freeze rails 2.3.9

vendor/rails/actionpack/lib/action_controller/assertions/dom_assertions.rb

@@ -0,0 +1,55 @@
+module ActionController
+  module Assertions
+    module DomAssertions
+      def self.strip_whitespace!(nodes)
+        nodes.reject! do |node|
+          if node.is_a?(HTML::Text)
+            node.content.strip!
+            node.content.empty?
+          else
+            strip_whitespace! node.children
+            false
+          end
+        end
+      end
+      
+      # Test two HTML strings for equivalency (e.g., identical up to reordering of attributes)
+      #
+      # ==== Examples
+      #
+      #   # assert that the referenced method generates the appropriate HTML string
+      #   assert_dom_equal '<a href="http://www.example.com">Apples</a>', link_to("Apples", "http://www.example.com")
+      #
+      def assert_dom_equal(expected, actual, message = "")
+        clean_backtrace do
+          expected_dom = HTML::Document.new(expected).root
+          actual_dom   = HTML::Document.new(actual).root
+          DomAssertions.strip_whitespace!(expected_dom.children)
+          DomAssertions.strip_whitespace!(actual_dom.children)
+
+          full_message = build_message(message, "<?> expected but was\n<?>.", expected_dom.to_s, actual_dom.to_s)
+          assert_block(full_message) { expected_dom == actual_dom }
+        end
+      end
+      
+      # The negated form of +assert_dom_equal+.
+      #
+      # ==== Examples
+      #
+      #   # assert that the referenced method does not generate the specified HTML string
+      #   assert_dom_not_equal '<a href="http://www.example.com">Apples</a>', link_to("Oranges", "http://www.example.com")
+      #
+      def assert_dom_not_equal(expected, actual, message = "")
+        clean_backtrace do
+          expected_dom = HTML::Document.new(expected).root
+          actual_dom   = HTML::Document.new(actual).root
+          DomAssertions.strip_whitespace!(expected_dom.children)
+          DomAssertions.strip_whitespace!(actual_dom.children)
+
+          full_message = build_message(message, "<?> expected to be != to\n<?>.", expected_dom.to_s, actual_dom.to_s)
+          assert_block(full_message) { expected_dom != actual_dom }
+        end
+      end
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/assertions/model_assertions.rb

@@ -0,0 +1,21 @@
+module ActionController
+  module Assertions
+    module ModelAssertions
+      # Ensures that the passed record is valid by Active Record standards and
+      # returns any error messages if it is not.
+      #
+      # ==== Examples
+      #
+      #   # assert that a newly created record is valid
+      #   model = Model.new
+      #   assert_valid(model)
+      #
+      def assert_valid(record)
+        ::ActiveSupport::Deprecation.warn("assert_valid is deprecated. Use assert record.valid? instead", caller)
+        clean_backtrace do
+          assert record.valid?, record.errors.full_messages.join("\n")
+        end
+      end
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/assertions/response_assertions.rb

@@ -0,0 +1,169 @@
+module ActionController
+  module Assertions
+    # A small suite of assertions that test responses from Rails applications.
+    module ResponseAssertions
+      # Asserts that the response is one of the following types:
+      #
+      # * <tt>:success</tt>   - Status code was 200
+      # * <tt>:redirect</tt>  - Status code was in the 300-399 range
+      # * <tt>:missing</tt>   - Status code was 404
+      # * <tt>:error</tt>     - Status code was in the 500-599 range
+      #
+      # You can also pass an explicit status number like assert_response(501)
+      # or its symbolic equivalent assert_response(:not_implemented).
+      # See ActionController::StatusCodes for a full list.
+      #
+      # ==== Examples
+      #
+      #   # assert that the response was a redirection
+      #   assert_response :redirect
+      #
+      #   # assert that the response code was status code 401 (unauthorized)
+      #   assert_response 401
+      #
+      def assert_response(type, message = nil)
+        clean_backtrace do
+          if [ :success, :missing, :redirect, :error ].include?(type) && @response.send("#{type}?")
+            assert_block("") { true } # to count the assertion
+          elsif type.is_a?(Fixnum) && @response.response_code == type
+            assert_block("") { true } # to count the assertion
+          elsif type.is_a?(Symbol) && @response.response_code == ActionController::StatusCodes::SYMBOL_TO_STATUS_CODE[type]
+            assert_block("") { true } # to count the assertion
+          else
+            if @response.error?
+              exception = @response.template.instance_variable_get(:@exception)
+              exception_message = exception && exception.message
+              assert_block(build_message(message, "Expected response to be a <?>, but was <?>\n<?>", type, @response.response_code, exception_message.to_s)) { false }
+            else
+              assert_block(build_message(message, "Expected response to be a <?>, but was <?>", type, @response.response_code)) { false }
+            end
+          end
+        end
+      end
+
+      # Assert that the redirection options passed in match those of the redirect called in the latest action.
+      # This match can be partial, such that assert_redirected_to(:controller => "weblog") will also
+      # match the redirection of redirect_to(:controller => "weblog", :action => "show") and so on.
+      #
+      # ==== Examples
+      #
+      #   # assert that the redirection was to the "index" action on the WeblogController
+      #   assert_redirected_to :controller => "weblog", :action => "index"
+      #
+      #   # assert that the redirection was to the named route login_url
+      #   assert_redirected_to login_url
+      #
+      #   # assert that the redirection was to the url for @customer
+      #   assert_redirected_to @customer
+      #
+      def assert_redirected_to(options = {}, message=nil)
+        clean_backtrace do
+          assert_response(:redirect, message)
+          return true if options == @response.redirected_to
+
+          # Support partial arguments for hash redirections
+          if options.is_a?(Hash) && @response.redirected_to.is_a?(Hash)
+            if options.all? {|(key, value)| @response.redirected_to[key] == value}
+              callstack = caller.dup
+              callstack.slice!(0, 2)
+              ::ActiveSupport::Deprecation.warn("Using assert_redirected_to with partial hash arguments is deprecated. Specify the full set arguments instead", callstack)
+              return true
+            end
+          end
+
+          redirected_to_after_normalisation = normalize_argument_to_redirection(@response.redirected_to)
+          options_after_normalisation       = normalize_argument_to_redirection(options)
+
+          if redirected_to_after_normalisation != options_after_normalisation
+            flunk "Expected response to be a redirect to <#{options_after_normalisation}> but was a redirect to <#{redirected_to_after_normalisation}>"
+          end
+        end
+      end
+
+      # Asserts that the request was rendered with the appropriate template file or partials
+      #
+      # ==== Examples
+      #
+      #   # assert that the "new" view template was rendered
+      #   assert_template "new"
+      #
+      #   # assert that the "new" view template was rendered with Symbol
+      #   assert_template :new
+      #
+      #   # assert that the "_customer" partial was rendered twice
+      #   assert_template :partial => '_customer', :count => 2
+      #
+      #   # assert that no partials were rendered
+      #   assert_template :partial => false
+      #
+      def assert_template(options = {}, message = nil)
+        clean_backtrace do
+          case options
+           when NilClass, String, Symbol
+            rendered = @response.rendered[:template].to_s
+            msg = build_message(message,
+                    "expecting <?> but rendering with <?>",
+                    options, rendered)
+            assert_block(msg) do
+              if options.nil?
+                @response.rendered[:template].blank?
+              else
+                rendered.to_s.match(options.to_s)
+              end
+            end
+          when Hash
+            if expected_partial = options[:partial]
+              partials = @response.rendered[:partials]
+              if expected_count = options[:count]
+                found = partials.detect { |p, _| p.to_s.match(expected_partial) }
+                actual_count = found.nil? ? 0 : found.second
+                msg = build_message(message,
+                        "expecting ? to be rendered ? time(s) but rendered ? time(s)",
+                         expected_partial, expected_count, actual_count)
+                assert(actual_count == expected_count.to_i, msg)
+              else
+                msg = build_message(message,
+                        "expecting partial <?> but action rendered <?>",
+                        options[:partial], partials.keys)
+                assert(partials.keys.any? { |p| p.to_s.match(expected_partial) }, msg)
+              end
+            else
+              assert @response.rendered[:partials].empty?,
+                "Expected no partials to be rendered"
+            end
+          else
+            raise ArgumentError  
+          end
+        end
+      end
+
+      private
+        # Proxy to to_param if the object will respond to it.
+        def parameterize(value)
+          value.respond_to?(:to_param) ? value.to_param : value
+        end
+
+        def normalize_argument_to_redirection(fragment)
+          case fragment
+          when %r{^\w[\w\d+.-]*:.*}
+            fragment
+          when String
+            if fragment =~ %r{^\w[\w\d+.-]*:.*}
+              fragment
+            else
+              if fragment !~ /^\//
+                ActiveSupport::Deprecation.warn "Omitting the leading slash on a path with assert_redirected_to is deprecated. Use '/#{fragment}' instead.", caller(2)
+                fragment = "/#{fragment}"
+              end
+              @request.protocol + @request.host_with_port + fragment
+            end
+          when :back
+            raise RedirectBackError unless refer = @request.headers["Referer"]
+            refer
+          else
+            @controller.url_for(fragment)
+          end.gsub(/[\r\n]/, '')
+        end
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/assertions/routing_assertions.rb

@@ -0,0 +1,146 @@
+module ActionController
+  module Assertions
+    # Suite of assertions to test routes generated by Rails and the handling of requests made to them.
+    module RoutingAssertions
+      # Asserts that the routing of the given +path+ was handled correctly and that the parsed options (given in the +expected_options+ hash)
+      # match +path+.  Basically, it asserts that Rails recognizes the route given by +expected_options+.
+      #
+      # Pass a hash in the second argument (+path+) to specify the request method.  This is useful for routes
+      # requiring a specific HTTP method.  The hash should contain a :path with the incoming request path
+      # and a :method containing the required HTTP verb.
+      #
+      #   # assert that POSTing to /items will call the create action on ItemsController
+      #   assert_recognizes {:controller => 'items', :action => 'create'}, {:path => 'items', :method => :post}
+      #
+      # You can also pass in +extras+ with a hash containing URL parameters that would normally be in the query string.  This can be used
+      # to assert that values in the query string string will end up in the params hash correctly.  To test query strings you must use the
+      # extras argument, appending the query string on the path directly will not work.  For example:
+      #
+      #   # assert that a path of '/items/list/1?view=print' returns the correct options
+      #   assert_recognizes {:controller => 'items', :action => 'list', :id => '1', :view => 'print'}, 'items/list/1', { :view => "print" }
+      #
+      # The +message+ parameter allows you to pass in an error message that is displayed upon failure.
+      #
+      # ==== Examples
+      #   # Check the default route (i.e., the index action)
+      #   assert_recognizes {:controller => 'items', :action => 'index'}, 'items'
+      #
+      #   # Test a specific action
+      #   assert_recognizes {:controller => 'items', :action => 'list'}, 'items/list'
+      #
+      #   # Test an action with a parameter
+      #   assert_recognizes {:controller => 'items', :action => 'destroy', :id => '1'}, 'items/destroy/1'
+      #
+      #   # Test a custom route
+      #   assert_recognizes {:controller => 'items', :action => 'show', :id => '1'}, 'view/item1'
+      #
+      #   # Check a Simply RESTful generated route
+      #   assert_recognizes list_items_url, 'items/list'
+      def assert_recognizes(expected_options, path, extras={}, message=nil)
+        if path.is_a? Hash
+          request_method = path[:method]
+          path           = path[:path]
+        else
+          request_method = nil
+        end
+
+        clean_backtrace do
+          ActionController::Routing::Routes.reload if ActionController::Routing::Routes.empty?
+          request = recognized_request_for(path, request_method)
+
+          expected_options = expected_options.clone
+          extras.each_key { |key| expected_options.delete key } unless extras.nil?
+
+          expected_options.stringify_keys!
+          routing_diff = expected_options.diff(request.path_parameters)
+          msg = build_message(message, "The recognized options <?> did not match <?>, difference: <?>",
+              request.path_parameters, expected_options, expected_options.diff(request.path_parameters))
+          assert_block(msg) { request.path_parameters == expected_options }
+        end
+      end
+
+      # Asserts that the provided options can be used to generate the provided path.  This is the inverse of +assert_recognizes+.
+      # The +extras+ parameter is used to tell the request the names and values of additional request parameters that would be in
+      # a query string. The +message+ parameter allows you to specify a custom error message for assertion failures.
+      #
+      # The +defaults+ parameter is unused.
+      #
+      # ==== Examples
+      #   # Asserts that the default action is generated for a route with no action
+      #   assert_generates "/items", :controller => "items", :action => "index"
+      #
+      #   # Tests that the list action is properly routed
+      #   assert_generates "/items/list", :controller => "items", :action => "list"
+      #
+      #   # Tests the generation of a route with a parameter
+      #   assert_generates "/items/list/1", { :controller => "items", :action => "list", :id => "1" }
+      #
+      #   # Asserts that the generated route gives us our custom route
+      #   assert_generates "changesets/12", { :controller => 'scm', :action => 'show_diff', :revision => "12" }
+      def assert_generates(expected_path, options, defaults={}, extras = {}, message=nil)
+        clean_backtrace do
+          expected_path = "/#{expected_path}" unless expected_path[0] == ?/
+          # Load routes.rb if it hasn't been loaded.
+          ActionController::Routing::Routes.reload if ActionController::Routing::Routes.empty?
+
+          generated_path, extra_keys = ActionController::Routing::Routes.generate_extras(options, defaults)
+          found_extras = options.reject {|k, v| ! extra_keys.include? k}
+
+          msg = build_message(message, "found extras <?>, not <?>", found_extras, extras)
+          assert_block(msg) { found_extras == extras }
+
+          msg = build_message(message, "The generated path <?> did not match <?>", generated_path,
+              expected_path)
+          assert_block(msg) { expected_path == generated_path }
+        end
+      end
+
+      # Asserts that path and options match both ways; in other words, it verifies that <tt>path</tt> generates
+      # <tt>options</tt> and then that <tt>options</tt> generates <tt>path</tt>.  This essentially combines +assert_recognizes+
+      # and +assert_generates+ into one step.
+      #
+      # The +extras+ hash allows you to specify options that would normally be provided as a query string to the action.  The
+      # +message+ parameter allows you to specify a custom error message to display upon failure.
+      #
+      # ==== Examples
+      #  # Assert a basic route: a controller with the default action (index)
+      #  assert_routing '/home', :controller => 'home', :action => 'index'
+      #
+      #  # Test a route generated with a specific controller, action, and parameter (id)
+      #  assert_routing '/entries/show/23', :controller => 'entries', :action => 'show', id => 23
+      #
+      #  # Assert a basic route (controller + default action), with an error message if it fails
+      #  assert_routing '/store', { :controller => 'store', :action => 'index' }, {}, {}, 'Route for store index not generated properly'
+      #
+      #  # Tests a route, providing a defaults hash
+      #  assert_routing 'controller/action/9', {:id => "9", :item => "square"}, {:controller => "controller", :action => "action"}, {}, {:item => "square"}
+      #
+      #  # Tests a route with a HTTP method
+      #  assert_routing { :method => 'put', :path => '/product/321' }, { :controller => "product", :action => "update", :id => "321" }
+      def assert_routing(path, options, defaults={}, extras={}, message=nil)
+        assert_recognizes(options, path, extras, message)
+
+        controller, default_controller = options[:controller], defaults[:controller]
+        if controller && controller.include?(?/) && default_controller && default_controller.include?(?/)
+          options[:controller] = "/#{controller}"
+        end
+
+        assert_generates(path.is_a?(Hash) ? path[:path] : path, options, defaults, extras, message)
+      end
+
+      private
+        # Recognizes the route for a given path.
+        def recognized_request_for(path, request_method = nil)
+          path = "/#{path}" unless path.first == '/'
+
+          # Assume given controller
+          request = ActionController::TestRequest.new
+          request.env["REQUEST_METHOD"] = request_method.to_s.upcase if request_method
+          request.path   = path
+
+          ActionController::Routing::Routes.recognize(request)
+          request
+        end
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/assertions/selector_assertions.rb

@@ -0,0 +1,638 @@
+#--
+# Copyright (c) 2006 Assaf Arkin (http://labnotes.org)
+# Under MIT and/or CC By license.
+#++
+
+module ActionController
+  module Assertions
+    unless const_defined?(:NO_STRIP)
+      NO_STRIP = %w{pre script style textarea}
+    end
+
+    # Adds the +assert_select+ method for use in Rails functional
+    # test cases, which can be used to make assertions on the response HTML of a controller
+    # action. You can also call +assert_select+ within another +assert_select+ to
+    # make assertions on elements selected by the enclosing assertion.
+    #
+    # Use +css_select+ to select elements without making an assertions, either
+    # from the response HTML or elements selected by the enclosing assertion.
+    #
+    # In addition to HTML responses, you can make the following assertions:
+    # * +assert_select_rjs+ - Assertions on HTML content of RJS update and insertion operations.
+    # * +assert_select_encoded+ - Assertions on HTML encoded inside XML, for example for dealing with feed item descriptions.
+    # * +assert_select_email+ - Assertions on the HTML body of an e-mail.
+    #
+    # Also see HTML::Selector to learn how to use selectors.
+    module SelectorAssertions
+
+      def initialize(*args)
+        super
+        @selected = nil
+      end
+
+      # :call-seq:
+      #   css_select(selector) => array
+      #   css_select(element, selector) => array
+      #
+      # Select and return all matching elements.
+      #
+      # If called with a single argument, uses that argument as a selector
+      # to match all elements of the current page. Returns an empty array
+      # if no match is found.
+      #
+      # If called with two arguments, uses the first argument as the base
+      # element and the second argument as the selector. Attempts to match the
+      # base element and any of its children. Returns an empty array if no
+      # match is found.
+      #
+      # The selector may be a CSS selector expression (String), an expression
+      # with substitution values (Array) or an HTML::Selector object.
+      #
+      # ==== Examples
+      #   # Selects all div tags
+      #   divs = css_select("div")
+      #
+      #   # Selects all paragraph tags and does something interesting
+      #   pars = css_select("p")
+      #   pars.each do |par|
+      #     # Do something fun with paragraphs here...
+      #   end
+      #
+      #   # Selects all list items in unordered lists
+      #   items = css_select("ul>li")
+      #
+      #   # Selects all form tags and then all inputs inside the form
+      #   forms = css_select("form")
+      #   forms.each do |form|
+      #     inputs = css_select(form, "input")
+      #     ...
+      #   end
+      #
+      def css_select(*args)
+        # See assert_select to understand what's going on here.
+        arg = args.shift
+
+        if arg.is_a?(HTML::Node)
+          root = arg
+          arg = args.shift
+        elsif arg == nil
+          raise ArgumentError, "First argument is either selector or element to select, but nil found. Perhaps you called assert_select with an element that does not exist?"
+        elsif @selected
+          matches = []
+
+          @selected.each do |selected|
+            subset = css_select(selected, HTML::Selector.new(arg.dup, args.dup))
+            subset.each do |match|
+              matches << match unless matches.any? { |m| m.equal?(match) }
+            end
+          end
+
+          return matches
+        else
+          root = response_from_page_or_rjs
+        end
+
+        case arg
+          when String
+            selector = HTML::Selector.new(arg, args)
+          when Array
+            selector = HTML::Selector.new(*arg)
+          when HTML::Selector
+            selector = arg
+          else raise ArgumentError, "Expecting a selector as the first argument"
+        end
+
+        selector.select(root)
+      end
+
+      # :call-seq:
+      #   assert_select(selector, equality?, message?)
+      #   assert_select(element, selector, equality?, message?)
+      #
+      # An assertion that selects elements and makes one or more equality tests.
+      #
+      # If the first argument is an element, selects all matching elements
+      # starting from (and including) that element and all its children in
+      # depth-first order.
+      #
+      # If no element if specified, calling +assert_select+ selects from the
+      # response HTML unless +assert_select+ is called from within an +assert_select+ block.
+      #
+      # When called with a block +assert_select+ passes an array of selected elements
+      # to the block. Calling +assert_select+ from the block, with no element specified,
+      # runs the assertion on the complete set of elements selected by the enclosing assertion.
+      # Alternatively the array may be iterated through so that +assert_select+ can be called
+      # separately for each element.
+      #
+      #
+      # ==== Example
+      # If the response contains two ordered lists, each with four list elements then:
+      #   assert_select "ol" do |elements|
+      #     elements.each do |element|
+      #       assert_select element, "li", 4
+      #     end
+      #   end
+      #
+      # will pass, as will:
+      #   assert_select "ol" do
+      #     assert_select "li", 8
+      #   end
+      #
+      # The selector may be a CSS selector expression (String), an expression
+      # with substitution values, or an HTML::Selector object.
+      #
+      # === Equality Tests
+      #
+      # The equality test may be one of the following:
+      # * <tt>true</tt> - Assertion is true if at least one element selected.
+      # * <tt>false</tt> - Assertion is true if no element selected.
+      # * <tt>String/Regexp</tt> - Assertion is true if the text value of at least
+      #   one element matches the string or regular expression.
+      # * <tt>Integer</tt> - Assertion is true if exactly that number of
+      #   elements are selected.
+      # * <tt>Range</tt> - Assertion is true if the number of selected
+      #   elements fit the range.
+      # If no equality test specified, the assertion is true if at least one
+      # element selected.
+      #
+      # To perform more than one equality tests, use a hash with the following keys:
+      # * <tt>:text</tt> - Narrow the selection to elements that have this text
+      #   value (string or regexp).
+      # * <tt>:html</tt> - Narrow the selection to elements that have this HTML
+      #   content (string or regexp).
+      # * <tt>:count</tt> - Assertion is true if the number of selected elements
+      #   is equal to this value.
+      # * <tt>:minimum</tt> - Assertion is true if the number of selected
+      #   elements is at least this value.
+      # * <tt>:maximum</tt> - Assertion is true if the number of selected
+      #   elements is at most this value.
+      #
+      # If the method is called with a block, once all equality tests are
+      # evaluated the block is called with an array of all matched elements.
+      #
+      # ==== Examples
+      #
+      #   # At least one form element
+      #   assert_select "form"
+      #
+      #   # Form element includes four input fields
+      #   assert_select "form input", 4
+      #
+      #   # Page title is "Welcome"
+      #   assert_select "title", "Welcome"
+      #
+      #   # Page title is "Welcome" and there is only one title element
+      #   assert_select "title", {:count=>1, :text=>"Welcome"},
+      #       "Wrong title or more than one title element"
+      #
+      #   # Page contains no forms
+      #   assert_select "form", false, "This page must contain no forms"
+      #
+      #   # Test the content and style
+      #   assert_select "body div.header ul.menu"
+      #
+      #   # Use substitution values
+      #   assert_select "ol>li#?", /item-\d+/
+      #
+      #   # All input fields in the form have a name
+      #   assert_select "form input" do
+      #     assert_select "[name=?]", /.+/  # Not empty
+      #   end
+      def assert_select(*args, &block)
+        # Start with optional element followed by mandatory selector.
+        arg = args.shift
+
+        if arg.is_a?(HTML::Node)
+          # First argument is a node (tag or text, but also HTML root),
+          # so we know what we're selecting from.
+          root = arg
+          arg = args.shift
+        elsif arg == nil
+          # This usually happens when passing a node/element that
+          # happens to be nil.
+          raise ArgumentError, "First argument is either selector or element to select, but nil found. Perhaps you called assert_select with an element that does not exist?"
+        elsif @selected
+          root = HTML::Node.new(nil)
+          root.children.concat @selected
+        else
+          # Otherwise just operate on the response document.
+          root = response_from_page_or_rjs
+        end
+
+        # First or second argument is the selector: string and we pass
+        # all remaining arguments. Array and we pass the argument. Also
+        # accepts selector itself.
+        case arg
+          when String
+            selector = HTML::Selector.new(arg, args)
+          when Array
+            selector = HTML::Selector.new(*arg)
+          when HTML::Selector
+            selector = arg
+          else raise ArgumentError, "Expecting a selector as the first argument"
+        end
+
+        # Next argument is used for equality tests.
+        equals = {}
+        case arg = args.shift
+          when Hash
+            equals = arg
+          when String, Regexp
+            equals[:text] = arg
+          when Integer
+            equals[:count] = arg
+          when Range
+            equals[:minimum] = arg.begin
+            equals[:maximum] = arg.end
+          when FalseClass
+            equals[:count] = 0
+          when NilClass, TrueClass
+            equals[:minimum] = 1
+          else raise ArgumentError, "I don't understand what you're trying to match"
+        end
+
+        # By default we're looking for at least one match.
+        if equals[:count]
+          equals[:minimum] = equals[:maximum] = equals[:count]
+        else
+          equals[:minimum] = 1 unless equals[:minimum]
+        end
+
+        # Last argument is the message we use if the assertion fails.
+        message = args.shift
+        #- message = "No match made with selector #{selector.inspect}" unless message
+        if args.shift
+          raise ArgumentError, "Not expecting that last argument, you either have too many arguments, or they're the wrong type"
+        end
+
+        matches = selector.select(root)
+        # If text/html, narrow down to those elements that match it.
+        content_mismatch = nil
+        if match_with = equals[:text]
+          matches.delete_if do |match|
+            text = ""
+            text.force_encoding(match_with.encoding) if text.respond_to?(:force_encoding)
+            stack = match.children.reverse
+            while node = stack.pop
+              if node.tag?
+                stack.concat node.children.reverse
+              else
+                content = node.content
+                content.force_encoding(match_with.encoding) if content.respond_to?(:force_encoding)
+                text << content
+              end
+            end
+            text.strip! unless NO_STRIP.include?(match.name)
+            unless match_with.is_a?(Regexp) ? (text =~ match_with) : (text == match_with.to_s)
+              content_mismatch ||= build_message(message, "<?> expected but was\n<?>.", match_with, text)
+              true
+            end
+          end
+        elsif match_with = equals[:html]
+          matches.delete_if do |match|
+            html = match.children.map(&:to_s).join
+            html.strip! unless NO_STRIP.include?(match.name)
+            unless match_with.is_a?(Regexp) ? (html =~ match_with) : (html == match_with.to_s)
+              content_mismatch ||= build_message(message, "<?> expected but was\n<?>.", match_with, html)
+              true
+            end
+          end
+        end
+        # Expecting foo found bar element only if found zero, not if
+        # found one but expecting two.
+        message ||= content_mismatch if matches.empty?
+        # Test minimum/maximum occurrence.
+        min, max = equals[:minimum], equals[:maximum]
+        message = message || %(Expected #{count_description(min, max)} matching "#{selector.to_s}", found #{matches.size}.)
+        assert matches.size >= min, message if min
+        assert matches.size <= max, message if max
+
+        # If a block is given call that block. Set @selected to allow
+        # nested assert_select, which can be nested several levels deep.
+        if block_given? && !matches.empty?
+          begin
+            in_scope, @selected = @selected, matches
+            yield matches
+          ensure
+            @selected = in_scope
+          end
+        end
+
+        # Returns all matches elements.
+        matches
+      end
+
+      def count_description(min, max) #:nodoc:
+        pluralize = lambda {|word, quantity| word << (quantity == 1 ? '' : 's')}
+
+        if min && max && (max != min)
+          "between #{min} and #{max} elements"
+        elsif min && !(min == 1 && max == 1)
+          "at least #{min} #{pluralize['element', min]}"
+        elsif max
+          "at most #{max} #{pluralize['element', max]}"
+        end
+      end
+
+      # :call-seq:
+      #   assert_select_rjs(id?) { |elements| ... }
+      #   assert_select_rjs(statement, id?) { |elements| ... }
+      #   assert_select_rjs(:insert, position, id?) { |elements| ... }
+      #
+      # Selects content from the RJS response.
+      #
+      # === Narrowing down
+      #
+      # With no arguments, asserts that one or more elements are updated or
+      # inserted by RJS statements.
+      #
+      # Use the +id+ argument to narrow down the assertion to only statements
+      # that update or insert an element with that identifier.
+      #
+      # Use the first argument to narrow down assertions to only statements
+      # of that type. Possible values are <tt>:replace</tt>, <tt>:replace_html</tt>,
+      # <tt>:show</tt>, <tt>:hide</tt>, <tt>:toggle</tt>, <tt>:remove</tt> and
+      # <tt>:insert_html</tt>.
+      #
+      # Use the argument <tt>:insert</tt> followed by an insertion position to narrow
+      # down the assertion to only statements that insert elements in that
+      # position. Possible values are <tt>:top</tt>, <tt>:bottom</tt>, <tt>:before</tt>
+      # and <tt>:after</tt>.
+      #
+      # Using the <tt>:remove</tt> statement, you will be able to pass a block, but it will
+      # be ignored as there is no HTML passed for this statement.
+      #
+      # === Using blocks
+      #
+      # Without a block, +assert_select_rjs+ merely asserts that the response
+      # contains one or more RJS statements that replace or update content.
+      #
+      # With a block, +assert_select_rjs+ also selects all elements used in
+      # these statements and passes them to the block. Nested assertions are
+      # supported.
+      #
+      # Calling +assert_select_rjs+ with no arguments and using nested asserts
+      # asserts that the HTML content is returned by one or more RJS statements.
+      # Using +assert_select+ directly makes the same assertion on the content,
+      # but without distinguishing whether the content is returned in an HTML
+      # or JavaScript.
+      #
+      # ==== Examples
+      #
+      #   # Replacing the element foo.
+      #   # page.replace 'foo', ...
+      #   assert_select_rjs :replace, "foo"
+      #
+      #   # Replacing with the chained RJS proxy.
+      #   # page[:foo].replace ...
+      #   assert_select_rjs :chained_replace, 'foo'
+      #
+      #   # Inserting into the element bar, top position.
+      #   assert_select_rjs :insert, :top, "bar"
+      #
+      #   # Remove the element bar
+      #   assert_select_rjs :remove, "bar"
+      #
+      #   # Changing the element foo, with an image.
+      #   assert_select_rjs "foo" do
+      #     assert_select "img[src=/images/logo.gif""
+      #   end
+      #
+      #   # RJS inserts or updates a list with four items.
+      #   assert_select_rjs do
+      #     assert_select "ol>li", 4
+      #   end
+      #
+      #   # The same, but shorter.
+      #   assert_select "ol>li", 4
+      def assert_select_rjs(*args, &block)
+        rjs_type = args.first.is_a?(Symbol) ? args.shift : nil
+        id       = args.first.is_a?(String) ? args.shift : nil
+
+        # If the first argument is a symbol, it's the type of RJS statement we're looking
+        # for (update, replace, insertion, etc). Otherwise, we're looking for just about
+        # any RJS statement.
+        if rjs_type
+          if rjs_type == :insert
+            position  = args.shift
+            id = args.shift
+            insertion = "insert_#{position}".to_sym
+            raise ArgumentError, "Unknown RJS insertion type #{position}" unless RJS_STATEMENTS[insertion]
+            statement = "(#{RJS_STATEMENTS[insertion]})"
+          else
+            raise ArgumentError, "Unknown RJS statement type #{rjs_type}" unless RJS_STATEMENTS[rjs_type]
+            statement = "(#{RJS_STATEMENTS[rjs_type]})"
+          end
+        else
+          statement = "#{RJS_STATEMENTS[:any]}"
+        end
+
+        # Next argument we're looking for is the element identifier. If missing, we pick
+        # any element, otherwise we replace it in the statement.
+        pattern = Regexp.new(
+          id ? statement.gsub(RJS_ANY_ID, "\"#{id}\"") : statement
+        )
+
+        # Duplicate the body since the next step involves destroying it.
+        matches = nil
+        case rjs_type
+          when :remove, :show, :hide, :toggle
+            matches = @response.body.match(pattern)
+          else
+            @response.body.gsub(pattern) do |match|
+              html = unescape_rjs(match)
+              matches ||= []
+              matches.concat HTML::Document.new(html).root.children.select { |n| n.tag? }
+              ""
+            end
+        end
+
+        if matches
+          assert_block("") { true } # to count the assertion
+          if block_given? && !([:remove, :show, :hide, :toggle].include? rjs_type)
+            begin
+              in_scope, @selected = @selected, matches
+              yield matches
+            ensure
+              @selected = in_scope
+            end
+          end
+          matches
+        else
+          # RJS statement not found.
+          case rjs_type
+            when :remove, :show, :hide, :toggle
+              flunk_message = "No RJS statement that #{rjs_type.to_s}s '#{id}' was rendered."
+            else
+              flunk_message = "No RJS statement that replaces or inserts HTML content."
+          end
+          flunk args.shift || flunk_message
+        end
+      end
+
+      # :call-seq:
+      #   assert_select_encoded(element?) { |elements| ... }
+      #
+      # Extracts the content of an element, treats it as encoded HTML and runs
+      # nested assertion on it.
+      #
+      # You typically call this method within another assertion to operate on
+      # all currently selected elements. You can also pass an element or array
+      # of elements.
+      #
+      # The content of each element is un-encoded, and wrapped in the root
+      # element +encoded+. It then calls the block with all un-encoded elements.
+      #
+      # ==== Examples
+      #   # Selects all bold tags from within the title of an ATOM feed's entries (perhaps to nab a section name prefix)
+      #   assert_select_feed :atom, 1.0 do
+      #     # Select each entry item and then the title item
+      #     assert_select "entry>title" do
+      #       # Run assertions on the encoded title elements
+      #       assert_select_encoded do
+      #         assert_select "b"
+      #       end
+      #     end
+      #   end
+      #
+      #
+      #   # Selects all paragraph tags from within the description of an RSS feed
+      #   assert_select_feed :rss, 2.0 do
+      #     # Select description element of each feed item.
+      #     assert_select "channel>item>description" do
+      #       # Run assertions on the encoded elements.
+      #       assert_select_encoded do
+      #         assert_select "p"
+      #       end
+      #     end
+      #   end
+      def assert_select_encoded(element = nil, &block)
+        case element
+          when Array
+            elements = element
+          when HTML::Node
+            elements = [element]
+          when nil
+            unless elements = @selected
+              raise ArgumentError, "First argument is optional, but must be called from a nested assert_select"
+            end
+          else
+            raise ArgumentError, "Argument is optional, and may be node or array of nodes"
+        end
+
+        fix_content = lambda do |node|
+          # Gets around a bug in the Rails 1.1 HTML parser.
+          node.content.gsub(/<!\[CDATA\[(.*)(\]\]>)?/m) { CGI.escapeHTML($1) }
+        end
+
+        selected = elements.map do |element|
+          text = element.children.select{ |c| not c.tag? }.map{ |c| fix_content[c] }.join
+          root = HTML::Document.new(CGI.unescapeHTML("<encoded>#{text}</encoded>")).root
+          css_select(root, "encoded:root", &block)[0]
+        end
+
+        begin
+          old_selected, @selected = @selected, selected
+          assert_select ":root", &block
+        ensure
+          @selected = old_selected
+        end
+      end
+
+      # :call-seq:
+      #   assert_select_email { }
+      #
+      # Extracts the body of an email and runs nested assertions on it.
+      #
+      # You must enable deliveries for this assertion to work, use:
+      #   ActionMailer::Base.perform_deliveries = true
+      #
+      # ==== Examples
+      #
+      #  assert_select_email do
+      #    assert_select "h1", "Email alert"
+      #  end
+      #
+      #  assert_select_email do
+      #    items = assert_select "ol>li"
+      #    items.each do
+      #       # Work with items here...
+      #    end
+      #  end
+      #
+      def assert_select_email(&block)
+        deliveries = ActionMailer::Base.deliveries
+        assert !deliveries.empty?, "No e-mail in delivery list"
+
+        for delivery in deliveries
+          for part in delivery.parts
+            if part["Content-Type"].to_s =~ /^text\/html\W/
+              root = HTML::Document.new(part.body).root
+              assert_select root, ":root", &block
+            end
+          end
+        end
+      end
+
+      protected
+        unless const_defined?(:RJS_STATEMENTS)
+          RJS_PATTERN_HTML  = "\"((\\\\\"|[^\"])*)\""
+          RJS_ANY_ID        = "\"([^\"])*\""
+          RJS_STATEMENTS    = {
+            :chained_replace      => "\\$\\(#{RJS_ANY_ID}\\)\\.replace\\(#{RJS_PATTERN_HTML}\\)",
+            :chained_replace_html => "\\$\\(#{RJS_ANY_ID}\\)\\.update\\(#{RJS_PATTERN_HTML}\\)",
+            :replace_html         => "Element\\.update\\(#{RJS_ANY_ID}, #{RJS_PATTERN_HTML}\\)",
+            :replace              => "Element\\.replace\\(#{RJS_ANY_ID}, #{RJS_PATTERN_HTML}\\)"
+          }
+          [:remove, :show, :hide, :toggle].each do |action|
+            RJS_STATEMENTS[action] = "Element\\.#{action}\\(#{RJS_ANY_ID}\\)"
+          end
+          RJS_INSERTIONS = ["top", "bottom", "before", "after"]
+          RJS_INSERTIONS.each do |insertion|
+            RJS_STATEMENTS["insert_#{insertion}".to_sym] = "Element.insert\\(#{RJS_ANY_ID}, \\{ #{insertion}: #{RJS_PATTERN_HTML} \\}\\)"
+          end
+          RJS_STATEMENTS[:insert_html] = "Element.insert\\(#{RJS_ANY_ID}, \\{ (#{RJS_INSERTIONS.join('|')}): #{RJS_PATTERN_HTML} \\}\\)"
+          RJS_STATEMENTS[:any] = Regexp.new("(#{RJS_STATEMENTS.values.join('|')})")
+          RJS_PATTERN_UNICODE_ESCAPED_CHAR = /\\u([0-9a-zA-Z]{4})/
+        end
+
+        # +assert_select+ and +css_select+ call this to obtain the content in the HTML
+        # page, or from all the RJS statements, depending on the type of response.
+        def response_from_page_or_rjs()
+          content_type = @response.content_type
+
+          if content_type && Mime::JS =~ content_type
+            body = @response.body.dup
+            root = HTML::Node.new(nil)
+
+            while true
+              next if body.sub!(RJS_STATEMENTS[:any]) do |match|
+                html = unescape_rjs(match)
+                matches = HTML::Document.new(html).root.children.select { |n| n.tag? }
+                root.children.concat matches
+                ""
+              end
+              break
+            end
+
+            root
+          else
+            html_document.root
+          end
+        end
+
+        # Unescapes a RJS string.
+        def unescape_rjs(rjs_string)
+          # RJS encodes double quotes and line breaks.
+          unescaped= rjs_string.gsub('\"', '"')
+          unescaped.gsub!(/\\\//, '/')
+          unescaped.gsub!('\n', "\n")
+          unescaped.gsub!('\076', '>')
+          unescaped.gsub!('\074', '<')
+          # RJS encodes non-ascii characters.
+          unescaped.gsub!(RJS_PATTERN_UNICODE_ESCAPED_CHAR) {|u| [$1.hex].pack('U*')}
+          unescaped
+        end
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/assertions/tag_assertions.rb

