History.md

1.4.0 (2021-05-19)

Changes

• Removed convert processor and generator (which were quite insecure), in favour of utility commands in Dragonfly::ImageMagick::Commands

Fixes

• Better security for all job steps with parameter validations - addresses CVE-2021-33564

1.3.0 (2021-01-09)

Changes

• Dropped official support for ruby < 2.2 - too annoying to maintain

Fixes

• Fixed losing attachment when transaction rolled back on destroy (dlibanori)
• Fixed fetch_url edge case when redirect url includes special chars (thedanbob)

1.2.1 (2020-07-24)

Features

• Allow having no logger (setting to nil) (kaimou1357)

Fixes

• Fix URI.unescape deprecation warning (alberto-mota)

1.2.0 (2018-11-13)

Fixes

• Replaced quote with escape for escaping shell commands - works with paths with apostrophes

Changes

• Replaced Open3.popen3 with now recommended Open3.capture3 (tomasc)

1.1.5 (2018-03-23)

Fixes

• Moved destroy_dragonfly_attachments into an after_destroy - issue #477 (eldotz)

1.1.4 (2017-12-31)

Fixes

• Fixed data uris not working for long strings (reported dlibanori)
• Removed syntax warnings (swamp09)
• Correct ActiveRecord hook with ActiveSupport.on_load (efatsi)

1.1.3 (2017-06-02)

Fixes

• Make sure imagemagick convert processor updates mime_type correctly when format is changed

1.1.2 (2017-05-06)

Fixes

• Allow relative redirect urls in fetch_url (zorec)
• Fixed Forwardable deprecation warnings (neodude)
• Fixed incorrect detection of empty directories in ruby 2.4 (yuszuv)
• Store content type in meta if it's available so we don't lose information (Lukas Svoboda)

1.1.1 (2016-10-26)

Features

• Added delegate option for imagemagick (Will Fisher)

Fixes

• Use Base64.urlsafe_encode64 (Jan Raasch) Note that this changes b64 encodings from '/' to '_' and '+' to '-' in URLs, which will change a very small number of generated URLs (but shouldn't be enough to cause big recaching problems) URLs are encoded now according to the URL safe base64 specification in RFC 4648. Old URLs are still recognized so won't break.

1.1.0 (2016-10-24)

Fixes

• Fetch a URL with basic auth if it's present in the URI (Ben Pickles)
• Fix rack version problem for older rubies (rack 2.0 only works for ruby >= 2.2.2)
• Updated deprecated syntax in tests for WebMock, RSpec

Changes

• Dropped official support for Ruby <= 1.9.2 and Rubinius

1.0.12 (2015-09-16)

Features

• Made thumb processor args for a specific geometry publicly accesible

1.0.11 (2015-09-04)

Fixes

• Make sure tempfiles are created with paths matching the meta name

1.0.10 (2015-05-14)

Features

• Allow method signified by symbol in storage_options to take an attachment object
• Allow passing in "input_args" to convert processor

Fixes

• correct Rack version

1.0.9 (2015-04-29)

Fixes

• Remove sha parameter being echoed back on error for better security

1.0.8 (2015-04-23)

Fixes

• Job#close re-added, so that tempfiles are immediately removed after each request
• Specs passing for 1.8.7, 1.9.2 (i18n gem version specified)

1.0.7 (2014-08-26)

Changes

• Job#sha uses better algorithm
• renamed protect_from_dos_attacks -> verify_urls and turn on by default

1.0.6 (2014-08-22)

Features

• env can be accessed by routed endpoint blocks

Fixes

• analyser cache doesn't get stored in meta for a given piece of meta - can mess with stringifying analyser return values
• removed default secret, forcing user to specify one explicitly
• deal with "[" character problems in urls #337

1.0.5 (2014-05-15)

Fixes

• fetch_url wasn't correctly getting https endpoints on Ruby approx < 2

1.0.4 (2014-04-11)

Fixes

• fetch_url is more forgiving - assume escaped, if not escape

1.0.3 (2014-01-28)

Fixes

• changing meta on a job (e.g. fetch('blah').encode('jpg')) was interfering with meta on its parent job (e.g. fetch('blah'))

1.0.2 (2013-12-20)

