7 +3,13 @@
IMPORTANT: Liquid 2.6 is going to be the last version of Liquid which maintains explicit Ruby 1.8 compatability.
The following releases will only be tested against Ruby 1.9 and Ruby 2.0 and are likely to break on Ruby 1.8.
## 2.6.0 / 2013-11-25 / branch "2.6-stable"
## 2.6.1 / 2014-01-10 / branch "2-6-stable"
Security fix, cherry-picked from master (4e14a65):
* Don't call to_sym when creating conditions for security reasons, see #273 [Bouke van der Bijl, bouk]
* Prevent arbitrary method invocation on condition objects, see #274 [Dylan Thacker-Smith, dylanahsmith]
## 2.6.0 / 2013-11-25
* ...
* Bugfix for #106: fix example servlet [gnowoel]