@@ -0,0 +1,127 @@
+module ActionController
+  module Assertions
+    # Pair of assertions to testing elements in the HTML output of the response.
+    module TagAssertions
+      # Asserts that there is a tag/node/element in the body of the response
+      # that meets all of the given conditions. The +conditions+ parameter must
+      # be a hash of any of the following keys (all are optional):
+      #
+      # * <tt>:tag</tt>: the node type must match the corresponding value
+      # * <tt>:attributes</tt>: a hash. The node's attributes must match the
+      #   corresponding values in the hash.
+      # * <tt>:parent</tt>: a hash. The node's parent must match the
+      #   corresponding hash.
+      # * <tt>:child</tt>: a hash. At least one of the node's immediate children
+      #   must meet the criteria described by the hash.
+      # * <tt>:ancestor</tt>: a hash. At least one of the node's ancestors must
+      #   meet the criteria described by the hash.
+      # * <tt>:descendant</tt>: a hash. At least one of the node's descendants
+      #   must meet the criteria described by the hash.
+      # * <tt>:sibling</tt>: a hash. At least one of the node's siblings must
+      #   meet the criteria described by the hash.
+      # * <tt>:after</tt>: a hash. The node must be after any sibling meeting
+      #   the criteria described by the hash, and at least one sibling must match.
+      # * <tt>:before</tt>: a hash. The node must be before any sibling meeting
+      #   the criteria described by the hash, and at least one sibling must match.
+      # * <tt>:children</tt>: a hash, for counting children of a node. Accepts
+      #   the keys:
+      #   * <tt>:count</tt>: either a number or a range which must equal (or
+      #     include) the number of children that match.
+      #   * <tt>:less_than</tt>: the number of matching children must be less
+      #     than this number.
+      #   * <tt>:greater_than</tt>: the number of matching children must be
+      #     greater than this number.
+      #   * <tt>:only</tt>: another hash consisting of the keys to use
+      #     to match on the children, and only matching children will be
+      #     counted.
+      # * <tt>:content</tt>: the textual content of the node must match the
+      #   given value. This will not match HTML tags in the body of a
+      #   tag--only text.
+      #
+      # Conditions are matched using the following algorithm:
+      #
+      # * if the condition is a string, it must be a substring of the value.
+      # * if the condition is a regexp, it must match the value.
+      # * if the condition is a number, the value must match number.to_s.
+      # * if the condition is +true+, the value must not be +nil+.
+      # * if the condition is +false+ or +nil+, the value must be +nil+.
+      #
+      # === Examples
+      #
+      #   # Assert that there is a "span" tag
+      #   assert_tag :tag => "span"
+      #
+      #   # Assert that there is a "span" tag with id="x"
+      #   assert_tag :tag => "span", :attributes => { :id => "x" }
+      #
+      #   # Assert that there is a "span" tag using the short-hand
+      #   assert_tag :span
+      #
+      #   # Assert that there is a "span" tag with id="x" using the short-hand
+      #   assert_tag :span, :attributes => { :id => "x" }
+      #
+      #   # Assert that there is a "span" inside of a "div"
+      #   assert_tag :tag => "span", :parent => { :tag => "div" }
+      #
+      #   # Assert that there is a "span" somewhere inside a table
+      #   assert_tag :tag => "span", :ancestor => { :tag => "table" }
+      #
+      #   # Assert that there is a "span" with at least one "em" child
+      #   assert_tag :tag => "span", :child => { :tag => "em" }
+      #
+      #   # Assert that there is a "span" containing a (possibly nested)
+      #   # "strong" tag.
+      #   assert_tag :tag => "span", :descendant => { :tag => "strong" }
+      #
+      #   # Assert that there is a "span" containing between 2 and 4 "em" tags
+      #   # as immediate children
+      #   assert_tag :tag => "span",
+      #              :children => { :count => 2..4, :only => { :tag => "em" } } 
+      #
+      #   # Get funky: assert that there is a "div", with an "ul" ancestor
+      #   # and an "li" parent (with "class" = "enum"), and containing a 
+      #   # "span" descendant that contains text matching /hello world/
+      #   assert_tag :tag => "div",
+      #              :ancestor => { :tag => "ul" },
+      #              :parent => { :tag => "li",
+      #                           :attributes => { :class => "enum" } },
+      #              :descendant => { :tag => "span",
+      #                               :child => /hello world/ }
+      #
+      # <b>Please note</b>: +assert_tag+ and +assert_no_tag+ only work
+      # with well-formed XHTML. They recognize a few tags as implicitly self-closing
+      # (like br and hr and such) but will not work correctly with tags
+      # that allow optional closing tags (p, li, td). <em>You must explicitly
+      # close all of your tags to use these assertions.</em>
+      def assert_tag(*opts)
+        clean_backtrace do
+          opts = opts.size > 1 ? opts.last.merge({ :tag => opts.first.to_s }) : opts.first
+          tag = find_tag(opts)
+          assert tag, "expected tag, but no tag found matching #{opts.inspect} in:\n#{@response.body.inspect}"
+        end
+      end
+      
+      # Identical to +assert_tag+, but asserts that a matching tag does _not_
+      # exist. (See +assert_tag+ for a full discussion of the syntax.)
+      #
+      # === Examples
+      #   # Assert that there is not a "div" containing a "p"
+      #   assert_no_tag :tag => "div", :descendant => { :tag => "p" }
+      #
+      #   # Assert that an unordered list is empty
+      #   assert_no_tag :tag => "ul", :descendant => { :tag => "li" }
+      #
+      #   # Assert that there is not a "p" tag with between 1 to 3 "img" tags
+      #   # as immediate children
+      #   assert_no_tag :tag => "p",
+      #              :children => { :count => 1..3, :only => { :tag => "img" } }
+      def assert_no_tag(*opts)
+        clean_backtrace do
+          opts = opts.size > 1 ? opts.last.merge({ :tag => opts.first.to_s }) : opts.first
+          tag = find_tag(opts)
+          assert !tag, "expected no tag, but found tag matching #{opts.inspect} in:\n#{@response.body.inspect}"
+        end
+      end
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/benchmarking.rb

@@ -0,0 +1,107 @@
+require 'benchmark'
+
+module ActionController #:nodoc:
+  # The benchmarking module times the performance of actions and reports to the logger. If the Active Record
+  # package has been included, a separate timing section for database calls will be added as well.
+  module Benchmarking #:nodoc:
+    def self.included(base)
+      base.extend(ClassMethods)
+
+      base.class_eval do
+        alias_method_chain :perform_action, :benchmark
+        alias_method_chain :render, :benchmark
+      end
+    end
+
+    module ClassMethods
+      # Log and benchmark the workings of a single block and silence whatever logging that may have happened inside it 
+      # (unless <tt>use_silence</tt> is set to false).
+      #
+      # The benchmark is only recorded if the current level of the logger matches the <tt>log_level</tt>, which makes it
+      # easy to include benchmarking statements in production software that will remain inexpensive because the benchmark
+      # will only be conducted if the log level is low enough.
+      def benchmark(title, log_level = Logger::DEBUG, use_silence = true)
+        if logger && logger.level == log_level
+          result = nil
+          ms = Benchmark.ms { result = use_silence ? silence { yield } : yield }
+          logger.add(log_level, "#{title} (#{('%.1f' % ms)}ms)")
+          result
+        else
+          yield
+        end
+      end
+
+      # Silences the logger for the duration of the block.
+      def silence
+        old_logger_level, logger.level = logger.level, Logger::ERROR if logger
+        yield
+      ensure
+        logger.level = old_logger_level if logger
+      end
+    end
+
+    protected
+      def render_with_benchmark(options = nil, extra_options = {}, &block)
+        if logger
+          if Object.const_defined?("ActiveRecord") && ActiveRecord::Base.connected?
+            db_runtime = ActiveRecord::Base.connection.reset_runtime
+          end
+
+          render_output = nil
+          @view_runtime = Benchmark.ms { render_output = render_without_benchmark(options, extra_options, &block) }
+
+          if Object.const_defined?("ActiveRecord") && ActiveRecord::Base.connected?
+            @db_rt_before_render = db_runtime
+            @db_rt_after_render = ActiveRecord::Base.connection.reset_runtime
+            @view_runtime -= @db_rt_after_render
+          end
+
+          render_output
+        else
+          render_without_benchmark(options, extra_options, &block)
+        end
+      end    
+
+    private
+      def perform_action_with_benchmark
+        if logger
+          ms = [Benchmark.ms { perform_action_without_benchmark }, 0.01].max
+          logging_view          = defined?(@view_runtime)
+          logging_active_record = Object.const_defined?("ActiveRecord") && ActiveRecord::Base.connected?
+
+          log_message  = 'Completed in %.0fms' % ms
+
+          if logging_view || logging_active_record
+            log_message << " ("
+            log_message << view_runtime if logging_view
+
+            if logging_active_record
+              log_message << ", " if logging_view
+              log_message << active_record_runtime + ")"
+            else
+              ")"
+            end
+          end
+
+          log_message << " | #{response.status}"
+          log_message << " [#{complete_request_uri rescue "unknown"}]"
+
+          logger.info(log_message)
+          response.headers["X-Runtime"] = "%.0f" % ms
+        else
+          perform_action_without_benchmark
+        end
+      end
+
+      def view_runtime
+        "View: %.0f" % @view_runtime
+      end
+
+      def active_record_runtime
+        db_runtime = ActiveRecord::Base.connection.reset_runtime
+        db_runtime += @db_rt_before_render if @db_rt_before_render
+        db_runtime += @db_rt_after_render if @db_rt_after_render
+        "DB: %.0f" % db_runtime
+      end
+  end
+end

vendor/rails/actionpack/lib/action_controller/caching.rb

@@ -0,0 +1,71 @@
+require 'fileutils'
+require 'uri'
+require 'set'
+
+module ActionController #:nodoc:
+  # Caching is a cheap way of speeding up slow applications by keeping the result of calculations, renderings, and database calls
+  # around for subsequent requests. Action Controller affords you three approaches in varying levels of granularity: Page, Action, Fragment.
+  #
+  # You can read more about each approach and the sweeping assistance by clicking the modules below.
+  #
+  # Note: To turn off all caching and sweeping, set Base.perform_caching = false.
+  #
+  #
+  # == Caching stores
+  #
+  # All the caching stores from ActiveSupport::Cache is available to be used as backends for Action Controller caching. This setting only
+  # affects action and fragment caching as page caching is always written to disk.
+  #
+  # Configuration examples (MemoryStore is the default):
+  #
+  #   ActionController::Base.cache_store = :memory_store
+  #   ActionController::Base.cache_store = :file_store, "/path/to/cache/directory"
+  #   ActionController::Base.cache_store = :drb_store, "druby://localhost:9192"
+  #   ActionController::Base.cache_store = :mem_cache_store, "localhost"
+  #   ActionController::Base.cache_store = :mem_cache_store, Memcached::Rails.new("localhost:11211")
+  #   ActionController::Base.cache_store = MyOwnStore.new("parameter")
+  module Caching
+    autoload :Actions, 'action_controller/caching/actions'
+    autoload :Fragments, 'action_controller/caching/fragments'
+    autoload :Pages, 'action_controller/caching/pages'
+    autoload :Sweeper, 'action_controller/caching/sweeper'
+    autoload :Sweeping, 'action_controller/caching/sweeping'
+
+    def self.included(base) #:nodoc:
+      base.class_eval do
+        @@cache_store = nil
+        cattr_reader :cache_store
+
+        # Defines the storage option for cached fragments
+        def self.cache_store=(store_option)
+          @@cache_store = ActiveSupport::Cache.lookup_store(store_option)
+        end
+
+        include Pages, Actions, Fragments
+        include Sweeping if defined?(ActiveRecord)
+
+        @@perform_caching = true
+        cattr_accessor :perform_caching
+
+        def self.cache_configured?
+          perform_caching && cache_store
+        end
+      end
+    end
+
+    protected
+      # Convenience accessor
+      def cache(key, options = {}, &block)
+        if cache_configured?
+          cache_store.fetch(ActiveSupport::Cache.expand_cache_key(key, :controller), options, &block)
+        else
+          yield
+        end
+      end
+
+    private
+      def cache_configured?
+        self.class.cache_configured?
+      end
+  end
+end

vendor/rails/actionpack/lib/action_controller/caching/actions.rb

@@ -0,0 +1,177 @@
+require 'set'
+
+module ActionController #:nodoc:
+  module Caching
+    # Action caching is similar to page caching by the fact that the entire output of the response is cached, but unlike page caching,
+    # every request still goes through the Action Pack. The key benefit of this is that filters are run before the cache is served, which
+    # allows for authentication and other restrictions on whether someone is allowed to see the cache. Example:
+    #
+    #   class ListsController < ApplicationController
+    #     before_filter :authenticate, :except => :public
+    #     caches_page   :public
+    #     caches_action :index, :show, :feed
+    #   end
+    #
+    # In this example, the public action doesn't require authentication, so it's possible to use the faster page caching method. But both the
+    # show and feed action are to be shielded behind the authenticate filter, so we need to implement those as action caches.
+    #
+    # Action caching internally uses the fragment caching and an around filter to do the job. The fragment cache is named according to both
+    # the current host and the path. So a page that is accessed at http://david.somewhere.com/lists/show/1 will result in a fragment named
+    # "david.somewhere.com/lists/show/1". This allows the cacher to differentiate between "david.somewhere.com/lists/" and
+    # "jamis.somewhere.com/lists/" -- which is a helpful way of assisting the subdomain-as-account-key pattern.
+    #
+    # Different representations of the same resource, e.g. <tt>http://david.somewhere.com/lists</tt> and <tt>http://david.somewhere.com/lists.xml</tt>
+    # are treated like separate requests and so are cached separately. Keep in mind when expiring an action cache that <tt>:action => 'lists'</tt> is not the same
+    # as <tt>:action => 'list', :format => :xml</tt>.
+    #
+    # You can set modify the default action cache path by passing a :cache_path option.  This will be passed directly to ActionCachePath.path_for.  This is handy
+    # for actions with multiple possible routes that should be cached differently.  If a block is given, it is called with the current controller instance.
+    #
+    # And you can also use :if (or :unless) to pass a Proc that specifies when the action should be cached.
+    #
+    # Finally, if you are using memcached, you can also pass :expires_in.
+    #
+    #   class ListsController < ApplicationController
+    #     before_filter :authenticate, :except => :public
+    #     caches_page   :public
+    #     caches_action :index, :if => Proc.new { |c| !c.request.format.json? } # cache if is not a JSON request
+    #     caches_action :show, :cache_path => { :project => 1 }, :expires_in => 1.hour
+    #     caches_action :feed, :cache_path => Proc.new { |controller|
+    #       controller.params[:user_id] ?
+    #         controller.send(:user_list_url, controller.params[:user_id], controller.params[:id]) :
+    #         controller.send(:list_url, controller.params[:id]) }
+    #   end
+    #
+    # If you pass :layout => false, it will only cache your action content. It is useful when your layout has dynamic information.
+    #
+    module Actions
+      def self.included(base) #:nodoc:
+        base.extend(ClassMethods)
+          base.class_eval do
+            attr_accessor :rendered_action_cache, :action_cache_path
+          end
+      end
+
+      module ClassMethods
+        # Declares that +actions+ should be cached.
+        # See ActionController::Caching::Actions for details.
+        def caches_action(*actions)
+          return unless cache_configured?
+          options = actions.extract_options!
+          filter_options = { :only => actions, :if => options.delete(:if), :unless => options.delete(:unless) }
+
+          cache_filter = ActionCacheFilter.new(:layout => options.delete(:layout), :cache_path => options.delete(:cache_path), :store_options => options)
+          around_filter(filter_options) do |controller, action|
+            cache_filter.filter(controller, action)
+          end
+        end
+      end
+
+      protected
+        def expire_action(options = {})
+          return unless cache_configured?
+
+          if options[:action].is_a?(Array)
+            options[:action].dup.each do |action|
+              expire_fragment(ActionCachePath.path_for(self, options.merge({ :action => action }), false))
+            end
+          else
+            expire_fragment(ActionCachePath.path_for(self, options, false))
+          end
+        end
+
+      class ActionCacheFilter #:nodoc:
+        def initialize(options, &block)
+          @options = options
+        end
+
+        def filter(controller, action)
+          should_continue = before(controller)
+          action.call if should_continue
+          after(controller)
+        end
+
+        def before(controller)
+          cache_path = ActionCachePath.new(controller, path_options_for(controller, @options.slice(:cache_path)))
+          if cache = controller.read_fragment(cache_path.path, @options[:store_options])
+            controller.rendered_action_cache = true
+            set_content_type!(controller, cache_path.extension)
+            options = { :text => cache }
+            options.merge!(:layout => true) if cache_layout?
+            controller.__send__(:render, options)
+            false
+          else
+            controller.action_cache_path = cache_path
+          end
+        end
+
+        def after(controller)
+          return if controller.rendered_action_cache || !caching_allowed(controller)
+          action_content = cache_layout? ? content_for_layout(controller) : controller.response.body
+          controller.write_fragment(controller.action_cache_path.path, action_content, @options[:store_options])
+        end
+
+        private
+          def set_content_type!(controller, extension)
+            controller.response.content_type = Mime::Type.lookup_by_extension(extension).to_s if extension
+          end
+
+          def path_options_for(controller, options)
+            ((path_options = options[:cache_path]).respond_to?(:call) ? path_options.call(controller) : path_options) || {}
+          end
+
+          def caching_allowed(controller)
+            controller.request.get? && controller.response.status.to_i == 200
+          end
+
+          def cache_layout?
+            @options[:layout] == false
+          end
+
+          def content_for_layout(controller)
+            controller.response.layout && controller.response.template.instance_variable_get('@cached_content_for_layout')
+          end
+      end
+
+      class ActionCachePath
+        attr_reader :path, :extension
+
+        class << self
+          def path_for(controller, options, infer_extension = true)
+            new(controller, options, infer_extension).path
+          end
+        end
+        
+        # When true, infer_extension will look up the cache path extension from the request's path & format.
+        # This is desirable when reading and writing the cache, but not when expiring the cache -
+        # expire_action should expire the same files regardless of the request format.
+        def initialize(controller, options = {}, infer_extension = true)
+          if infer_extension
+            extract_extension(controller.request)
+            options = options.reverse_merge(:format => @extension) if options.is_a?(Hash)
+          end
+
+          path = controller.url_for(options).split('://').last
+          normalize!(path)
+          add_extension!(path, @extension)
+          @path = URI.unescape(path)
+        end
+
+        private
+          def normalize!(path)
+            path << 'index' if path[-1] == ?/
+          end
+
+          def add_extension!(path, extension)
+            path << ".#{extension}" if extension and !path.ends_with?(extension)
+          end
+          
+          def extract_extension(request)
+            # Don't want just what comes after the last '.' to accommodate multi part extensions
+            # such as tar.gz.
+            @extension = request.path[/^[^.]+\.(.+)$/, 1] || request.cache_format
+          end
+      end
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/caching/fragments.rb

@@ -0,0 +1,120 @@
+module ActionController #:nodoc:
+  module Caching
+    # Fragment caching is used for caching various blocks within templates without caching the entire action as a whole. This is useful when
+    # certain elements of an action change frequently or depend on complicated state while other parts rarely change or can be shared amongst multiple
+    # parties. The caching is done using the cache helper available in the Action View. A template with caching might look something like:
+    #
+    #   <b>Hello <%= @name %></b>
+    #   <% cache do %>
+    #     All the topics in the system:
+    #     <%= render :partial => "topic", :collection => Topic.find(:all) %>
+    #   <% end %>
+    #
+    # This cache will bind to the name of the action that called it, so if this code was part of the view for the topics/list action, you would
+    # be able to invalidate it using <tt>expire_fragment(:controller => "topics", :action => "list")</tt>.
+    #
+    # This default behavior is of limited use if you need to cache multiple fragments per action or if the action itself is cached using
+    # <tt>caches_action</tt>, so we also have the option to qualify the name of the cached fragment with something like:
+    #
+    #   <% cache(:action => "list", :action_suffix => "all_topics") do %>
+    #
+    # That would result in a name such as "/topics/list/all_topics", avoiding conflicts with the action cache and with any fragments that use a
+    # different suffix. Note that the URL doesn't have to really exist or be callable - the url_for system is just used to generate unique
+    # cache names that we can refer to when we need to expire the cache.
+    #
+    # The expiration call for this example is:
+    #
+    #   expire_fragment(:controller => "topics", :action => "list", :action_suffix => "all_topics")
+    module Fragments
+      # Given a key (as described in <tt>expire_fragment</tt>), returns a key suitable for use in reading,
+      # writing, or expiring a cached fragment. If the key is a hash, the generated key is the return
+      # value of url_for on that hash (without the protocol). All keys are prefixed with "views/" and uses
+      # ActiveSupport::Cache.expand_cache_key for the expansion.
+      def fragment_cache_key(key)
+        ActiveSupport::Cache.expand_cache_key(key.is_a?(Hash) ? url_for(key).split("://").last : key, :views)
+      end
+
+      def fragment_for(buffer, name = {}, options = nil, &block) #:nodoc:
+        if perform_caching
+          if cache = read_fragment(name, options)
+            buffer.safe_concat(cache.html_safe)
+          else
+            pos = buffer.length
+            block.call
+            write_fragment(name, buffer[pos..-1], options)
+          end
+        else
+          block.call
+        end
+      end
+
+      # Writes <tt>content</tt> to the location signified by <tt>key</tt> (see <tt>expire_fragment</tt> for acceptable formats)
+      def write_fragment(key, content, options = nil)
+        return content unless cache_configured?
+
+        self.class.benchmark "Cached fragment miss: #{key}" do
+          key = fragment_cache_key(key)
+          content = content.html_safe.to_str if content.respond_to?(:html_safe)
+          cache_store.write(key, content, options)
+        end
+
+        content
+      end
+
+      # Reads a cached fragment from the location signified by <tt>key</tt> (see <tt>expire_fragment</tt> for acceptable formats)
+      def read_fragment(key, options = nil)
+        return unless cache_configured?
+
+        key = fragment_cache_key(key)
+        self.class.benchmark "Cached fragment hit: #{key}" do
+          result = cache_store.read(key, options)
+          result.respond_to?(:html_safe) ? result.html_safe : result
+        end
+      end
+
+      # Check if a cached fragment from the location signified by <tt>key</tt> exists (see <tt>expire_fragment</tt> for acceptable formats)
+      def fragment_exist?(key, options = nil)
+        return unless cache_configured?
+
+        key = fragment_cache_key(key)
+
+        self.class.benchmark "Cached fragment exists?: #{key}" do
+          cache_store.exist?(key, options)
+        end
+      end
+
+      # Removes fragments from the cache.
+      #
+      # +key+ can take one of three forms:
+      # * String - This would normally take the form of a path, like
+      #   <tt>"pages/45/notes"</tt>.
+      # * Hash - Treated as an implicit call to +url_for+, like
+      #   <tt>{:controller => "pages", :action => "notes", :id => 45}</tt>
+      # * Regexp - Will remove any fragment that matches, so
+      #   <tt>%r{pages/\d*/notes}</tt> might remove all notes. Make sure you
+      #   don't use anchors in the regex (<tt>^</tt> or <tt>$</tt>) because
+      #   the actual filename matched looks like
+      #   <tt>./cache/filename/path.cache</tt>. Note: Regexp expiration is
+      #   only supported on caches that can iterate over all keys (unlike
+      #   memcached).
+      #
+      # +options+ is passed through to the cache store's <tt>delete</tt>
+      # method (or <tt>delete_matched</tt>, for Regexp keys.)
+      def expire_fragment(key, options = nil)
+        return unless cache_configured?
+
+        key = key.is_a?(Regexp) ? key : fragment_cache_key(key)
+
+        if key.is_a?(Regexp)
+          self.class.benchmark "Expired fragments matching: #{key.source}" do
+            cache_store.delete_matched(key, options)
+          end
+        else
+          self.class.benchmark "Expired fragment: #{key}" do
+            cache_store.delete(key, options)
+          end
+        end
+      end
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/caching/pages.rb

@@ -0,0 +1,152 @@
+require 'fileutils'
+require 'uri'
+
+module ActionController #:nodoc:
+  module Caching
+    # Page caching is an approach to caching where the entire action output of is stored as a HTML file that the web server
+    # can serve without going through Action Pack. This is the fastest way to cache your content as opposed to going dynamically
+    # through the process of generating the content. Unfortunately, this incredible speed-up is only available to stateless pages
+    # where all visitors are treated the same. Content management systems -- including weblogs and wikis -- have many pages that are
+    # a great fit for this approach, but account-based systems where people log in and manipulate their own data are often less
+    # likely candidates.
+    #
+    # Specifying which actions to cache is done through the <tt>caches_page</tt> class method:
+    #
+    #   class WeblogController < ActionController::Base
+    #     caches_page :show, :new
+    #   end
+    #
+    # This will generate cache files such as <tt>weblog/show/5.html</tt> and <tt>weblog/new.html</tt>,
+    # which match the URLs used to trigger the dynamic generation. This is how the web server is able
+    # pick up a cache file when it exists and otherwise let the request pass on to Action Pack to generate it.
+    #
+    # Expiration of the cache is handled by deleting the cached file, which results in a lazy regeneration approach where the cache
+    # is not restored before another hit is made against it. The API for doing so mimics the options from +url_for+ and friends:
+    #
+    #   class WeblogController < ActionController::Base
+    #     def update
+    #       List.update(params[:list][:id], params[:list])
+    #       expire_page :action => "show", :id => params[:list][:id]
+    #       redirect_to :action => "show", :id => params[:list][:id]
+    #     end
+    #   end
+    #
+    # Additionally, you can expire caches using Sweepers that act on changes in the model to determine when a cache is supposed to be
+    # expired.
+    module Pages
+      def self.included(base) #:nodoc:
+        base.extend(ClassMethods)
+        base.class_eval do
+          @@page_cache_directory = defined?(Rails.public_path) ? Rails.public_path : ""
+          ##
+          # :singleton-method:
+          # The cache directory should be the document root for the web server and is set using <tt>Base.page_cache_directory = "/document/root"</tt>.
+          # For Rails, this directory has already been set to Rails.public_path (which is usually set to <tt>RAILS_ROOT + "/public"</tt>). Changing
+          # this setting can be useful to avoid naming conflicts with files in <tt>public/</tt>, but doing so will likely require configuring your
+          # web server to look in the new location for cached files.
+          cattr_accessor :page_cache_directory
+
+          @@page_cache_extension = '.html'
+          ##
+          # :singleton-method:
+          # Most Rails requests do not have an extension, such as <tt>/weblog/new</tt>. In these cases, the page caching mechanism will add one in
+          # order to make it easy for the cached files to be picked up properly by the web server. By default, this cache extension is <tt>.html</tt>.
+          # If you want something else, like <tt>.php</tt> or <tt>.shtml</tt>, just set Base.page_cache_extension. In cases where a request already has an
+          # extension, such as <tt>.xml</tt> or <tt>.rss</tt>, page caching will not add an extension. This allows it to work well with RESTful apps.
+          cattr_accessor :page_cache_extension
+        end
+      end
+
+      module ClassMethods
+        # Expires the page that was cached with the +path+ as a key. Example:
+        #   expire_page "/lists/show"
+        def expire_page(path)
+          return unless perform_caching
+
+          benchmark "Expired page: #{page_cache_file(path)}" do
+            File.delete(page_cache_path(path)) if File.exist?(page_cache_path(path))
+          end
+        end
+
+        # Manually cache the +content+ in the key determined by +path+. Example:
+        #   cache_page "I'm the cached content", "/lists/show"
+        def cache_page(content, path)
+          return unless perform_caching
+
+          benchmark "Cached page: #{page_cache_file(path)}" do
+            FileUtils.makedirs(File.dirname(page_cache_path(path)))
+            File.open(page_cache_path(path), "wb+") { |f| f.write(content) }
+          end
+        end
+
+        # Caches the +actions+ using the page-caching approach that'll store the cache in a path within the page_cache_directory that
+        # matches the triggering url.
+        #
+        # Usage:
+        #
+        #   # cache the index action
+        #   caches_page :index
+        #
+        #   # cache the index action except for JSON requests
+        #   caches_page :index, :if => Proc.new { |c| !c.request.format.json? }
+        def caches_page(*actions)
+          return unless perform_caching
+          options = actions.extract_options!
+          after_filter({:only => actions}.merge(options)) { |c| c.cache_page }
+        end
+
+        private
+          def page_cache_file(path)
+            name = (path.empty? || path == "/") ? "/index" : URI.unescape(path.chomp('/'))
+            name << page_cache_extension unless (name.split('/').last || name).include? '.'
+            return name
+          end
+
+          def page_cache_path(path)
+            page_cache_directory + page_cache_file(path)
+          end
+      end
+
+      # Expires the page that was cached with the +options+ as a key. Example:
+      #   expire_page :controller => "lists", :action => "show"
+      def expire_page(options = {})
+        return unless perform_caching
+
+        if options.is_a?(Hash)
+          if options[:action].is_a?(Array)
+            options[:action].dup.each do |action|
+              self.class.expire_page(url_for(options.merge(:only_path => true, :skip_relative_url_root => true, :action => action)))
+            end
+          else
+            self.class.expire_page(url_for(options.merge(:only_path => true, :skip_relative_url_root => true)))
+          end
+        else
+          self.class.expire_page(options)
+        end
+      end
+
+      # Manually cache the +content+ in the key determined by +options+. If no content is provided, the contents of response.body is used
+      # If no options are provided, the requested url is used. Example:
+      #   cache_page "I'm the cached content", :controller => "lists", :action => "show"
+      def cache_page(content = nil, options = nil)
+        return unless perform_caching && caching_allowed
+
+        path = case options
+          when Hash
+            url_for(options.merge(:only_path => true, :skip_relative_url_root => true, :format => params[:format]))
+          when String
+            options
+          else
+            request.path
+        end
+
+        self.class.cache_page(content || response.body, path)
+      end
+
+      private
+        def caching_allowed
+          request.get? && response.status.to_i == 200
+        end
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/caching/sweeper.rb

@@ -0,0 +1,45 @@
+require 'active_record'
+
+module ActionController #:nodoc:
+  module Caching
+    class Sweeper < ActiveRecord::Observer #:nodoc:
+      attr_accessor :controller
+
+      def before(controller)
+        self.controller = controller
+        callback(:before) if controller.perform_caching
+      end
+
+      def after(controller)
+        callback(:after) if controller.perform_caching
+        # Clean up, so that the controller can be collected after this request
+        self.controller = nil
+      end
+
+      protected
+        # gets the action cache path for the given options.
+        def action_path_for(options)
+          ActionController::Caching::Actions::ActionCachePath.path_for(controller, options)
+        end
+
+        # Retrieve instance variables set in the controller.
+        def assigns(key)
+          controller.instance_variable_get("@#{key}")
+        end
+
+      private
+        def callback(timing)
+          controller_callback_method_name = "#{timing}_#{controller.controller_name.underscore}"
+          action_callback_method_name     = "#{controller_callback_method_name}_#{controller.action_name}"
+
+          __send__(controller_callback_method_name) if respond_to?(controller_callback_method_name, true)
+          __send__(action_callback_method_name)     if respond_to?(action_callback_method_name, true)
+        end
+
+        def method_missing(method, *arguments, &block)
+          return if @controller.nil?
+          @controller.__send__(method, *arguments, &block)
+        end
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/caching/sweeping.rb

@@ -0,0 +1,55 @@
+module ActionController #:nodoc:
+  module Caching
+    # Sweepers are the terminators of the caching world and responsible for expiring caches when model objects change.
+    # They do this by being half-observers, half-filters and implementing callbacks for both roles. A Sweeper example:
+    #
+    #   class ListSweeper < ActionController::Caching::Sweeper
+    #     observe List, Item
+    #
+    #     def after_save(record)
+    #       list = record.is_a?(List) ? record : record.list
+    #       expire_page(:controller => "lists", :action => %w( show public feed ), :id => list.id)
+    #       expire_action(:controller => "lists", :action => "all")
+    #       list.shares.each { |share| expire_page(:controller => "lists", :action => "show", :id => share.url_key) }
+    #     end
+    #   end
+    #
+    # The sweeper is assigned in the controllers that wish to have its job performed using the <tt>cache_sweeper</tt> class method:
+    #
+    #   class ListsController < ApplicationController
+    #     caches_action :index, :show, :public, :feed
+    #     cache_sweeper :list_sweeper, :only => [ :edit, :destroy, :share ]
+    #   end
+    #
+    # In the example above, four actions are cached and three actions are responsible for expiring those caches.
+    #
+    # You can also name an explicit class in the declaration of a sweeper, which is needed if the sweeper is in a module:
+    #
+    #   class ListsController < ApplicationController
+    #     caches_action :index, :show, :public, :feed
+    #     cache_sweeper OpenBar::Sweeper, :only => [ :edit, :destroy, :share ]
+    #   end
+    module Sweeping
+      def self.included(base) #:nodoc:
+        base.extend(ClassMethods)
+      end
+
+      module ClassMethods #:nodoc:
+        def cache_sweeper(*sweepers)
+          configuration = sweepers.extract_options!
+
+          sweepers.each do |sweeper|
+            ActiveRecord::Base.observers << sweeper if defined?(ActiveRecord) and defined?(ActiveRecord::Base)
+            sweeper_instance = (sweeper.is_a?(Symbol) ? Object.const_get(sweeper.to_s.classify) : sweeper).instance
+
+            if sweeper_instance.is_a?(Sweeper)
+              around_filter(sweeper_instance, :only => configuration[:only])
+            else
+              after_filter(sweeper_instance, :only => configuration[:only])
+            end
+          end
+        end
+      end
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/cgi_ext.rb

@@ -0,0 +1,15 @@
+require 'action_controller/cgi_ext/stdinput'
+require 'action_controller/cgi_ext/query_extension'
+require 'action_controller/cgi_ext/cookie'
+
+class CGI #:nodoc:
+  include ActionController::CgiExt::Stdinput
+
+  class << self
+    alias :escapeHTML_fail_on_nil :escapeHTML
+
+    def escapeHTML(string)
+      escapeHTML_fail_on_nil(string) unless string.nil?
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/cgi_ext/cookie.rb

@@ -0,0 +1,112 @@
+require 'delegate'
+
+CGI.module_eval { remove_const "Cookie" }
+
+# TODO: document how this differs from stdlib CGI::Cookie
+class CGI #:nodoc:
+  class Cookie < DelegateClass(Array)
+    attr_accessor :name, :value, :path, :domain, :expires
+    attr_reader :secure, :http_only
+
+    # Creates a new CGI::Cookie object.
+    #
+    # The contents of the cookie can be specified as a +name+ and one
+    # or more +value+ arguments.  Alternatively, the contents can
+    # be specified as a single hash argument.  The possible keywords of
+    # this hash are as follows:
+    #
+    # * <tt>:name</tt> - The name of the cookie.  Required.
+    # * <tt>:value</tt> - The cookie's value or list of values.
+    # * <tt>:path</tt> - The path for which this cookie applies.  Defaults to the
+    #   base directory of the CGI script.
+    # * <tt>:domain</tt> - The domain for which this cookie applies.
+    # * <tt>:expires</tt> - The time at which this cookie expires, as a Time object.
+    # * <tt>:secure</tt> - Whether this cookie is a secure cookie or not (defaults to
+    #   +false+). Secure cookies are only transmitted to HTTPS servers.
+    # * <tt>:http_only</tt> - Whether this cookie can be accessed by client side scripts (e.g. document.cookie) or only over HTTP.
+    #   More details in http://msdn2.microsoft.com/en-us/library/system.web.httpcookie.httponly.aspx. Defaults to +false+. 
+    #
+    # These keywords correspond to attributes of the cookie object.
+    def initialize(name = '', *value)
+      if name.kind_of?(String)
+        @name = name
+        @value = Array(value)
+        @domain = nil
+        @expires = nil
+        @secure = false
+        @http_only = false
+        @path = nil
+      else
+        @name = name['name']
+        @value = (name['value'].kind_of?(String) ? [name['value']] : Array(name['value'])).delete_if(&:blank?)
+        @domain = name['domain']
+        @expires = name['expires']
+        @secure = name['secure'] || false
+        @http_only = name['http_only'] || false
+        @path = name['path']
+      end
+
+      raise ArgumentError, "`name' required" unless @name
+
+      # simple support for IE
+      unless @path
+        %r|^(.*/)|.match(ENV['SCRIPT_NAME'])
+        @path = ($1 or '')
+      end
+
+      super(@value)
+    end
+
+    # Sets whether the Cookie is a secure cookie or not.
+    def secure=(val)
+      @secure = val == true
+    end
+
+    # Sets whether the Cookie is an HTTP only cookie or not.
+    def http_only=(val)
+      @http_only = val == true
+    end
+
+    # Converts the Cookie to its string representation.
+    def to_s
+      buf = ''
+      buf << @name << '='
+      buf << (@value.kind_of?(String) ? CGI::escape(@value) : @value.collect{|v| CGI::escape(v) }.join("&"))
+      buf << '; domain=' << @domain if @domain
+      buf << '; path=' << @path if @path
+      buf << '; expires=' << CGI::rfc1123_date(@expires) if @expires
+      buf << '; secure' if @secure
+      buf << '; HttpOnly' if @http_only
+      buf
+    end
+
+    # FIXME: work around broken 1.8.7 DelegateClass#respond_to?
+    def respond_to?(method, include_private = false)
+      return true if super(method)
+      return __getobj__.respond_to?(method, include_private)
+    end
+
+    # Parses a raw cookie string into a hash of <tt>cookie-name => cookie-object</tt>
+    # pairs.
+    #
+    #   cookies = CGI::Cookie::parse("raw_cookie_string")
+    #     # => { "name1" => cookie1, "name2" => cookie2, ... }
+    #
+    def self.parse(raw_cookie)
+      cookies = Hash.new([])
+
+      if raw_cookie
+        raw_cookie.split(/;\s?/).each do |pairs|
+          name, value = pairs.split('=',2)
+          next unless name and value
+          name = CGI::unescape(name)
+          unless cookies.has_key?(name)
+            cookies[name] = new(name, CGI::unescape(value))
+          end
+        end
+      end
+
+      cookies
+    end
+  end # class Cookie
+end

vendor/rails/actionpack/lib/action_controller/cgi_ext/query_extension.rb

@@ -0,0 +1,22 @@
+require 'cgi'
+
+class CGI #:nodoc:
+  module QueryExtension
+    # Remove the old initialize_query method before redefining it.
+    remove_method :initialize_query
+
+    # Neuter CGI parameter parsing.
+    def initialize_query
+      # Fix some strange request environments.
+      env_table['REQUEST_METHOD'] ||= 'GET'
+
+      # POST assumes missing Content-Type is application/x-www-form-urlencoded.
+      if env_table['CONTENT_TYPE'].blank? && env_table['REQUEST_METHOD'] == 'POST'
+        env_table['CONTENT_TYPE'] = 'application/x-www-form-urlencoded'
+      end
+
+      @cookies = CGI::Cookie::parse(env_table['HTTP_COOKIE'] || env_table['COOKIE'])
+      @params = {}
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/cgi_ext/stdinput.rb

@@ -0,0 +1,24 @@
+require 'cgi'
+
+module ActionController
+  module CgiExt
+    # Publicize the CGI's internal input stream so we can lazy-read
+    # request.body. Make it writable so we don't have to play $stdin games.
+    module Stdinput
+      def self.included(base)
+        base.class_eval do
+          remove_method :stdinput
+          attr_accessor :stdinput
+        end
+
+        base.alias_method_chain :initialize, :stdinput
+      end
+
+      def initialize_with_stdinput(type = nil, stdinput = $stdin)
+        @stdinput = stdinput
+        @stdinput.set_encoding(Encoding::BINARY) if @stdinput.respond_to?(:set_encoding)
+        initialize_without_stdinput(type || 'query')
+      end
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/cgi_process.rb