Fixes

• more secure generation of secret in rails generator
• ensure popen3 doesn't hang

1.0.1 (2013-11-28)

Changes

• FileDataStore doesn't use hours_minutes_seconds in its path - it uses a random string instead (12_15_59_saf4fs_file.png -> sdf4c2G_file.png)

Features

• model attribute xxx_changed? method (useful e.g. in validations)

Fixes

• proper support for Ruby 1.8.7 and JRuby (version 1.7.8)
• routed endpoints can deal with returned Attachment objects (rather than returned Job objects) and return 404 if the endpoint proc returns nil
• default Content-Disposition header doesn't url-encode filename unless the request is from IE
• fetch_url deals with urls that redirect to https (previously was blowing up)

1.0.0 (2013-11-24)

Changes

• configuration
  • Dragonfly[:images] -> Dragonfly.app and Dragonfly.app(:named_app)
  • configuration block DSL overhaul
  • Rails is set up using a generator, not by requiring the file "dragonfly/rails/images"
  • Rack::Cache is not inserted by Dragonfly - this is up to the user
• data store spec
  • store/retrieve -> read/write
  • write takes a Content, not a TempObject (though the interface is much the same)
  • return nil on read to signify not found instead of raising
• S3, Couch and Mongo data stores extracted into separate gems
• models
  • easier and simpler to include in custom models using Dragonfly::Model
  • image_accessor, asset_accessor, xxx_accessor, etc. -> single dragonfly_accessor
  • user needs to extend Dragonfly::Model::Validations manually to use dragonfly validations
• Custom processors, datastores, generators and analysers are made easier by Content object which has convenience methods
• Removed "encoders" - these are covered by processors now
• Removed "job" shortcuts - they are not needed as processors can invoke other processors
• No "smart" determination of mime-type - just use file extension (anything more than that can be done by the user)
• metadata is required to be serializable to/from JSON
• removed allow_fetch_file and allow_fetch_url in favour of more fine-control with fetch_file_whitelist and fetch_url_whitelist
• switch off dealing with legacy urls by default
• proper requires throughout the code instead of autoloading
• simple 500 response for unknown errors

Features

• model attachment default (by specifying a path to a e.g. a default image)
• convert and thumb processors take a 'frame' option
• thumb takes a 'format' option
• fetch_file and model.attachment_url= accept a data uri string
• Attachment#xxx_stored, e.g. my_model.my_attachment_stored? (my_attachment here being the attachment name)
• define for creating custom methods on Job/Attachment objects
• url_path_prefix for when mounted in Rack with a "SCRIPT_NAME"
• when customizing response headers, ability to remove headers by setting to nil
• better logging
  • for each response
  • for shell commands

Fixes

• inserting CookieMonster doesn't depend on existence of ActionDispatch::Cookies
• image? returns false for pdfs
• fetch_url raises more useful ErrorResponse on error
• shell commands don't print warnings to stderr
• ability to assign attachment/job from other app

0.9.15 (2013-05-04)

Features

• Allow turning off support of legacy urls

Fixes

• More conservative URL escaping - back to Rack::Utils.escape_path
• Don't check for malicious strings when deserializing from datastores (they're to be trusted)

0.9.14 (2013-02-13)

Features

• Attachment#b64_data

Fixes

• Fix '+' character being converted to ' ' (revert to URI.escape instead of Rack::Utils.escape)
• Support old-style deprecated urls (with a check for malicious ones)
• Handle case where uid is an empty string

0.9.13 (2013-01-30)

Changes

• URLS are encoded/decoded with JSON, not with Marshal

0.9.12 (2012-04-08)

Features

• Allow using a mongo replica set with mongo datastore

Fixes

• define_macro_on_include was giving a stack error with multiple accessors on same app

0.9.11 (2012-03-12)

Features

• Allow the S3 base URL to be customised with url_host (or per-request)
• Added App#name (name as per Dragonfly[:app_name])

Changes

• Better inspect for App, Processor, Analyser, Encoder, Generator, Job, TempObject, RoutedEndpoint, JobEndpoint

Fixes

• Rescue from Excon::Errors::Conflict which apparently gets raised sometimes (don't know why - see #167)
• Alias portrait and landscape without question marks, so magic_attributes can be used with them
• Fixed stack error when using define_macro_on_include twice
• Use fog's sync_clock to overcome potential S3 time skew problems
• Using :name in urls was causing problems when filenames had dashes in them