@@ -0,0 +1,77 @@
+require 'action_controller/cgi_ext'
+
+module ActionController #:nodoc:
+  class CGIHandler
+    module ProperStream
+      def each
+        while line = gets
+          yield line
+        end
+      end
+
+      def read(*args)
+        if args.empty?
+          super || ""
+        else
+          super
+        end
+      end
+    end
+
+    def self.dispatch_cgi(app, cgi, out = $stdout)
+      env = cgi.__send__(:env_table)
+      env.delete "HTTP_CONTENT_LENGTH"
+
+      cgi.stdinput.extend ProperStream
+
+      env["SCRIPT_NAME"] = "" if env["SCRIPT_NAME"] == "/"
+
+      env.update({
+        "rack.version" => [0,1],
+        "rack.input" => cgi.stdinput,
+        "rack.errors" => $stderr,
+        "rack.multithread" => false,
+        "rack.multiprocess" => true,
+        "rack.run_once" => false,
+        "rack.url_scheme" => ["yes", "on", "1"].include?(env["HTTPS"]) ? "https" : "http"
+      })
+
+      env["QUERY_STRING"] ||= ""
+      env["HTTP_VERSION"] ||= env["SERVER_PROTOCOL"]
+      env["REQUEST_PATH"] ||= "/"
+      env.delete "PATH_INFO" if env["PATH_INFO"] == ""
+
+      status, headers, body = app.call(env)
+      begin
+        out.binmode if out.respond_to?(:binmode)
+        out.sync = false if out.respond_to?(:sync=)
+
+        headers['Status'] = status.to_s
+
+        if headers.include?('Set-Cookie')
+          headers['cookie'] = headers.delete('Set-Cookie').split("\n")
+        end
+
+        out.write(cgi.header(headers))
+
+        body.each { |part|
+          out.write part
+          out.flush if out.respond_to?(:flush)
+        }
+      ensure
+        body.close if body.respond_to?(:close)
+      end
+    end
+  end
+
+  class CgiRequest #:nodoc:
+    DEFAULT_SESSION_OPTIONS = {
+      :database_manager  => nil,
+      :prefix            => "ruby_sess.",
+      :session_path      => "/",
+      :session_key       => "_session_id",
+      :cookie_only       => true,
+      :session_http_only => true
+    }
+  end
+end

vendor/rails/actionpack/lib/action_controller/cookies.rb

@@ -0,0 +1,191 @@
+module ActionController #:nodoc:
+  # Cookies are read and written through ActionController#cookies.
+  #
+  # The cookies being read are the ones received along with the request, the cookies
+  # being written will be sent out with the response. Reading a cookie does not get
+  # the cookie object itself back, just the value it holds.
+  #
+  # Examples for writing:
+  #
+  #   # Sets a simple session cookie.
+  #   cookies[:user_name] = "david"
+  #
+  #   # Sets a cookie that expires in 1 hour.
+  #   cookies[:login] = { :value => "XJ-122", :expires => 1.hour.from_now }
+  #
+  # Examples for reading:
+  #
+  #   cookies[:user_name] # => "david"
+  #   cookies.size        # => 2
+  #
+  # Example for deleting:
+  #
+  #   cookies.delete :user_name
+  #
+  # Please note that if you specify a :domain when setting a cookie, you must also specify the domain when deleting the cookie:
+  #
+  #  cookies[:key] = {
+  #    :value => 'a yummy cookie',
+  #    :expires => 1.year.from_now,
+  #    :domain => 'domain.com'
+  #  }
+  #
+  #  cookies.delete(:key, :domain => 'domain.com')
+  #
+  # The option symbols for setting cookies are:
+  #
+  # * <tt>:value</tt> - The cookie's value or list of values (as an array).
+  # * <tt>:path</tt> - The path for which this cookie applies.  Defaults to the root
+  #   of the application.
+  # * <tt>:domain</tt> - The domain for which this cookie applies.
+  # * <tt>:expires</tt> - The time at which this cookie expires, as a Time object.
+  # * <tt>:secure</tt> - Whether this cookie is a only transmitted to HTTPS servers.
+  #   Default is +false+.
+  # * <tt>:httponly</tt> - Whether this cookie is accessible via scripting or
+  #   only HTTP. Defaults to +false+.
+  module Cookies
+    def self.included(base)
+      base.helper_method :cookies
+      base.cattr_accessor :cookie_verifier_secret
+    end
+
+    protected
+      # Returns the cookie container, which operates as described above.
+      def cookies
+        @cookies ||= CookieJar.new(self)
+      end
+  end
+
+  class CookieJar < Hash #:nodoc:
+    attr_reader :controller
+    
+    def initialize(controller)
+      @controller, @cookies = controller, controller.request.cookies
+      super()
+      update(@cookies)
+    end
+
+    # Returns the value of the cookie by +name+, or +nil+ if no such cookie exists.
+    def [](name)
+      super(name.to_s)
+    end
+
+    # Sets the cookie named +name+. The second argument may be the very cookie
+    # value, or a hash of options as documented above.
+    def []=(key, options)
+      if options.is_a?(Hash)
+        options.symbolize_keys!
+      else
+        options = { :value => options }
+      end
+
+      options[:path] = "/" unless options.has_key?(:path)
+      super(key.to_s, options[:value])
+      @controller.response.set_cookie(key, options)
+    end
+
+    # Removes the cookie on the client machine by setting the value to an empty string
+    # and setting its expiration date into the past. Like <tt>[]=</tt>, you can pass in
+    # an options hash to delete cookies with extra data such as a <tt>:path</tt>.
+    def delete(key, options = {})
+      options.symbolize_keys!
+      options[:path] = "/" unless options.has_key?(:path)
+      value = super(key.to_s)
+      @controller.response.delete_cookie(key, options)
+      value
+    end
+
+    # Returns a jar that'll automatically set the assigned cookies to have an expiration date 20 years from now. Example:
+    #
+    #   cookies.permanent[:prefers_open_id] = true
+    #   # => Set-Cookie: prefers_open_id=true; path=/; expires=Sun, 16-Dec-2029 03:24:16 GMT
+    #
+    # This jar is only meant for writing. You'll read permanent cookies through the regular accessor.
+    #
+    # This jar allows chaining with the signed jar as well, so you can set permanent, signed cookies. Examples:
+    #
+    #   cookies.permanent.signed[:remember_me] = current_user.id
+    #   # => Set-Cookie: discount=BAhU--848956038e692d7046deab32b7131856ab20e14e; path=/; expires=Sun, 16-Dec-2029 03:24:16 GMT
+    def permanent
+      @permanent ||= PermanentCookieJar.new(self)
+    end
+    
+    # Returns a jar that'll automatically generate a signed representation of cookie value and verify it when reading from
+    # the cookie again. This is useful for creating cookies with values that the user is not supposed to change. If a signed
+    # cookie was tampered with by the user (or a 3rd party), an ActiveSupport::MessageVerifier::InvalidSignature exception will
+    # be raised.
+    #
+    # This jar requires that you set a suitable secret for the verification on ActionController::Base.cookie_verifier_secret.
+    #
+    # Example:
+    #
+    #   cookies.signed[:discount] = 45
+    #   # => Set-Cookie: discount=BAhpMg==--2c1c6906c90a3bc4fd54a51ffb41dffa4bf6b5f7; path=/
+    #
+    #   cookies.signed[:discount] # => 45
+    def signed
+      @signed ||= SignedCookieJar.new(self)
+    end
+  end
+  
+  class PermanentCookieJar < CookieJar #:nodoc:
+    def initialize(parent_jar)
+      @parent_jar = parent_jar
+    end
+
+    def []=(key, options)
+      if options.is_a?(Hash)
+        options.symbolize_keys!
+      else
+        options = { :value => options }
+      end
+      
+      options[:expires] = 20.years.from_now
+      @parent_jar[key] = options
+    end
+
+    def signed
+      @signed ||= SignedCookieJar.new(self)
+    end
+
+    def controller
+      @parent_jar.controller
+    end
+
+    def method_missing(method, *arguments, &block)
+      @parent_jar.send(method, *arguments, &block)
+    end
+  end
+  
+  class SignedCookieJar < CookieJar #:nodoc:
+    def initialize(parent_jar)
+      unless parent_jar.controller.class.cookie_verifier_secret
+        raise "You must set ActionController::Base.cookie_verifier_secret to use signed cookies"
+      end
+
+      @parent_jar = parent_jar
+      @verifier = ActiveSupport::MessageVerifier.new(@parent_jar.controller.class.cookie_verifier_secret)
+    end
+    
+    def [](name)
+      if value = @parent_jar[name]
+        @verifier.verify(value)
+      end
+    end
+    
+    def []=(key, options)
+      if options.is_a?(Hash)
+        options.symbolize_keys!
+        options[:value] = @verifier.generate(options[:value])
+      else
+        options = { :value => @verifier.generate(options) }
+      end
+      
+      @parent_jar[key] = options
+    end
+    
+    def method_missing(method, *arguments, &block)
+      @parent_jar.send(method, *arguments, &block)
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/dispatcher.rb

@@ -0,0 +1,133 @@
+module ActionController
+  # Dispatches requests to the appropriate controller and takes care of
+  # reloading the app after each request when Dependencies.load? is true.
+  class Dispatcher
+    @@cache_classes = true
+
+    class << self
+      def define_dispatcher_callbacks(cache_classes)
+        @@cache_classes = cache_classes
+        unless cache_classes
+          ActionView::Helpers::AssetTagHelper.cache_asset_timestamps = false
+        end
+
+        if defined?(ActiveRecord)
+          to_prepare(:activerecord_instantiate_observers) { ActiveRecord::Base.instantiate_observers }
+        end
+
+        after_dispatch :flush_logger if Base.logger && Base.logger.respond_to?(:flush)
+
+        to_prepare do
+          I18n.reload!
+        end
+      end
+
+      # DEPRECATE: Remove CGI support
+      def dispatch(cgi = nil, session_options = CgiRequest::DEFAULT_SESSION_OPTIONS, output = $stdout)
+        new(output).dispatch_cgi(cgi, session_options)
+      end
+
+      # Add a preparation callback. Preparation callbacks are run before every
+      # request in development mode, and before the first request in production
+      # mode.
+      #
+      # An optional identifier may be supplied for the callback. If provided,
+      # to_prepare may be called again with the same identifier to replace the
+      # existing callback. Passing an identifier is a suggested practice if the
+      # code adding a preparation block may be reloaded.
+      def to_prepare(identifier = nil, &block)
+        @prepare_dispatch_callbacks ||= ActiveSupport::Callbacks::CallbackChain.new
+        callback = ActiveSupport::Callbacks::Callback.new(:prepare_dispatch, block, :identifier => identifier)
+        @prepare_dispatch_callbacks.replace_or_append!(callback)
+      end
+
+      def run_prepare_callbacks
+        if defined?(Rails) && Rails.logger
+          logger = Rails.logger
+        else
+          logger = Logger.new($stderr)
+        end
+
+        new(logger).send :run_callbacks, :prepare_dispatch
+      end
+
+      def reload_application
+        # Run prepare callbacks before every request in development mode
+        run_prepare_callbacks
+
+        Routing::Routes.reload
+      end
+
+      def cleanup_application
+        # Cleanup the application before processing the current request.
+        ActiveRecord::Base.reset_subclasses if defined?(ActiveRecord)
+        ActiveSupport::Dependencies.clear
+        ActiveRecord::Base.clear_reloadable_connections! if defined?(ActiveRecord)
+      end
+    end
+
+    cattr_accessor :middleware
+    self.middleware = MiddlewareStack.new do |middleware|
+      middlewares = File.join(File.dirname(__FILE__), "middlewares.rb")
+      middleware.instance_eval(File.read(middlewares))
+    end
+
+    include ActiveSupport::Callbacks
+    define_callbacks :prepare_dispatch, :before_dispatch, :after_dispatch
+
+    # DEPRECATE: Remove arguments, since they are only used by CGI
+    def initialize(output = $stdout, request = nil, response = nil)
+      @output = output
+      build_middleware_stack if @@cache_classes
+    end
+
+    def dispatch
+      begin
+        run_callbacks :before_dispatch
+        Routing::Routes.call(@env)
+      rescue Exception => exception
+        if controller ||= (::ApplicationController rescue Base)
+          controller.call_with_exception(@env, exception).to_a
+        else
+          raise exception
+        end
+      ensure
+        run_callbacks :after_dispatch, :enumerator => :reverse_each
+      end
+    end
+
+    # DEPRECATE: Remove CGI support
+    def dispatch_cgi(cgi, session_options)
+      CGIHandler.dispatch_cgi(self, cgi, @output)
+    end
+
+    def call(env)
+      if @@cache_classes
+        @app.call(env)
+      else
+        Reloader.run do
+          # When class reloading is turned on, we will want to rebuild the
+          # middleware stack every time we process a request. If we don't
+          # rebuild the middleware stack, then the stack may contain references
+          # to old classes metal classes, which will b0rk class reloading.
+          build_middleware_stack
+          @app.call(env)
+        end
+      end
+    end
+
+    def _call(env)
+      @env = env
+      dispatch
+    end
+
+    def flush_logger
+      Base.logger.flush
+    end
+
+    private
+      def build_middleware_stack
+        @app = @@middleware.build(lambda { |env| self.dup._call(env) })
+      end
+  end
+end

vendor/rails/actionpack/lib/action_controller/failsafe.rb

@@ -0,0 +1,87 @@
+require 'erb'
+
+module ActionController
+  # The Failsafe middleware is usually the top-most middleware in the Rack
+  # middleware chain. It returns the underlying middleware's response, but if
+  # the underlying middle raises an exception then Failsafe will log the
+  # exception into the Rails log file, and will attempt to return an error
+  # message response.
+  #
+  # Failsafe is a last resort for logging errors and for telling the HTTP
+  # client that something went wrong. Do not confuse this with the
+  # ActionController::Rescue module, which is responsible for catching
+  # exceptions at deeper levels. Unlike Failsafe, which is as simple as
+  # possible, Rescue provides features that allow developers to hook into
+  # the error handling logic, and can customize the error message response
+  # based on the HTTP client's IP.
+  class Failsafe
+    cattr_accessor :error_file_path
+    self.error_file_path = Rails.public_path if defined?(Rails.public_path)
+
+    def initialize(app)
+      @app = app
+    end
+
+    def call(env)
+      @app.call(env)
+    rescue Exception => exception
+      # Reraise exception in test environment
+      if defined?(Rails) && Rails.env.test?
+        raise exception
+      else
+        failsafe_response(exception)
+      end
+    end
+
+    private
+      def failsafe_response(exception)
+        log_failsafe_exception(exception)
+        [500, {'Content-Type' => 'text/html'}, [failsafe_response_body]]
+      rescue Exception => failsafe_error # Logger or IO errors
+        $stderr.puts "Error during failsafe response: #{failsafe_error}"
+      end
+
+      def failsafe_response_body
+        error_template_path = "#{self.class.error_file_path}/500.html"
+        if File.exist?(error_template_path)
+          begin
+            result = render_template(error_template_path)
+          rescue Exception
+            result = nil
+          end
+        else
+          result = nil
+        end
+        if result.nil?
+          result = "<html><body><h1>500 Internal Server Error</h1>" <<
+            "If you are the administrator of this website, then please read this web " <<
+            "application's log file to find out what went wrong.</body></html>"
+        end
+        result
+      end
+      
+      # The default 500.html uses the h() method.
+      def h(text) # :nodoc:
+        ERB::Util.h(text)
+      end
+      
+      def render_template(filename)
+        ERB.new(File.read(filename)).result(binding)
+      end
+
+      def log_failsafe_exception(exception)
+        message = "/!\\ FAILSAFE /!\\  #{Time.now}\n  Status: 500 Internal Server Error\n"
+        message << "  #{exception}\n    #{exception.backtrace.join("\n    ")}" if exception
+        failsafe_logger.fatal(message)
+        failsafe_logger.flush if failsafe_logger.respond_to?(:flush)
+      end
+
+      def failsafe_logger
+        if defined?(Rails) && Rails.logger
+          Rails.logger
+        else
+          Logger.new($stderr)
+        end
+      end
+  end
+end

vendor/rails/actionpack/lib/action_controller/filters.rb

@@ -0,0 +1,680 @@
+module ActionController #:nodoc:
+  module Filters #:nodoc:
+    def self.included(base)
+      base.class_eval do
+        extend ClassMethods
+        include ActionController::Filters::InstanceMethods
+      end
+    end
+
+    class FilterChain < ActiveSupport::Callbacks::CallbackChain #:nodoc:
+      def append_filter_to_chain(filters, filter_type, &block)
+        pos = find_filter_append_position(filters, filter_type)
+        update_filter_chain(filters, filter_type, pos, &block)
+      end
+
+      def prepend_filter_to_chain(filters, filter_type, &block)
+        pos = find_filter_prepend_position(filters, filter_type)
+        update_filter_chain(filters, filter_type, pos, &block)
+      end
+
+      def create_filters(filters, filter_type, &block)
+        filters, conditions = extract_options(filters, &block)
+        filters.map! { |filter| find_or_create_filter(filter, filter_type, conditions) }
+        filters
+      end
+
+      def skip_filter_in_chain(*filters, &test)
+        filters, conditions = extract_options(filters)
+        filters.each do |filter|
+          if callback = find(filter) then delete(callback) end
+        end if conditions.empty?
+        update_filter_in_chain(filters, :skip => conditions, &test)
+      end
+
+      private
+        def update_filter_chain(filters, filter_type, pos, &block)
+          new_filters = create_filters(filters, filter_type, &block)
+          insert(pos, new_filters).flatten!
+        end
+
+        def find_filter_append_position(filters, filter_type)
+          # appending an after filter puts it at the end of the call chain
+          # before and around filters go before the first after filter in the chain
+          unless filter_type == :after
+            each_with_index do |f,i|
+              return i if f.after?
+            end
+          end
+          return -1
+        end
+
+        def find_filter_prepend_position(filters, filter_type)
+          # prepending a before or around filter puts it at the front of the call chain
+          # after filters go before the first after filter in the chain
+          if filter_type == :after
+            each_with_index do |f,i|
+              return i if f.after?
+            end
+            return -1
+          end
+          return 0
+        end
+
+        def find_or_create_filter(filter, filter_type, options = {})
+          update_filter_in_chain([filter], options)
+
+          if found_filter = find(filter) { |f| f.type == filter_type }
+            found_filter
+          else
+            filter_kind = case
+            when filter.respond_to?(:before) && filter_type == :before
+              :before
+            when filter.respond_to?(:after) && filter_type == :after
+              :after
+            else
+              :filter
+            end
+
+            case filter_type
+            when :before
+              BeforeFilter.new(filter_kind, filter, options)
+            when :after
+              AfterFilter.new(filter_kind, filter, options)
+            else
+              AroundFilter.new(filter_kind, filter, options)
+            end
+          end
+        end
+
+        def update_filter_in_chain(filters, options, &test)
+          filters.map! { |f| block_given? ? find(f, &test) : find(f) }
+          filters.compact!
+
+          map! do |filter|
+            if filters.include?(filter)
+              new_filter = filter.dup
+              new_filter.update_options!(options)
+              new_filter
+            else
+              filter
+            end
+          end
+        end
+    end
+
+    class Filter < ActiveSupport::Callbacks::Callback #:nodoc:
+      def initialize(kind, method, options = {})
+        super
+        update_options! options
+      end
+
+      # override these to return true in appropriate subclass
+      def before?
+        false
+      end
+
+      def after?
+        false
+      end
+
+      def around?
+        false
+      end
+
+      # Make sets of strings from :only/:except options
+      def update_options!(other)
+        if other
+          convert_only_and_except_options_to_sets_of_strings(other)
+          if other[:skip]
+            convert_only_and_except_options_to_sets_of_strings(other[:skip])
+          end
+        end
+
+        options.update(other)
+      end
+
+      private
+        def should_not_skip?(controller)
+          if options[:skip]
+            !included_in_action?(controller, options[:skip])
+          else
+            true
+          end
+        end
+
+        def included_in_action?(controller, options)
+          if options[:only]
+            options[:only].include?(controller.action_name)
+          elsif options[:except]
+            !options[:except].include?(controller.action_name)
+          else
+            true
+          end
+        end
+
+        def should_run_callback?(controller)
+          should_not_skip?(controller) && included_in_action?(controller, options) && super
+        end
+
+        def convert_only_and_except_options_to_sets_of_strings(opts)
+          [:only, :except].each do |key|
+            if values = opts[key]
+              opts[key] = Array(values).map(&:to_s).to_set
+            end
+          end
+        end
+    end
+
+    class AroundFilter < Filter #:nodoc:
+      def type
+        :around
+      end
+
+      def around?
+        true
+      end
+
+      def call(controller, &block)
+        if should_run_callback?(controller)
+          method = filter_responds_to_before_and_after? ? around_proc : self.method
+
+          # For around_filter do |controller, action|
+          if method.is_a?(Proc) && method.arity == 2
+            evaluate_method(method, controller, block)
+          else
+            evaluate_method(method, controller, &block)
+          end
+        else
+          block.call
+        end
+      end
+
+      private
+        def filter_responds_to_before_and_after?
+          method.respond_to?(:before) && method.respond_to?(:after)
+        end
+
+        def around_proc
+          Proc.new do |controller, action|
+            method.before(controller)
+
+            if controller.__send__(:performed?)
+              controller.__send__(:halt_filter_chain, method, :rendered_or_redirected)
+            else
+              begin
+                action.call
+              ensure
+                method.after(controller)
+              end
+            end
+          end
+        end
+    end
+
+    class BeforeFilter < Filter #:nodoc:
+      def type
+        :before
+      end
+
+      def before?
+        true
+      end
+
+      def call(controller, &block)
+        super
+        if controller.__send__(:performed?)
+          controller.__send__(:halt_filter_chain, method, :rendered_or_redirected)
+        end
+      end
+    end
+
+    class AfterFilter < Filter #:nodoc:
+      def type
+        :after
+      end
+
+      def after?
+        true
+      end
+    end
+
+    # Filters enable controllers to run shared pre- and post-processing code for its actions. These filters can be used to do
+    # authentication, caching, or auditing before the intended action is performed. Or to do localization or output
+    # compression after the action has been performed. Filters have access to the request, response, and all the instance
+    # variables set by other filters in the chain or by the action (in the case of after filters).
+    #
+    # == Filter inheritance
+    #
+    # Controller inheritance hierarchies share filters downwards, but subclasses can also add or skip filters without
+    # affecting the superclass. For example:
+    #
+    #   class BankController < ActionController::Base
+    #     before_filter :audit
+    #
+    #     private
+    #       def audit
+    #         # record the action and parameters in an audit log
+    #       end
+    #   end
+    #
+    #   class VaultController < BankController
+    #     before_filter :verify_credentials
+    #
+    #     private
+    #       def verify_credentials
+    #         # make sure the user is allowed into the vault
+    #       end
+    #   end
+    #
+    # Now any actions performed on the BankController will have the audit method called before. On the VaultController,
+    # first the audit method is called, then the verify_credentials method. If the audit method renders or redirects, then
+    # verify_credentials and the intended action are never called.
+    #
+    # == Filter types
+    #
+    # A filter can take one of three forms: method reference (symbol), external class, or inline method (proc). The first
+    # is the most common and works by referencing a protected or private method somewhere in the inheritance hierarchy of
+    # the controller by use of a symbol. In the bank example above, both BankController and VaultController use this form.
+    #
+    # Using an external class makes for more easily reused generic filters, such as output compression. External filter classes
+    # are implemented by having a static +filter+ method on any class and then passing this class to the filter method. Example:
+    #
+    #   class OutputCompressionFilter
+    #     def self.filter(controller)
+    #       controller.response.body = compress(controller.response.body)
+    #     end
+    #   end
+    #
+    #   class NewspaperController < ActionController::Base
+    #     after_filter OutputCompressionFilter
+    #   end
+    #
+    # The filter method is passed the controller instance and is hence granted access to all aspects of the controller and can
+    # manipulate them as it sees fit.
+    #
+    # The inline method (using a proc) can be used to quickly do something small that doesn't require a lot of explanation.
+    # Or just as a quick test. It works like this:
+    #
+    #   class WeblogController < ActionController::Base
+    #     before_filter { |controller| head(400) if controller.params["stop_action"] }
+    #   end
+    #
+    # As you can see, the block expects to be passed the controller after it has assigned the request to the internal variables.
+    # This means that the block has access to both the request and response objects complete with convenience methods for params,
+    # session, template, and assigns. Note: The inline method doesn't strictly have to be a block; any object that responds to call
+    # and returns 1 or -1 on arity will do (such as a Proc or an Method object).
+    #
+    # Please note that around_filters function a little differently than the normal before and after filters with regard to filter
+    # types. Please see the section dedicated to around_filters below.
+    #
+    # == Filter chain ordering
+    #
+    # Using <tt>before_filter</tt> and <tt>after_filter</tt> appends the specified filters to the existing chain. That's usually
+    # just fine, but some times you care more about the order in which the filters are executed. When that's the case, you
+    # can use <tt>prepend_before_filter</tt> and <tt>prepend_after_filter</tt>. Filters added by these methods will be put at the
+    # beginning of their respective chain and executed before the rest. For example:
+    #
+    #   class ShoppingController < ActionController::Base
+    #     before_filter :verify_open_shop
+    #
+    #   class CheckoutController < ShoppingController
+    #     prepend_before_filter :ensure_items_in_cart, :ensure_items_in_stock
+    #
+    # The filter chain for the CheckoutController is now <tt>:ensure_items_in_cart, :ensure_items_in_stock,</tt>
+    # <tt>:verify_open_shop</tt>. So if either of the ensure filters renders or redirects, we'll never get around to see if the shop
+    # is open or not.
+    #
+    # You may pass multiple filter arguments of each type as well as a filter block.
+    # If a block is given, it is treated as the last argument.
+    #
+    # == Around filters
+    #
+    # Around filters wrap an action, executing code both before and after.
+    # They may be declared as method references, blocks, or objects responding
+    # to +filter+ or to both +before+ and +after+.
+    #
+    # To use a method as an +around_filter+, pass a symbol naming the Ruby method.
+    # Yield (or <tt>block.call</tt>) within the method to run the action.
+    #
+    #   around_filter :catch_exceptions
+    #
+    #   private
+    #     def catch_exceptions
+    #       yield
+    #     rescue => exception
+    #       logger.debug "Caught exception! #{exception}"
+    #       raise
+    #     end
+    #
+    # To use a block as an +around_filter+, pass a block taking as args both
+    # the controller and the action block. You can't call yield directly from
+    # an +around_filter+ block; explicitly call the action block instead:
+    #
+    #   around_filter do |controller, action|
+    #     logger.debug "before #{controller.action_name}"
+    #     action.call
+    #     logger.debug "after #{controller.action_name}"
+    #   end
+    #
+    # To use a filter object with +around_filter+, pass an object responding
+    # to <tt>:filter</tt> or both <tt>:before</tt> and <tt>:after</tt>. With a
+    # filter method, yield to the block as above:
+    #
+    #   around_filter BenchmarkingFilter
+    #
+    #   class BenchmarkingFilter
+    #     def self.filter(controller, &block)
+    #       Benchmark.measure(&block)
+    #     end
+    #   end
+    #
+    # With +before+ and +after+ methods:
+    #
+    #   around_filter Authorizer.new
+    #
+    #   class Authorizer
+    #     # This will run before the action. Redirecting aborts the action.
+    #     def before(controller)
+    #       unless user.authorized?
+    #         redirect_to(login_url)
+    #       end
+    #     end
+    #
+    #     # This will run after the action if and only if before did not render or redirect.
+    #     def after(controller)
+    #     end
+    #   end
+    #
+    # If the filter has +before+ and +after+ methods, the +before+ method will be
+    # called before the action. If +before+ renders or redirects, the filter chain is
+    # halted and +after+ will not be run. See Filter Chain Halting below for
+    # an example.
+    #
+    # == Filter chain skipping
+    #
+    # Declaring a filter on a base class conveniently applies to its subclasses,
+    # but sometimes a subclass should skip some of its superclass' filters:
+    #
+    #   class ApplicationController < ActionController::Base
+    #     before_filter :authenticate
+    #     around_filter :catch_exceptions
+    #   end
+    #
+    #   class WeblogController < ApplicationController
+    #     # Will run the :authenticate and :catch_exceptions filters.
+    #   end
+    #
+    #   class SignupController < ApplicationController
+    #     # Skip :authenticate, run :catch_exceptions.
+    #     skip_before_filter :authenticate
+    #   end
+    #
+    #   class ProjectsController < ApplicationController
+    #     # Skip :catch_exceptions, run :authenticate.
+    #     skip_filter :catch_exceptions
+    #   end
+    #
+    #   class ClientsController < ApplicationController
+    #     # Skip :catch_exceptions and :authenticate unless action is index.
+    #     skip_filter :catch_exceptions, :authenticate, :except => :index
+    #   end
+    #
+    # == Filter conditions
+    #
+    # Filters may be limited to specific actions by declaring the actions to
+    # include or exclude. Both options accept single actions
+    # (<tt>:only => :index</tt>) or arrays of actions
+    # (<tt>:except => [:foo, :bar]</tt>).
+    #
+    #   class Journal < ActionController::Base
+    #     # Require authentication for edit and delete.
+    #     before_filter :authorize, :only => [:edit, :delete]
+    #
+    #     # Passing options to a filter with a block.
+    #     around_filter(:except => :index) do |controller, action_block|
+    #       results = Profiler.run(&action_block)
+    #       controller.response.sub! "</body>", "#{results}</body>"
+    #     end
+    #
+    #     private
+    #       def authorize
+    #         # Redirect to login unless authenticated.
+    #       end
+    #   end
+    #
+    # == Filter Chain Halting
+    #
+    # <tt>before_filter</tt> and <tt>around_filter</tt> may halt the request
+    # before a controller action is run. This is useful, for example, to deny
+    # access to unauthenticated users or to redirect from HTTP to HTTPS.
+    # Simply call render or redirect. After filters will not be executed if the filter 
+    # chain is halted.
+    #
+    # Around filters halt the request unless the action block is called.
+    # Given these filters
+    #   after_filter :after
+    #   around_filter :around
+    #   before_filter :before
+    #
+    # The filter chain will look like:
+    #
+    #   ...
+    #   . \
+    #   .  #around (code before yield)
+    #   .  .  \
+    #   .  .  #before (actual filter code is run)
+    #   .  .  .  \
+    #   .  .  .  execute controller action
+    #   .  .  .  /
+    #   .  .  ...
+    #   .  .  /
+    #   .  #around (code after yield)
+    #   . /
+    #   #after (actual filter code is run, unless the around filter does not yield)
+    #
+    # If +around+ returns before yielding, +after+ will still not be run. The +before+
+    # filter and controller action will not be run. If +before+ renders or redirects,
+    # the second half of +around+ and will still run but +after+ and the
+    # action will not. If +around+ fails to yield, +after+ will not be run.
+    module ClassMethods
+      # The passed <tt>filters</tt> will be appended to the filter_chain and
+      # will execute before the action on this controller is performed.
+      def append_before_filter(*filters, &block)
+        filter_chain.append_filter_to_chain(filters, :before, &block)
+      end
+
+      # The passed <tt>filters</tt> will be prepended to the filter_chain and
+      # will execute before the action on this controller is performed.
+      def prepend_before_filter(*filters, &block)
+        filter_chain.prepend_filter_to_chain(filters, :before, &block)
+      end
+
+      # Shorthand for append_before_filter since it's the most common.
+      alias :before_filter :append_before_filter
+
+      # The passed <tt>filters</tt> will be appended to the array of filters
+      # that run _after_ actions on this controller are performed.
+      def append_after_filter(*filters, &block)
+        filter_chain.append_filter_to_chain(filters, :after, &block)
+      end
+
+      # The passed <tt>filters</tt> will be prepended to the array of filters
+      # that run _after_ actions on this controller are performed.
+      def prepend_after_filter(*filters, &block)
+        filter_chain.prepend_filter_to_chain(filters, :after, &block)
+      end
+
+      # Shorthand for append_after_filter since it's the most common.
+      alias :after_filter :append_after_filter
+
+      # If you <tt>append_around_filter A.new, B.new</tt>, the filter chain looks like
+      #
+      #   B#before
+      #     A#before
+      #       # run the action
+      #     A#after
+      #   B#after
+      #
+      # With around filters which yield to the action block, +before+ and +after+
+      # are the code before and after the yield.
+      def append_around_filter(*filters, &block)
+        filter_chain.append_filter_to_chain(filters, :around, &block)
+      end
+
+      # If you <tt>prepend_around_filter A.new, B.new</tt>, the filter chain looks like:
+      #
+      #   A#before
+      #     B#before
+      #       # run the action
+      #     B#after
+      #   A#after
+      #
+      # With around filters which yield to the action block, +before+ and +after+
+      # are the code before and after the yield.
+      def prepend_around_filter(*filters, &block)
+        filter_chain.prepend_filter_to_chain(filters, :around, &block)
+      end
+
+      # Shorthand for +append_around_filter+ since it's the most common.
+      alias :around_filter :append_around_filter
+
+      # Removes the specified filters from the +before+ filter chain. Note that this only works for skipping method-reference
+      # filters, not procs. This is especially useful for managing the chain in inheritance hierarchies where only one out
+      # of many sub-controllers need a different hierarchy.
+      #
+      # You can control the actions to skip the filter for with the <tt>:only</tt> and <tt>:except</tt> options,
+      # just like when you apply the filters.
+      def skip_before_filter(*filters)
+        filter_chain.skip_filter_in_chain(*filters, &:before?)
+      end
+
+      # Removes the specified filters from the +after+ filter chain. Note that this only works for skipping method-reference
+      # filters, not procs. This is especially useful for managing the chain in inheritance hierarchies where only one out
+      # of many sub-controllers need a different hierarchy.
+      #
+      # You can control the actions to skip the filter for with the <tt>:only</tt> and <tt>:except</tt> options,
+      # just like when you apply the filters.
+      def skip_after_filter(*filters)
+        filter_chain.skip_filter_in_chain(*filters, &:after?)
+      end
+
+      # Removes the specified filters from the filter chain. This only works for method reference (symbol)
+      # filters, not procs. This method is different from skip_after_filter and skip_before_filter in that
+      # it will match any before, after or yielding around filter.
+      #
+      # You can control the actions to skip the filter for with the <tt>:only</tt> and <tt>:except</tt> options,
+      # just like when you apply the filters.
+      def skip_filter(*filters)
+        filter_chain.skip_filter_in_chain(*filters)
+      end
+
+      # Returns an array of Filter objects for this controller.
+      def filter_chain
+        if chain = read_inheritable_attribute('filter_chain')
+          return chain
+        else
+          write_inheritable_attribute('filter_chain', FilterChain.new)
+          return filter_chain
+        end
+      end
+
+      # Returns all the before filters for this class and all its ancestors.
+      # This method returns the actual filter that was assigned in the controller to maintain existing functionality.
+      def before_filters #:nodoc:
+        filter_chain.select(&:before?).map(&:method)
+      end
+
+      # Returns all the after filters for this class and all its ancestors.
+      # This method returns the actual filter that was assigned in the controller to maintain existing functionality.
+      def after_filters #:nodoc:
+        filter_chain.select(&:after?).map(&:method)
+      end
+    end
+
+    module InstanceMethods # :nodoc:
+      def self.included(base)
+        base.class_eval do
+          alias_method_chain :perform_action, :filters
+          alias_method_chain :process, :filters
+        end
+      end
+
+      protected
+        def process_with_filters(request, response, method = :perform_action, *arguments) #:nodoc:
+          @before_filter_chain_aborted = false
+          process_without_filters(request, response, method, *arguments)
+        end
+
+        def perform_action_with_filters
+          call_filters(self.class.filter_chain, 0, 0)
+        end
+
+      private
+        def call_filters(chain, index, nesting)
+          index = run_before_filters(chain, index, nesting)
+          aborted = @before_filter_chain_aborted
+          perform_action_without_filters unless performed? || aborted
+          return index if nesting != 0 || aborted
+          run_after_filters(chain, index)
+        end
+
+        def run_before_filters(chain, index, nesting)
+          while chain[index]
+            filter, index = chain[index], index
+            break unless filter # end of call chain reached
+
+            case filter
+            when BeforeFilter
+              filter.call(self)  # invoke before filter
+              index = index.next
+              break if @before_filter_chain_aborted
+            when AroundFilter
+              yielded = false
+
+              filter.call(self) do
+                yielded = true
+                # all remaining before and around filters will be run in this call
+                index = call_filters(chain, index.next, nesting.next)
+              end
+
+              halt_filter_chain(filter, :did_not_yield) unless yielded
+
+              break
+            else
+              break  # no before or around filters left
+            end
+          end
+
+          index
+        end
+
+        def run_after_filters(chain, index)
+          seen_after_filter = false
+
+          while chain[index]
+            filter, index = chain[index], index
+            break unless filter # end of call chain reached
+
+            case filter
+            when AfterFilter
+              seen_after_filter = true
+              filter.call(self)  # invoke after filter
+            else
+              # implementation error or someone has mucked with the filter chain
+              raise ActionControllerError, "filter #{filter.inspect} was in the wrong place!" if seen_after_filter
+            end
+
+            index = index.next
+          end
+
+          index.next
+        end
+
+        def halt_filter_chain(filter, reason)
+          @before_filter_chain_aborted = true
+          logger.info "Filter chain halted as [#{filter.inspect}] #{reason}." if logger
+        end
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/flash.rb

@@ -0,0 +1,213 @@
+module ActionController #:nodoc:
+  # The flash provides a way to pass temporary objects between actions. Anything you place in the flash will be exposed
+  # to the very next action and then cleared out. This is a great way of doing notices and alerts, such as a create
+  # action that sets <tt>flash[:notice] = "Successfully created"</tt> before redirecting to a display action that can
+  # then expose the flash to its template. Actually, that exposure is automatically done. Example:
+  #
+  #   class PostsController < ActionController::Base
+  #     def create
+  #       # save post
+  #       flash[:notice] = "Successfully created post"
+  #       redirect_to posts_path(@post)
+  #     end
+  #
+  #     def show
+  #       # doesn't need to assign the flash notice to the template, that's done automatically
+  #     end
+  #   end
+  #
+  #   show.html.erb
+  #     <% if flash[:notice] %>
+  #       <div class="notice"><%= flash[:notice] %></div>
+  #     <% end %>
+  #
+  # This example just places a string in the flash, but you can put any object in there. And of course, you can put as
+  # many as you like at a time too. Just remember: They'll be gone by the time the next action has been performed.
+  #
+  # See docs on the FlashHash class for more details about the flash.
+  module Flash
+    def self.included(base)
+      base.class_eval do
+        include InstanceMethods
+
+        alias_method_chain :perform_action, :flash
+        alias_method_chain :reset_session,  :flash
+        alias_method_chain :redirect_to,    :flash
+
+        helper_method :alert
+        helper_method :notice
+      end
+    end
+
+    class FlashNow #:nodoc:
+      def initialize(flash)
+        @flash = flash
+      end
+
+      def []=(k, v)
+        @flash[k] = v
+        @flash.discard(k)
+        v
+      end
+
+      def [](k)
+        @flash[k]
+      end
+    end
+
+    class FlashHash < Hash
+      def initialize #:nodoc:
+        super
+        @used = {}
+      end
+
+      def []=(k, v) #:nodoc:
+        keep(k)
+        super
+      end
+
+      def update(h) #:nodoc:
+        h.keys.each { |k| keep(k) }
+        super
+      end
+
+      alias :merge! :update
+
+      def replace(h) #:nodoc:
+        @used = {}
+        super
+      end
+
+      # Sets a flash that will not be available to the next action, only to the current.
+      #
+      #     flash.now[:message] = "Hello current action"
+      #
+      # This method enables you to use the flash as a central messaging system in your app.
+      # When you need to pass an object to the next action, you use the standard flash assign (<tt>[]=</tt>).
+      # When you need to pass an object to the current action, you use <tt>now</tt>, and your object will
+      # vanish when the current action is done.
+      #
+      # Entries set via <tt>now</tt> are accessed the same way as standard entries: <tt>flash['my-key']</tt>.
+      def now
+        FlashNow.new(self)
+      end
+
+      # Keeps either the entire current flash or a specific flash entry available for the next action:
+      #
+      #    flash.keep            # keeps the entire flash
+      #    flash.keep(:notice)   # keeps only the "notice" entry, the rest of the flash is discarded
+      def keep(k = nil)
+        use(k, false)
+      end
+
+      # Marks the entire flash or a single flash entry to be discarded by the end of the current action:
+      #
+      #     flash.discard              # discard the entire flash at the end of the current action
+      #     flash.discard(:warning)    # discard only the "warning" entry at the end of the current action
+      def discard(k = nil)
+        use(k)
+      end
+
+      # Mark for removal entries that were kept, and delete unkept ones.
+      #
+      # This method is called automatically by filters, so you generally don't need to care about it.
+      def sweep #:nodoc:
+        keys.each do |k|
+          unless @used[k]
+            use(k)
+          else
+            delete(k)
+            @used.delete(k)
+          end
+        end
+
+        # clean up after keys that could have been left over by calling reject! or shift on the flash
+        (@used.keys - keys).each{ |k| @used.delete(k) }
+      end
+
+      def store(session, key = "flash")
+        return if self.empty?
+        session[key] = self
+      end
+
+      private
+        # Used internally by the <tt>keep</tt> and <tt>discard</tt> methods
+        #     use()               # marks the entire flash as used
+        #     use('msg')          # marks the "msg" entry as used
+        #     use(nil, false)     # marks the entire flash as unused (keeps it around for one more action)
+        #     use('msg', false)   # marks the "msg" entry as unused (keeps it around for one more action)
+        def use(k=nil, v=true)
+          unless k.nil?
+            @used[k] = v
+          else
+            keys.each{ |key| use(key, v) }
+          end
+        end
+    end
+
+    module InstanceMethods #:nodoc:
+      protected
+        def perform_action_with_flash
+          perform_action_without_flash
+          if defined? @_flash
+            @_flash.store(session)
+            remove_instance_variable(:@_flash)
+          end
+        end
+
+        def reset_session_with_flash
+          reset_session_without_flash
+          remove_instance_variable(:@_flash) if defined? @_flash
+        end
+
+        def redirect_to_with_flash(options = {}, response_status_and_flash = {}) #:doc:
+          if alert = response_status_and_flash.delete(:alert)
+            flash[:alert] = alert
+          end
+
+          if notice = response_status_and_flash.delete(:notice)
+            flash[:notice] = notice
+          end
+          
+          if other_flashes = response_status_and_flash.delete(:flash)
+            flash.update(other_flashes)
+          end
+          
+          redirect_to_without_flash(options, response_status_and_flash)
+        end
+
+        # Access the contents of the flash. Use <tt>flash["notice"]</tt> to
+        # read a notice you put there or <tt>flash["notice"] = "hello"</tt>
+        # to put a new one.
+        def flash #:doc:
+          if !defined?(@_flash)
+            @_flash = session["flash"] || FlashHash.new
+            @_flash.sweep
+          end
+
+          @_flash
+        end
+
+        
+        # Convenience accessor for flash[:alert]
+        def alert
+          flash[:alert]
+        end
+        
+        # Convenience accessor for flash[:alert]=
+        def alert=(message)
+          flash[:alert] = message
+        end
+
+        # Convenience accessor for flash[:notice]
+        def notice
+          flash[:notice]
+        end
+        
+        # Convenience accessor for flash[:notice]=
+        def notice=(message)
+          flash[:notice] = message
+        end
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/headers.rb

@@ -0,0 +1,33 @@
+require 'active_support/memoizable'
+
+module ActionController
+  module Http
+    class Headers < ::Hash
+      extend ActiveSupport::Memoizable
+
+      def initialize(*args)
+         if args.size == 1 && args[0].is_a?(Hash)
+           super()
+           update(args[0])
+         else
+           super
+         end
+       end
+
+      def [](header_name)
+        if include?(header_name)
+          super
+        else
+          super(env_name(header_name))
+        end
+      end
+
+      private
+        # Converts a HTTP header name to an environment variable name.
+        def env_name(header_name)
+          "HTTP_#{header_name.upcase.gsub(/-/, '_')}"
+        end
+        memoize :env_name
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/helpers.rb

@@ -0,0 +1,225 @@
+require 'active_support/dependencies'
+
+# FIXME: helper { ... } is broken on Ruby 1.9
+module ActionController #:nodoc:
+  module Helpers #:nodoc:
+    def self.included(base)
+      # Initialize the base module to aggregate its helpers.
+      base.class_inheritable_accessor :master_helper_module
+      base.master_helper_module = Module.new
+
+      # Set the default directory for helpers
+      base.class_inheritable_accessor :helpers_dir
+      base.helpers_dir = (defined?(RAILS_ROOT) ? "#{RAILS_ROOT}/app/helpers" : "app/helpers")
+
+      # Extend base with class methods to declare helpers.
+      base.extend(ClassMethods)
+
+      base.class_eval do
+        # Wrap inherited to create a new master helper module for subclasses.
+        class << self
+          alias_method_chain :inherited, :helper
+        end
+      end
+    end
+
+    # The Rails framework provides a large number of helpers for working with +assets+, +dates+, +forms+, 
+    # +numbers+ and Active Record objects, to name a few. These helpers are available to all templates
+    # by default.
+    #
+    # In addition to using the standard template helpers provided in the Rails framework, creating custom helpers to
+    # extract complicated logic or reusable functionality is strongly encouraged.  By default, the controller will 
+    # include a helper whose name matches that of the controller, e.g., <tt>MyController</tt> will automatically
+    # include <tt>MyHelper</tt>.
+    # 
+    # Additional helpers can be specified using the +helper+ class method in <tt>ActionController::Base</tt> or any
+    # controller which inherits from it.
+    #
+    # ==== Examples
+    # The +to_s+ method from the Time class can be wrapped in a helper method to display a custom message if 
+    # the Time object is blank:
+    #
+    #   module FormattedTimeHelper
+    #     def format_time(time, format=:long, blank_message="&nbsp;")
+    #       time.blank? ? blank_message : time.to_s(format)
+    #     end
+    #   end
+    #
+    # FormattedTimeHelper can now be included in a controller, using the +helper+ class method:
+    #
+    #   class EventsController < ActionController::Base
+    #     helper FormattedTimeHelper
+    #     def index
+    #       @events = Event.find(:all)
+    #     end
+    #   end
+    #
+    # Then, in any view rendered by <tt>EventController</tt>, the <tt>format_time</tt> method can be called:
+    #
+    #   <% @events.each do |event| -%>
+    #     <p>
+    #       <% format_time(event.time, :short, "N/A") %> | <%= event.name %> 
+    #     </p>
+    #   <% end -%>
+    #
+    # Finally, assuming we have two event instances, one which has a time and one which does not, 
+    # the output might look like this:
+    #
+    #   23 Aug 11:30 | Carolina Railhawks Soccer Match 
+    #   N/A | Carolina Railhaws Training Workshop
+    #
+    module ClassMethods
+      # Makes all the (instance) methods in the helper module available to templates rendered through this controller.
+      # See ActionView::Helpers (link:classes/ActionView/Helpers.html) for more about making your own helper modules
+      # available to the templates.
+      def add_template_helper(helper_module) #:nodoc:
+        master_helper_module.module_eval { include helper_module }
+      end
+
+      # The +helper+ class method can take a series of helper module names, a block, or both.
+      #
+      # * <tt>*args</tt>: One or more modules, strings or symbols, or the special symbol <tt>:all</tt>.
+      # * <tt>&block</tt>: A block defining helper methods.
+      # 
+      # ==== Examples
+      # When the argument is a string or symbol, the method will provide the "_helper" suffix, require the file 
+      # and include the module in the template class.  The second form illustrates how to include custom helpers 
+      # when working with namespaced controllers, or other cases where the file containing the helper definition is not
+      # in one of Rails' standard load paths:
+      #   helper :foo             # => requires 'foo_helper' and includes FooHelper
+      #   helper 'resources/foo'  # => requires 'resources/foo_helper' and includes Resources::FooHelper
+      #
+      # When the argument is a module it will be included directly in the template class.
+      #   helper FooHelper # => includes FooHelper
+      #
+      # When the argument is the symbol <tt>:all</tt>, the controller will include all helpers beneath
+      # <tt>ActionController::Base.helpers_dir</tt> (defaults to <tt>app/helpers/**/*.rb</tt> under RAILS_ROOT).
+      #   helper :all
+      #
+      # Additionally, the +helper+ class method can receive and evaluate a block, making the methods defined available 
+      # to the template.
+      #   # One line
+      #   helper { def hello() "Hello, world!" end }
+      #   # Multi-line
+      #   helper do
+      #     def foo(bar) 
+      #       "#{bar} is the very best" 
+      #     end
+      #   end
+      # 
+      # Finally, all the above styles can be mixed together, and the +helper+ method can be invoked with a mix of
+      # +symbols+, +strings+, +modules+ and blocks.
+      #   helper(:three, BlindHelper) { def mice() 'mice' end }
+      #
+      def helper(*args, &block)
+        args.flatten.each do |arg|
+          case arg
+            when Module
+              add_template_helper(arg)
+            when :all
+              helper(all_application_helpers)
+            when String, Symbol
+              file_name  = arg.to_s.underscore + '_helper'
+              class_name = file_name.camelize
+
+              begin
+                require_dependency(file_name)
+              rescue LoadError => load_error
+                requiree = / -- (.*?)(\.rb)?$/.match(load_error.message).to_a[1]
+                if requiree == file_name
+                  msg = "Missing helper file helpers/#{file_name}.rb"
+                  raise LoadError.new(msg).copy_blame!(load_error)
+                else
+                  raise
+                end
+              end
+
+              add_template_helper(class_name.constantize)
+            else
+              raise ArgumentError, "helper expects String, Symbol, or Module argument (was: #{args.inspect})"
+          end
+        end
+
+        # Evaluate block in template class if given.
+        master_helper_module.module_eval(&block) if block_given?
+      end
+
+      # Declare a controller method as a helper. For example, the following
+      # makes the +current_user+ controller method available to the view:
+      #   class ApplicationController < ActionController::Base
+      #     helper_method :current_user, :logged_in?
+      #
+      #     def current_user
+      #       @current_user ||= User.find_by_id(session[:user])
+      #     end
+      #
+      #      def logged_in?
+      #        current_user != nil
+      #      end
+      #   end
+      #
+      # In a view:
+      #  <% if logged_in? -%>Welcome, <%= current_user.name %><% end -%>
+      def helper_method(*methods)
+        methods.flatten.each do |method|
+          master_helper_module.module_eval <<-end_eval
+            def #{method}(*args, &block)                    # def current_user(*args, &block)
+              controller.send(%(#{method}), *args, &block)  #   controller.send(%(current_user), *args, &block)
+            end                                             # end
+          end_eval
+        end
+      end
+
+      # Declares helper accessors for controller attributes. For example, the
+      # following adds new +name+ and <tt>name=</tt> instance methods to a
+      # controller and makes them available to the view:
+      #   helper_attr :name
+      #   attr_accessor :name
+      def helper_attr(*attrs)
+        attrs.flatten.each { |attr| helper_method(attr, "#{attr}=") }
+      end
+
+      # Provides a proxy to access helpers methods from outside the view.
+      def helpers
+        unless @helper_proxy
+          @helper_proxy = ActionView::Base.new
+          @helper_proxy.extend master_helper_module
+        else
+          @helper_proxy
+        end
+      end
+
+      private
+        def default_helper_module!
+          unless name.blank?
+            module_name = name.sub(/Controller$|$/, 'Helper')
+            module_path = module_name.split('::').map { |m| m.underscore }.join('/')
+            require_dependency module_path
+            helper module_name.constantize
+          end
+        rescue MissingSourceFile => e
+          raise unless e.is_missing? module_path
+        rescue NameError => e
+          raise unless e.missing_name? module_name
+        end
+
+        def inherited_with_helper(child)
+          inherited_without_helper(child)
+
+          begin
+            child.master_helper_module = Module.new
+            child.master_helper_module.__send__ :include, master_helper_module
+            child.__send__ :default_helper_module!
+          rescue MissingSourceFile => e
+            raise unless e.is_missing?("helpers/#{child.controller_path}_helper")
+          end
+        end
+
+        # Extract helper names from files in app/helpers/**/*.rb
+        def all_application_helpers
+          extract = /^#{Regexp.quote(helpers_dir)}\/?(.*)_helper.rb$/
+          Dir["#{helpers_dir}/**/*_helper.rb"].map { |file| file.sub extract, '\1' }
+        end
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/http_authentication.rb

@@ -0,0 +1,309 @@
+module ActionController
+  module HttpAuthentication
+    # Makes it dead easy to do HTTP Basic authentication.
+    #
+    # Simple Basic example:
+    #
+    #   class PostsController < ApplicationController
+    #     USER_NAME, PASSWORD = "dhh", "secret"
+    #
+    #     before_filter :authenticate, :except => [ :index ]
+    #
+    #     def index
+    #       render :text => "Everyone can see me!"
+    #     end
+    #
+    #     def edit
+    #       render :text => "I'm only accessible if you know the password"
+    #     end
+    #
+    #     private
+    #       def authenticate
+    #         authenticate_or_request_with_http_basic do |user_name, password|
+    #           user_name == USER_NAME && password == PASSWORD
+    #         end
+    #       end
+    #   end
+    #
+    #
+    # Here is a more advanced Basic example where only Atom feeds and the XML API is protected by HTTP authentication,
+    # the regular HTML interface is protected by a session approach:
+    #
+    #   class ApplicationController < ActionController::Base
+    #     before_filter :set_account, :authenticate
+    #
+    #     protected
+    #       def set_account
+    #         @account = Account.find_by_url_name(request.subdomains.first)
+    #       end
+    #
+    #       def authenticate
+    #         case request.format
+    #         when Mime::XML, Mime::ATOM
+    #           if user = authenticate_with_http_basic { |u, p| @account.users.authenticate(u, p) }
+    #             @current_user = user
+    #           else
+    #             request_http_basic_authentication
+    #           end
+    #         else
+    #           if session_authenticated?
+    #             @current_user = @account.users.find(session[:authenticated][:user_id])
+    #           else
+    #             redirect_to(login_url) and return false
+    #           end
+    #         end
+    #       end
+    #   end
+    #
+    # In your integration tests, you can do something like this:
+    #
+    #   def test_access_granted_from_xml
+    #     get(
+    #       "/notes/1.xml", nil,
+    #       :authorization => ActionController::HttpAuthentication::Basic.encode_credentials(users(:dhh).name, users(:dhh).password)
+    #     )
+    #
+    #     assert_equal 200, status
+    #   end
+    #
+    # Simple Digest example:
+    #
+    #   require 'digest/md5'
+    #   class PostsController < ApplicationController
+    #     REALM = "SuperSecret"
+    #     USERS = {"dhh" => "secret", #plain text password
+    #              "dap" => Digest:MD5::hexdigest(["dap",REALM,"secret"].join(":"))  #ha1 digest password
+    #
+    #     before_filter :authenticate, :except => [:index]
+    #
+    #     def index
+    #       render :text => "Everyone can see me!"
+    #     end
+    #
+    #     def edit
+    #       render :text => "I'm only accessible if you know the password"
+    #     end
+    #
+    #     private
+    #       def authenticate
+    #         authenticate_or_request_with_http_digest(REALM) do |username|
+    #           USERS[username]
+    #         end
+    #       end
+    #   end
+    #
+    # NOTE: The +authenticate_or_request_with_http_digest+ block must return the user's password or the ha1 digest hash so the framework can appropriately
+    #       hash to check the user's credentials. Returning +nil+ will cause authentication to fail.
+    #       Storing the ha1 hash: MD5(username:realm:password), is better than storing a plain password. If
+    #       the password file or database is compromised, the attacker would be able to use the ha1 hash to
+    #       authenticate as the user at this +realm+, but would not have the user's password to try using at
+    #       other sites.
+    #
+    # On shared hosts, Apache sometimes doesn't pass authentication headers to
+    # FCGI instances. If your environment matches this description and you cannot
+    # authenticate, try this rule in your Apache setup:
+    #
+    #   RewriteRule ^(.*)$ dispatch.fcgi [E=X-HTTP_AUTHORIZATION:%{HTTP:Authorization},QSA,L]
+    module Basic
+      extend self
+
+      module ControllerMethods
+        def authenticate_or_request_with_http_basic(realm = "Application", &login_procedure)
+          authenticate_with_http_basic(&login_procedure) || request_http_basic_authentication(realm)
+        end
+
+        def authenticate_with_http_basic(&login_procedure)
+          HttpAuthentication::Basic.authenticate(self, &login_procedure)
+        end
+
+        def request_http_basic_authentication(realm = "Application")
+          HttpAuthentication::Basic.authentication_request(self, realm)
+        end
+      end
+
+      def authenticate(controller, &login_procedure)
+        unless authorization(controller.request).blank?
+          login_procedure.call(*user_name_and_password(controller.request))
+        end
+      end
+
+      def user_name_and_password(request)
+        decode_credentials(request).split(/:/, 2)
+      end
+
+      def authorization(request)
+        request.env['HTTP_AUTHORIZATION']   ||
+        request.env['X-HTTP_AUTHORIZATION'] ||
+        request.env['X_HTTP_AUTHORIZATION'] ||
+        request.env['REDIRECT_X_HTTP_AUTHORIZATION']
+      end
+
+      def decode_credentials(request)
+        ActiveSupport::Base64.decode64(authorization(request).split(' ', 2).last || '')
+      end
+
+      def encode_credentials(user_name, password)
+        "Basic #{ActiveSupport::Base64.encode64("#{user_name}:#{password}")}"
+      end
+
+      def authentication_request(controller, realm)
+        controller.headers["WWW-Authenticate"] = %(Basic realm="#{realm.gsub(/"/, "")}")
+        controller.__send__ :render, :text => "HTTP Basic: Access denied.\n", :status => :unauthorized
+      end
+    end
+
+    module Digest
+      extend self
+
+      module ControllerMethods
+        def authenticate_or_request_with_http_digest(realm = "Application", &password_procedure)
+          authenticate_with_http_digest(realm, &password_procedure) || request_http_digest_authentication(realm)
+        end
+
+        # Authenticate with HTTP Digest, returns true or false
+        def authenticate_with_http_digest(realm = "Application", &password_procedure)
+          HttpAuthentication::Digest.authenticate(self, realm, &password_procedure)
+        end
+
+        # Render output including the HTTP Digest authentication header
+        def request_http_digest_authentication(realm = "Application", message = nil)
+          HttpAuthentication::Digest.authentication_request(self, realm, message)
+        end
+      end
+
+      # Returns false on a valid response, true otherwise
+      def authenticate(controller, realm, &password_procedure)
+        authorization(controller.request) && validate_digest_response(controller.request, realm, &password_procedure)
+      end
+
+      def authorization(request)
+        request.env['HTTP_AUTHORIZATION']   ||
+        request.env['X-HTTP_AUTHORIZATION'] ||
+        request.env['X_HTTP_AUTHORIZATION'] ||
+        request.env['REDIRECT_X_HTTP_AUTHORIZATION']
+      end
+
+      # Returns false unless the request credentials response value matches the expected value.
+      # First try the password as a ha1 digest password. If this fails, then try it as a plain
+      # text password.
+      def validate_digest_response(request, realm, &password_procedure)
+        credentials = decode_credentials_header(request)
+        valid_nonce = validate_nonce(request, credentials[:nonce])
+
+        if valid_nonce && realm == credentials[:realm] && opaque == credentials[:opaque]
+          password = password_procedure.call(credentials[:username])
+          return false unless password
+
+          method = request.env['rack.methodoverride.original_method'] || request.env['REQUEST_METHOD']
+          uri    = credentials[:uri][0,1] == '/' ? request.request_uri : request.url
+
+         [true, false].any? do |password_is_ha1|
+           expected = expected_response(method, uri, credentials, password, password_is_ha1)
+           expected == credentials[:response]
+         end
+        end
+      end
+
+      # Returns the expected response for a request of +http_method+ to +uri+ with the decoded +credentials+ and the expected +password+
+      # Optional parameter +password_is_ha1+ is set to +true+ by default, since best practice is to store ha1 digest instead
+      # of a plain-text password.
+      def expected_response(http_method, uri, credentials, password, password_is_ha1=true)
+        ha1 = password_is_ha1 ? password : ha1(credentials, password)
+        ha2 = ::Digest::MD5.hexdigest([http_method.to_s.upcase, uri].join(':'))
+        ::Digest::MD5.hexdigest([ha1, credentials[:nonce], credentials[:nc], credentials[:cnonce], credentials[:qop], ha2].join(':'))
+      end
+
+      def ha1(credentials, password)
+        ::Digest::MD5.hexdigest([credentials[:username], credentials[:realm], password].join(':'))
+      end
+
+      def encode_credentials(http_method, credentials, password, password_is_ha1)
+        credentials[:response] = expected_response(http_method, credentials[:uri], credentials, password, password_is_ha1)
+        "Digest " + credentials.sort_by {|x| x[0].to_s }.inject([]) {|a, v| a << "#{v[0]}='#{v[1]}'" }.join(', ')
+      end
+
+      def decode_credentials_header(request)
+        decode_credentials(authorization(request))
+      end
+
+      def decode_credentials(header)
+        header.to_s.gsub(/^Digest\s+/,'').split(',').inject({}.with_indifferent_access) do |hash, pair|
+          key, value = pair.split('=', 2)
+          hash[key.strip] = value.to_s.gsub(/^"|"$/,'').gsub(/'/, '')
+          hash
+        end
+      end
+
+      def authentication_header(controller, realm)
+        controller.headers["WWW-Authenticate"] = %(Digest realm="#{realm}", qop="auth", algorithm=MD5, nonce="#{nonce}", opaque="#{opaque}")
+      end
+
+      def authentication_request(controller, realm, message = nil)
+        message ||= "HTTP Digest: Access denied.\n"
+        authentication_header(controller, realm)
+        controller.__send__ :render, :text => message, :status => :unauthorized
+      end
+
+      # Uses an MD5 digest based on time to generate a value to be used only once.
+      #
+      # A server-specified data string which should be uniquely generated each time a 401 response is made.
+      # It is recommended that this string be base64 or hexadecimal data.
+      # Specifically, since the string is passed in the header lines as a quoted string, the double-quote character is not allowed.
+      #
+      # The contents of the nonce are implementation dependent.
+      # The quality of the implementation depends on a good choice.
+      # A nonce might, for example, be constructed as the base 64 encoding of
+      #
+      # => time-stamp H(time-stamp ":" ETag ":" private-key)
+      #
+      # where time-stamp is a server-generated time or other non-repeating value,
+      # ETag is the value of the HTTP ETag header associated with the requested entity,
+      # and private-key is data known only to the server.
+      # With a nonce of this form a server would recalculate the hash portion after receiving the client authentication header and
+      # reject the request if it did not match the nonce from that header or
+      # if the time-stamp value is not recent enough. In this way the server can limit the time of the nonce's validity.
+      # The inclusion of the ETag prevents a replay request for an updated version of the resource.
+      # (Note: including the IP address of the client in the nonce would appear to offer the server the ability
+      # to limit the reuse of the nonce to the same client that originally got it.
+      # However, that would break proxy farms, where requests from a single user often go through different proxies in the farm.
+      # Also, IP address spoofing is not that hard.)
+      #
+      # An implementation might choose not to accept a previously used nonce or a previously used digest, in order to
+      # protect against a replay attack. Or, an implementation might choose to use one-time nonces or digests for
+      # POST or PUT requests and a time-stamp for GET requests. For more details on the issues involved see Section 4
+      # of this document.
+      #
+      # The nonce is opaque to the client. Composed of Time, and hash of Time with secret
+      # key from the Rails session secret generated upon creation of project. Ensures
+      # the time cannot be modifed by client.
+      def nonce(time = Time.now)
+        t = time.to_i
+        hashed = [t, secret_key]
+        digest = ::Digest::MD5.hexdigest(hashed.join(":"))
+        Base64.encode64("#{t}:#{digest}").gsub("\n", '')
+      end
+
+      # Might want a shorter timeout depending on whether the request
+      # is a PUT or POST, and if client is browser or web service.
+      # Can be much shorter if the Stale directive is implemented. This would
+      # allow a user to use new nonce without prompting user again for their
+      # username and password.
+      def validate_nonce(request, value, seconds_to_timeout=5*60)
+        return false if value.nil?
+        t = Base64.decode64(value).split(":").first.to_i
+        nonce(t) == value && (t - Time.now.to_i).abs <= seconds_to_timeout
+      end
+
+      # Opaque based on random generation - but changing each request?
+      def opaque()
+        ::Digest::MD5.hexdigest(secret_key)
+      end
+
+      # Set in /initializers/session_store.rb, and loaded even if sessions are not in use.
+      def secret_key
+        ActionController::Base.session_options[:secret]
+      end
+
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/integration.rb

@@ -0,0 +1,707 @@
+require 'stringio'
+require 'uri'
+require 'active_support/test_case'
+require 'action_controller/rack_lint_patch'
+
+module ActionController
+  module Integration #:nodoc:
+    # An integration Session instance represents a set of requests and responses
+    # performed sequentially by some virtual user. Because you can instantiate
+    # multiple sessions and run them side-by-side, you can also mimic (to some
+    # limited extent) multiple simultaneous users interacting with your system.
+    #
+    # Typically, you will instantiate a new session using
+    # IntegrationTest#open_session, rather than instantiating
+    # Integration::Session directly.
+    class Session
+      include Test::Unit::Assertions
+      include ActionController::TestCase::Assertions
+      include ActionController::TestProcess
+
+      # Rack application to use
+      attr_accessor :application
+
+      # The integer HTTP status code of the last request.
+      attr_reader :status
+
+      # The status message that accompanied the status code of the last request.
+      attr_reader :status_message
+
+      # The body of the last request.
+      attr_reader :body
+
+      # The URI of the last request.
+      attr_reader :path
+
+      # The hostname used in the last request.
+      attr_accessor :host
+
+      # The remote_addr used in the last request.
+      attr_accessor :remote_addr
+
+      # The Accept header to send.
+      attr_accessor :accept
+
+      # A map of the cookies returned by the last response, and which will be
+      # sent with the next request.
+      attr_reader :cookies
+
+      # A map of the headers returned by the last response.
+      attr_reader :headers
+
+      # A reference to the controller instance used by the last request.
+      attr_reader :controller
+
+      # A reference to the request instance used by the last request.
+      attr_reader :request
+
+      # A reference to the response instance used by the last request.
+      attr_reader :response
+
+      # A running counter of the number of requests processed.
+      attr_accessor :request_count
+
+      class MultiPartNeededException < Exception
+      end
+
+      # Create and initialize a new Session instance.
+      def initialize(app = nil)
+        @application = app || ActionController::Dispatcher.new
+        reset!
+      end
+
+      # Resets the instance. This can be used to reset the state information
+      # in an existing session instance, so it can be used from a clean-slate
+      # condition.
+      #
+      #   session.reset!
+      def reset!
+        @status = @path = @headers = nil
+        @result = @status_message = nil
+        @https = false
+        @cookies = {}
+        @controller = @request = @response = nil
+        @request_count = 0
+
+        self.host        = "www.example.com"
+        self.remote_addr = "127.0.0.1"
+        self.accept      = "text/xml,application/xml,application/xhtml+xml," +
+                           "text/html;q=0.9,text/plain;q=0.8,image/png," +
+                           "*/*;q=0.5"
+
+        unless defined? @named_routes_configured
+          # install the named routes in this session instance.
+          klass = class << self; self; end
+          Routing::Routes.install_helpers(klass)
+
+          # the helpers are made protected by default--we make them public for
+          # easier access during testing and troubleshooting.
+          klass.module_eval { public *Routing::Routes.named_routes.helpers }
+          @named_routes_configured = true
+        end
+      end
+
+      # Specify whether or not the session should mimic a secure HTTPS request.
+      #
+      #   session.https!
+      #   session.https!(false)
+      def https!(flag = true)
+        @https = flag
+      end
+
+      # Return +true+ if the session is mimicking a secure HTTPS request.
+      #
+      #   if session.https?
+      #     ...
+      #   end
+      def https?
+        @https
+      end
+
+      # Set the host name to use in the next request.
+      #
+      #   session.host! "www.example.com"
+      def host!(name)
+        @host = name
+      end
+
+      # Follow a single redirect response. If the last response was not a
+      # redirect, an exception will be raised. Otherwise, the redirect is
+      # performed on the location header.
+      def follow_redirect!
+        raise "not a redirect! #{@status} #{@status_message}" unless redirect?
+        get(interpret_uri(headers['location']))
+        status
+      end
+
+      # Performs a request using the specified method, following any subsequent
+      # redirect. Note that the redirects are followed until the response is
+      # not a redirect--this means you may run into an infinite loop if your
+      # redirect loops back to itself.
+      def request_via_redirect(http_method, path, parameters = nil, headers = nil)
+        send(http_method, path, parameters, headers)
+        follow_redirect! while redirect?
+        status
+      end
+
+      # Performs a GET request, following any subsequent redirect.
+      # See +request_via_redirect+ for more information.
+      def get_via_redirect(path, parameters = nil, headers = nil)
+        request_via_redirect(:get, path, parameters, headers)
+      end
+
+      # Performs a POST request, following any subsequent redirect.
+      # See +request_via_redirect+ for more information.
+      def post_via_redirect(path, parameters = nil, headers = nil)
+        request_via_redirect(:post, path, parameters, headers)
+      end
+
+      # Performs a PUT request, following any subsequent redirect.
+      # See +request_via_redirect+ for more information.
+      def put_via_redirect(path, parameters = nil, headers = nil)
+        request_via_redirect(:put, path, parameters, headers)
+      end
+
+      # Performs a DELETE request, following any subsequent redirect.
+      # See +request_via_redirect+ for more information.
+      def delete_via_redirect(path, parameters = nil, headers = nil)
+        request_via_redirect(:delete, path, parameters, headers)
+      end
+
+      # Returns +true+ if the last response was a redirect.
+      def redirect?
+        status/100 == 3
+      end
+
+      # Performs a GET request with the given parameters.
+      #
+      # - +path+: The URI (as a String) on which you want to perform a GET
+      #   request.
+      # - +parameters+: The HTTP parameters that you want to pass. This may
+      #   be +nil+,
+      #   a Hash, or a String that is appropriately encoded
+      #   (<tt>application/x-www-form-urlencoded</tt> or
+      #   <tt>multipart/form-data</tt>).
+      # - +headers+: Additional HTTP headers to pass, as a Hash. The keys will
+      #   automatically be upcased, with the prefix 'HTTP_' added if needed.
+      #
+      # This method returns an Response object, which one can use to
+      # inspect the details of the response. Furthermore, if this method was
+      # called from an ActionController::IntegrationTest object, then that
+      # object's <tt>@response</tt> instance variable will point to the same
+      # response object.
+      #
+      # You can also perform POST, PUT, DELETE, and HEAD requests with +post+,
+      # +put+, +delete+, and +head+.
+      def get(path, parameters = nil, headers = nil)
+        process :get, path, parameters, headers
+      end
+
+      # Performs a POST request with the given parameters. See get() for more
+      # details.
+      def post(path, parameters = nil, headers = nil)
+        process :post, path, parameters, headers
+      end
+
+      # Performs a PUT request with the given parameters. See get() for more
+      # details.
+      def put(path, parameters = nil, headers = nil)
+        process :put, path, parameters, headers
+      end
+
+      # Performs a DELETE request with the given parameters. See get() for
+      # more details.
+      def delete(path, parameters = nil, headers = nil)
+        process :delete, path, parameters, headers
+      end
+
+      # Performs a HEAD request with the given parameters. See get() for more
+      # details.
+      def head(path, parameters = nil, headers = nil)
+        process :head, path, parameters, headers
+      end
+
+      # Performs an XMLHttpRequest request with the given parameters, mirroring
+      # a request from the Prototype library.
+      #
+      # The request_method is :get, :post, :put, :delete or :head; the
+      # parameters are +nil+, a hash, or a url-encoded or multipart string;
+      # the headers are a hash.  Keys are automatically upcased and prefixed
+      # with 'HTTP_' if not already.
+      def xml_http_request(request_method, path, parameters = nil, headers = nil)
+        headers ||= {}
+        headers['X-Requested-With'] = 'XMLHttpRequest'
+        headers['Accept'] ||= [Mime::JS, Mime::HTML, Mime::XML, 'text/xml', Mime::ALL].join(', ')
+        process(request_method, path, parameters, headers)
+      end
+      alias xhr :xml_http_request
+
+      # Returns the URL for the given options, according to the rules specified
+      # in the application's routes.
+      def url_for(options)
+        controller ?
+          controller.url_for(options) :
+          generic_url_rewriter.rewrite(options)
+      end
+
+      private
+        # Tailors the session based on the given URI, setting the HTTPS value
+        # and the hostname.
+        def interpret_uri(path)
+          location = URI.parse(path)
+          https! URI::HTTPS === location if location.scheme
+          host! location.host if location.host
+          location.query ? "#{location.path}?#{location.query}" : location.path
+        end
+
+        # Performs the actual request.
+        def process(method, path, parameters = nil, headers = nil)
+          data = requestify(parameters)
+          path = interpret_uri(path) if path =~ %r{://}
+          path = "/#{path}" unless path[0] == ?/
+          @path = path
+          env = {}
+
+          if method == :get
+            env["QUERY_STRING"] = data
+            data = nil
+          end
+
+          env["QUERY_STRING"] ||= ""
+
+          data ||= ''
+          data.force_encoding(Encoding::ASCII_8BIT) if data.respond_to?(:force_encoding)
+          data = data.is_a?(IO) ? data : StringIO.new(data)
+
+          env.update(
+            "REQUEST_METHOD"  => method.to_s.upcase,
+            "SERVER_NAME"     => host,
+            "SERVER_PORT"     => (https? ? "443" : "80"),
+            "HTTPS"           => https? ? "on" : "off",
+            "rack.url_scheme" => https? ? "https" : "http",
+            "SCRIPT_NAME"     => "",
+
+            "REQUEST_URI"    => path,
+            "PATH_INFO"      => path,
+            "HTTP_HOST"      => host,
+            "REMOTE_ADDR"    => remote_addr,
+            "CONTENT_TYPE"   => "application/x-www-form-urlencoded",
+            "CONTENT_LENGTH" => data ? data.length.to_s : nil,
+            "HTTP_COOKIE"    => encode_cookies,
+            "HTTP_ACCEPT"    => accept,
+
+            "rack.version"      => [0,1],
+            "rack.input"        => data,
+            "rack.errors"       => StringIO.new,
+            "rack.multithread"  => true,
+            "rack.multiprocess" => true,
+            "rack.run_once"     => false
+          )
+
+          (headers || {}).each do |key, value|
+            key = key.to_s.upcase.gsub(/-/, "_")
+            key = "HTTP_#{key}" unless env.has_key?(key) || key =~ /^HTTP_/
+            env[key] = value
+          end
+
+          [ControllerCapture, ActionController::ProcessWithTest].each do |mod|
+            unless ActionController::Base < mod
+              ActionController::Base.class_eval { include mod }
+            end
+          end
+
+          ActionController::Base.clear_last_instantiation!
+
+          app = Rack::Lint.new(@application)
+          status, headers, body = app.call(env)
+          @request_count += 1
+
+          @html_document = nil
+
+          @status = status.to_i
+          @status_message = StatusCodes::STATUS_CODES[@status]
+
+          @headers = Rack::Utils::HeaderHash.new(headers)
+
+          cookies = @headers['Set-Cookie']
+          cookies = cookies.to_s.split("\n") unless cookies.is_a?(Array)
+          cookies.each do |cookie|
+            name, value = cookie.match(/^([^=]*)=([^;]*);/)[1,2]
+            @cookies[name] = value
+          end
+
+          @body = ""
+          if body.respond_to?(:to_str)
+            @body << body
+          else
+            body.each { |part| @body << part }
+          end
+
+          if @controller = ActionController::Base.last_instantiation
+            @request = @controller.request
+            @response = @controller.response
+            @controller.send(:set_test_assigns)
+          else
+            # Decorate responses from Rack Middleware and Rails Metal
+            # as an Response for the purposes of integration testing
+            @response = Response.new
+            @response.status = status.to_s
+            @response.headers.replace(@headers)
+            @response.body = @body
+          end
+
+          # Decorate the response with the standard behavior of the
+          # TestResponse so that things like assert_response can be
+          # used in integration tests.
+          @response.extend(TestResponseBehavior)
+
+          body.close if body.respond_to?(:close)
+
+          return @status
+        rescue MultiPartNeededException
+          boundary = "----------XnJLe9ZIbbGUYtzPQJ16u1"
+          status = process(method, path,
+            multipart_body(parameters, boundary),
+            (headers || {}).merge(
+              {"CONTENT_TYPE" => "multipart/form-data; boundary=#{boundary}"}))
+          return status
+        end
+
+        # Encode the cookies hash in a format suitable for passing to a
+        # request.
+        def encode_cookies
+          cookies.inject("") do |string, (name, value)|
+            string << "#{name}=#{value}; "
+          end
+        end
+
+        # Get a temporary URL writer object
+        def generic_url_rewriter
+          env = {
+            'REQUEST_METHOD' => "GET",
+            'QUERY_STRING'   => "",
+            "REQUEST_URI"    => "/",
+            "HTTP_HOST"      => host,
+            "SERVER_PORT"    => https? ? "443" : "80",
+            "HTTPS"          => https? ? "on" : "off"
+          }
+          UrlRewriter.new(Request.new(env), {})
+        end
+
+        def name_with_prefix(prefix, name)
+          prefix ? "#{prefix}[#{name}]" : name.to_s
+        end
+
+        # Convert the given parameters to a request string. The parameters may
+        # be a string, +nil+, or a Hash.
+        def requestify(parameters, prefix=nil)
+          if TestUploadedFile === parameters
+            raise MultiPartNeededException
+          elsif Hash === parameters
+            return nil if parameters.empty?
+            parameters.map { |k,v|
+              requestify(v, name_with_prefix(prefix, k))
+            }.join("&")
+          elsif Array === parameters
+            parameters.map { |v|
+              requestify(v, name_with_prefix(prefix, ""))
+            }.join("&")
+          elsif prefix.nil?
+            parameters
+          else
+            "#{CGI.escape(prefix)}=#{CGI.escape(parameters.to_s)}"
+          end
+        end
+
+        def multipart_requestify(params, first=true)
+          Array.new.tap do |p|
+            params.each do |key, value|
+              k = first ? key.to_s : "[#{key.to_s}]"
+              if Hash === value
+                multipart_requestify(value, false).each do |subkey, subvalue|
+                  p << [k + subkey, subvalue]
+                end
+              elsif Array === value
+                value.each do |element|
+                  if Hash === element || Array === element
+                    multipart_requestify(element, false).each do |subkey, subvalue|
+                      p << ["#{k}[]#{subkey}", subvalue]
+                    end
+                  else
+                    p << ["#{k}[]", element]
+                  end
+                end
+              else
+                p << [k, value]
+              end
+            end
+          end
+        end
+
+        def multipart_body(params, boundary)
+          multipart_requestify(params).map do |key, value|
+            if value.respond_to?(:original_filename)
+              File.open(value.path, "rb") do |f|
+                f.set_encoding(Encoding::BINARY) if f.respond_to?(:set_encoding)
+
+                <<-EOF
+--#{boundary}\r
+Content-Disposition: form-data; name="#{key}"; filename="#{CGI.escape(value.original_filename)}"\r
+Content-Type: #{value.content_type}\r
+Content-Length: #{File.stat(value.path).size}\r
+\r
+#{f.read}\r
+EOF
+              end
+            else
+<<-EOF
+--#{boundary}\r
+Content-Disposition: form-data; name="#{key}"\r
+\r
+#{value}\r
+EOF
+            end
+          end.join("")+"--#{boundary}--\r"
+        end
+
+    end
+
+    # A module used to extend ActionController::Base, so that integration tests
+    # can capture the controller used to satisfy a request.
+    module ControllerCapture #:nodoc:
+      def self.included(base)
+        base.extend(ClassMethods)
+        base.class_eval do
+          class << self
+            alias_method_chain :new, :capture
+          end
+        end
+      end
+
+      module ClassMethods #:nodoc:
+        mattr_accessor :last_instantiation
+
+        def clear_last_instantiation!
+          self.last_instantiation = nil
+        end
+
+        def new_with_capture(*args)
+          controller = new_without_capture(*args)
+          self.last_instantiation ||= controller
+          controller
+        end
+      end
+    end
+
+    module Runner
+      def initialize(*args)
+        super
+        @integration_session = nil
+      end
+
+      # Reset the current session. This is useful for testing multiple sessions
+      # in a single test case.
+      def reset!
+        @integration_session = open_session
+      end
+
+      %w(get post put head delete cookies assigns
+         xml_http_request xhr get_via_redirect post_via_redirect).each do |method|
+        define_method(method) do |*args|
+          reset! unless @integration_session
+          # reset the html_document variable, but only for new get/post calls
+          @html_document = nil unless %w(cookies assigns).include?(method)
+          @integration_session.__send__(method, *args).tap do
+            copy_session_variables!
+          end
+        end
+      end
+
+      # Open a new session instance. If a block is given, the new session is
+      # yielded to the block before being returned.
+      #
+      #   session = open_session do |sess|
+      #     sess.extend(CustomAssertions)
+      #   end
+      #
+      # By default, a single session is automatically created for you, but you
+      # can use this method to open multiple sessions that ought to be tested
+      # simultaneously.
+      def open_session(application = nil)
+        session = Integration::Session.new(application)
+
+        # delegate the fixture accessors back to the test instance
+        extras = Module.new { attr_accessor :delegate, :test_result }
+        if self.class.respond_to?(:fixture_table_names)
+          self.class.fixture_table_names.each do |table_name|
+            name = table_name.tr(".", "_")
+            next unless respond_to?(name)
+            extras.__send__(:define_method, name) { |*args|
+              delegate.send(name, *args)
+            }
+          end
+        end
+
+        # delegate add_assertion to the test case
+        extras.__send__(:define_method, :add_assertion) {
+          test_result.add_assertion
+        }
+        session.extend(extras)
+        session.delegate = self
+        session.test_result = @_result
+
+        yield session if block_given?
+        session
+      end
+
+      # Copy the instance variables from the current session instance into the
+      # test instance.
+      def copy_session_variables! #:nodoc:
+        return unless @integration_session
+        %w(controller response request).each do |var|
+          instance_variable_set("@#{var}", @integration_session.__send__(var))
+        end
+      end
+
+      # Delegate unhandled messages to the current session instance.
+      def method_missing(sym, *args, &block)
+        reset! unless @integration_session
+        if @integration_session.respond_to?(sym)
+          @integration_session.__send__(sym, *args, &block).tap do
+            copy_session_variables!
+          end
+        else
+          super
+        end
+      end
+    end
+  end
+
+  # An IntegrationTest is one that spans multiple controllers and actions,
+  # tying them all together to ensure they work together as expected. It tests
+  # more completely than either unit or functional tests do, exercising the
+  # entire stack, from the dispatcher to the database.
+  #
+  # At its simplest, you simply extend IntegrationTest and write your tests
+  # using the get/post methods:
+  #
+  #   require "#{File.dirname(__FILE__)}/test_helper"
+  #
+  #   class ExampleTest < ActionController::IntegrationTest
+  #     fixtures :people
+  #
+  #     def test_login
+  #       # get the login page
+  #       get "/login"
+  #       assert_equal 200, status
+  #
+  #       # post the login and follow through to the home page
+  #       post "/login", :username => people(:jamis).username,
+  #         :password => people(:jamis).password
+  #       follow_redirect!
+  #       assert_equal 200, status
+  #       assert_equal "/home", path
+  #     end
+  #   end
+  #
+  # However, you can also have multiple session instances open per test, and
+  # even extend those instances with assertions and methods to create a very
+  # powerful testing DSL that is specific for your application. You can even
+  # reference any named routes you happen to have defined!
+  #
+  #   require "#{File.dirname(__FILE__)}/test_helper"
+  #
+  #   class AdvancedTest < ActionController::IntegrationTest
+  #     fixtures :people, :rooms
+  #
+  #     def test_login_and_speak
+  #       jamis, david = login(:jamis), login(:david)
+  #       room = rooms(:office)
+  #
+  #       jamis.enter(room)
+  #       jamis.speak(room, "anybody home?")
+  #
+  #       david.enter(room)
+  #       david.speak(room, "hello!")
+  #     end
+  #
+  #     private
+  #
+  #       module CustomAssertions
+  #         def enter(room)
+  #           # reference a named route, for maximum internal consistency!
+  #           get(room_url(:id => room.id))
+  #           assert(...)
+  #           ...
+  #         end
+  #
+  #         def speak(room, message)
+  #           xml_http_request "/say/#{room.id}", :message => message
+  #           assert(...)
+  #           ...
+  #         end
+  #       end
+  #
+  #       def login(who)
+  #         open_session do |sess|
+  #           sess.extend(CustomAssertions)
+  #           who = people(who)
+  #           sess.post "/login", :username => who.username,
+  #             :password => who.password
+  #           assert(...)
+  #         end
+  #       end
+  #   end
+  class IntegrationTest < ActiveSupport::TestCase
+    include Integration::Runner
+
+    # Work around a bug in test/unit caused by the default test being named
+    # as a symbol (:default_test), which causes regex test filters
+    # (like "ruby test.rb -n /foo/") to fail because =~ doesn't work on
+    # symbols.
+    def initialize(name) #:nodoc:
+      super(name.to_s)
+    end
+
+    # Work around test/unit's requirement that every subclass of TestCase have
+    # at least one test method. Note that this implementation extends to all
+    # subclasses, as well, so subclasses of IntegrationTest may also exist
+    # without any test methods.
+    def run(*args) #:nodoc:
+      return if @method_name == "default_test"
+      super
+    end
+
+    # Because of how use_instantiated_fixtures and use_transactional_fixtures
+    # are defined, we need to treat them as special cases. Otherwise, users
+    # would potentially have to set their values for both Test::Unit::TestCase
+    # ActionController::IntegrationTest, since by the time the value is set on
+    # TestCase, IntegrationTest has already been defined and cannot inherit
+    # changes to those variables. So, we make those two attributes
+    # copy-on-write.
+
+    class << self
+      def use_transactional_fixtures=(flag) #:nodoc:
+        @_use_transactional_fixtures = true
+        @use_transactional_fixtures = flag
+      end
+
+      def use_instantiated_fixtures=(flag) #:nodoc:
+        @_use_instantiated_fixtures = true
+        @use_instantiated_fixtures = flag
+      end
+
+      def use_transactional_fixtures #:nodoc:
+        @_use_transactional_fixtures ?
+          @use_transactional_fixtures :
+          superclass.use_transactional_fixtures
+      end
+
+      def use_instantiated_fixtures #:nodoc:
+        @_use_instantiated_fixtures ?
+          @use_instantiated_fixtures :
+          superclass.use_instantiated_fixtures
+      end
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/layout.rb