0.9.10 (2012-01-11)

Fixes

• FileDataStore was causing errors when the storage path was flat (not in a directory structure)

0.9.9 (2011-12-30)

Features

• Created tempfiles use the original file extension if known
• Added :case_sensitive option to validates_property for dealing with upper-case extensions and mime-types.
• Github Markup syntax on readme for code highlighting
• S3DataStore can use https for remote urls (either configurable or per-url)
• to_file can take :mode option for setting custom permissions
• to_file creates intermediate subdirs by default, can be turned off with :mkdirs => false option
• Added some more S3 regions

Changes

• Datastores now use temp_object.meta, not the second arg passed in to store
• meta, name, etc. now lazily load the job on an attachment - previously you'd have to call apply to get the meta from the datastore
• When assigning an image via the activemodel extensions, mark that uid attribute will change
• validates_property uses Rails 3 validators
• Deprecated saved 'heroku' config, in favour of configuring S3 explicitly

Fixes

• Model attachment urls are consistent now - the name is appended to the url (with format "/:job/:name") ONLY if it has the "name" magic attribute
• identify wasn't working properly for files with capital letter extensions
• S3 datastore sets content mime_type by default
• File extensions with numbers like JP2 weren't being processed/analysed properly
• Protect against object_ids being recycled and messing with analyser cache
• All url segments are correctly url-escaped now
• Fixed TempObject File.open mode
• S3DataStore was breaking on bucket_exists? when using AWS IAM
• Put CookieMonster before ActionDispatch::Cookies in rack middleware stack - that way Rack::Cache won't come between them and mess things up

0.9.8 (2011-09-08)

Fixes

• Regenerated gemspec again with ruby 1.8.7 - didn't seem to be fixed

0.9.7 (2011-09-08)

Fixes

• Regenerated gemspec to overcome annoying yaml issue (http://blog.rubygems.org/2011/08/31/shaving-the-yaml-yacc.html)

0.9.6 (2011-09-06)

Features

• Allow setting content_type when storing in Mongo GridFS

Changes

• Tests use Rails 3.1

Fixes

• Moved from fog's deprecated get_object_url to get_object_https_url
• Allow initializing a TempObject with Rack::Test::UploadedFile
• Tests working in Windows (except feature that uses FileCommandAnalyser)
• Better shell quoting

0.9.5 (2011-07-27)

Features

• Added reflection method app.analyser_methods

Fixes

• Fixed convert and identify for files with spaces
• Fixed size validations for Rails 3.0.7

0.9.4 (2011-06-10)

Fixes

• Made use of Rack calling close on the response body to clean up tempfiles. The response body is now the job, which delegates each to the temp_object.

0.9.3 (2011-06-03)

Fixes

• TempObject#to_file sets file permissions 644 - copying wasn't previously guaranteeing this
• Added TempObject#close and closed?, which Rack uses to clean up tempfiles
• replaced '/' characters with '~' in base64 encoded urls (they were confusing url recognition)

0.9.2 (2011-05-19)

Features

• Added env['dragonfly.job'] for use in other Rack middlewares
• Added CookieMonster middleware for removing 'Set-Cookie' headers

Fixes

• Remove 'Set-Cookie' header from any requests coming from a rails route

0.9.1 (2011-05-11)

Features

• Added reflection methods app.processor_methods, app.generator_methods and app.job_methods

Fixes

• Improved performance of resize_and_crop method, using imagemagick built-in '^' operator
• Improved server security validations
• Deal with Excon::Errors::SocketError: EOFError errors which get thrown sometimes from S3 connection
• Allow files with '..' (but not '../') in the middle of their name in file data store

0.9.0 (2011-04-27)