@@ -0,0 +1,286 @@
+module ActionController #:nodoc:
+  module Layout #:nodoc:
+    def self.included(base)
+      base.extend(ClassMethods)
+      base.class_eval do
+        class << self
+          alias_method_chain :inherited, :layout
+        end
+      end
+    end
+
+    # Layouts reverse the common pattern of including shared headers and footers in many templates to isolate changes in
+    # repeated setups. The inclusion pattern has pages that look like this:
+    #
+    #   <%= render "shared/header" %>
+    #   Hello World
+    #   <%= render "shared/footer" %>
+    #
+    # This approach is a decent way of keeping common structures isolated from the changing content, but it's verbose
+    # and if you ever want to change the structure of these two includes, you'll have to change all the templates.
+    #
+    # With layouts, you can flip it around and have the common structure know where to insert changing content. This means
+    # that the header and footer are only mentioned in one place, like this:
+    #
+    #   // The header part of this layout
+    #   <%= yield %>
+    #   // The footer part of this layout
+    #
+    # And then you have content pages that look like this:
+    #
+    #    hello world
+    #
+    # At rendering time, the content page is computed and then inserted in the layout, like this:
+    #
+    #   // The header part of this layout
+    #   hello world
+    #   // The footer part of this layout
+    #
+    # NOTE: The old notation for rendering the view from a layout was to expose the magic <tt>@content_for_layout</tt> instance
+    # variable. The preferred notation now is to use <tt>yield</tt>, as documented above.
+    #
+    # == Accessing shared variables
+    #
+    # Layouts have access to variables specified in the content pages and vice versa. This allows you to have layouts with
+    # references that won't materialize before rendering time:
+    #
+    #   <h1><%= @page_title %></h1>
+    #   <%= yield %>
+    #
+    # ...and content pages that fulfill these references _at_ rendering time:
+    #
+    #    <% @page_title = "Welcome" %>
+    #    Off-world colonies offers you a chance to start a new life
+    #
+    # The result after rendering is:
+    #
+    #   <h1>Welcome</h1>
+    #   Off-world colonies offers you a chance to start a new life
+    #
+    # == Automatic layout assignment
+    #
+    # If there is a template in <tt>app/views/layouts/</tt> with the same name as the current controller then it will be automatically
+    # set as that controller's layout unless explicitly told otherwise. Say you have a WeblogController, for example. If a template named
+    # <tt>app/views/layouts/weblog.erb</tt> or <tt>app/views/layouts/weblog.builder</tt> exists then it will be automatically set as
+    # the layout for your WeblogController. You can create a layout with the name <tt>application.erb</tt> or <tt>application.builder</tt>
+    # and this will be set as the default controller if there is no layout with the same name as the current controller and there is
+    # no layout explicitly assigned with the +layout+ method. Nested controllers use the same folder structure for automatic layout.
+    # assignment. So an Admin::WeblogController will look for a template named <tt>app/views/layouts/admin/weblog.erb</tt>.
+    # Setting a layout explicitly will always override the automatic behaviour for the controller where the layout is set.
+    # Explicitly setting the layout in a parent class, though, will not override the child class's layout assignment if the child
+    # class has a layout with the same name.
+    #
+    # == Inheritance for layouts
+    #
+    # Layouts are shared downwards in the inheritance hierarchy, but not upwards. Examples:
+    #
+    #   class BankController < ActionController::Base
+    #     layout "bank_standard"
+    #
+    #   class InformationController < BankController
+    #
+    #   class VaultController < BankController
+    #     layout :access_level_layout
+    #
+    #   class EmployeeController < BankController
+    #     layout nil
+    #
+    # The InformationController uses "bank_standard" inherited from the BankController, the VaultController overwrites
+    # and picks the layout dynamically, and the EmployeeController doesn't want to use a layout at all.
+    #
+    # == Types of layouts
+    #
+    # Layouts are basically just regular templates, but the name of this template needs not be specified statically. Sometimes
+    # you want to alternate layouts depending on runtime information, such as whether someone is logged in or not. This can
+    # be done either by specifying a method reference as a symbol or using an inline method (as a proc).
+    #
+    # The method reference is the preferred approach to variable layouts and is used like this:
+    #
+    #   class WeblogController < ActionController::Base
+    #     layout :writers_and_readers
+    #
+    #     def index
+    #       # fetching posts
+    #     end
+    #
+    #     private
+    #       def writers_and_readers
+    #         logged_in? ? "writer_layout" : "reader_layout"
+    #       end
+    #
+    # Now when a new request for the index action is processed, the layout will vary depending on whether the person accessing
+    # is logged in or not.
+    #
+    # If you want to use an inline method, such as a proc, do something like this:
+    #
+    #   class WeblogController < ActionController::Base
+    #     layout proc{ |controller| controller.logged_in? ? "writer_layout" : "reader_layout" }
+    #
+    # Of course, the most common way of specifying a layout is still just as a plain template name:
+    #
+    #   class WeblogController < ActionController::Base
+    #     layout "weblog_standard"
+    #
+    # If no directory is specified for the template name, the template will by default be looked for in <tt>app/views/layouts/</tt>.
+    # Otherwise, it will be looked up relative to the template root.
+    #
+    # == Conditional layouts
+    #
+    # If you have a layout that by default is applied to all the actions of a controller, you still have the option of rendering
+    # a given action or set of actions without a layout, or restricting a layout to only a single action or a set of actions. The
+    # <tt>:only</tt> and <tt>:except</tt> options can be passed to the layout call. For example:
+    #
+    #   class WeblogController < ActionController::Base
+    #     layout "weblog_standard", :except => :rss
+    #
+    #     # ...
+    #
+    #   end
+    #
+    # This will assign "weblog_standard" as the WeblogController's layout  except for the +rss+ action, which will not wrap a layout
+    # around the rendered view.
+    #
+    # Both the <tt>:only</tt> and <tt>:except</tt> condition can accept an arbitrary number of method references, so
+    # #<tt>:except => [ :rss, :text_only ]</tt> is valid, as is <tt>:except => :rss</tt>.
+    #
+    # == Using a different layout in the action render call
+    #
+    # If most of your actions use the same layout, it makes perfect sense to define a controller-wide layout as described above.
+    # Sometimes you'll have exceptions where one action wants to use a different layout than the rest of the controller.
+    # You can do this by passing a <tt>:layout</tt> option to the <tt>render</tt> call. For example:
+    #
+    #   class WeblogController < ActionController::Base
+    #     layout "weblog_standard"
+    #
+    #     def help
+    #       render :action => "help", :layout => "help"
+    #     end
+    #   end
+    #
+    # This will render the help action with the "help" layout instead of the controller-wide "weblog_standard" layout.
+    module ClassMethods
+      # If a layout is specified, all rendered actions will have their result rendered
+      # when the layout <tt>yield</tt>s. This layout can itself depend on instance variables assigned during action
+      # performance and have access to them as any normal template would.
+      def layout(template_name, conditions = {}, auto = false)
+        add_layout_conditions(conditions)
+        write_inheritable_attribute(:layout, template_name)
+        write_inheritable_attribute(:auto_layout, auto)
+      end
+
+      def layout_conditions #:nodoc:
+        @layout_conditions ||= read_inheritable_attribute(:layout_conditions)
+      end
+
+      def layout_list #:nodoc:
+        Array(view_paths).sum([]) { |path| Dir["#{path.to_str}/layouts/**/*"] }
+      end
+
+      private
+        def inherited_with_layout(child)
+          inherited_without_layout(child)
+          unless child.name.blank?
+            layout_match = child.name.underscore.sub(/_controller$/, '').sub(/^controllers\//, '')
+            child.layout(layout_match, {}, true) unless child.layout_list.grep(%r{layouts/#{layout_match}(\.[a-z][0-9a-z]*)+$}).empty?
+          end
+        end
+
+        def add_layout_conditions(conditions)
+          write_inheritable_hash(:layout_conditions, normalize_conditions(conditions))
+        end
+
+        def normalize_conditions(conditions)
+          conditions.inject({}) {|hash, (key, value)| hash.merge(key => [value].flatten.map {|action| action.to_s})}
+        end
+    end
+
+    def initialize(*args)
+      super
+      @real_format = nil
+    end
+
+    # Returns the name of the active layout. If the layout was specified as a method reference (through a symbol), this method
+    # is called and the return value is used. Likewise if the layout was specified as an inline method (through a proc or method
+    # object). If the layout was defined without a directory, layouts is assumed. So <tt>layout "weblog/standard"</tt> will return
+    # weblog/standard, but <tt>layout "standard"</tt> will return layouts/standard.
+    def active_layout(passed_layout = nil, options = {})
+      layout = passed_layout || default_layout
+      return layout if layout.respond_to?(:render)
+
+      active_layout = case layout
+        when Symbol then __send__(layout)
+        when Proc   then layout.call(self)
+        else layout
+      end
+
+      find_layout(active_layout, default_template_format, options[:html_fallback]) if active_layout
+    end
+
+    private
+      def default_layout #:nodoc:
+        layout = self.class.read_inheritable_attribute(:layout)
+        return layout unless self.class.read_inheritable_attribute(:auto_layout)
+        find_layout(layout, default_template_format)
+      rescue ActionView::MissingTemplate
+        nil
+      end
+
+      def find_layout(layout, format, html_fallback=false) #:nodoc:
+        view_paths.find_template(layout.to_s =~ /\A\/|layouts\// ? layout : "layouts/#{layout}", format, html_fallback)
+      rescue ActionView::MissingTemplate
+        raise if Mime::Type.lookup_by_extension(format.to_s).html?
+      end
+
+      def pick_layout(options)
+        if options.has_key?(:layout)
+          case layout = options.delete(:layout)
+          when FalseClass
+            nil
+          when NilClass, TrueClass
+            active_layout if action_has_layout? && candidate_for_layout?(:template => default_template_name)
+          else
+            active_layout(layout, :html_fallback => true)
+          end
+        else
+          active_layout if action_has_layout? && candidate_for_layout?(options)
+        end
+      end
+
+      def action_has_layout?
+        if conditions = self.class.layout_conditions
+          case
+            when only = conditions[:only]
+              only.include?(action_name)
+            when except = conditions[:except]
+              !except.include?(action_name)
+            else
+              true
+          end
+        else
+          true
+        end
+      end
+
+      def candidate_for_layout?(options)
+        template = options[:template] || default_template(options[:action])
+        if options.values_at(:text, :xml, :json, :file, :inline, :partial, :nothing, :update).compact.empty?
+          begin
+            template_object = self.view_paths.find_template(template, default_template_format)
+            # this restores the behavior from 2.2.2, where response.template.template_format was reset
+            # to :html for :js requests with a matching html template.
+            # see v2.2.2, ActionView::Base, lines 328-330
+            @real_format = :html if response.template.template_format == :js && template_object.format == "html"
+            !template_object.exempt_from_layout?
+          rescue ActionView::MissingTemplate
+            true
+          end
+        end
+      rescue ActionView::MissingTemplate
+        false
+      end
+
+      def default_template_format
+        @real_format || response.template.template_format
+      end
+  end
+end

vendor/rails/actionpack/lib/action_controller/middleware_stack.rb

@@ -0,0 +1,119 @@
+module ActionController
+  class MiddlewareStack < Array
+    class Middleware
+      def self.new(klass, *args, &block)
+        if klass.is_a?(self)
+          klass
+        else
+          super
+        end
+      end
+
+      attr_reader :args, :block
+
+      def initialize(klass, *args, &block)
+        @klass = klass
+
+        options = args.extract_options!
+        if options.has_key?(:if)
+          @conditional = options.delete(:if)
+        else
+          @conditional = true
+        end
+        args << options unless options.empty?
+
+        @args = args
+        @block = block
+      end
+
+      def klass
+        if @klass.respond_to?(:call)
+          @klass.call
+        elsif @klass.is_a?(Class)
+          @klass
+        else
+          @klass.to_s.constantize
+        end
+      rescue NameError
+        @klass
+      end
+
+      def active?
+        return false unless klass
+
+        if @conditional.respond_to?(:call)
+          @conditional.call
+        else
+          @conditional
+        end
+      end
+
+      def ==(middleware)
+        case middleware
+        when Middleware
+          klass == middleware.klass
+        when Class
+          klass == middleware
+        else
+          klass == middleware.to_s.constantize
+        end
+      end
+
+      def inspect
+        str = klass.to_s
+        args.each { |arg| str += ", #{arg.inspect}" }
+        str
+      end
+
+      def build(app)
+        if block
+          klass.new(app, *build_args, &block)
+        else
+          klass.new(app, *build_args)
+        end
+      end
+
+      private
+
+        def build_args
+          Array(args).map { |arg| arg.respond_to?(:call) ? arg.call : arg }
+        end
+    end
+
+    def initialize(*args, &block)
+      super(*args)
+      block.call(self) if block_given?
+    end
+
+    def insert(index, *args, &block)
+      index = self.index(index) unless index.is_a?(Integer)
+      middleware = Middleware.new(*args, &block)
+      super(index, middleware)
+    end
+
+    alias_method :insert_before, :insert
+
+    def insert_after(index, *args, &block)
+      index = self.index(index) unless index.is_a?(Integer)
+      insert(index + 1, *args, &block)
+    end
+
+    def swap(target, *args, &block)
+      insert_before(target, *args, &block)
+      delete(target)
+    end
+
+    def use(*args, &block)
+      middleware = Middleware.new(*args, &block)
+      push(middleware)
+    end
+
+    def active
+      find_all { |middleware| middleware.active? }
+    end
+
+    def build(app)
+      active.reverse.inject(app) { |a, e| e.build(a) }
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/middlewares.rb

@@ -0,0 +1,14 @@
+use "Rack::Lock", :if => lambda {
+  !ActionController::Base.allow_concurrency
+}
+
+use "ActionController::Failsafe"
+
+use lambda { ActionController::Base.session_store },
+    lambda { ActionController::Base.session_options }
+
+use "ActionController::ParamsParser"
+use "Rack::MethodOverride"
+use "Rack::Head"
+
+use "ActionController::StringCoercion"

vendor/rails/actionpack/lib/action_controller/mime_responds.rb

@@ -0,0 +1,193 @@
+module ActionController #:nodoc:
+  module MimeResponds #:nodoc:
+    def self.included(base)
+      base.module_eval do
+        include ActionController::MimeResponds::InstanceMethods
+      end
+    end
+
+    module InstanceMethods
+      # Without web-service support, an action which collects the data for displaying a list of people
+      # might look something like this:
+      #
+      #   def index
+      #     @people = Person.find(:all)
+      #   end
+      #
+      # Here's the same action, with web-service support baked in:
+      #
+      #   def index
+      #     @people = Person.find(:all)
+      #
+      #     respond_to do |format|
+      #       format.html
+      #       format.xml { render :xml => @people.to_xml }
+      #     end
+      #   end
+      #
+      # What that says is, "if the client wants HTML in response to this action, just respond as we
+      # would have before, but if the client wants XML, return them the list of people in XML format."
+      # (Rails determines the desired response format from the HTTP Accept header submitted by the client.)
+      #
+      # Supposing you have an action that adds a new person, optionally creating their company
+      # (by name) if it does not already exist, without web-services, it might look like this:
+      #
+      #   def create
+      #     @company = Company.find_or_create_by_name(params[:company][:name])
+      #     @person  = @company.people.create(params[:person])
+      #
+      #     redirect_to(person_list_url)
+      #   end
+      #
+      # Here's the same action, with web-service support baked in:
+      #
+      #   def create
+      #     company  = params[:person].delete(:company)
+      #     @company = Company.find_or_create_by_name(company[:name])
+      #     @person  = @company.people.create(params[:person])
+      #
+      #     respond_to do |format|
+      #       format.html { redirect_to(person_list_url) }
+      #       format.js
+      #       format.xml  { render :xml => @person.to_xml(:include => @company) }
+      #     end
+      #   end
+      #
+      # If the client wants HTML, we just redirect them back to the person list. If they want Javascript
+      # (format.js), then it is an RJS request and we render the RJS template associated with this action.
+      # Lastly, if the client wants XML, we render the created person as XML, but with a twist: we also
+      # include the person's company in the rendered XML, so you get something like this:
+      #
+      #   <person>
+      #     <id>...</id>
+      #     ...
+      #     <company>
+      #       <id>...</id>
+      #       <name>...</name>
+      #       ...
+      #     </company>
+      #   </person>
+      #
+      # Note, however, the extra bit at the top of that action:
+      #
+      #   company  = params[:person].delete(:company)
+      #   @company = Company.find_or_create_by_name(company[:name])
+      #
+      # This is because the incoming XML document (if a web-service request is in process) can only contain a
+      # single root-node. So, we have to rearrange things so that the request looks like this (url-encoded):
+      #
+      #   person[name]=...&person[company][name]=...&...
+      #
+      # And, like this (xml-encoded):
+      #
+      #   <person>
+      #     <name>...</name>
+      #     <company>
+      #       <name>...</name>
+      #     </company>
+      #   </person>
+      #
+      # In other words, we make the request so that it operates on a single entity's person. Then, in the action,
+      # we extract the company data from the request, find or create the company, and then create the new person
+      # with the remaining data.
+      #
+      # Note that you can define your own XML parameter parser which would allow you to describe multiple entities
+      # in a single request (i.e., by wrapping them all in a single root node), but if you just go with the flow
+      # and accept Rails' defaults, life will be much easier.
+      #
+      # If you need to use a MIME type which isn't supported by default, you can register your own handlers in
+      # environment.rb as follows.
+      #
+      #   Mime::Type.register "image/jpg", :jpg
+      def respond_to(*types, &block)
+        raise ArgumentError, "respond_to takes either types or a block, never both" unless types.any? ^ block
+        block ||= lambda { |responder| types.each { |type| responder.send(type) } }
+        responder = Responder.new(self)
+        block.call(responder)
+        responder.respond
+      end
+    end
+
+    class Responder #:nodoc:
+      def initialize(controller)
+        @controller = controller
+        @request    = controller.request
+        @response   = controller.response
+
+        if ActionController::Base.use_accept_header
+          @mime_type_priority = Array(Mime::Type.lookup_by_extension(@request.parameters[:format]) || @request.accepts)
+        else
+          @mime_type_priority = [@request.format]
+        end
+
+        @order     = []
+        @responses = {}
+      end
+
+      def custom(mime_type, &block)
+        mime_type = mime_type.is_a?(Mime::Type) ? mime_type : Mime::Type.lookup(mime_type.to_s)
+
+        @order << mime_type
+
+        @responses[mime_type] ||= Proc.new do
+          @response.template.template_format = mime_type.to_sym
+          @response.content_type = mime_type.to_s
+          block_given? ? block.call : @controller.send(:render, :action => @controller.action_name)
+        end
+      end
+
+      def any(*args, &block)
+        if args.any?
+          args.each { |type| send(type, &block) }
+        else
+          custom(@mime_type_priority.first, &block)
+        end
+      end
+      
+      def self.generate_method_for_mime(mime)
+        sym = mime.is_a?(Symbol) ? mime : mime.to_sym
+        const = sym.to_s.upcase
+        class_eval <<-RUBY, __FILE__, __LINE__ + 1
+          def #{sym}(&block)                # def html(&block)
+            custom(Mime::#{const}, &block)  #   custom(Mime::HTML, &block)
+          end                               # end
+        RUBY
+      end
+
+      Mime::SET.each do |mime|
+        generate_method_for_mime(mime)
+      end
+
+      def method_missing(symbol, &block)
+        mime_constant = Mime.const_get(symbol.to_s.upcase)
+      
+        if Mime::SET.include?(mime_constant)
+          self.class.generate_method_for_mime(mime_constant)
+          send(symbol, &block)
+        else
+          super
+        end
+      end
+
+      def respond
+        for priority in @mime_type_priority
+          if priority == Mime::ALL
+            @responses[@order.first].call
+            return
+          else
+            if @responses[priority]
+              @responses[priority].call
+              return # mime type match found, be happy and return
+            end
+          end
+        end
+
+        if @order.include?(Mime::ALL)
+          @responses[Mime::ALL].call
+        else
+          @controller.send :head, :not_acceptable
+        end
+      end
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/mime_type.rb

@@ -0,0 +1,212 @@
+require 'set'
+
+module Mime
+  SET              = []
+  EXTENSION_LOOKUP = Hash.new { |h, k| h[k] = Type.new(k) unless k.blank? }
+  LOOKUP           = Hash.new { |h, k| h[k] = Type.new(k) unless k.blank? }
+
+  # Encapsulates the notion of a mime type. Can be used at render time, for example, with:
+  #
+  #   class PostsController < ActionController::Base
+  #     def show
+  #       @post = Post.find(params[:id])
+  #
+  #       respond_to do |format|
+  #         format.html
+  #         format.ics { render :text => post.to_ics, :mime_type => Mime::Type["text/calendar"]  }
+  #         format.xml { render :xml => @people.to_xml }
+  #       end
+  #     end
+  #   end
+  class Type
+    @@html_types = Set.new [:html, :all]
+    cattr_reader :html_types
+
+    # These are the content types which browsers can generate without using ajax, flash, etc
+    # i.e. following a link, getting an image or posting a form.  CSRF protection
+    # only needs to protect against these types.
+    @@browser_generated_types = Set.new [:html, :url_encoded_form, :multipart_form, :text]
+    cattr_reader :browser_generated_types
+
+
+    @@unverifiable_types = Set.new [:text, :json, :csv, :xml, :rss, :atom, :yaml]
+    def self.unverifiable_types
+      ActiveSupport::Deprecation.warn("unverifiable_types is deprecated and has no effect", caller)
+      @@unverifiable_types
+    end
+
+    # A simple helper class used in parsing the accept header
+    class AcceptItem #:nodoc:
+      attr_accessor :order, :name, :q
+
+      def initialize(order, name, q=nil)
+        @order = order
+        @name = name.strip
+        q ||= 0.0 if @name == Mime::ALL # default wilcard match to end of list
+        @q = ((q || 1.0).to_f * 100).to_i
+      end
+
+      def to_s
+        @name
+      end
+
+      def <=>(item)
+        result = item.q <=> q
+        result = order <=> item.order if result == 0
+        result
+      end
+
+      def ==(item)
+        name == (item.respond_to?(:name) ? item.name : item)
+      end
+    end
+
+    class << self
+      def lookup(string)
+        LOOKUP[string]
+      end
+
+      def lookup_by_extension(extension)
+        EXTENSION_LOOKUP[extension]
+      end
+
+      # Registers an alias that's not used on mime type lookup, but can be referenced directly. Especially useful for
+      # rendering different HTML versions depending on the user agent, like an iPhone.
+      def register_alias(string, symbol, extension_synonyms = [])
+        register(string, symbol, [], extension_synonyms, true)
+      end
+
+      def register(string, symbol, mime_type_synonyms = [], extension_synonyms = [], skip_lookup = false)
+        Mime.instance_eval { const_set symbol.to_s.upcase, Type.new(string, symbol, mime_type_synonyms) }
+
+        SET << Mime.const_get(symbol.to_s.upcase)
+
+        ([string] + mime_type_synonyms).each { |string| LOOKUP[string] = SET.last } unless skip_lookup
+        ([symbol.to_s] + extension_synonyms).each { |ext| EXTENSION_LOOKUP[ext] = SET.last }
+      end
+
+      def parse(accept_header)
+        if accept_header !~ /,/
+          [Mime::Type.lookup(accept_header)]
+        else
+          # keep track of creation order to keep the subsequent sort stable
+          list = []
+          accept_header.split(/,/).each_with_index do |header, index| 
+            params, q = header.split(/;\s*q=/)       
+            if params
+              params.strip!          
+              list << AcceptItem.new(index, params, q) unless params.empty?
+            end
+          end
+          list.sort!
+
+          # Take care of the broken text/xml entry by renaming or deleting it
+          text_xml = list.index("text/xml")
+          app_xml = list.index(Mime::XML.to_s)
+
+          if text_xml && app_xml
+            # set the q value to the max of the two
+            list[app_xml].q = [list[text_xml].q, list[app_xml].q].max
+
+            # make sure app_xml is ahead of text_xml in the list
+            if app_xml > text_xml
+              list[app_xml], list[text_xml] = list[text_xml], list[app_xml]
+              app_xml, text_xml = text_xml, app_xml
+            end
+
+            # delete text_xml from the list
+            list.delete_at(text_xml)
+
+          elsif text_xml
+            list[text_xml].name = Mime::XML.to_s
+          end
+
+          # Look for more specific XML-based types and sort them ahead of app/xml
+
+          if app_xml
+            idx = app_xml
+            app_xml_type = list[app_xml]
+
+            while(idx < list.length)
+              type = list[idx]
+              break if type.q < app_xml_type.q
+              if type.name =~ /\+xml$/
+                list[app_xml], list[idx] = list[idx], list[app_xml]
+                app_xml = idx
+              end
+              idx += 1
+            end
+          end
+
+          list.map! { |i| Mime::Type.lookup(i.name) }.uniq!
+          list
+        end
+      end
+    end
+    
+    def initialize(string, symbol = nil, synonyms = [])
+      @symbol, @synonyms = symbol, synonyms
+      @string = string
+    end
+    
+    def to_s
+      @string
+    end
+    
+    def to_str
+      to_s
+    end
+    
+    def to_sym
+      @symbol || @string.to_sym
+    end
+
+    def ===(list)
+      if list.is_a?(Array)
+        (@synonyms + [ self ]).any? { |synonym| list.include?(synonym) }
+      else
+        super
+      end
+    end
+    
+    def ==(mime_type)
+      return false if mime_type.blank?
+      (@synonyms + [ self ]).any? do |synonym| 
+        synonym.to_s == mime_type.to_s || synonym.to_sym == mime_type.to_sym 
+      end
+    end
+
+    def =~(mime_type)
+      return false if mime_type.blank?
+      regexp = Regexp.new(Regexp.quote(mime_type.to_s))
+      (@synonyms + [ self ]).any? do |synonym|
+        synonym.to_s =~ regexp
+      end
+    end
+
+    # Returns true if Action Pack should check requests using this Mime Type for possible request forgery.  See
+    # ActionController::RequestForgeryProtection.
+    def verify_request?
+      browser_generated?
+    end
+
+    def html?
+      @@html_types.include?(to_sym) || @string =~ /html/
+    end
+
+    def browser_generated?
+      @@browser_generated_types.include?(to_sym)
+    end
+
+    private
+      def method_missing(method, *args)
+        if method.to_s =~ /(\w+)\?$/
+          $1.downcase.to_sym == to_sym
+        else
+          super
+        end
+      end
+  end
+end
+
+require 'action_controller/mime_types'

vendor/rails/actionpack/lib/action_controller/mime_types.rb

@@ -0,0 +1,21 @@
+# Build list of Mime types for HTTP responses
+# http://www.iana.org/assignments/media-types/
+
+Mime::Type.register "*/*", :all
+Mime::Type.register "text/plain", :text, [], %w(txt)
+Mime::Type.register "text/html", :html, %w( application/xhtml+xml ), %w( xhtml )
+Mime::Type.register "text/javascript", :js, %w( application/javascript application/x-javascript )
+Mime::Type.register "text/css", :css
+Mime::Type.register "text/calendar", :ics
+Mime::Type.register "text/csv", :csv
+Mime::Type.register "application/xml", :xml, %w( text/xml application/x-xml )
+Mime::Type.register "application/rss+xml", :rss
+Mime::Type.register "application/atom+xml", :atom
+Mime::Type.register "application/x-yaml", :yaml, %w( text/yaml )
+
+Mime::Type.register "multipart/form-data", :multipart_form
+Mime::Type.register "application/x-www-form-urlencoded", :url_encoded_form
+
+# http://www.ietf.org/rfc/rfc4627.txt
+# http://www.json.org/JSONRequest.html
+Mime::Type.register "application/json", :json, %w( text/x-json application/jsonrequest )

vendor/rails/actionpack/lib/action_controller/params_parser.rb

@@ -0,0 +1,77 @@
+module ActionController
+  class ParamsParser
+    ActionController::Base.param_parsers[Mime::XML] = :xml_simple
+    ActionController::Base.param_parsers[Mime::JSON] = :json
+
+    def initialize(app)
+      @app = app
+    end
+
+    def call(env)
+      if params = parse_formatted_parameters(env)
+        env["action_controller.request.request_parameters"] = params
+      end
+
+      @app.call(env)
+    end
+
+    private
+      def parse_formatted_parameters(env)
+        request = Request.new(env)
+
+        return false if request.content_length.zero?
+
+        mime_type = content_type_from_legacy_post_data_format_header(env) || request.content_type
+        strategy = ActionController::Base.param_parsers[mime_type]
+
+        return false unless strategy
+
+        case strategy
+          when Proc
+            strategy.call(request.raw_post)
+          when :xml_simple, :xml_node
+            body = request.raw_post
+            body.blank? ? {} : Hash.from_xml(body).with_indifferent_access
+          when :yaml
+            YAML.load(request.raw_post)
+          when :json
+            body = request.raw_post
+            if body.blank?
+              {}
+            else
+              data = ActiveSupport::JSON.decode(body)
+              data = {:_json => data} unless data.is_a?(Hash)
+              data.with_indifferent_access
+            end
+          else
+            false
+        end
+      rescue Exception => e # YAML, XML or Ruby code block errors
+        logger.debug "Error occurred while parsing request parameters.\nContents:\n\n#{request.raw_post}"
+
+        raise
+          { "body" => request.raw_post,
+            "content_type" => request.content_type,
+            "content_length" => request.content_length,
+            "exception" => "#{e.message} (#{e.class})",
+            "backtrace" => e.backtrace }
+      end
+
+      def content_type_from_legacy_post_data_format_header(env)
+        if x_post_format = env['HTTP_X_POST_DATA_FORMAT']
+          case x_post_format.to_s.downcase
+            when 'yaml'
+              return Mime::YAML
+            when 'xml'
+              return Mime::XML
+          end
+        end
+
+        nil
+      end
+
+      def logger
+        defined?(Rails.logger) ? Rails.logger : Logger.new($stderr)
+      end
+  end
+end

vendor/rails/actionpack/lib/action_controller/performance_test.rb

@@ -0,0 +1,15 @@
+require 'active_support/testing/performance'
+require 'active_support/testing/default'
+
+module ActionController
+  # An integration test that runs a code profiler on your test methods.
+  # Profiling output for combinations of each test method, measurement, and
+  # output format are written to your tmp/performance directory.
+  #
+  # By default, process_time is measured and both flat and graph_html output
+  # formats are written, so you'll have two output files per test method.
+  class PerformanceTest < ActionController::IntegrationTest
+    include ActiveSupport::Testing::Performance
+    include ActiveSupport::Testing::Default
+  end
+end

vendor/rails/actionpack/lib/action_controller/polymorphic_routes.rb

@@ -0,0 +1,189 @@
+module ActionController
+  # Polymorphic URL helpers are methods for smart resolution to a named route call when
+  # given an Active Record model instance. They are to be used in combination with
+  # ActionController::Resources.
+  #
+  # These methods are useful when you want to generate correct URL or path to a RESTful
+  # resource without having to know the exact type of the record in question.
+  #
+  # Nested resources and/or namespaces are also supported, as illustrated in the example:
+  #
+  #   polymorphic_url([:admin, @article, @comment])
+  #
+  # results in:
+  #   
+  #   admin_article_comment_url(@article, @comment)
+  #
+  # == Usage within the framework
+  #
+  # Polymorphic URL helpers are used in a number of places throughout the Rails framework:
+  #
+  # * <tt>url_for</tt>, so you can use it with a record as the argument, e.g.
+  #   <tt>url_for(@article)</tt>;
+  # * ActionView::Helpers::FormHelper uses <tt>polymorphic_path</tt>, so you can write
+  #   <tt>form_for(@article)</tt> without having to specify <tt>:url</tt> parameter for the form
+  #   action;
+  # * <tt>redirect_to</tt> (which, in fact, uses <tt>url_for</tt>) so you can write
+  #   <tt>redirect_to(post)</tt> in your controllers;
+  # * ActionView::Helpers::AtomFeedHelper, so you don't have to explicitly specify URLs
+  #   for feed entries.
+  #
+  # == Prefixed polymorphic helpers
+  #
+  # In addition to <tt>polymorphic_url</tt> and <tt>polymorphic_path</tt> methods, a
+  # number of prefixed helpers are available as a shorthand to <tt>:action => "..."</tt>
+  # in options. Those are:
+  #
+  # * <tt>edit_polymorphic_url</tt>, <tt>edit_polymorphic_path</tt>
+  # * <tt>new_polymorphic_url</tt>, <tt>new_polymorphic_path</tt>
+  #
+  # Example usage:
+  #
+  #   edit_polymorphic_path(@post)              # => "/posts/1/edit"
+  #   polymorphic_path(@post, :format => :pdf)  # => "/posts/1.pdf"
+  module PolymorphicRoutes
+    # Constructs a call to a named RESTful route for the given record and returns the
+    # resulting URL string. For example:
+    #
+    #   # calls post_url(post)
+    #   polymorphic_url(post) # => "http://example.com/posts/1"
+    #   polymorphic_url([blog, post]) # => "http://example.com/blogs/1/posts/1"
+    #   polymorphic_url([:admin, blog, post]) # => "http://example.com/admin/blogs/1/posts/1"
+    #   polymorphic_url([user, :blog, post]) # => "http://example.com/users/1/blog/posts/1"
+    #
+    # ==== Options
+    #
+    # * <tt>:action</tt> - Specifies the action prefix for the named route:
+    #   <tt>:new</tt> or <tt>:edit</tt>. Default is no prefix.
+    # * <tt>:routing_type</tt> - Allowed values are <tt>:path</tt> or <tt>:url</tt>.
+    #   Default is <tt>:url</tt>.
+    #
+    # ==== Examples
+    #
+    #   # an Article record
+    #   polymorphic_url(record)  # same as article_url(record)
+    #
+    #   # a Comment record
+    #   polymorphic_url(record)  # same as comment_url(record)
+    #
+    #   # it recognizes new records and maps to the collection
+    #   record = Comment.new
+    #   polymorphic_url(record)  # same as comments_url()
+    #
+    def polymorphic_url(record_or_hash_or_array, options = {})
+      if record_or_hash_or_array.kind_of?(Array)
+        record_or_hash_or_array = record_or_hash_or_array.compact
+        record_or_hash_or_array = record_or_hash_or_array[0] if record_or_hash_or_array.size == 1
+      end
+
+      record = extract_record(record_or_hash_or_array)
+
+      args = case record_or_hash_or_array
+        when Hash;  [ record_or_hash_or_array ]
+        when Array; record_or_hash_or_array.dup
+        else        [ record_or_hash_or_array ]
+      end
+
+      inflection =
+        case
+        when options[:action].to_s == "new"
+          args.pop
+          :singular
+        when record.respond_to?(:new_record?) && record.new_record?
+          args.pop
+          :plural
+        else
+          :singular
+        end
+
+      args.delete_if {|arg| arg.is_a?(Symbol) || arg.is_a?(String)}
+      named_route = build_named_route_call(record_or_hash_or_array, inflection, options)
+
+      url_options = options.except(:action, :routing_type)
+      unless url_options.empty?
+        args.last.kind_of?(Hash) ? args.last.merge!(url_options) : args << url_options
+      end
+
+      __send__(named_route, *args)
+    end
+
+    # Returns the path component of a URL for the given record. It uses
+    # <tt>polymorphic_url</tt> with <tt>:routing_type => :path</tt>.
+    def polymorphic_path(record_or_hash_or_array, options = {})
+      options[:routing_type] = :path
+      polymorphic_url(record_or_hash_or_array, options)
+    end
+
+    %w(edit new).each do |action|
+      module_eval <<-EOT, __FILE__, __LINE__ + 1
+        def #{action}_polymorphic_url(record_or_hash, options = {})         # def edit_polymorphic_url(record_or_hash, options = {})
+          polymorphic_url(                                                  #   polymorphic_url(
+            record_or_hash,                                                 #     record_or_hash,
+            options.merge(:action => "#{action}"))                          #     options.merge(:action => "edit"))
+        end                                                                 # end
+                                                                            #
+        def #{action}_polymorphic_path(record_or_hash, options = {})        # def edit_polymorphic_path(record_or_hash, options = {})
+          polymorphic_url(                                                  #   polymorphic_url(
+            record_or_hash,                                                 #     record_or_hash,
+            options.merge(:action => "#{action}", :routing_type => :path))  #     options.merge(:action => "edit", :routing_type => :path))
+        end                                                                 # end
+      EOT
+    end
+
+    def formatted_polymorphic_url(record_or_hash, options = {})
+      ActiveSupport::Deprecation.warn("formatted_polymorphic_url has been deprecated. Please pass :format to the polymorphic_url method instead", caller)
+      options[:format] = record_or_hash.pop if Array === record_or_hash
+      polymorphic_url(record_or_hash, options)
+    end
+
+    def formatted_polymorphic_path(record_or_hash, options = {})
+      ActiveSupport::Deprecation.warn("formatted_polymorphic_path has been deprecated. Please pass :format to the polymorphic_path method instead", caller)
+      options[:format] = record_or_hash.pop if record_or_hash === Array
+      polymorphic_url(record_or_hash, options.merge(:routing_type => :path))
+    end
+
+    private
+      def action_prefix(options)
+        options[:action] ? "#{options[:action]}_" : ''
+      end
+
+      def routing_type(options)
+        options[:routing_type] || :url
+      end
+
+      def build_named_route_call(records, inflection, options = {})
+        unless records.is_a?(Array)
+          record = extract_record(records)
+          route  = ''
+        else
+          record = records.pop
+          route = records.inject("") do |string, parent|
+            if parent.is_a?(Symbol) || parent.is_a?(String)
+              string << "#{parent}_"
+            else
+              string << RecordIdentifier.__send__("plural_class_name", parent).singularize
+              string << "_"
+            end
+          end
+        end
+
+        if record.is_a?(Symbol) || record.is_a?(String)
+          route << "#{record}_"
+        else
+          route << RecordIdentifier.__send__("plural_class_name", record)
+          route = route.singularize if inflection == :singular
+          route << "_"
+        end
+
+        action_prefix(options) + route + routing_type(options).to_s
+      end
+
+      def extract_record(record_or_hash_or_array)
+        case record_or_hash_or_array
+          when Array; record_or_hash_or_array.last
+          when Hash;  record_or_hash_or_array[:id]
+          else        record_or_hash_or_array
+        end
+      end
+  end
+end

vendor/rails/actionpack/lib/action_controller/rack_lint_patch.rb

@@ -0,0 +1,36 @@
+# Rack 1.0 does not allow string subclass body. This does not play well with our ActiveSupport::SafeBuffer.
+# The next release of Rack will be allowing string subclass body - http://github.com/rack/rack/commit/de668df02802a0335376a81ba709270e43ba9d55
+# TODO : Remove this monkey patch after the next release of Rack
+
+module RackLintPatch
+  module AllowStringSubclass
+    def self.included(base)
+      base.send :alias_method, :each, :each_with_hack
+    end
+
+    def each_with_hack
+      @closed = false
+
+      @body.each { |part|
+        assert("Body yielded non-string value #{part.inspect}") {
+          part.kind_of?(String)
+        }
+        yield part
+      }
+
+      if @body.respond_to?(:to_path)
+        assert("The file identified by body.to_path does not exist") {
+          ::File.exist? @body.to_path
+        }
+      end
+    end
+  end
+
+  begin
+    app = proc {|env| [200, {"Content-Type" => "text/plain", "Content-Length" => "12"}, [Class.new(String).new("Hello World!")]] }
+    response = Rack::MockRequest.new(Rack::Lint.new(app)).get('/')
+  rescue Rack::Lint::LintError => e
+    raise(e) unless e.message =~ /Body yielded non-string value/
+    Rack::Lint.send :include, AllowStringSubclass
+  end
+end

vendor/rails/actionpack/lib/action_controller/record_identifier.rb

@@ -0,0 +1,104 @@
+module ActionController  
+  # The record identifier encapsulates a number of naming conventions for dealing with records, like Active Records or 
+  # Active Resources or pretty much any other model type that has an id. These patterns are then used to try elevate
+  # the view actions to a higher logical level. Example:
+  #
+  #   # routes
+  #   map.resources :posts
+  #
+  #   # view
+  #   <% div_for(post) do %>     <div id="post_45" class="post">
+  #     <%= post.body %>           What a wonderful world!
+  #   <% end %>                  </div>
+  #
+  #   # controller
+  #   def destroy
+  #     post = Post.find(params[:id])
+  #     post.destroy
+  #
+  #     respond_to do |format|
+  #       format.html { redirect_to(post) } # Calls polymorphic_url(post) which in turn calls post_url(post)
+  #       format.js do
+  #         # Calls: new Effect.fade('post_45');
+  #         render(:update) { |page| page[post].visual_effect(:fade) }
+  #       end
+  #     end
+  #   end
+  #
+  # As the example above shows, you can stop caring to a large extent what the actual id of the post is. You just know
+  # that one is being assigned and that the subsequent calls in redirect_to and the RJS expect that same naming 
+  # convention and allows you to write less code if you follow it.
+  module RecordIdentifier
+    extend self
+
+    JOIN = '_'.freeze
+    NEW = 'new'.freeze
+
+    # Returns plural/singular for a record or class. Example:
+    #
+    #   partial_path(post)                   # => "posts/post"
+    #   partial_path(Person)                 # => "people/person"
+    #   partial_path(Person, "admin/games")  # => "admin/people/person"
+    def partial_path(record_or_class, controller_path = nil)
+      name = model_name_from_record_or_class(record_or_class)
+
+      if controller_path && controller_path.include?("/")
+        "#{File.dirname(controller_path)}/#{name.partial_path}"
+      else
+        name.partial_path
+      end
+    end
+
+    # The DOM class convention is to use the singular form of an object or class. Examples:
+    #
+    #   dom_class(post)   # => "post"
+    #   dom_class(Person) # => "person"
+    #
+    # If you need to address multiple instances of the same class in the same view, you can prefix the dom_class:
+    #
+    #   dom_class(post, :edit)   # => "edit_post"
+    #   dom_class(Person, :edit) # => "edit_person"
+    def dom_class(record_or_class, prefix = nil)
+      singular = singular_class_name(record_or_class)
+      prefix ? "#{prefix}#{JOIN}#{singular}" : singular
+    end
+
+    # The DOM id convention is to use the singular form of an object or class with the id following an underscore.
+    # If no id is found, prefix with "new_" instead. Examples:
+    #
+    #   dom_id(Post.find(45))       # => "post_45"
+    #   dom_id(Post.new)            # => "new_post"
+    #
+    # If you need to address multiple instances of the same class in the same view, you can prefix the dom_id:
+    #
+    #   dom_id(Post.find(45), :edit) # => "edit_post_45"
+    def dom_id(record, prefix = nil) 
+      if record_id = record.id
+        "#{dom_class(record, prefix)}#{JOIN}#{record_id}"
+      else
+        dom_class(record, prefix || NEW)
+      end
+    end
+
+    # Returns the plural class name of a record or class. Examples:
+    #
+    #   plural_class_name(post)             # => "posts"
+    #   plural_class_name(Highrise::Person) # => "highrise_people"
+    def plural_class_name(record_or_class)
+      model_name_from_record_or_class(record_or_class).plural
+    end
+
+    # Returns the singular class name of a record or class. Examples:
+    #
+    #   singular_class_name(post)             # => "post"
+    #   singular_class_name(Highrise::Person) # => "highrise_person"
+    def singular_class_name(record_or_class)
+      model_name_from_record_or_class(record_or_class).singular
+    end
+
+    private
+      def model_name_from_record_or_class(record_or_class)
+        (record_or_class.is_a?(Class) ? record_or_class : record_or_class.class).model_name
+      end
+  end
+end

vendor/rails/actionpack/lib/action_controller/reloader.rb

@@ -0,0 +1,54 @@
+require 'thread'
+
+module ActionController
+  class Reloader
+    @@default_lock = Mutex.new
+    cattr_accessor :default_lock
+
+    class BodyWrapper
+      def initialize(body, lock)
+        @body = body
+        @lock = lock
+      end
+
+      def close
+        @body.close if @body.respond_to?(:close)
+      ensure
+        Dispatcher.cleanup_application
+        @lock.unlock
+      end
+
+      def method_missing(*args, &block)
+        @body.send(*args, &block)
+      end
+
+      def respond_to?(symbol, include_private = false)
+        symbol == :close || @body.respond_to?(symbol, include_private)
+      end
+    end
+
+    def self.run(lock = @@default_lock)
+      lock.lock
+      begin
+        Dispatcher.reload_application
+        status, headers, body = yield
+        # We do not want to call 'cleanup_application' in an ensure block
+        # because the returned Rack response body may lazily generate its data. This
+        # is for example the case if one calls
+        #
+        #   render :text => lambda { ... code here which refers to application models ... }
+        #
+        # in an ActionController.
+        #
+        # Instead, we will want to cleanup the application code after the request is
+        # completely finished. So we wrap the body in a BodyWrapper class so that
+        # when the Rack handler calls #close during the end of the request, we get to
+        # run our cleanup code.
+        [status, headers, BodyWrapper.new(body, lock)]
+      rescue Exception
+        lock.unlock
+        raise
+      end
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/request.rb

@@ -0,0 +1,493 @@
+require 'tempfile'
+require 'stringio'
+require 'strscan'
+
+require 'active_support/memoizable'
+require 'action_controller/cgi_ext'
+
+module ActionController
+  class Request < Rack::Request
+
+    %w[ AUTH_TYPE GATEWAY_INTERFACE
+        PATH_TRANSLATED REMOTE_HOST
+        REMOTE_IDENT REMOTE_USER REMOTE_ADDR
+        SERVER_NAME SERVER_PROTOCOL
+
+        HTTP_ACCEPT HTTP_ACCEPT_CHARSET HTTP_ACCEPT_ENCODING
+        HTTP_ACCEPT_LANGUAGE HTTP_CACHE_CONTROL HTTP_FROM
+        HTTP_NEGOTIATE HTTP_PRAGMA HTTP_REFERER HTTP_USER_AGENT ].each do |env|
+      define_method(env.sub(/^HTTP_/n, '').downcase) do
+        @env[env]
+      end
+    end
+
+    def key?(key)
+      @env.key?(key)
+    end
+
+    HTTP_METHODS = %w(get head put post delete options)
+    HTTP_METHOD_LOOKUP = HTTP_METHODS.inject({}) { |h, m| h[m] = h[m.upcase] = m.to_sym; h }
+
+    # Returns the true HTTP request \method as a lowercase symbol, such as
+    # <tt>:get</tt>. If the request \method is not listed in the HTTP_METHODS
+    # constant above, an UnknownHttpMethod exception is raised.
+    def request_method
+      @request_method ||= HTTP_METHOD_LOOKUP[super] || raise(UnknownHttpMethod, "#{super}, accepted HTTP methods are #{HTTP_METHODS.to_sentence(:locale => :en)}")
+    end
+
+    # Returns the HTTP request \method used for action processing as a
+    # lowercase symbol, such as <tt>:post</tt>. (Unlike #request_method, this
+    # method returns <tt>:get</tt> for a HEAD request because the two are
+    # functionally equivalent from the application's perspective.)
+    def method
+      request_method == :head ? :get : request_method
+    end
+
+    # Is this a GET (or HEAD) request?  Equivalent to <tt>request.method == :get</tt>.
+    def get?
+      method == :get
+    end
+
+    # Is this a POST request?  Equivalent to <tt>request.method == :post</tt>.
+    def post?
+      request_method == :post
+    end
+
+    # Is this a PUT request?  Equivalent to <tt>request.method == :put</tt>.
+    def put?
+      request_method == :put
+    end
+
+    # Is this a DELETE request?  Equivalent to <tt>request.method == :delete</tt>.
+    def delete?
+      request_method == :delete
+    end
+
+    # Is this a HEAD request? Since <tt>request.method</tt> sees HEAD as <tt>:get</tt>,
+    # this \method checks the actual HTTP \method directly.
+    def head?
+      request_method == :head
+    end
+
+    # Provides access to the request's HTTP headers, for example:
+    #
+    #   request.headers["Content-Type"] # => "text/plain"
+    def headers
+      @headers ||= ActionController::Http::Headers.new(@env)
+    end
+
+    # Returns the content length of the request as an integer.
+    def content_length
+      super.to_i
+    end
+
+    # The MIME type of the HTTP request, such as Mime::XML.
+    #
+    # For backward compatibility, the post \format is extracted from the
+    # X-Post-Data-Format HTTP header if present.
+    def content_type
+      @content_type ||= begin
+        if @env['CONTENT_TYPE'] =~ /^([^,\;]*)/
+          Mime::Type.lookup($1.strip.downcase)
+        else
+          nil
+        end
+      end
+    end
+
+    def media_type
+      content_type.to_s
+    end
+
+    # Returns the accepted MIME type for the request.
+    def accepts
+      @accepts ||= begin
+        header = @env['HTTP_ACCEPT'].to_s.strip
+
+        if header.empty?
+          [content_type, Mime::ALL].compact
+        else
+          Mime::Type.parse(header)
+        end
+      end
+    end
+
+    def if_modified_since
+      if since = env['HTTP_IF_MODIFIED_SINCE']
+        Time.rfc2822(since) rescue nil
+      end
+    end
+
+    def if_none_match
+      env['HTTP_IF_NONE_MATCH']
+    end
+
+    def not_modified?(modified_at)
+      if_modified_since && modified_at && if_modified_since >= modified_at
+    end
+
+    def etag_matches?(etag)
+      if_none_match && if_none_match == etag
+    end
+
+    # Check response freshness (Last-Modified and ETag) against request
+    # If-Modified-Since and If-None-Match conditions. If both headers are
+    # supplied, both must match, or the request is not considered fresh.
+    def fresh?(response)
+      case
+      when if_modified_since && if_none_match
+        not_modified?(response.last_modified) && etag_matches?(response.etag)
+      when if_modified_since
+        not_modified?(response.last_modified)
+      when if_none_match
+        etag_matches?(response.etag)
+      else
+        false
+      end
+    end
+
+    # Returns the Mime type for the \format used in the request.
+    #
+    #   GET /posts/5.xml   | request.format => Mime::XML
+    #   GET /posts/5.xhtml | request.format => Mime::HTML
+    #   GET /posts/5       | request.format => Mime::HTML or MIME::JS, or request.accepts.first depending on the value of <tt>ActionController::Base.use_accept_header</tt>
+    def format
+      @format ||=
+        if parameters[:format]
+          Mime::Type.lookup_by_extension(parameters[:format])
+        elsif ActionController::Base.use_accept_header
+          accepts.first
+        elsif xhr?
+          Mime::Type.lookup_by_extension("js")
+        else
+          Mime::Type.lookup_by_extension("html")
+        end
+    end
+
+
+    # Sets the \format by string extension, which can be used to force custom formats
+    # that are not controlled by the extension.
+    #
+    #   class ApplicationController < ActionController::Base
+    #     before_filter :adjust_format_for_iphone
+    #
+    #     private
+    #       def adjust_format_for_iphone
+    #         request.format = :iphone if request.env["HTTP_USER_AGENT"][/iPhone/]
+    #       end
+    #   end
+    def format=(extension)
+      parameters[:format] = extension.to_s
+      @format = Mime::Type.lookup_by_extension(parameters[:format])
+    end
+
+    # Returns a symbolized version of the <tt>:format</tt> parameter of the request.
+    # If no \format is given it returns <tt>:js</tt>for Ajax requests and <tt>:html</tt>
+    # otherwise.
+    def template_format
+      parameter_format = parameters[:format]
+
+      if parameter_format
+        parameter_format
+      elsif xhr?
+        :js
+      else
+        :html
+      end
+    end
+
+    def cache_format
+      parameters[:format]
+    end
+
+    # Returns true if the request's "X-Requested-With" header contains
+    # "XMLHttpRequest". (The Prototype Javascript library sends this header with
+    # every Ajax request.)
+    def xml_http_request?
+      !(@env['HTTP_X_REQUESTED_WITH'] !~ /XMLHttpRequest/i)
+    end
+    alias xhr? :xml_http_request?
+
+    # Which IP addresses are "trusted proxies" that can be stripped from
+    # the right-hand-side of X-Forwarded-For
+    TRUSTED_PROXIES = /^127\.0\.0\.1$|^(10|172\.(1[6-9]|2[0-9]|30|31)|192\.168)\./i
+
+    # Determines originating IP address.  REMOTE_ADDR is the standard
+    # but will fail if the user is behind a proxy.  HTTP_CLIENT_IP and/or
+    # HTTP_X_FORWARDED_FOR are set by proxies so check for these if
+    # REMOTE_ADDR is a proxy.  HTTP_X_FORWARDED_FOR may be a comma-
+    # delimited list in the case of multiple chained proxies; the last
+    # address which is not trusted is the originating IP.
+    def remote_ip
+      remote_addr_list = @env['REMOTE_ADDR'] && @env['REMOTE_ADDR'].scan(/[^,\s]+/)
+
+      unless remote_addr_list.blank?
+        not_trusted_addrs = remote_addr_list.reject {|addr| addr =~ TRUSTED_PROXIES}
+        return not_trusted_addrs.first unless not_trusted_addrs.empty?
+      end
+      remote_ips = @env['HTTP_X_FORWARDED_FOR'] && @env['HTTP_X_FORWARDED_FOR'].split(',')
+
+      if @env.include? 'HTTP_CLIENT_IP'
+        if ActionController::Base.ip_spoofing_check && remote_ips && !remote_ips.include?(@env['HTTP_CLIENT_IP'])
+          # We don't know which came from the proxy, and which from the user
+          raise ActionControllerError.new(<<EOM)
+IP spoofing attack?!
+HTTP_CLIENT_IP=#{@env['HTTP_CLIENT_IP'].inspect}
+HTTP_X_FORWARDED_FOR=#{@env['HTTP_X_FORWARDED_FOR'].inspect}
+EOM
+        end
+
+        return @env['HTTP_CLIENT_IP']
+      end
+
+      if remote_ips
+        while remote_ips.size > 1 && TRUSTED_PROXIES =~ remote_ips.last.strip
+          remote_ips.pop
+        end
+
+        return remote_ips.last.strip
+      end
+
+      @env['REMOTE_ADDR']
+    end
+
+    # Returns the lowercase name of the HTTP server software.
+    def server_software
+      (@env['SERVER_SOFTWARE'] && /^([a-zA-Z]+)/ =~ @env['SERVER_SOFTWARE']) ? $1.downcase : nil
+    end
+
+    # Returns the complete URL used for this request.
+    def url
+      protocol + host_with_port + request_uri
+    end
+
+    # Returns 'https://' if this is an SSL request and 'http://' otherwise.
+    def protocol
+      ssl? ? 'https://' : 'http://'
+    end
+
+    # Is this an SSL request?
+    def ssl?
+      @env['HTTPS'] == 'on' || @env['HTTP_X_FORWARDED_PROTO'] == 'https'
+    end
+
+    # Returns the \host for this request, such as "example.com".
+    def raw_host_with_port
+      if forwarded = env["HTTP_X_FORWARDED_HOST"]
+        forwarded.split(/,\s?/).last
+      else
+        env['HTTP_HOST'] || "#{env['SERVER_NAME'] || env['SERVER_ADDR']}:#{env['SERVER_PORT']}"
+      end
+    end
+
+    # Returns the host for this request, such as example.com.
+    def host
+      raw_host_with_port.sub(/:\d+$/, '')
+    end
+
+    # Returns a \host:\port string for this request, such as "example.com" or
+    # "example.com:8080".
+    def host_with_port
+      "#{host}#{port_string}"
+    end
+
+    # Returns the port number of this request as an integer.
+    def port
+      if raw_host_with_port =~ /:(\d+)$/
+        $1.to_i
+      else
+        standard_port
+      end
+    end
+
+    # Returns the standard \port number for this request's protocol.
+    def standard_port
+      case protocol
+        when 'https://' then 443
+        else 80
+      end
+    end
+
+    # Returns a \port suffix like ":8080" if the \port number of this request
+    # is not the default HTTP \port 80 or HTTPS \port 443.
+    def port_string
+      port == standard_port ? '' : ":#{port}"
+    end
+
+    # Returns the \domain part of a \host, such as "rubyonrails.org" in "www.rubyonrails.org". You can specify
+    # a different <tt>tld_length</tt>, such as 2 to catch rubyonrails.co.uk in "www.rubyonrails.co.uk".
+    def domain(tld_length = 1)
+      return nil unless named_host?(host)
+
+      host.split('.').last(1 + tld_length).join('.')
+    end
+
+    # Returns all the \subdomains as an array, so <tt>["dev", "www"]</tt> would be
+    # returned for "dev.www.rubyonrails.org". You can specify a different <tt>tld_length</tt>,
+    # such as 2 to catch <tt>["www"]</tt> instead of <tt>["www", "rubyonrails"]</tt>
+    # in "www.rubyonrails.co.uk".
+    def subdomains(tld_length = 1)
+      return [] unless named_host?(host)
+      parts = host.split('.')
+      parts[0..-(tld_length+2)]
+    end
+
+    # Returns the query string, accounting for server idiosyncrasies.
+    def query_string
+      @env['QUERY_STRING'].present? ? @env['QUERY_STRING'] : (@env['REQUEST_URI'].split('?', 2)[1] || '')
+    end
+
+    # Returns the request URI, accounting for server idiosyncrasies.
+    # WEBrick includes the full URL. IIS leaves REQUEST_URI blank.
+    def request_uri
+      if uri = @env['REQUEST_URI']
+        # Remove domain, which webrick puts into the request_uri.
+        (%r{^\w+\://[^/]+(/.*|$)$} =~ uri) ? $1 : uri
+      else
+        # Construct IIS missing REQUEST_URI from SCRIPT_NAME and PATH_INFO.
+        uri = @env['PATH_INFO'].to_s
+
+        if script_filename = @env['SCRIPT_NAME'].to_s.match(%r{[^/]+$})
+          uri = uri.sub(/#{script_filename}\//, '')
+        end
+
+        env_qs = @env['QUERY_STRING'].to_s
+        uri += "?#{env_qs}" unless env_qs.empty?
+
+        if uri.blank?
+          @env.delete('REQUEST_URI')
+        else
+          @env['REQUEST_URI'] = uri
+        end
+      end
+    end
+
+    # Returns the interpreted \path to requested resource after all the installation
+    # directory of this application was taken into account.
+    def path
+      path = request_uri.to_s[/\A[^\?]*/]
+      path.sub!(/\A#{ActionController::Base.relative_url_root}/, '')
+      path
+    end
+
+    # Read the request \body. This is useful for web services that need to
+    # work with raw requests directly.
+    def raw_post
+      unless @env.include? 'RAW_POST_DATA'
+        @env['RAW_POST_DATA'] = body.read(@env['CONTENT_LENGTH'].to_i)
+        body.rewind if body.respond_to?(:rewind)
+      end
+      @env['RAW_POST_DATA']
+    end
+
+    # Returns both GET and POST \parameters in a single hash.
+    def parameters
+      @parameters ||= request_parameters.merge(query_parameters).update(path_parameters).with_indifferent_access
+    end
+    alias_method :params, :parameters
+
+    def path_parameters=(parameters) #:nodoc:
+      @env["action_controller.request.path_parameters"] = parameters
+      @symbolized_path_parameters = @parameters = nil
+    end
+
+    # The same as <tt>path_parameters</tt> with explicitly symbolized keys.
+    def symbolized_path_parameters
+      @symbolized_path_parameters ||= path_parameters.symbolize_keys
+    end
+
+    # Returns a hash with the \parameters used to form the \path of the request.
+    # Returned hash keys are strings:
+    #
+    #   {'action' => 'my_action', 'controller' => 'my_controller'}
+    #
+    # See <tt>symbolized_path_parameters</tt> for symbolized keys.
+    def path_parameters
+      @env["action_controller.request.path_parameters"] ||= {}
+    end
+
+    # The request body is an IO input stream. If the RAW_POST_DATA environment
+    # variable is already set, wrap it in a StringIO.
+    def body
+      if raw_post = @env['RAW_POST_DATA']
+        raw_post.force_encoding(Encoding::BINARY) if raw_post.respond_to?(:force_encoding)
+        StringIO.new(raw_post)
+      else
+        @env['rack.input']
+      end
+    end
+
+    def form_data?
+      FORM_DATA_MEDIA_TYPES.include?(content_type.to_s)
+    end
+
+    # Override Rack's GET method to support indifferent access
+    def GET
+      @env["action_controller.request.query_parameters"] ||= normalize_parameters(super)
+    end
+    alias_method :query_parameters, :GET
+
+    # Override Rack's POST method to support indifferent access
+    def POST
+      @env["action_controller.request.request_parameters"] ||= normalize_parameters(super)
+    end
+    alias_method :request_parameters, :POST
+
+    def body_stream #:nodoc:
+      @env['rack.input']
+    end
+
+    def session
+      @env['rack.session'] ||= {}
+    end
+
+    def session=(session) #:nodoc:
+      @env['rack.session'] = session
+    end
+
+    def reset_session
+      session.destroy if session
+      self.session = {}
+    end
+
+    def session_options
+      @env['rack.session.options'] ||= {}
+    end
+
+    def session_options=(options)
+      @env['rack.session.options'] = options
+    end
+
+    def server_port
+      @env['SERVER_PORT'].to_i
+    end
+
+    private
+      def named_host?(host)
+        !(host.nil? || /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.match(host))
+      end
+
+      # Convert nested Hashs to HashWithIndifferentAccess and replace
+      # file upload hashs with UploadedFile objects
+      def normalize_parameters(value)
+        case value
+        when Hash
+          if value.has_key?(:tempfile)
+            upload = value[:tempfile]
+            upload.extend(UploadedFile)
+            upload.original_path = value[:filename]
+            upload.content_type = value[:type]
+            upload
+          else
+            h = {}
+            value.each { |k, v| h[k] = normalize_parameters(v) }
+            h.with_indifferent_access
+          end
+        when Array
+          value.map { |e| normalize_parameters(e) }
+        else
+          value
+        end
+      end
+  end
+end

vendor/rails/actionpack/lib/action_controller/request_forgery_protection.rb

@@ -0,0 +1,113 @@
+module ActionController #:nodoc:
+  class InvalidAuthenticityToken < ActionControllerError #:nodoc:
+  end
+
+  module RequestForgeryProtection
+    def self.included(base)
+      base.class_eval do
+        helper_method :form_authenticity_token
+        helper_method :protect_against_forgery?
+      end
+      base.extend(ClassMethods)
+    end
+    
+    # Protecting controller actions from CSRF attacks by ensuring that all forms are coming from the current web application, not a
+    # forged link from another site, is done by embedding a token based on a random string stored in the session (which an attacker wouldn't know) in all
+    # forms and Ajax requests generated by Rails and then verifying the authenticity of that token in the controller.  Only
+    # HTML/JavaScript requests are checked, so this will not protect your XML API (presumably you'll have a different authentication
+    # scheme there anyway).  Also, GET requests are not protected as these should be idempotent anyway.
+    #
+    # This is turned on with the <tt>protect_from_forgery</tt> method, which will check the token and raise an
+    # ActionController::InvalidAuthenticityToken if it doesn't match what was expected. You can customize the error message in
+    # production by editing public/422.html.  A call to this method in ApplicationController is generated by default in post-Rails 2.0
+    # applications.
+    #
+    # The token parameter is named <tt>authenticity_token</tt> by default. If you are generating an HTML form manually (without the
+    # use of Rails' <tt>form_for</tt>, <tt>form_tag</tt> or other helpers), you have to include a hidden field named like that and
+    # set its value to what is returned by <tt>form_authenticity_token</tt>. Same applies to manually constructed Ajax requests. To
+    # make the token available through a global variable to scripts on a certain page, you could add something like this to a view:
+    #
+    #   <%= javascript_tag "window._token = '#{form_authenticity_token}'" %>
+    #
+    # Request forgery protection is disabled by default in test environment.  If you are upgrading from Rails 1.x, add this to
+    # config/environments/test.rb:
+    #
+    #   # Disable request forgery protection in test environment
+    #   config.action_controller.allow_forgery_protection = false
+    # 
+    # == Learn more about CSRF (Cross-Site Request Forgery) attacks
+    #
+    # Here are some resources:
+    # * http://isc.sans.org/diary.html?storyid=1750
+    # * http://en.wikipedia.org/wiki/Cross-site_request_forgery
+    #
+    # Keep in mind, this is NOT a silver-bullet, plug 'n' play, warm security blanket for your rails application.
+    # There are a few guidelines you should follow:
+    # 
+    # * Keep your GET requests safe and idempotent.  More reading material:
+    #   * http://www.xml.com/pub/a/2002/04/24/deviant.html
+    #   * http://www.w3.org/Protocols/rfc2616/rfc2616-sec9.html#sec9.1.1
+    # * Make sure the session cookies that Rails creates are non-persistent.  Check in Firefox and look for "Expires: at end of session"
+    #
+    module ClassMethods
+      # Turn on request forgery protection. Bear in mind that only non-GET, HTML/JavaScript requests are checked.
+      #
+      # Example:
+      #
+      #   class FooController < ApplicationController
+      #     protect_from_forgery :except => :index
+      #
+      #     # you can disable csrf protection on controller-by-controller basis:
+      #     skip_before_filter :verify_authenticity_token
+      #   end
+      #
+      # Valid Options:
+      #
+      # * <tt>:only/:except</tt> - Passed to the <tt>before_filter</tt> call.  Set which actions are verified.
+      def protect_from_forgery(options = {})
+        self.request_forgery_protection_token ||= :authenticity_token
+        before_filter :verify_authenticity_token, :only => options.delete(:only), :except => options.delete(:except)
+        if options[:secret] || options[:digest]
+          ActiveSupport::Deprecation.warn("protect_from_forgery only takes :only and :except options now. :digest and :secret have no effect", caller)
+        end
+      end
+    end
+
+    protected
+      # The actual before_filter that is used.  Modify this to change how you handle unverified requests.
+      def verify_authenticity_token
+        verified_request? || raise(ActionController::InvalidAuthenticityToken)
+      end
+      
+      # Returns true or false if a request is verified.  Checks:
+      #
+      # * is the format restricted?  By default, only HTML requests are checked.
+      # * is it a GET request?  Gets should be safe and idempotent
+      # * Does the form_authenticity_token match the given token value from the params?
+      def verified_request?
+        !protect_against_forgery?     ||
+          request.method == :get      ||
+          request.xhr?                ||
+          !verifiable_request_format? ||
+          form_authenticity_token == form_authenticity_param
+      end
+
+      def form_authenticity_param
+        params[request_forgery_protection_token]
+      end
+
+      def verifiable_request_format?
+        !request.content_type.nil? && request.content_type.verify_request?
+      end
+    
+      # Sets the token value for the current session.  Pass a <tt>:secret</tt> option
+      # in +protect_from_forgery+ to add a custom salt to the hash.
+      def form_authenticity_token
+        session[:_csrf_token] ||= ActiveSupport::SecureRandom.base64(32)
+      end
+
+      def protect_against_forgery?
+        allow_forgery_protection && request_forgery_protection_token
+      end
+  end
+end

vendor/rails/actionpack/lib/action_controller/rescue.rb

@@ -0,0 +1,183 @@
+module ActionController #:nodoc:
+  # Actions that fail to perform as expected throw exceptions. These
+  # exceptions can either be rescued for the public view (with a nice
+  # user-friendly explanation) or for the developers view (with tons of
+  # debugging information). The developers view is already implemented by
+  # the Action Controller, but the public view should be tailored to your
+  # specific application.
+  #
+  # The default behavior for public exceptions is to render a static html
+  # file with the name of the error code thrown.  If no such file exists, an
+  # empty response is sent with the correct status code.
+  #
+  # You can override what constitutes a local request by overriding the
+  # <tt>local_request?</tt> method in your own controller. Custom rescue
+  # behavior is achieved by overriding the <tt>rescue_action_in_public</tt>
+  # and <tt>rescue_action_locally</tt> methods.
+  module Rescue
+    LOCALHOST = [/^127\.0\.0\.\d{1,3}$/, /^::1$/, /^0:0:0:0:0:0:0:1(%.*)?$/].freeze
+
+    DEFAULT_RESCUE_RESPONSE = :internal_server_error
+    DEFAULT_RESCUE_RESPONSES = {
+      'ActionController::RoutingError'             => :not_found,
+      'ActionController::UnknownAction'            => :not_found,
+      'ActiveRecord::RecordNotFound'               => :not_found,
+      'ActiveRecord::StaleObjectError'             => :conflict,
+      'ActiveRecord::RecordInvalid'                => :unprocessable_entity,
+      'ActiveRecord::RecordNotSaved'               => :unprocessable_entity,
+      'ActionController::MethodNotAllowed'         => :method_not_allowed,
+      'ActionController::NotImplemented'           => :not_implemented,
+      'ActionController::InvalidAuthenticityToken' => :unprocessable_entity
+    }
+
+    DEFAULT_RESCUE_TEMPLATE = 'diagnostics'
+    DEFAULT_RESCUE_TEMPLATES = {
+      'ActionView::MissingTemplate'       => 'missing_template',
+      'ActionController::RoutingError'    => 'routing_error',
+      'ActionController::UnknownAction'   => 'unknown_action',
+      'ActionView::TemplateError'         => 'template_error'
+    }
+
+    RESCUES_TEMPLATE_PATH = ActionView::Template::EagerPath.new_and_loaded(
+      File.join(File.dirname(__FILE__), "templates"))
+
+    def self.included(base) #:nodoc:
+      base.cattr_accessor :rescue_responses
+      base.rescue_responses = Hash.new(DEFAULT_RESCUE_RESPONSE)
+      base.rescue_responses.update DEFAULT_RESCUE_RESPONSES
+
+      base.cattr_accessor :rescue_templates
+      base.rescue_templates = Hash.new(DEFAULT_RESCUE_TEMPLATE)
+      base.rescue_templates.update DEFAULT_RESCUE_TEMPLATES
+
+      base.extend(ClassMethods)
+      base.send :include, ActiveSupport::Rescuable
+
+      base.class_eval do
+        alias_method_chain :perform_action, :rescue
+      end
+    end
+
+    module ClassMethods
+      def call_with_exception(env, exception) #:nodoc:
+        request = env["action_controller.rescue.request"] ||= Request.new(env)
+        response = env["action_controller.rescue.response"] ||= Response.new
+        new.process(request, response, :rescue_action, exception)
+      end
+    end
+
+    protected
+      # Exception handler called when the performance of an action raises
+      # an exception.
+      def rescue_action(exception)
+        rescue_with_handler(exception) ||
+          rescue_action_without_handler(exception)
+      end
+
+      # Overwrite to implement custom logging of errors. By default
+      # logs as fatal.
+      def log_error(exception) #:doc:
+        ActiveSupport::Deprecation.silence do
+          if ActionView::TemplateError === exception
+            logger.fatal(exception.to_s)
+          else
+            logger.fatal(
+              "\n#{exception.class} (#{exception.message}):\n  " +
+              clean_backtrace(exception).join("\n  ") + "\n\n"
+            )
+          end
+        end
+      end
+
+      # Overwrite to implement public exception handling (for requests
+      # answering false to <tt>local_request?</tt>).  By default will call
+      # render_optional_error_file.  Override this method to provide more
+      # user friendly error messages.
+      def rescue_action_in_public(exception) #:doc:
+        render_optional_error_file response_code_for_rescue(exception)
+      end
+
+      # Attempts to render a static error page based on the
+      # <tt>status_code</tt> thrown, or just return headers if no such file
+      # exists. At first, it will try to render a localized static page.
+      # For example, if a 500 error is being handled Rails and locale is :da,
+      # it will first attempt to render the file at <tt>public/500.da.html</tt>
+      # then attempt to render <tt>public/500.html</tt>. If none of them exist,
+      # the body of the response will be left empty.
+      def render_optional_error_file(status_code)
+        status = interpret_status(status_code)
+        locale_path = "#{Rails.public_path}/#{status[0,3]}.#{I18n.locale}.html" if I18n.locale
+        path = "#{Rails.public_path}/#{status[0,3]}.html"
+
+        if locale_path && File.exist?(locale_path)
+          render :file => locale_path, :status => status, :content_type => Mime::HTML
+        elsif File.exist?(path)
+          render :file => path, :status => status, :content_type => Mime::HTML
+        else
+          head status
+        end
+      end
+
+      # True if the request came from localhost, 127.0.0.1. Override this
+      # method if you wish to redefine the meaning of a local request to
+      # include remote IP addresses or other criteria.
+      def local_request? #:doc:
+        LOCALHOST.any?{ |local_ip| request.remote_addr =~ local_ip && request.remote_ip =~ local_ip }
+      end
+
+      # Render detailed diagnostics for unhandled exceptions rescued from
+      # a controller action.
+      def rescue_action_locally(exception)
+        @template.instance_variable_set("@exception", exception)
+        @template.instance_variable_set("@rescues_path", RESCUES_TEMPLATE_PATH)
+        @template.instance_variable_set("@contents",
+          @template.render(:file => template_path_for_local_rescue(exception)))
+
+        response.content_type = Mime::HTML
+        render_for_file(rescues_path("layout"),
+          response_code_for_rescue(exception))
+      end
+
+      def rescue_action_without_handler(exception)
+        log_error(exception) if logger
+        erase_results if performed?
+
+        # Let the exception alter the response if it wants.
+        # For example, MethodNotAllowed sets the Allow header.
+        if exception.respond_to?(:handle_response!)
+          exception.handle_response!(response)
+        end
+
+        if consider_all_requests_local || local_request?
+          rescue_action_locally(exception)
+        else
+          rescue_action_in_public(exception)
+        end
+      end
+
+    private
+      def perform_action_with_rescue #:nodoc:
+        perform_action_without_rescue
+      rescue Exception => exception
+        rescue_action(exception)
+      end
+
+      def rescues_path(template_name)
+        RESCUES_TEMPLATE_PATH["rescues/#{template_name}.erb"]
+      end
+
+      def template_path_for_local_rescue(exception)
+        rescues_path(rescue_templates[exception.class.name])
+      end
+
+      def response_code_for_rescue(exception)
+        rescue_responses[exception.class.name]
+      end
+
+      def clean_backtrace(exception)
+        defined?(Rails) && Rails.respond_to?(:backtrace_cleaner) ?
+          Rails.backtrace_cleaner.clean(exception.backtrace) :
+          exception.backtrace
+      end
+  end
+end