Features

• Model accessors are configurable
  • added after_assign callback
  • added after_unassign callback
  • added copy_to for e.g. up-front thumbnailing
  • added storage_opts and storage_xxx
• Added model remove_xxxxx for using with checkboxes
• Added model xxxx_url for assigning content from a url
• Added job step fetch_url
• Added retain! and model retained_xxxxx for avoiding multiple uploads when validations fail
• Added image? to imagemagick analyser
• Added imagemagick plain generator
• Added strip to imagemagick processor
• Added CouchDataStore that uses a CouchDB as a data storage engine
• Added before_serve callback
• Allowed for configurable response headers
• Made url re-definable with define_url
• validates_property can take a proc for the message
• Saved configs can be registered now so they can be used with configure_with(:symbol)
• Configurable objects can fallback to a parent configuration, so e.g. the server can be configured through the parent app's configure block.
• Allowed initializing data by using a pathname
• convert_command and identify_command can be configured on a per-app basis
• Added remote_url and ability for datastores to form urls
  • Added for File, Couch and S3 datastores
• Models automatically copy magic attributes into meta
• S3DataStore configurable headers
• 'dragonfly/rails/images' slightly smarter and added file_accessor for more semantic use of non-image attachments
• Made dragonfly response configurable
• Mongo datastore can reuse an existing connection/db
• FileDataStore can be configured not to store meta (save on extra file)

Changes

• Removed url_path_prefix and url_suffix in favour of url_format
  • Middleware doesn't need mount point argument now
• Removed support for rails 2.3
• Removed RMagick support (and extracted into a plugin)
• ImageMagick processors etc. moved into the ImageMagick namespace
• moved from aws/s3 -> fog for S3 support
• Renamed SimpleEndpoint -> Server
• moved name and meta into Job, simplified, and now they don't cause the job to be applied
• FileDataStore stores metadata in xxx.meta now, not xxx.extra
• removed Job methods uid_basename, uid_extname, encoded_format and encoded_extname as they are now unnecessary

Fixes

• Performance tweaks regarding temp_objects model accessors and job objects

0.8.5 (2011-05-11)

Fixes

• Allow filenames that have '..' in them (but not '../') in the filedatastore
• Better security for server

0.8.4 (2011-04-27)

Fixes

• Security fix for file data store

0.8.2 (2011-01-11)

Fixes

• Renamed ActiveModel methods like 'attachments' to avoid name clashes
• Respond properly to HEAD, POST, PUT and DELETE requests
• Got it working with jRuby and Rubinius
• Made DOS protection SHA (and ETag) consistent

0.8.1 (2010-11-22)

Fixes

Removed runtime dependencies that Jeweler automatically takes from the Gemfile

0.8.0 (2010-11-21)

Features

• New ImageMagick generator, processor, encoder and analyser, which are now defaults (thanks to Henry Phan for work on this)

Fixes

• Works with Rails 3.0.2 uploaded files (which has a changed API)

0.7.7 (2010-10-31)

Features

• Added username/password authentication to mongo data store

Fixes

• Fixes for Windows, inc. tempfile binmode and closing files
• "IOError: closed stream" fix (hopefully!)

0.7.6 (2010-09-12)

Features

• Added methods for querying job steps, and Job#uid, Job#uid_basename, etc.
• Added Job#b64_data
• Added configurable url_suffix
• Added configurable content_disposition and content_filename
• Can pass extra GET params to url_for
• Can manually set uid on FileDataStore and S3DataStore (not yet documented because attachments have no way to pass it on yet)
• Model attachments store meta info about themselves

Changes

• Configurable module doesn't implicitly call 'call' if attribute set as proc
• Refactored Endpoint module -> Response object

Fixes

• Ruby 1.9.2-p0 was raising encoding errors due to Tempfiles not being in binmode

0.7.5 (2010-09-01)

Changes

• RMagick processor, encoder, analyser and generator all use the filesystem now They can be configured to use in-memory strings with the use_filesystem config option.
• Upgraded support from Rails 3.0.0.rc -> Rails.3.0.0

0.7.4 (2010-08-28)

Features

• Gave model accessors bang methods process! and encode!

0.7.3 (2010-08-27)

Fixes

• Seems as though inserting after Rails' Rack::Lock was worth it after all

0.7.2 (2010-08-27)

Fixes

• S3DataStore was breaking if previous data hadn't stored meta

0.7.1 (2010-08-26)

Fixes

• SimpleEndpoint was modifying env path_info so wasn't creating proper cache keys
• to_response accepts env, so can use if-not-modified, etc.