vendor/rails/actionpack/lib/action_controller/resources.rb

@@ -0,0 +1,682 @@
+module ActionController
+  # == Overview
+  #
+  # ActionController::Resources are a way of defining RESTful \resources.  A RESTful \resource, in basic terms,
+  # is something that can be pointed at and it will respond with a representation of the data requested.
+  # In real terms this could mean a user with a browser requests an HTML page, or that a desktop application
+  # requests XML data.
+  #
+  # RESTful design is based on the assumption that there are four generic verbs that a user of an
+  # application can request from a \resource (the noun).
+  #
+  # \Resources can be requested using four basic HTTP verbs (GET, POST, PUT, DELETE), the method used
+  # denotes the type of action that should take place.
+  #
+  # === The Different Methods and their Usage
+  #
+  # * GET    - Requests for a \resource, no saving or editing of a \resource should occur in a GET request.
+  # * POST   - Creation of \resources.
+  # * PUT    - Editing of attributes on a \resource.
+  # * DELETE - Deletion of a \resource.
+  #
+  # === Examples
+  #
+  #   # A GET request on the Posts resource is asking for all Posts
+  #   GET /posts
+  #
+  #   # A GET request on a single Post resource is asking for that particular Post
+  #   GET /posts/1
+  #
+  #   # A POST request on the Posts resource is asking for a Post to be created with the supplied details
+  #   POST /posts # with => { :post => { :title => "My Whizzy New Post", :body => "I've got a brand new combine harvester" } }
+  #
+  #   # A PUT request on a single Post resource is asking for a Post to be updated
+  #   PUT /posts # with => { :id => 1, :post => { :title => "Changed Whizzy Title" } }
+  #
+  #   # A DELETE request on a single Post resource is asking for it to be deleted
+  #   DELETE /posts # with => { :id => 1 }
+  #
+  # By using the REST convention, users of our application can assume certain things about how the data
+  # is requested and how it is returned.  Rails simplifies the routing part of RESTful design by
+  # supplying you with methods to create them in your routes.rb file.
+  #
+  # Read more about REST at http://en.wikipedia.org/wiki/Representational_State_Transfer
+  module Resources
+    INHERITABLE_OPTIONS = :namespace, :shallow
+
+    class Resource #:nodoc:
+      DEFAULT_ACTIONS = :index, :create, :new, :edit, :show, :update, :destroy
+
+      attr_reader :collection_methods, :member_methods, :new_methods
+      attr_reader :path_prefix, :name_prefix, :path_segment
+      attr_reader :plural, :singular
+      attr_reader :options
+
+      def initialize(entities, options)
+        @plural   ||= entities
+        @singular ||= options[:singular] || plural.to_s.singularize
+        @path_segment = options.delete(:as) || @plural
+
+        @options = options
+
+        arrange_actions
+        add_default_actions
+        set_allowed_actions
+        set_prefixes
+      end
+
+      def controller
+        @controller ||= "#{options[:namespace]}#{(options[:controller] || plural).to_s}"
+      end
+
+      def requirements(with_id = false)
+        @requirements   ||= @options[:requirements] || {}
+        @id_requirement ||= { :id => @requirements.delete(:id) || /[^#{Routing::SEPARATORS.join}]+/ }
+
+        with_id ? @requirements.merge(@id_requirement) : @requirements
+      end
+
+      def conditions
+        @conditions ||= @options[:conditions] || {}
+      end
+
+      def path
+        @path ||= "#{path_prefix}/#{path_segment}"
+      end
+
+      def new_path
+        new_action   = self.options[:path_names][:new] if self.options[:path_names]
+        new_action ||= Base.resources_path_names[:new]
+        @new_path  ||= "#{path}/#{new_action}"
+      end
+
+      def shallow_path_prefix
+        @shallow_path_prefix ||= @options[:shallow] ? @options[:namespace].try(:sub, /\/$/, '') : path_prefix
+      end
+
+      def member_path
+        @member_path ||= "#{shallow_path_prefix}/#{path_segment}/:id"
+      end
+
+      def nesting_path_prefix
+        @nesting_path_prefix ||= "#{shallow_path_prefix}/#{path_segment}/:#{singular}_id"
+      end
+
+      def shallow_name_prefix
+        @shallow_name_prefix ||= @options[:shallow] ? @options[:namespace].try(:gsub, /\//, '_') : name_prefix
+      end
+
+      def nesting_name_prefix
+        "#{shallow_name_prefix}#{singular}_"
+      end
+
+      def action_separator
+        @action_separator ||= Base.resource_action_separator
+      end
+
+      def uncountable?
+        @singular.to_s == @plural.to_s
+      end
+
+      def has_action?(action)
+        !DEFAULT_ACTIONS.include?(action) || action_allowed?(action)
+      end
+
+      protected
+        def arrange_actions
+          @collection_methods = arrange_actions_by_methods(options.delete(:collection))
+          @member_methods     = arrange_actions_by_methods(options.delete(:member))
+          @new_methods        = arrange_actions_by_methods(options.delete(:new))
+        end
+
+        def add_default_actions
+          add_default_action(member_methods, :get, :edit)
+          add_default_action(new_methods, :get, :new)
+        end
+
+        def set_allowed_actions
+          only, except = @options.values_at(:only, :except)
+          @allowed_actions ||= {}
+
+          if only == :all || except == :none
+            only = nil
+            except = []
+          elsif only == :none || except == :all
+            only = []
+            except = nil
+          end
+
+          if only
+            @allowed_actions[:only] = Array(only).map(&:to_sym)
+          elsif except
+            @allowed_actions[:except] = Array(except).map(&:to_sym)
+          end
+        end
+
+        def action_allowed?(action)
+          only, except = @allowed_actions.values_at(:only, :except)
+          (!only || only.include?(action)) && (!except || !except.include?(action))
+        end
+
+        def set_prefixes
+          @path_prefix = options.delete(:path_prefix)
+          @name_prefix = options.delete(:name_prefix)
+        end
+
+        def arrange_actions_by_methods(actions)
+          (actions || {}).inject({}) do |flipped_hash, (key, value)|
+            (flipped_hash[value] ||= []) << key
+            flipped_hash
+          end
+        end
+
+        def add_default_action(collection, method, action)
+          (collection[method] ||= []).unshift(action)
+        end
+    end
+
+    class SingletonResource < Resource #:nodoc:
+      def initialize(entity, options)
+        @singular = @plural = entity
+        options[:controller] ||= @singular.to_s.pluralize
+        super
+      end
+
+      alias_method :shallow_path_prefix, :path_prefix
+      alias_method :shallow_name_prefix, :name_prefix
+      alias_method :member_path,         :path
+      alias_method :nesting_path_prefix, :path
+    end
+
+    # Creates named routes for implementing verb-oriented controllers
+    # for a collection \resource.
+    #
+    # For example:
+    #
+    #   map.resources :messages
+    #
+    # will map the following actions in the corresponding controller:
+    #
+    #   class MessagesController < ActionController::Base
+    #     # GET messages_url
+    #     def index
+    #       # return all messages
+    #     end
+    #
+    #     # GET new_message_url
+    #     def new
+    #       # return an HTML form for describing a new message
+    #     end
+    #
+    #     # POST messages_url
+    #     def create
+    #       # create a new message
+    #     end
+    #
+    #     # GET message_url(:id => 1)
+    #     def show
+    #       # find and return a specific message
+    #     end
+    #
+    #     # GET edit_message_url(:id => 1)
+    #     def edit
+    #       # return an HTML form for editing a specific message
+    #     end
+    #
+    #     # PUT message_url(:id => 1)
+    #     def update
+    #       # find and update a specific message
+    #     end
+    #
+    #     # DELETE message_url(:id => 1)
+    #     def destroy
+    #       # delete a specific message
+    #     end
+    #   end
+    #
+    # Along with the routes themselves, +resources+ generates named routes for use in
+    # controllers and views. <tt>map.resources :messages</tt> produces the following named routes and helpers:
+    #
+    #   Named Route   Helpers
+    #   ============  =====================================================
+    #   messages      messages_url, hash_for_messages_url,
+    #                 messages_path, hash_for_messages_path
+    #
+    #   message       message_url(id), hash_for_message_url(id),
+    #                 message_path(id), hash_for_message_path(id)
+    #
+    #   new_message   new_message_url, hash_for_new_message_url,
+    #                 new_message_path, hash_for_new_message_path
+    #
+    #   edit_message  edit_message_url(id), hash_for_edit_message_url(id),
+    #                 edit_message_path(id), hash_for_edit_message_path(id)
+    #
+    # You can use these helpers instead of +url_for+ or methods that take +url_for+ parameters. For example:
+    #
+    #   redirect_to :controller => 'messages', :action => 'index'
+    #   # and
+    #   <%= link_to "edit this message", :controller => 'messages', :action => 'edit', :id => @message.id %>
+    #
+    # now become:
+    #
+    #   redirect_to messages_url
+    #   # and
+    #   <%= link_to "edit this message", edit_message_url(@message) # calls @message.id automatically
+    #
+    # Since web browsers don't support the PUT and DELETE verbs, you will need to add a parameter '_method' to your
+    # form tags. The form helpers make this a little easier. For an update form with a <tt>@message</tt> object:
+    #
+    #   <%= form_tag message_path(@message), :method => :put %>
+    #
+    # or
+    #
+    #   <% form_for :message, @message, :url => message_path(@message), :html => {:method => :put} do |f| %>
+    #
+    # or
+    #
+    #   <% form_for @message do |f| %>
+    #
+    # which takes into account whether <tt>@message</tt> is a new record or not and generates the
+    # path and method accordingly.
+    #
+    # The +resources+ method accepts the following options to customize the resulting routes:
+    # * <tt>:collection</tt> - Add named routes for other actions that operate on the collection.
+    #   Takes a hash of <tt>#{action} => #{method}</tt>, where method is <tt>:get</tt>/<tt>:post</tt>/<tt>:put</tt>/<tt>:delete</tt>,
+    #   an array of any of the previous, or <tt>:any</tt> if the method does not matter.
+    #   These routes map to a URL like /messages/rss, with a route of +rss_messages_url+.
+    # * <tt>:member</tt> - Same as <tt>:collection</tt>, but for actions that operate on a specific member.
+    # * <tt>:new</tt> - Same as <tt>:collection</tt>, but for actions that operate on the new \resource action.
+    # * <tt>:controller</tt> - Specify the controller name for the routes.
+    # * <tt>:singular</tt> - Specify the singular name used in the member routes.
+    # * <tt>:requirements</tt> - Set custom routing parameter requirements; this is a hash of either 
+    #     regular expressions (which must match for the route to match) or extra parameters. For example:
+    #
+    #       map.resource :profile, :path_prefix => ':name', :requirements => { :name => /[a-zA-Z]+/, :extra => 'value' }
+    #
+    #     will only match if the first part is alphabetic, and will pass the parameter :extra to the controller.
+    # * <tt>:conditions</tt> - Specify custom routing recognition conditions.  \Resources sets the <tt>:method</tt> value for the method-specific routes.
+    # * <tt>:as</tt> - Specify a different \resource name to use in the URL path. For example:
+    #     # products_path == '/productos'
+    #     map.resources :products, :as => 'productos' do |product|
+    #       # product_reviews_path(product) == '/productos/1234/comentarios'
+    #       product.resources :product_reviews, :as => 'comentarios'
+    #     end
+    #
+    # * <tt>:has_one</tt> - Specify nested \resources, this is a shorthand for mapping singleton \resources beneath the current.
+    # * <tt>:has_many</tt> - Same has <tt>:has_one</tt>, but for plural \resources.
+    #
+    #   You may directly specify the routing association with +has_one+ and +has_many+ like:
+    #
+    #     map.resources :notes, :has_one => :author, :has_many => [:comments, :attachments]
+    #
+    #   This is the same as:
+    #
+    #     map.resources :notes do |notes|
+    #       notes.resource  :author
+    #       notes.resources :comments
+    #       notes.resources :attachments
+    #     end
+    #
+    # * <tt>:path_names</tt> - Specify different path names for the actions. For example:
+    #     # new_products_path == '/productos/nuevo'
+    #     # bids_product_path(1) == '/productos/1/licitacoes'
+    #     map.resources :products, :as => 'productos', :member => { :bids => :get }, :path_names => { :new => 'nuevo', :bids => 'licitacoes' }
+    #
+    #   You can also set default action names from an environment, like this:
+    #     config.action_controller.resources_path_names = { :new => 'nuevo', :edit => 'editar' }
+    #
+    # * <tt>:path_prefix</tt> - Set a prefix to the routes with required route variables.
+    #
+    #   Weblog comments usually belong to a post, so you might use +resources+ like:
+    #
+    #     map.resources :articles
+    #     map.resources :comments, :path_prefix => '/articles/:article_id'
+    #
+    #   You can nest +resources+ calls to set this automatically:
+    #
+    #     map.resources :articles do |article|
+    #       article.resources :comments
+    #     end
+    #
+    #   The comment \resources work the same, but must now include a value for <tt>:article_id</tt>.
+    #
+    #     article_comments_url(@article)
+    #     article_comment_url(@article, @comment)
+    #
+    #     article_comments_url(:article_id => @article)
+    #     article_comment_url(:article_id => @article, :id => @comment)
+    #
+    #   If you don't want to load all objects from the database you might want to use the <tt>article_id</tt> directly:
+    #
+    #     articles_comments_url(@comment.article_id, @comment)
+    #
+    # * <tt>:name_prefix</tt> - Define a prefix for all generated routes, usually ending in an underscore.
+    #   Use this if you have named routes that may clash.
+    #
+    #     map.resources :tags, :path_prefix => '/books/:book_id', :name_prefix => 'book_'
+    #     map.resources :tags, :path_prefix => '/toys/:toy_id',   :name_prefix => 'toy_'
+    #
+    # You may also use <tt>:name_prefix</tt> to override the generic named routes in a nested \resource:
+    #
+    #   map.resources :articles do |article|
+    #     article.resources :comments, :name_prefix => nil
+    #   end
+    #
+    # This will yield named \resources like so:
+    #
+    #   comments_url(@article)
+    #   comment_url(@article, @comment)
+    #
+    # * <tt>:shallow</tt> - If true, paths for nested resources which reference a specific member
+    #   (ie. those with an :id parameter) will not use the parent path prefix or name prefix.
+    #
+    # The <tt>:shallow</tt> option is inherited by any nested resource(s).
+    #
+    # For example, 'users', 'posts' and 'comments' all use shallow paths with the following nested resources:
+    #
+    #   map.resources :users, :shallow => true do |user|
+    #     user.resources :posts do |post|
+    #       post.resources :comments
+    #     end
+    #   end
+    #   # --> GET /users/1/posts (maps to the PostsController#index action as usual)
+    #   #     also adds the usual named route called "user_posts"
+    #   # --> GET /posts/2 (maps to the PostsController#show action as if it were not nested)
+    #   #     also adds the named route called "post"
+    #   # --> GET /posts/2/comments (maps to the CommentsController#index action)
+    #   #     also adds the named route called "post_comments"
+    #   # --> GET /comments/2 (maps to the CommentsController#show action as if it were not nested)
+    #   #     also adds the named route called "comment"
+    #
+    # You may also use <tt>:shallow</tt> in combination with the +has_one+ and +has_many+ shorthand notations like:
+    #
+    #   map.resources :users, :has_many => { :posts => :comments }, :shallow => true
+    #
+    # * <tt>:only</tt> and <tt>:except</tt> - Specify which of the seven default actions should be routed to.
+    #
+    # <tt>:only</tt> and <tt>:except</tt> may be set to <tt>:all</tt>, <tt>:none</tt>, an action name or a
+    # list of action names. By default, routes are generated for all seven actions.
+    #
+    # For example:
+    #
+    #   map.resources :posts, :only => [:index, :show] do |post|
+    #     post.resources :comments, :except => [:update, :destroy]
+    #   end
+    #   # --> GET /posts (maps to the PostsController#index action)
+    #   # --> POST /posts (fails)
+    #   # --> GET /posts/1 (maps to the PostsController#show action)
+    #   # --> DELETE /posts/1 (fails)
+    #   # --> POST /posts/1/comments (maps to the CommentsController#create action)
+    #   # --> PUT /posts/1/comments/1 (fails)
+    #
+    # If <tt>map.resources</tt> is called with multiple resources, they all get the same options applied.
+    #
+    # Examples:
+    #
+    #   map.resources :messages, :path_prefix => "/thread/:thread_id"
+    #   # --> GET /thread/7/messages/1
+    #
+    #   map.resources :messages, :collection => { :rss => :get }
+    #   # --> GET /messages/rss (maps to the #rss action)
+    #   #     also adds a named route called "rss_messages"
+    #
+    #   map.resources :messages, :member => { :mark => :post }
+    #   # --> POST /messages/1/mark (maps to the #mark action)
+    #   #     also adds a named route called "mark_message"
+    #
+    #   map.resources :messages, :new => { :preview => :post }
+    #   # --> POST /messages/new/preview (maps to the #preview action)
+    #   #     also adds a named route called "preview_new_message"
+    #
+    #   map.resources :messages, :new => { :new => :any, :preview => :post }
+    #   # --> POST /messages/new/preview (maps to the #preview action)
+    #   #     also adds a named route called "preview_new_message"
+    #   # --> /messages/new can be invoked via any request method
+    #
+    #   map.resources :messages, :controller => "categories",
+    #         :path_prefix => "/category/:category_id",
+    #         :name_prefix => "category_"
+    #   # --> GET /categories/7/messages/1
+    #   #     has named route "category_message"
+    #
+    # The +resources+ method sets HTTP method restrictions on the routes it generates. For example, making an
+    # HTTP POST on <tt>new_message_url</tt> will raise a RoutingError exception. The default route in
+    # <tt>config/routes.rb</tt> overrides this and allows invalid HTTP methods for \resource routes.
+    def resources(*entities, &block)
+      options = entities.extract_options!
+      entities.each { |entity| map_resource(entity, options.dup, &block) }
+    end
+
+    # Creates named routes for implementing verb-oriented controllers for a singleton \resource.
+    # A singleton \resource is global to its current context.  For unnested singleton \resources,
+    # the \resource is global to the current user visiting the application, such as a user's
+    # <tt>/account</tt> profile.  For nested singleton \resources, the \resource is global to its parent
+    # \resource, such as a <tt>projects</tt> \resource that <tt>has_one :project_manager</tt>.
+    # The <tt>project_manager</tt> should be mapped as a singleton \resource under <tt>projects</tt>:
+    #
+    #   map.resources :projects do |project|
+    #     project.resource :project_manager
+    #   end
+    #
+    # See +resources+ for general conventions.  These are the main differences:
+    # * A singular name is given to <tt>map.resource</tt>.  The default controller name is still taken from the plural name.
+    # * To specify a custom plural name, use the <tt>:plural</tt> option.  There is no <tt>:singular</tt> option.
+    # * No default index route is created for the singleton \resource controller.
+    # * When nesting singleton \resources, only the singular name is used as the path prefix (example: 'account/messages/1')
+    #
+    # For example:
+    #
+    #   map.resource :account
+    #
+    # maps these actions in the Accounts controller:
+    #
+    #   class AccountsController < ActionController::Base
+    #     # GET new_account_url
+    #     def new
+    #       # return an HTML form for describing the new account
+    #     end
+    #
+    #     # POST account_url
+    #     def create
+    #       # create an account
+    #     end
+    #
+    #     # GET account_url
+    #     def show
+    #       # find and return the account
+    #     end
+    #
+    #     # GET edit_account_url
+    #     def edit
+    #       # return an HTML form for editing the account
+    #     end
+    #
+    #     # PUT account_url
+    #     def update
+    #       # find and update the account
+    #     end
+    #
+    #     # DELETE account_url
+    #     def destroy
+    #       # delete the account
+    #     end
+    #   end
+    #
+    # Along with the routes themselves, +resource+ generates named routes for
+    # use in controllers and views. <tt>map.resource :account</tt> produces
+    # these named routes and helpers:
+    #
+    #   Named Route   Helpers
+    #   ============  =============================================
+    #   account       account_url, hash_for_account_url,
+    #                 account_path, hash_for_account_path
+    #
+    #   new_account   new_account_url, hash_for_new_account_url,
+    #                 new_account_path, hash_for_new_account_path
+    #
+    #   edit_account  edit_account_url, hash_for_edit_account_url,
+    #                 edit_account_path, hash_for_edit_account_path
+    def resource(*entities, &block)
+      options = entities.extract_options!
+      entities.each { |entity| map_singleton_resource(entity, options.dup, &block) }
+    end
+
+    private
+      def map_resource(entities, options = {}, &block)
+        resource = Resource.new(entities, options)
+
+        with_options :controller => resource.controller do |map|
+          map_associations(resource, options)
+
+          if block_given?
+            with_options(options.slice(*INHERITABLE_OPTIONS).merge(:path_prefix => resource.nesting_path_prefix, :name_prefix => resource.nesting_name_prefix), &block)
+          end
+
+          map_collection_actions(map, resource)
+          map_default_collection_actions(map, resource)
+          map_new_actions(map, resource)
+          map_member_actions(map, resource)
+        end
+      end
+
+      def map_singleton_resource(entities, options = {}, &block)
+        resource = SingletonResource.new(entities, options)
+
+        with_options :controller => resource.controller do |map|
+          map_associations(resource, options)
+
+          if block_given?
+            with_options(options.slice(*INHERITABLE_OPTIONS).merge(:path_prefix => resource.nesting_path_prefix, :name_prefix => resource.nesting_name_prefix), &block)
+          end
+
+          map_collection_actions(map, resource)
+          map_new_actions(map, resource)
+          map_member_actions(map, resource)
+          map_default_singleton_actions(map, resource)
+        end
+      end
+
+      def map_associations(resource, options)
+        map_has_many_associations(resource, options.delete(:has_many), options) if options[:has_many]
+
+        path_prefix = "#{options.delete(:path_prefix)}#{resource.nesting_path_prefix}"
+        name_prefix = "#{options.delete(:name_prefix)}#{resource.nesting_name_prefix}"
+
+        Array(options[:has_one]).each do |association|
+          resource(association, options.slice(*INHERITABLE_OPTIONS).merge(:path_prefix => path_prefix, :name_prefix => name_prefix))
+        end
+      end
+
+      def map_has_many_associations(resource, associations, options)
+        case associations
+        when Hash
+          associations.each do |association,has_many|
+            map_has_many_associations(resource, association, options.merge(:has_many => has_many))
+          end
+        when Array
+          associations.each do |association|
+            map_has_many_associations(resource, association, options)
+          end
+        when Symbol, String
+          resources(associations, options.slice(*INHERITABLE_OPTIONS).merge(:path_prefix => resource.nesting_path_prefix, :name_prefix => resource.nesting_name_prefix, :has_many => options[:has_many]))
+        else
+        end
+      end
+
+      def map_collection_actions(map, resource)
+        resource.collection_methods.each do |method, actions|
+          actions.each do |action|
+            [method].flatten.each do |m|
+              action_path = resource.options[:path_names][action] if resource.options[:path_names].is_a?(Hash)
+              action_path ||= action
+
+              map_resource_routes(map, resource, action, "#{resource.path}#{resource.action_separator}#{action_path}", "#{action}_#{resource.name_prefix}#{resource.plural}", m)
+            end
+          end
+        end
+      end
+
+      def map_default_collection_actions(map, resource)
+        index_route_name = "#{resource.name_prefix}#{resource.plural}"
+
+        if resource.uncountable?
+          index_route_name << "_index"
+        end
+
+        map_resource_routes(map, resource, :index, resource.path, index_route_name)
+        map_resource_routes(map, resource, :create, resource.path, index_route_name)
+      end
+
+      def map_default_singleton_actions(map, resource)
+        map_resource_routes(map, resource, :create, resource.path, "#{resource.shallow_name_prefix}#{resource.singular}")
+      end
+
+      def map_new_actions(map, resource)
+        resource.new_methods.each do |method, actions|
+          actions.each do |action|
+            route_path = resource.new_path
+            route_name = "new_#{resource.name_prefix}#{resource.singular}"
+
+            unless action == :new
+              route_path = "#{route_path}#{resource.action_separator}#{action}"
+              route_name = "#{action}_#{route_name}"
+            end
+
+            map_resource_routes(map, resource, action, route_path, route_name, method)
+          end
+        end
+      end
+
+      def map_member_actions(map, resource)
+        resource.member_methods.each do |method, actions|
+          actions.each do |action|
+            [method].flatten.each do |m|
+              action_path = resource.options[:path_names][action] if resource.options[:path_names].is_a?(Hash)
+              action_path ||= Base.resources_path_names[action] || action
+
+              map_resource_routes(map, resource, action, "#{resource.member_path}#{resource.action_separator}#{action_path}", "#{action}_#{resource.shallow_name_prefix}#{resource.singular}", m, { :force_id => true })
+            end
+          end
+        end
+
+        route_path = "#{resource.shallow_name_prefix}#{resource.singular}"
+        map_resource_routes(map, resource, :show, resource.member_path, route_path)
+        map_resource_routes(map, resource, :update, resource.member_path, route_path)
+        map_resource_routes(map, resource, :destroy, resource.member_path, route_path)
+      end
+
+      def map_resource_routes(map, resource, action, route_path, route_name = nil, method = nil, resource_options = {} )
+        if resource.has_action?(action)
+          action_options = action_options_for(action, resource, method, resource_options)
+          formatted_route_path = "#{route_path}.:format"
+
+          if route_name && @set.named_routes[route_name.to_sym].nil?
+            map.named_route(route_name, formatted_route_path, action_options)
+          else
+            map.connect(formatted_route_path, action_options)
+          end
+        end
+      end
+
+      def add_conditions_for(conditions, method)
+        ({:conditions => conditions.dup}).tap do |options|
+          options[:conditions][:method] = method unless method == :any
+        end
+      end
+
+      def action_options_for(action, resource, method = nil, resource_options = {})
+        default_options = { :action => action.to_s }
+        require_id = !resource.kind_of?(SingletonResource)
+        force_id = resource_options[:force_id] && !resource.kind_of?(SingletonResource)
+
+        case default_options[:action]
+          when "index", "new"; default_options.merge(add_conditions_for(resource.conditions, method || :get)).merge(resource.requirements)
+          when "create";       default_options.merge(add_conditions_for(resource.conditions, method || :post)).merge(resource.requirements)
+          when "show", "edit"; default_options.merge(add_conditions_for(resource.conditions, method || :get)).merge(resource.requirements(require_id))
+          when "update";       default_options.merge(add_conditions_for(resource.conditions, method || :put)).merge(resource.requirements(require_id))
+          when "destroy";      default_options.merge(add_conditions_for(resource.conditions, method || :delete)).merge(resource.requirements(require_id))
+          else                 default_options.merge(add_conditions_for(resource.conditions, method)).merge(resource.requirements(force_id))
+        end
+      end
+  end
+end

vendor/rails/actionpack/lib/action_controller/response.rb

@@ -0,0 +1,236 @@
+require 'digest/md5'
+
+module ActionController # :nodoc:
+  # Represents an HTTP response generated by a controller action. One can use
+  # an ActionController::Response object to retrieve the current state
+  # of the response, or customize the response. An Response object can
+  # either represent a "real" HTTP response (i.e. one that is meant to be sent
+  # back to the web browser) or a test response (i.e. one that is generated
+  # from integration tests). See CgiResponse and TestResponse, respectively.
+  #
+  # Response is mostly a Ruby on Rails framework implement detail, and
+  # should never be used directly in controllers. Controllers should use the
+  # methods defined in ActionController::Base instead. For example, if you want
+  # to set the HTTP response's content MIME type, then use
+  # ActionControllerBase#headers instead of Response#headers.
+  #
+  # Nevertheless, integration tests may want to inspect controller responses in
+  # more detail, and that's when Response can be useful for application
+  # developers. Integration test methods such as
+  # ActionController::Integration::Session#get and
+  # ActionController::Integration::Session#post return objects of type
+  # TestResponse (which are of course also of type Response).
+  #
+  # For example, the following demo integration "test" prints the body of the
+  # controller response to the console:
+  #
+  #  class DemoControllerTest < ActionController::IntegrationTest
+  #    def test_print_root_path_to_console
+  #      get('/')
+  #      puts @response.body
+  #    end
+  #  end
+  class Response < Rack::Response
+    DEFAULT_HEADERS = { "Cache-Control" => "no-cache" }
+    attr_accessor :request
+
+    attr_accessor :session, :assigns, :template, :layout
+    attr_accessor :redirected_to, :redirected_to_method_params
+
+    delegate :default_charset, :to => 'ActionController::Base'
+
+    def initialize
+      @status = 200
+      @header = Rack::Utils::HeaderHash.new(DEFAULT_HEADERS)
+
+      @writer = lambda { |x| @body << x }
+      @block = nil
+
+      @body = "",
+      @session = []
+      @assigns = []
+    end
+
+    def location; headers['Location'] end
+    def location=(url) headers['Location'] = url end
+
+
+    # Sets the HTTP response's content MIME type. For example, in the controller
+    # you could write this:
+    #
+    #  response.content_type = "text/plain"
+    #
+    # If a character set has been defined for this response (see charset=) then
+    # the character set information will also be included in the content type
+    # information.
+    def content_type=(mime_type)
+      self.headers["Content-Type"] =
+        if mime_type =~ /charset/ || (c = charset).nil?
+          mime_type.to_s
+        else
+          "#{mime_type}; charset=#{c}"
+        end
+    end
+
+    # Returns the response's content MIME type, or nil if content type has been set.
+    def content_type
+      content_type = String(headers["Content-Type"] || headers["type"]).split(";")[0]
+      content_type.blank? ? nil : content_type
+    end
+
+    # Set the charset of the Content-Type header. Set to nil to remove it.
+    # If no content type is set, it defaults to HTML.
+    def charset=(charset)
+      headers["Content-Type"] =
+        if charset
+          "#{content_type || Mime::HTML}; charset=#{charset}"
+        else
+          content_type || Mime::HTML.to_s
+        end
+    end
+
+    def charset
+      charset = String(headers["Content-Type"] || headers["type"]).split(";")[1]
+      charset.blank? ? nil : charset.strip.split("=")[1]
+    end
+
+    def last_modified
+      if last = headers['Last-Modified']
+        Time.httpdate(last)
+      end
+    end
+
+    def last_modified?
+      headers.include?('Last-Modified')
+    end
+
+    def last_modified=(utc_time)
+      headers['Last-Modified'] = utc_time.httpdate
+    end
+
+    def etag
+      headers['ETag']
+    end
+
+    def etag?
+      headers.include?('ETag')
+    end
+
+    def etag=(etag)
+      headers['ETag'] = %("#{Digest::MD5.hexdigest(ActiveSupport::Cache.expand_cache_key(etag))}")
+    end
+
+    def redirect(url, status)
+      self.status = status
+      self.location = url.gsub(/[\r\n]/, '')
+      self.body = "<html><body>You are being <a href=\"#{CGI.escapeHTML(url)}\">redirected</a>.</body></html>"
+    end
+
+    def sending_file?
+      headers["Content-Transfer-Encoding"] == "binary"
+    end
+
+    def assign_default_content_type_and_charset!
+      self.content_type ||= Mime::HTML
+      self.charset ||= default_charset unless sending_file?
+    end
+
+    def prepare!
+      assign_default_content_type_and_charset!
+      handle_conditional_get!
+      set_content_length!
+      convert_content_type!
+      convert_language!
+      convert_cookies!
+    end
+
+    def each(&callback)
+      if @body.respond_to?(:call)
+        @writer = lambda { |x| callback.call(x) }
+        @body.call(self, self)
+      elsif @body.respond_to?(:to_str)
+        yield @body
+      else
+        @body.each(&callback)
+      end
+
+      @writer = callback
+      @block.call(self) if @block
+    end
+
+    def write(str)
+      @writer.call str.to_s
+      str
+    end
+
+    def flush #:nodoc:
+      ActiveSupport::Deprecation.warn(
+        'Calling output.flush is no longer needed for streaming output ' +
+        'because ActionController::Response automatically handles it', caller)
+    end
+
+    def set_cookie(key, value)
+      if value.has_key?(:http_only)
+        ActiveSupport::Deprecation.warn(
+          "The :http_only option in ActionController::Response#set_cookie " +
+          "has been renamed. Please use :httponly instead.", caller)
+        value[:httponly] ||= value.delete(:http_only)
+      end
+
+      super(key, value)
+    end
+
+    private
+      def handle_conditional_get!
+        if etag? || last_modified?
+          set_conditional_cache_control!
+        elsif nonempty_ok_response?
+          self.etag = body
+
+          if request && request.etag_matches?(etag)
+            self.status = '304 Not Modified'
+            self.body = ''
+          end
+
+          set_conditional_cache_control!
+        end
+      end
+
+      def nonempty_ok_response?
+        ok = !status || status.to_s[0..2] == '200'
+        ok && body.is_a?(String) && !body.blank?
+      end
+
+      def set_conditional_cache_control!
+        if headers['Cache-Control'] == DEFAULT_HEADERS['Cache-Control']
+          headers['Cache-Control'] = 'private, max-age=0, must-revalidate'
+        end
+      end
+
+      def convert_content_type!
+        headers['Content-Type'] ||= "text/html"
+        headers['Content-Type'] += "; charset=" + headers.delete('charset') if headers['charset']
+      end
+
+      # Don't set the Content-Length for block-based bodies as that would mean
+      # reading it all into memory. Not nice for, say, a 2GB streaming file.
+      def set_content_length!
+        if status && status.to_s[0..2] == '204'
+          headers.delete('Content-Length')
+        elsif length = headers['Content-Length']
+          headers['Content-Length'] = length.to_s
+        elsif !body.respond_to?(:call) && (!status || status.to_s[0..2] != '304')
+          headers["Content-Length"] = (body.respond_to?(:bytesize) ? body.bytesize : body.size).to_s
+        end
+      end
+
+      def convert_language!
+        headers["Content-Language"] = headers.delete("language") if headers["language"]
+      end
+
+      def convert_cookies!
+        cookies = Array(headers['Set-Cookie']).compact
+        headers['Set-Cookie'] = cookies unless cookies.empty?
+      end
+  end
+end

vendor/rails/actionpack/lib/action_controller/routing.rb

@@ -0,0 +1,388 @@
+require 'cgi'
+require 'uri'
+require 'action_controller/routing/optimisations'
+require 'action_controller/routing/routing_ext'
+require 'action_controller/routing/route'
+require 'action_controller/routing/segments'
+require 'action_controller/routing/builder'
+require 'action_controller/routing/route_set'
+require 'action_controller/routing/recognition_optimisation'
+
+module ActionController
+  # == Routing
+  #
+  # The routing module provides URL rewriting in native Ruby. It's a way to
+  # redirect incoming requests to controllers and actions. This replaces
+  # mod_rewrite rules. Best of all, Rails' Routing works with any web server.
+  # Routes are defined in <tt>config/routes.rb</tt>.
+  #
+  # Consider the following route, installed by Rails when you generate your
+  # application:
+  #
+  #   map.connect ':controller/:action/:id'
+  #
+  # This route states that it expects requests to consist of a
+  # <tt>:controller</tt> followed by an <tt>:action</tt> that in turn is fed
+  # some <tt>:id</tt>.
+  #
+  # Suppose you get an incoming request for <tt>/blog/edit/22</tt>, you'll end up
+  # with:
+  #
+  #   params = { :controller => 'blog',
+  #              :action     => 'edit',
+  #              :id         => '22'
+  #           }
+  #
+  # Think of creating routes as drawing a map for your requests. The map tells
+  # them where to go based on some predefined pattern:
+  #
+  #   ActionController::Routing::Routes.draw do |map|
+  #     Pattern 1 tells some request to go to one place
+  #     Pattern 2 tell them to go to another
+  #     ...
+  #   end
+  #
+  # The following symbols are special:
+  #
+  #   :controller maps to your controller name
+  #   :action     maps to an action with your controllers
+  #
+  # Other names simply map to a parameter as in the case of <tt>:id</tt>.
+  #
+  # == Route priority
+  #
+  # Not all routes are created equally. Routes have priority defined by the
+  # order of appearance of the routes in the <tt>config/routes.rb</tt> file. The priority goes
+  # from top to bottom. The last route in that file is at the lowest priority
+  # and will be applied last. If no route matches, 404 is returned.
+  #
+  # Within blocks, the empty pattern is at the highest priority.
+  # In practice this works out nicely:
+  #
+  #   ActionController::Routing::Routes.draw do |map|
+  #     map.with_options :controller => 'blog' do |blog|
+  #       blog.show '',  :action => 'list'
+  #     end
+  #     map.connect ':controller/:action/:view'
+  #   end
+  #
+  # In this case, invoking blog controller (with an URL like '/blog/')
+  # without parameters will activate the 'list' action by default.
+  #
+  # == Defaults routes and default parameters
+  #
+  # Setting a default route is straightforward in Rails - you simply append a
+  # Hash at the end of your mapping to set any default parameters.
+  #
+  # Example:
+  #
+  #   ActionController::Routing:Routes.draw do |map|
+  #     map.connect ':controller/:action/:id', :controller => 'blog'
+  #   end
+  #
+  # This sets up +blog+ as the default controller if no other is specified.
+  # This means visiting '/' would invoke the blog controller.
+  #
+  # More formally, you can include arbitrary parameters in the route, thus:
+  #
+  #   map.connect ':controller/:action/:id', :action => 'show', :page => 'Dashboard'
+  #
+  # This will pass the :page parameter to all incoming requests that match this route.
+  #
+  # Note: The default routes, as provided by the Rails generator, make all actions in every
+  # controller accessible via GET requests. You should consider removing them or commenting
+  # them out if you're using named routes and resources.
+  #
+  # == Named routes
+  #
+  # Routes can be named with the syntax <tt>map.name_of_route options</tt>,
+  # allowing for easy reference within your source as +name_of_route_url+
+  # for the full URL and +name_of_route_path+ for the URI path.
+  #
+  # Example:
+  #
+  #   # In routes.rb
+  #   map.login 'login', :controller => 'accounts', :action => 'login'
+  #
+  #   # With render, redirect_to, tests, etc.
+  #   redirect_to login_url
+  #
+  # Arguments can be passed as well.
+  #
+  #   redirect_to show_item_path(:id => 25)
+  #
+  # Use <tt>map.root</tt> as a shorthand to name a route for the root path "".
+  #
+  #   # In routes.rb
+  #   map.root :controller => 'blogs'
+  #
+  #   # would recognize http://www.example.com/ as
+  #   params = { :controller => 'blogs', :action => 'index' }
+  #
+  #   # and provide these named routes
+  #   root_url   # => 'http://www.example.com/'
+  #   root_path  # => ''
+  #
+  # You can also specify an already-defined named route in your <tt>map.root</tt> call:
+  #
+  #   # In routes.rb
+  #   map.new_session :controller => 'sessions', :action => 'new'
+  #   map.root :new_session
+  #
+  # Note: when using +with_options+, the route is simply named after the
+  # method you call on the block parameter rather than map.
+  #
+  #   # In routes.rb
+  #   map.with_options :controller => 'blog' do |blog|
+  #     blog.show    '',            :action  => 'list'
+  #     blog.delete  'delete/:id',  :action  => 'delete',
+  #     blog.edit    'edit/:id',    :action  => 'edit'
+  #   end
+  #
+  #   # provides named routes for show, delete, and edit
+  #   link_to @article.title, show_path(:id => @article.id)
+  #
+  # == Pretty URLs
+  #
+  # Routes can generate pretty URLs. For example:
+  #
+  #   map.connect 'articles/:year/:month/:day',
+  #               :controller => 'articles',
+  #               :action     => 'find_by_date',
+  #               :year       => /\d{4}/,
+  #               :month      => /\d{1,2}/,
+  #               :day        => /\d{1,2}/
+  #
+  # Using the route above, the URL "http://localhost:3000/articles/2005/11/06"
+  # maps to
+  #
+  #   params = {:year => '2005', :month => '11', :day => '06'}
+  #
+  # == Regular Expressions and parameters
+  # You can specify a regular expression to define a format for a parameter.
+  #
+  #   map.geocode 'geocode/:postalcode', :controller => 'geocode',
+  #               :action => 'show', :postalcode => /\d{5}(-\d{4})?/
+  #
+  # or, more formally:
+  #
+  #   map.geocode 'geocode/:postalcode', :controller => 'geocode',
+  #               :action => 'show', :requirements => { :postalcode => /\d{5}(-\d{4})?/ }
+  #
+  # Formats can include the 'ignorecase' and 'extended syntax' regular
+  # expression modifiers:
+  #
+  #   map.geocode 'geocode/:postalcode', :controller => 'geocode',
+  #               :action => 'show', :postalcode => /hx\d\d\s\d[a-z]{2}/i
+  #
+  #   map.geocode 'geocode/:postalcode', :controller => 'geocode',
+  #               :action => 'show',:requirements => {
+  #                 :postalcode => /# Postcode format
+  #                                 \d{5} #Prefix
+  #                                 (-\d{4})? #Suffix
+  #                                 /x
+  #               }
+  #
+  # Using the multiline match modifier will raise an ArgumentError.
+  # Encoding regular expression modifiers are silently ignored. The
+  # match will always use the default encoding or ASCII.
+  #
+  # == Route globbing
+  #
+  # Specifying <tt>*[string]</tt> as part of a rule like:
+  #
+  #   map.connect '*path' , :controller => 'blog' , :action => 'unrecognized?'
+  #
+  # will glob all remaining parts of the route that were not recognized earlier. 
+  # The globbed values are in <tt>params[:path]</tt> as an array of path segments.
+  #
+  # == Route conditions
+  #
+  # With conditions you can define restrictions on routes. Currently the only valid condition is <tt>:method</tt>.
+  #
+  # * <tt>:method</tt> - Allows you to specify which method can access the route. Possible values are <tt>:post</tt>,
+  #   <tt>:get</tt>, <tt>:put</tt>, <tt>:delete</tt> and <tt>:any</tt>. The default value is <tt>:any</tt>,
+  #   <tt>:any</tt> means that any method can access the route.
+  #
+  # Example:
+  #
+  #   map.connect 'post/:id', :controller => 'posts', :action => 'show',
+  #               :conditions => { :method => :get }
+  #   map.connect 'post/:id', :controller => 'posts', :action => 'create_comment',
+  #               :conditions => { :method => :post }
+  #
+  # Now, if you POST to <tt>/posts/:id</tt>, it will route to the <tt>create_comment</tt> action. A GET on the same
+  # URL will route to the <tt>show</tt> action.
+  #
+  # == Reloading routes
+  #
+  # You can reload routes if you feel you must:
+  #
+  #   ActionController::Routing::Routes.reload
+  #
+  # This will clear all named routes and reload routes.rb if the file has been modified from
+  # last load. To absolutely force reloading, use <tt>reload!</tt>.
+  #
+  # == Testing Routes
+  #
+  # The two main methods for testing your routes:
+  #
+  # === +assert_routing+
+  #
+  #   def test_movie_route_properly_splits
+  #    opts = {:controller => "plugin", :action => "checkout", :id => "2"}
+  #    assert_routing "plugin/checkout/2", opts
+  #   end
+  #
+  # +assert_routing+ lets you test whether or not the route properly resolves into options.
+  #
+  # === +assert_recognizes+
+  #
+  #   def test_route_has_options
+  #    opts = {:controller => "plugin", :action => "show", :id => "12"}
+  #    assert_recognizes opts, "/plugins/show/12"
+  #   end
+  #
+  # Note the subtle difference between the two: +assert_routing+ tests that
+  # a URL fits options while +assert_recognizes+ tests that a URL
+  # breaks into parameters properly.
+  #
+  # In tests you can simply pass the URL or named route to +get+ or +post+.
+  #
+  #   def send_to_jail
+  #     get '/jail'
+  #     assert_response :success
+  #     assert_template "jail/front"
+  #   end
+  #
+  #   def goes_to_login
+  #     get login_url
+  #     #...
+  #   end
+  #
+  # == View a list of all your routes
+  #
+  # Run <tt>rake routes</tt>.
+  #
+  module Routing
+    SEPARATORS = %w( / . ? )
+
+    HTTP_METHODS = [:get, :head, :post, :put, :delete, :options]
+
+    ALLOWED_REQUIREMENTS_FOR_OPTIMISATION = [:controller, :action].to_set
+
+    mattr_accessor :generate_best_match
+    self.generate_best_match = true
+
+    # The root paths which may contain controller files
+    mattr_accessor :controller_paths
+    self.controller_paths = []
+
+    # A helper module to hold URL related helpers.
+    module Helpers
+      include PolymorphicRoutes
+    end
+
+    class << self
+      # Expects an array of controller names as the first argument.
+      # Executes the passed block with only the named controllers named available.
+      # This method is used in internal Rails testing.
+      def with_controllers(names)
+        prior_controllers = @possible_controllers
+        use_controllers! names
+        yield
+      ensure
+        use_controllers! prior_controllers
+      end
+
+      # Returns an array of paths, cleaned of double-slashes and relative path references.
+      # * "\\\" and "//"  become "\\" or "/".
+      # * "/foo/bar/../config" becomes "/foo/config".
+      # The returned array is sorted by length, descending.
+      def normalize_paths(paths)
+        # do the hokey-pokey of path normalization...
+        paths = paths.collect do |path|
+          path = path.
+            gsub("//", "/").           # replace double / chars with a single
+            gsub("\\\\", "\\").        # replace double \ chars with a single
+            gsub(%r{(.)[\\/]$}, '\1')  # drop final / or \ if path ends with it
+
+          # eliminate .. paths where possible
+          re = %r{[^/\\]+[/\\]\.\.[/\\]}
+          path.gsub!(re, "") while path.match(re)
+          path
+        end
+
+        # start with longest path, first
+        paths = paths.uniq.sort_by { |path| - path.length }
+      end
+
+      # Returns the array of controller names currently available to ActionController::Routing.
+      def possible_controllers
+        unless @possible_controllers
+          @possible_controllers = []
+
+          paths = controller_paths.select { |path| File.directory?(path) && path != "." }
+
+          seen_paths = Hash.new {|h, k| h[k] = true; false}
+          normalize_paths(paths).each do |load_path|
+            Dir["#{load_path}/**/*_controller.rb"].collect do |path|
+              next if seen_paths[path.gsub(%r{^\.[/\\]}, "")]
+
+              controller_name = path[(load_path.length + 1)..-1]
+
+              controller_name.gsub!(/_controller\.rb\Z/, '')
+              @possible_controllers << controller_name
+            end
+          end
+
+          # remove duplicates
+          @possible_controllers.uniq!
+        end
+        @possible_controllers
+      end
+
+      # Replaces the internal list of controllers available to ActionController::Routing with the passed argument.
+      #   ActionController::Routing.use_controllers!([ "posts", "comments", "admin/comments" ])
+      def use_controllers!(controller_names)
+        @possible_controllers = controller_names
+      end
+
+      # Returns a controller path for a new +controller+ based on a +previous+ controller path.
+      # Handles 4 scenarios:
+      #
+      # * stay in the previous controller:
+      #     controller_relative_to( nil, "groups/discussion" ) # => "groups/discussion"
+      #
+      # * stay in the previous namespace:
+      #     controller_relative_to( "posts", "groups/discussion" ) # => "groups/posts"
+      #
+      # * forced move to the root namespace:
+      #     controller_relative_to( "/posts", "groups/discussion" ) # => "posts"
+      #
+      # * previous namespace is root:
+      #     controller_relative_to( "posts", "anything_with_no_slashes" ) # =>"posts"
+      #
+      def controller_relative_to(controller, previous)
+        if controller.nil?           then previous
+        elsif controller[0] == ?/    then controller[1..-1]
+        elsif %r{^(.*)/} =~ previous then "#{$1}/#{controller}"
+        else controller
+        end
+      end
+    end
+
+    Routes = RouteSet.new
+
+    ActiveSupport::Inflector.module_eval do
+      # Ensures that routes are reloaded when Rails inflections are updated.
+      def inflections_with_route_reloading(&block)
+        (inflections_without_route_reloading(&block)).tap {
+          ActionController::Routing::Routes.reload! if block_given?
+        }
+      end
+
+      alias_method_chain :inflections, :route_reloading
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/routing/builder.rb