Features

• Doc tweaks: Added mongo page, notes about Capistrano

Changes

• ETags generated by hash of job.serialize - was getting a bit long

0.7.0 (2010-08-25)

Features

• Ability to chain processing, encoding
• Added Generators for arbitrary content generation
• 'fetch_file' method for easily getting local files
• ActiveModel support
• Mongoid support
• Better Sinatra, etc. support (using 'to_response')
• Data stores now store meta, name and format information too
• Added Mongo Data Store
• temp_objects maintain name, meta, etc. across processing, encoding, etc.
• added portrait? and landscape? to RMagick analyser
• Ability to add single custom processor/encoder/analyser/generator
• added flip and flop to RMagick processor
• ability to configure whether it trusts the file extension
• nice text response for root path
• ability to configure url host
• ability to override path_prefix/host when calling url
• routed endpoints
• simple endpoints
• more intelligent working out of Content-Type to send back

Fixes

• proper use of ETags
• remove whitespace from file/s3 datastore uids
• dragonfly/rails/images url-encodes rack-cache config for windows users
• Ruby 1.9.2 support
• Better RMagick memory management using image.destroy!

Changes

• Dragonfly::App[:images] -> Dragonfly[:images]
• Moved text/plasma generation into Generator
• Use of lazy 'Job' objects
• simplified shortcuts interface
• changed interface for attaching to ActiveRecord
• simplified saved configurations and allow referring to them as symbols
• Removed need for Base class for datastores, processors, analysers and encoders
• FileCommandAnalyser included in Rails config, not RMagick
• better use of logging module for sharing logs between classes
• mounting the app is down the middleware/elsewhere, not the app itself
• DOS protection off by default
• encoded urls
• got rid of unnecessary configurable sha_length

0.6.2 (2010-06-24)

Features

• Added ability for custom error messages in validations

0.6.1 (2010-05-16)

Fixes

• STI was breaking when the model had a mixin too

0.6.0 (2010-05-11)

Features

• Added 'scale factor' for text generation, which gives better quality font rendering for smaller fonts
• Configurable objects allow for passing args, and passing a block for extra config
• Added more 'saved configurations', for easier setting up on e.g. Heroku
• Added RMagickAnalyser#format
• Added greyscale to RMagickProcessor
• S3DataStore is configurable as to whether it uses the filesystem or not (to save a tempfile)

Fixes

• Some specs refactoring, including making text processing specs less brittle
• RMagickEncoder::SUPPORTED_FORMATS was proving problematic - now we use a configurable list instead
• Got Rails 3 beta3 cucumber features working
• Added check to see if bucket already exists in S3DataStore - apparently this was problematic in EU

Changes

• temp_object.tempfile now returns a closed tempfile, which temp_object.file returns an open file. Can also pass a block to temp_object.file which closes the file automatically
• Processors/Analysers/Encoders know about app now so can log to app's log
• Imagemagick errors in RMagick processor/analyser/encoder now throw unable_to_handle and log a warning
• Removed Rails generators - better being more explicit with saved configurations which are more concise now

0.5.7 (2010-04-18)

Fixes

• Strip file command mime_type value because some versions of file command were appending a line-break

0.5.6 (2010-04-13)

Fixes

• Wasn't working properly with Single-Table Inheritance

0.5.5 (2010-04-13)

Fixes

• Rails 3 has changed 'metaclass' -> 'singleton_class' so adapt accordingly

0.5.4 (2010-04-12)

Features

• Allow setting the uid manually

Fixes

• Assigning an accessor to nil wasn't working properly

0.5.3 (2010-03-27)

Fixes

• Assigning an accessor to nil wasn't working properly

0.5.2 (2010-03-04)

Features

• Added 'registered mime-types'
• Enhanced docs

Fixes

• RMagickEncoder only encodes if not already in that format

0.5.1 (2010-02-20)

Fixes

• Fixed 'broken pipe' errors in FileCommandAnalyser due to outputting loads of stuff to the command line stdin

0.5.0 (2010-02-20)

Added support

• support for Rails 3

0.4.4 (2010-02-16)

Better late than never to start logging change history...

New features

• added aspect_ratio to rmagick_analyser

Added support

• support for ruby 1.9
• added development dependencies to gemspec for easier setting up