@@ -0,0 +1,197 @@
+module ActionController
+  module Routing
+    class RouteBuilder #:nodoc:
+      attr_reader :separators, :optional_separators
+      attr_reader :separator_regexp, :nonseparator_regexp, :interval_regexp
+
+      def initialize
+        @separators = Routing::SEPARATORS
+        @optional_separators = %w( / )
+
+        @separator_regexp = /[#{Regexp.escape(separators.join)}]/
+        @nonseparator_regexp = /\A([^#{Regexp.escape(separators.join)}]+)/
+        @interval_regexp = /(.*?)(#{separator_regexp}|$)/
+      end
+
+      # Accepts a "route path" (a string defining a route), and returns the array
+      # of segments that corresponds to it. Note that the segment array is only
+      # partially initialized--the defaults and requirements, for instance, need
+      # to be set separately, via the +assign_route_options+ method, and the
+      # <tt>optional?</tt> method for each segment will not be reliable until after
+      # +assign_route_options+ is called, as well.
+      def segments_for_route_path(path)
+        rest, segments = path, []
+
+        until rest.empty?
+          segment, rest = segment_for(rest)
+          segments << segment
+        end
+        segments
+      end
+
+      # A factory method that returns a new segment instance appropriate for the
+      # format of the given string.
+      def segment_for(string)
+        segment =
+          case string
+            when  /\A\.(:format)?\// 
+              OptionalFormatSegment.new
+            when /\A:(\w+)/
+              key = $1.to_sym
+              key == :controller ? ControllerSegment.new(key) : DynamicSegment.new(key)
+            when /\A\*(\w+)/
+              PathSegment.new($1.to_sym, :optional => true)
+            when /\A\?(.*?)\?/
+              StaticSegment.new($1, :optional => true)
+            when nonseparator_regexp
+              StaticSegment.new($1)
+            when separator_regexp
+              DividerSegment.new($&, :optional => optional_separators.include?($&))
+          end
+        [segment, $~.post_match]
+      end
+
+      # Split the given hash of options into requirement and default hashes. The
+      # segments are passed alongside in order to distinguish between default values
+      # and requirements.
+      def divide_route_options(segments, options)
+        options = options.except(:path_prefix, :name_prefix)
+
+        if options[:namespace]
+          options[:controller] = "#{options.delete(:namespace).sub(/\/$/, '')}/#{options[:controller]}"
+        end
+
+        requirements = (options.delete(:requirements) || {}).dup
+        defaults     = (options.delete(:defaults)     || {}).dup
+        conditions   = (options.delete(:conditions)   || {}).dup
+
+        validate_route_conditions(conditions)
+
+        path_keys = segments.collect { |segment| segment.key if segment.respond_to?(:key) }.compact
+        options.each do |key, value|
+          hash = (path_keys.include?(key) && ! value.is_a?(Regexp)) ? defaults : requirements
+          hash[key] = value
+        end
+
+        [defaults, requirements, conditions]
+      end
+
+      # Takes a hash of defaults and a hash of requirements, and assigns them to
+      # the segments. Any unused requirements (which do not correspond to a segment)
+      # are returned as a hash.
+      def assign_route_options(segments, defaults, requirements)
+        route_requirements = {} # Requirements that do not belong to a segment
+
+        segment_named = Proc.new do |key|
+          segments.detect { |segment| segment.key == key if segment.respond_to?(:key) }
+        end
+
+        requirements.each do |key, requirement|
+          segment = segment_named[key]
+          if segment
+            raise TypeError, "#{key}: requirements on a path segment must be regular expressions" unless requirement.is_a?(Regexp)
+            if requirement.source =~ %r{\A(\\A|\^)|(\\Z|\\z|\$)\Z}
+              raise ArgumentError, "Regexp anchor characters are not allowed in routing requirements: #{requirement.inspect}"
+            end
+            if requirement.multiline?
+              raise ArgumentError, "Regexp multiline option not allowed in routing requirements: #{requirement.inspect}"
+            end
+            segment.regexp = requirement
+          else
+            route_requirements[key] = requirement
+          end
+        end
+
+        defaults.each do |key, default|
+          segment = segment_named[key]
+          raise ArgumentError, "#{key}: No matching segment exists; cannot assign default" unless segment
+          segment.is_optional = true
+          segment.default = default.to_param if default
+        end
+
+        assign_default_route_options(segments)
+        ensure_required_segments(segments)
+        route_requirements
+      end
+
+      # Assign default options, such as 'index' as a default for <tt>:action</tt>. This
+      # method must be run *after* user supplied requirements and defaults have
+      # been applied to the segments.
+      def assign_default_route_options(segments)
+        segments.each do |segment|
+          next unless segment.is_a? DynamicSegment
+          case segment.key
+            when :action
+              if segment.regexp.nil? || segment.regexp.match('index').to_s == 'index'
+                segment.default ||= 'index'
+                segment.is_optional = true
+              end
+            when :id
+              if segment.default.nil? && segment.regexp.nil? || segment.regexp =~ ''
+                segment.is_optional = true
+              end
+          end
+        end
+      end
+
+      # Makes sure that there are no optional segments that precede a required
+      # segment. If any are found that precede a required segment, they are
+      # made required.
+      def ensure_required_segments(segments)
+        allow_optional = true
+        segments.reverse_each do |segment|
+          allow_optional &&= segment.optional?
+          if !allow_optional && segment.optional?
+            unless segment.optionality_implied?
+              warn "Route segment \"#{segment.to_s}\" cannot be optional because it precedes a required segment. This segment will be required."
+            end
+            segment.is_optional = false
+          elsif allow_optional && segment.respond_to?(:default) && segment.default
+            # if a segment has a default, then it is optional
+            segment.is_optional = true
+          end
+        end
+      end
+
+      # Construct and return a route with the given path and options.
+      def build(path, options)
+        # Wrap the path with slashes
+        path = "/#{path}" unless path[0] == ?/
+        path = "#{path}/" unless path[-1] == ?/
+
+        prefix = options[:path_prefix].to_s.gsub(/^\//,'')
+        path = "/#{prefix}#{path}" unless prefix.blank?
+
+        segments = segments_for_route_path(path)
+        defaults, requirements, conditions = divide_route_options(segments, options)
+        requirements = assign_route_options(segments, defaults, requirements)
+
+        # TODO: Segments should be frozen on initialize
+        segments.each { |segment| segment.freeze }
+
+        route = Route.new(segments, requirements, conditions)
+
+        if !route.significant_keys.include?(:controller)
+          raise ArgumentError, "Illegal route: the :controller must be specified!"
+        end
+
+        route.freeze
+      end
+
+      private
+        def validate_route_conditions(conditions)
+          if method = conditions[:method]
+            [method].flatten.each do |m|
+              if m == :head
+                raise ArgumentError, "HTTP method HEAD is invalid in route conditions. Rails processes HEAD requests the same as GETs, returning just the response headers"
+              end
+
+              unless HTTP_METHODS.include?(m.to_sym)
+                raise ArgumentError, "Invalid HTTP method specified in route conditions: #{conditions.inspect}"
+              end
+            end
+          end
+        end
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/routing/optimisations.rb

@@ -0,0 +1,130 @@
+module ActionController
+  module Routing
+    # Much of the slow performance from routes comes from the
+    # complexity of expiry, <tt>:requirements</tt> matching, defaults providing
+    # and figuring out which url pattern to use.  With named routes
+    # we can avoid the expense of finding the right route.  So if
+    # they've provided the right number of arguments, and have no
+    # <tt>:requirements</tt>, we can just build up a string and return it.
+    #
+    # To support building optimisations for other common cases, the
+    # generation code is separated into several classes
+    module Optimisation
+      def generate_optimisation_block(route, kind)
+        return "" unless route.optimise?
+        OPTIMISERS.inject("") do |memo, klazz|
+          memo << klazz.new(route, kind).source_code
+          memo
+        end
+      end
+
+      class Optimiser
+        attr_reader :route, :kind
+        GLOBAL_GUARD_CONDITIONS = [
+          "(!defined?(default_url_options) || default_url_options.blank?)",
+          "(!defined?(controller.default_url_options) || controller.default_url_options.blank?)",
+          "defined?(request)",
+          "request"
+          ]
+
+        def initialize(route, kind)
+          @route = route
+          @kind  = kind
+        end
+
+        def guard_conditions
+          ["false"]
+        end
+
+        def generation_code
+          'nil'
+        end
+
+        def source_code
+          if applicable?
+            guard_condition = (GLOBAL_GUARD_CONDITIONS + guard_conditions).join(" && ")
+            "return #{generation_code} if #{guard_condition}\n"
+          else
+            "\n"
+          end
+        end
+
+        # Temporarily disabled <tt>:url</tt> optimisation pending proper solution to
+        # Issues around request.host etc.
+        def applicable?
+          true
+        end
+      end
+
+      # Given a route
+      #
+      #   map.person '/people/:id'
+      #
+      # If the user calls <tt>person_url(@person)</tt>, we can simply
+      # return a string like "/people/#{@person.to_param}"
+      # rather than triggering the expensive logic in +url_for+.
+      class PositionalArguments < Optimiser
+        def guard_conditions
+          number_of_arguments = route.required_segment_keys.size
+          # if they're using foo_url(:id=>2) it's one
+          # argument, but we don't want to generate /foos/id2
+          if number_of_arguments == 1
+            ["args.size == 1", "!args.first.is_a?(Hash)"]
+          else
+            ["args.size == #{number_of_arguments}"]
+          end
+        end
+
+        def generation_code
+          elements = []
+          idx = 0
+
+          if kind == :url
+            elements << '#{request.protocol}'
+            elements << '#{request.host_with_port}'
+          end
+
+          elements << '#{ActionController::Base.relative_url_root if ActionController::Base.relative_url_root}'
+
+          # The last entry in <tt>route.segments</tt> appears to *always* be a
+          # 'divider segment' for '/' but we have assertions to ensure that
+          # we don't include the trailing slashes, so skip them.
+          (route.segments.size == 1 ? route.segments : route.segments[0..-2]).each do |segment|
+            if segment.is_a?(DynamicSegment)
+              elements << segment.interpolation_chunk("args[#{idx}].to_param")
+              idx += 1
+            else
+              elements << segment.interpolation_chunk
+            end
+          end
+          %("#{elements * ''}")
+        end
+      end
+
+      # This case is mostly the same as the positional arguments case
+      # above, but it supports additional query parameters as the last
+      # argument
+      class PositionalArgumentsWithAdditionalParams < PositionalArguments
+        def guard_conditions
+          ["args.size == #{route.segment_keys.size + 1}"] +
+          UrlRewriter::RESERVED_OPTIONS.collect{ |key| "!args.last.has_key?(:#{key})" }
+        end
+
+        # This case uses almost the same code as positional arguments,
+        # but add a question mark and args.last.to_query on the end,
+        # unless the last arg is empty
+        def generation_code
+          super.insert(-2, '#{\'?\' + args.last.to_query unless args.last.empty?}')
+        end
+
+        # To avoid generating "http://localhost/?host=foo.example.com" we
+        # can't use this optimisation on routes without any segments
+        def applicable?
+          super && route.segment_keys.size > 0
+        end
+      end
+
+      OPTIMISERS = [PositionalArguments, PositionalArgumentsWithAdditionalParams]
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/routing/recognition_optimisation.rb

@@ -0,0 +1,167 @@
+module ActionController
+  module Routing
+    # BEFORE:   0.191446860631307 ms/url
+    # AFTER:    0.029847304022858 ms/url
+    # Speed up: 6.4 times
+    #
+    # Route recognition is slow due to one-by-one iterating over
+    # a whole routeset (each map.resources generates at least 14 routes)
+    # and matching weird regexps on each step.
+    #
+    # We optimize this by skipping all URI segments that 100% sure can't
+    # be matched, moving deeper in a tree of routes (where node == segment)
+    # until first possible match is accured. In such case, we start walking
+    # a flat list of routes, matching them with accurate matcher.
+    # So, first step: search a segment tree for the first relevant index.
+    # Second step: iterate routes starting with that index.
+    #
+    # How tree is walked? We can do a recursive tests, but it's smarter:
+    # We just create a tree of if-s and elsif-s matching segments.
+    #
+    # We have segments of 3 flavors:
+    # 1) nil (no segment, route finished)
+    # 2) const-dot-dynamic (like "/posts.:xml", "/preview.:size.jpg")
+    # 3) const (like "/posts", "/comments")
+    # 4) dynamic ("/:id", "file.:size.:extension")
+    #
+    # We split incoming string into segments and iterate over them.
+    # When segment is nil, we drop immediately, on a current node index.
+    # When segment is equal to some const, we step into branch.
+    # If none constants matched, we step into 'dynamic' branch (it's a last).
+    # If we can't match anything, we drop to last index on a level.
+    #
+    # Note: we maintain the original routes order, so we finish building
+    #       steps on a first dynamic segment.
+    #
+    #
+    # Example. Given the routes:
+    #   0 /posts/
+    #   1 /posts/:id
+    #   2 /posts/:id/comments
+    #   3 /posts/blah
+    #   4 /users/
+    #   5 /users/:id
+    #   6 /users/:id/profile
+    #
+    # request_uri = /users/123
+    #
+    # There will be only 4 iterations:
+    #  1) segm test for /posts prefix, skip all /posts/* routes
+    #  2) segm test for /users/
+    #  3) segm test for /users/:id
+    #     (jump to list index = 5)
+    #  4) full test for /users/:id => here we are!
+    class RouteSet
+      def recognize_path(path, environment={})
+        result = recognize_optimized(path, environment) and return result
+
+        # Route was not recognized. Try to find out why (maybe wrong verb).
+        allows = HTTP_METHODS.select { |verb| routes.find { |r| r.recognize(path, environment.merge(:method => verb)) } }
+
+        if environment[:method] && !HTTP_METHODS.include?(environment[:method])
+          raise NotImplemented.new(*allows)
+        elsif !allows.empty?
+          raise MethodNotAllowed.new(*allows)
+        else
+          raise RoutingError, "No route matches #{path.inspect} with #{environment.inspect}"
+        end
+      end
+
+      def segment_tree(routes)
+        tree = [0]
+
+        i = -1
+        routes.each do |route|
+          i += 1
+          # not fast, but runs only once
+          segments = to_plain_segments(route.segments.inject("") { |str,s| str << s.to_s })
+
+          node  = tree
+          segments.each do |seg|
+            seg = :dynamic if seg && seg[0] == ?:
+            node << [seg, [i]] if node.empty? || node[node.size - 1][0] != seg
+            node = node[node.size - 1][1]
+          end
+        end
+        tree
+      end
+
+      def generate_code(list, padding='  ', level = 0)
+        # a digit
+        return padding + "#{list[0]}\n" if list.size == 1 && !(Array === list[0])
+
+        body = padding + "(seg = segments[#{level}]; \n"
+
+        i = 0
+        was_nil = false
+        list.each do |item|
+          if Array === item
+            i += 1
+            start = (i == 1)
+            tag, sub = item
+            if tag == :dynamic
+              body += padding + "#{start ? 'if' : 'elsif'} true\n"
+              body += generate_code(sub, padding + "  ", level + 1)
+              break
+            elsif tag == nil && !was_nil
+              was_nil = true
+              body += padding + "#{start ? 'if' : 'elsif'} seg.nil?\n"
+              body += generate_code(sub, padding + "  ", level + 1)
+            else
+              body += padding + "#{start ? 'if' : 'elsif'} seg == '#{tag}'\n"
+              body += generate_code(sub, padding + "  ", level + 1)
+            end
+          end
+        end
+        body += padding + "else\n"
+        body += padding + "  #{list[0]}\n"
+        body += padding + "end)\n"
+        body
+      end
+
+      # this must be really fast
+      def to_plain_segments(str)
+        str = str.dup
+        str.sub!(/^\/+/,'')
+        str.sub!(/\/+$/,'')
+        segments = str.split(/\.[^\/]+\/+|\/+|\.[^\/]+\Z/) # cut off ".format" also
+        segments << nil
+        segments
+      end
+
+      private
+        def write_recognize_optimized!
+          tree = segment_tree(routes)
+          body = generate_code(tree)
+
+          remove_recognize_optimized!
+
+          instance_eval %{
+            def recognize_optimized(path, env)
+              segments = to_plain_segments(path)
+              index = #{body}
+              return nil unless index
+              while index < routes.size
+                result = routes[index].recognize(path, env) and return result
+                index += 1
+              end
+              nil
+            end
+          }, '(recognize_optimized)', 1
+        end
+
+        def clear_recognize_optimized!
+          remove_recognize_optimized!
+          write_recognize_optimized!
+        end
+
+        def remove_recognize_optimized!
+          if respond_to?(:recognize_optimized)
+            class << self
+              remove_method :recognize_optimized
+            end
+          end
+        end
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/routing/route.rb

@@ -0,0 +1,265 @@
+module ActionController
+  module Routing
+    class Route #:nodoc:
+      attr_accessor :segments, :requirements, :conditions, :optimise
+
+      def initialize(segments = [], requirements = {}, conditions = {})
+        @segments = segments
+        @requirements = requirements
+        @conditions = conditions
+
+        if !significant_keys.include?(:action) && !requirements[:action]
+          @requirements[:action] = "index"
+          @significant_keys << :action
+        end
+
+        # Routes cannot use the current string interpolation method
+        # if there are user-supplied <tt>:requirements</tt> as the interpolation
+        # code won't raise RoutingErrors when generating
+        has_requirements = @segments.detect { |segment| segment.respond_to?(:regexp) && segment.regexp }
+        if has_requirements || @requirements.keys.to_set != Routing::ALLOWED_REQUIREMENTS_FOR_OPTIMISATION
+          @optimise = false
+        else
+          @optimise = true
+        end
+      end
+
+      # Indicates whether the routes should be optimised with the string interpolation
+      # version of the named routes methods.
+      def optimise?
+        @optimise && ActionController::Base::optimise_named_routes
+      end
+
+      def segment_keys
+        segments.collect do |segment|
+          segment.key if segment.respond_to? :key
+        end.compact
+      end
+      
+      def required_segment_keys
+        required_segments = segments.select {|seg| (!seg.optional? && !seg.is_a?(DividerSegment)) || seg.is_a?(PathSegment) }
+        required_segments.collect { |seg| seg.key if seg.respond_to?(:key)}.compact
+      end
+
+      # Build a query string from the keys of the given hash. If +only_keys+
+      # is given (as an array), only the keys indicated will be used to build
+      # the query string. The query string will correctly build array parameter
+      # values.
+      def build_query_string(hash, only_keys = nil)
+        elements = []
+
+        (only_keys || hash.keys).each do |key|
+          if value = hash[key]
+            elements << value.to_query(key)
+          end
+        end
+
+        elements.empty? ? '' : "?#{elements.sort * '&'}"
+      end
+
+      # A route's parameter shell contains parameter values that are not in the
+      # route's path, but should be placed in the recognized hash.
+      #
+      # For example, +{:controller => 'pages', :action => 'show'} is the shell for the route:
+      #
+      #   map.connect '/page/:id', :controller => 'pages', :action => 'show', :id => /\d+/
+      #
+      def parameter_shell
+        @parameter_shell ||= {}.tap do |shell|
+          requirements.each do |key, requirement|
+            shell[key] = requirement unless requirement.is_a? Regexp
+          end
+        end
+      end
+
+      # Return an array containing all the keys that are used in this route. This
+      # includes keys that appear inside the path, and keys that have requirements
+      # placed upon them.
+      def significant_keys
+        @significant_keys ||= [].tap do |sk|
+          segments.each { |segment| sk << segment.key if segment.respond_to? :key }
+          sk.concat requirements.keys
+          sk.uniq!
+        end
+      end
+
+      # Return a hash of key/value pairs representing the keys in the route that
+      # have defaults, or which are specified by non-regexp requirements.
+      def defaults
+        @defaults ||= {}.tap do |hash|
+          segments.each do |segment|
+            next unless segment.respond_to? :default
+            hash[segment.key] = segment.default unless segment.default.nil?
+          end
+          requirements.each do |key,req|
+            next if Regexp === req || req.nil?
+            hash[key] = req
+          end
+        end
+      end
+
+      def matches_controller_and_action?(controller, action)
+        prepare_matching!
+        (@controller_requirement.nil? || @controller_requirement === controller) &&
+        (@action_requirement.nil? || @action_requirement === action)
+      end
+
+      def to_s
+        @to_s ||= begin
+          segs = segments.inject("") { |str,s| str << s.to_s }
+          "%-6s %-40s %s" % [(conditions[:method] || :any).to_s.upcase, segs, requirements.inspect]
+        end
+      end
+
+      # TODO: Route should be prepared and frozen on initialize
+      def freeze
+        unless frozen?
+          write_generation!
+          write_recognition!
+          prepare_matching!
+
+          parameter_shell
+          significant_keys
+          defaults
+          to_s
+        end
+
+        super
+      end
+
+      def generate(options, hash, expire_on = {})
+        path, hash = generate_raw(options, hash, expire_on)
+        append_query_string(path, hash, extra_keys(options))
+      end
+
+      def generate_extras(options, hash, expire_on = {})
+        path, hash = generate_raw(options, hash, expire_on)
+        [path, extra_keys(options)]
+      end
+
+      private
+        def requirement_for(key)
+          return requirements[key] if requirements.key? key
+          segments.each do |segment|
+            return segment.regexp if segment.respond_to?(:key) && segment.key == key
+          end
+          nil
+        end
+
+        # Write and compile a +generate+ method for this Route.
+        def write_generation!
+          # Build the main body of the generation
+          body = "expired = false\n#{generation_extraction}\n#{generation_structure}"
+
+          # If we have conditions that must be tested first, nest the body inside an if
+          body = "if #{generation_requirements}\n#{body}\nend" if generation_requirements
+          args = "options, hash, expire_on = {}"
+
+          # Nest the body inside of a def block, and then compile it.
+          raw_method = method_decl = "def generate_raw(#{args})\npath = begin\n#{body}\nend\n[path, hash]\nend"
+          instance_eval method_decl, "generated code (#{__FILE__}:#{__LINE__})"
+
+          # expire_on.keys == recall.keys; in other words, the keys in the expire_on hash
+          # are the same as the keys that were recalled from the previous request. Thus,
+          # we can use the expire_on.keys to determine which keys ought to be used to build
+          # the query string. (Never use keys from the recalled request when building the
+          # query string.)
+
+          raw_method
+        end
+
+        # Build several lines of code that extract values from the options hash. If any
+        # of the values are missing or rejected then a return will be executed.
+        def generation_extraction
+          segments.collect do |segment|
+            segment.extraction_code
+          end.compact * "\n"
+        end
+
+        # Produce a condition expression that will check the requirements of this route
+        # upon generation.
+        def generation_requirements
+          requirement_conditions = requirements.collect do |key, req|
+            if req.is_a? Regexp
+              value_regexp = Regexp.new "\\A#{req.to_s}\\Z"
+              "hash[:#{key}] && #{value_regexp.inspect} =~ options[:#{key}]"
+            else
+              "hash[:#{key}] == #{req.inspect}"
+            end
+          end
+          requirement_conditions * ' && ' unless requirement_conditions.empty?
+        end
+
+        def generation_structure
+          segments.last.string_structure segments[0..-2]
+        end
+
+        # Write and compile a +recognize+ method for this Route.
+        def write_recognition!
+          # Create an if structure to extract the params from a match if it occurs.
+          body = "params = parameter_shell.dup\n#{recognition_extraction * "\n"}\nparams"
+          body = "if #{recognition_conditions.join(" && ")}\n#{body}\nend"
+
+          # Build the method declaration and compile it
+          method_decl = "def recognize(path, env = {})\n#{body}\nend"
+          instance_eval method_decl, "generated code (#{__FILE__}:#{__LINE__})"
+          method_decl
+        end
+
+        # Plugins may override this method to add other conditions, like checks on
+        # host, subdomain, and so forth. Note that changes here only affect route
+        # recognition, not generation.
+        def recognition_conditions
+          result = ["(match = #{Regexp.new(recognition_pattern).inspect}.match(path))"]
+          result << "[conditions[:method]].flatten.include?(env[:method])" if conditions[:method]
+          result
+        end
+
+        # Build the regular expression pattern that will match this route.
+        def recognition_pattern(wrap = true)
+          pattern = ''
+          segments.reverse_each do |segment|
+            pattern = segment.build_pattern pattern
+          end
+          wrap ? ("\\A" + pattern + "\\Z") : pattern
+        end
+
+        # Write the code to extract the parameters from a matched route.
+        def recognition_extraction
+          next_capture = 1
+          extraction = segments.collect do |segment|
+            x = segment.match_extraction(next_capture)
+            next_capture += segment.number_of_captures
+            x
+          end
+          extraction.compact
+        end
+
+        # Generate the query string with any extra keys in the hash and append
+        # it to the given path, returning the new path.
+        def append_query_string(path, hash, query_keys = nil)
+          return nil unless path
+          query_keys ||= extra_keys(hash)
+          "#{path}#{build_query_string(hash, query_keys)}"
+        end
+
+        # Determine which keys in the given hash are "extra". Extra keys are
+        # those that were not used to generate a particular route. The extra
+        # keys also do not include those recalled from the prior request, nor
+        # do they include any keys that were implied in the route (like a
+        # <tt>:controller</tt> that is required, but not explicitly used in the
+        # text of the route.)
+        def extra_keys(hash, recall = {})
+          (hash || {}).keys.map { |k| k.to_sym } - (recall || {}).keys - significant_keys
+        end
+
+        def prepare_matching!
+          unless defined? @matching_prepared
+            @controller_requirement = requirement_for(:controller)
+            @action_requirement = requirement_for(:action)
+            @matching_prepared = true
+          end
+        end
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/routing/route_set.rb

@@ -0,0 +1,503 @@
+module ActionController
+  module Routing
+    class RouteSet #:nodoc:
+      # Mapper instances are used to build routes. The object passed to the draw
+      # block in config/routes.rb is a Mapper instance.
+      #
+      # Mapper instances have relatively few instance methods, in order to avoid
+      # clashes with named routes.
+      class Mapper #:doc:
+        include ActionController::Resources
+
+        def initialize(set) #:nodoc:
+          @set = set
+        end
+
+        # Create an unnamed route with the provided +path+ and +options+. See
+        # ActionController::Routing for an introduction to routes.
+        def connect(path, options = {})
+          @set.add_route(path, options)
+        end
+
+        # Creates a named route called "root" for matching the root level request.
+        def root(options = {})
+          if options.is_a?(Symbol)
+            if source_route = @set.named_routes.routes[options]
+              options = source_route.defaults.merge({ :conditions => source_route.conditions })
+            end
+          end
+          named_route("root", '', options)
+        end
+
+        def named_route(name, path, options = {}) #:nodoc:
+          @set.add_named_route(name, path, options)
+        end
+
+        # Enables the use of resources in a module by setting the name_prefix, path_prefix, and namespace for the model.
+        # Example:
+        #
+        #   map.namespace(:admin) do |admin|
+        #     admin.resources :products,
+        #       :has_many => [ :tags, :images, :variants ]
+        #   end
+        #
+        # This will create +admin_products_url+ pointing to "admin/products", which will look for an Admin::ProductsController.
+        # It'll also create +admin_product_tags_url+ pointing to "admin/products/#{product_id}/tags", which will look for
+        # Admin::TagsController.
+        def namespace(name, options = {}, &block)
+          if options[:namespace]
+            with_options({:path_prefix => "#{options.delete(:path_prefix)}/#{name}", :name_prefix => "#{options.delete(:name_prefix)}#{name}_", :namespace => "#{options.delete(:namespace)}#{name}/" }.merge(options), &block)
+          else
+            with_options({:path_prefix => name, :name_prefix => "#{name}_", :namespace => "#{name}/" }.merge(options), &block)
+          end
+        end
+
+        def method_missing(route_name, *args, &proc) #:nodoc:
+          super unless args.length >= 1 && proc.nil?
+          @set.add_named_route(route_name, *args)
+        end
+      end
+
+      # A NamedRouteCollection instance is a collection of named routes, and also
+      # maintains an anonymous module that can be used to install helpers for the
+      # named routes.
+      class NamedRouteCollection #:nodoc:
+        include Enumerable
+        include ActionController::Routing::Optimisation
+        attr_reader :routes, :helpers
+
+        def initialize
+          clear!
+        end
+
+        def clear!
+          @routes = {}
+          @helpers = []
+
+          @module ||= Module.new
+          @module.instance_methods.each do |selector|
+            @module.class_eval { remove_method selector }
+          end
+        end
+
+        def add(name, route)
+          routes[name.to_sym] = route
+          define_named_route_methods(name, route)
+        end
+
+        def get(name)
+          routes[name.to_sym]
+        end
+
+        alias []=   add
+        alias []    get
+        alias clear clear!
+
+        def each
+          routes.each { |name, route| yield name, route }
+          self
+        end
+
+        def names
+          routes.keys
+        end
+
+        def length
+          routes.length
+        end
+
+        def reset!
+          old_routes = routes.dup
+          clear!
+          old_routes.each do |name, route|
+            add(name, route)
+          end
+        end
+
+        def install(destinations = [ActionController::Base, ActionView::Base], regenerate = false)
+          reset! if regenerate
+          Array(destinations).each do |dest|
+            dest.__send__(:include, @module)
+          end
+        end
+
+        private
+          def url_helper_name(name, kind = :url)
+            :"#{name}_#{kind}"
+          end
+
+          def hash_access_name(name, kind = :url)
+            :"hash_for_#{name}_#{kind}"
+          end
+
+          def define_named_route_methods(name, route)
+            {:url => {:only_path => false}, :path => {:only_path => true}}.each do |kind, opts|
+              hash = route.defaults.merge(:use_route => name).merge(opts)
+              define_hash_access route, name, kind, hash
+              define_url_helper route, name, kind, hash
+            end
+          end
+
+          def named_helper_module_eval(code, *args)
+            @module.module_eval(code, *args)
+          end
+
+          def define_hash_access(route, name, kind, options)
+            selector = hash_access_name(name, kind)
+            named_helper_module_eval <<-end_eval # We use module_eval to avoid leaks
+              def #{selector}(options = nil)                                      # def hash_for_users_url(options = nil)
+                options ? #{options.inspect}.merge(options) : #{options.inspect}  #   options ? {:only_path=>false}.merge(options) : {:only_path=>false}
+              end                                                                 # end
+              protected :#{selector}                                              # protected :hash_for_users_url
+            end_eval
+            helpers << selector
+          end
+
+          def define_url_helper(route, name, kind, options)
+            selector = url_helper_name(name, kind)
+            # The segment keys used for positional paramters
+
+            hash_access_method = hash_access_name(name, kind)
+
+            # allow ordered parameters to be associated with corresponding
+            # dynamic segments, so you can do
+            #
+            #   foo_url(bar, baz, bang)
+            #
+            # instead of
+            #
+            #   foo_url(:bar => bar, :baz => baz, :bang => bang)
+            #
+            # Also allow options hash, so you can do
+            #
+            #   foo_url(bar, baz, bang, :sort_by => 'baz')
+            #
+            named_helper_module_eval <<-end_eval # We use module_eval to avoid leaks
+              def #{selector}(*args)                                                        # def users_url(*args)
+                args.compact!                                                               #
+                                                                                            #
+                #{generate_optimisation_block(route, kind)}                                 #   #{generate_optimisation_block(route, kind)}
+                                                                                            #
+                opts = if args.empty? || Hash === args.first                                #   opts = if args.empty? || Hash === args.first
+                  args.first || {}                                                          #     args.first || {}
+                else                                                                        #   else
+                  options = args.extract_options!                                           #     options = args.extract_options!
+                  args = args.zip(#{route.segment_keys.inspect}).inject({}) do |h, (v, k)|  #     args = args.zip([]).inject({}) do |h, (v, k)|
+                    h[k] = v                                                                #       h[k] = v
+                    h                                                                       #       h
+                  end                                                                       #     end
+                  options.merge(args)                                                       #     options.merge(args)
+                end                                                                         #   end
+                                                                                            #
+                url_for(#{hash_access_method}(opts))                                        #   url_for(hash_for_users_url(opts))
+                                                                                            #
+              end                                                                           # end
+              #Add an alias to support the now deprecated formatted_* URL.                  # #Add an alias to support the now deprecated formatted_* URL.
+              def formatted_#{selector}(*args)                                              # def formatted_users_url(*args)
+                ActiveSupport::Deprecation.warn(                                            #   ActiveSupport::Deprecation.warn(
+                  "formatted_#{selector}() has been deprecated. " +                         #     "formatted_users_url() has been deprecated. " +
+                  "Please pass format to the standard " +                                   #     "Please pass format to the standard " +
+                  "#{selector} method instead.", caller)                                    #     "users_url method instead.", caller)
+                #{selector}(*args)                                                          #   users_url(*args)
+              end                                                                           # end
+              protected :#{selector}                                                        # protected :users_url
+            end_eval
+            helpers << selector
+          end
+      end
+
+      attr_accessor :routes, :named_routes, :configuration_files
+
+      def initialize
+        self.configuration_files = []
+
+        self.routes = []
+        self.named_routes = NamedRouteCollection.new
+
+        clear_recognize_optimized!
+      end
+
+      # Subclasses and plugins may override this method to specify a different
+      # RouteBuilder instance, so that other route DSL's can be created.
+      def builder
+        @builder ||= RouteBuilder.new
+      end
+
+      def draw
+        yield Mapper.new(self)
+        install_helpers
+      end
+
+      def clear!
+        routes.clear
+        named_routes.clear
+        @combined_regexp = nil
+        @routes_by_controller = nil
+        # This will force routing/recognition_optimization.rb
+        # to refresh optimisations.
+        clear_recognize_optimized!
+      end
+
+      def install_helpers(destinations = [ActionController::Base, ActionView::Base], regenerate_code = false)
+        Array(destinations).each { |d| d.module_eval { include Helpers } }
+        named_routes.install(destinations, regenerate_code)
+      end
+
+      def empty?
+        routes.empty?
+      end
+
+      def add_configuration_file(path)
+        self.configuration_files << path
+      end
+
+      # Deprecated accessor
+      def configuration_file=(path)
+        add_configuration_file(path)
+      end
+      
+      # Deprecated accessor
+      def configuration_file
+        configuration_files
+      end
+
+      def load!
+        Routing.use_controllers!(nil) # Clear the controller cache so we may discover new ones
+        clear!
+        load_routes!
+      end
+
+      # reload! will always force a reload whereas load checks the timestamp first
+      alias reload! load!
+
+      def reload
+        if configuration_files.any? && @routes_last_modified
+          if routes_changed_at == @routes_last_modified
+            return # routes didn't change, don't reload
+          else
+            @routes_last_modified = routes_changed_at
+          end
+        end
+
+        load!
+      end
+
+      def load_routes!
+        if configuration_files.any?
+          configuration_files.each { |config| load(config) }
+          @routes_last_modified = routes_changed_at
+        else
+          add_route ":controller/:action/:id"
+        end
+      end
+      
+      def routes_changed_at
+        routes_changed_at = nil
+        
+        configuration_files.each do |config|
+          config_changed_at = File.stat(config).mtime
+
+          if routes_changed_at.nil? || config_changed_at > routes_changed_at
+            routes_changed_at = config_changed_at 
+          end
+        end
+        
+        routes_changed_at
+      end
+
+      def add_route(path, options = {})
+        options.each { |k, v| options[k] = v.to_s if [:controller, :action].include?(k) && v.is_a?(Symbol) }
+        route = builder.build(path, options)
+        routes << route
+        route
+      end
+
+      def add_named_route(name, path, options = {})
+        # TODO - is options EVER used?
+        name = options[:name_prefix] + name.to_s if options[:name_prefix]
+        named_routes[name.to_sym] = add_route(path, options)
+      end
+
+      def options_as_params(options)
+        # If an explicit :controller was given, always make :action explicit
+        # too, so that action expiry works as expected for things like
+        #
+        #   generate({:controller => 'content'}, {:controller => 'content', :action => 'show'})
+        #
+        # (the above is from the unit tests). In the above case, because the
+        # controller was explicitly given, but no action, the action is implied to
+        # be "index", not the recalled action of "show".
+        #
+        # great fun, eh?
+
+        options_as_params = options.clone
+        options_as_params[:action] ||= 'index' if options[:controller]
+        options_as_params[:action] = options_as_params[:action].to_s if options_as_params[:action]
+        options_as_params
+      end
+
+      def build_expiry(options, recall)
+        recall.inject({}) do |expiry, (key, recalled_value)|
+          expiry[key] = (options.key?(key) && options[key].to_param != recalled_value.to_param)
+          expiry
+        end
+      end
+
+      # Generate the path indicated by the arguments, and return an array of
+      # the keys that were not used to generate it.
+      def extra_keys(options, recall={})
+        generate_extras(options, recall).last
+      end
+
+      def generate_extras(options, recall={})
+        generate(options, recall, :generate_extras)
+      end
+
+      def generate(options, recall = {}, method=:generate)
+        named_route_name = options.delete(:use_route)
+        generate_all = options.delete(:generate_all)
+        if named_route_name
+          named_route = named_routes[named_route_name]
+          options = named_route.parameter_shell.merge(options)
+        end
+
+        options = options_as_params(options)
+        expire_on = build_expiry(options, recall)
+
+        if options[:controller]
+          options[:controller] = options[:controller].to_s
+        end
+        # if the controller has changed, make sure it changes relative to the
+        # current controller module, if any. In other words, if we're currently
+        # on admin/get, and the new controller is 'set', the new controller
+        # should really be admin/set.
+        if !named_route && expire_on[:controller] && options[:controller] && options[:controller][0] != ?/
+          old_parts = recall[:controller].split('/')
+          new_parts = options[:controller].split('/')
+          parts = old_parts[0..-(new_parts.length + 1)] + new_parts
+          options[:controller] = parts.join('/')
+        end
+
+        # drop the leading '/' on the controller name
+        options[:controller] = options[:controller][1..-1] if options[:controller] && options[:controller][0] == ?/
+        merged = recall.merge(options)
+
+        if named_route
+          path = named_route.generate(options, merged, expire_on)
+          if path.nil?
+            raise_named_route_error(options, named_route, named_route_name)
+          else
+            return path
+          end
+        else
+          merged[:action] ||= 'index'
+          options[:action] ||= 'index'
+
+          controller = merged[:controller]
+          action = merged[:action]
+
+          raise RoutingError, "Need controller and action!" unless controller && action
+
+          if generate_all
+            # Used by caching to expire all paths for a resource
+            return routes.collect do |route|
+              route.__send__(method, options, merged, expire_on)
+            end.compact
+          end
+
+          # don't use the recalled keys when determining which routes to check
+          future_routes, deprecated_routes = routes_by_controller[controller][action][options.reject {|k,v| !v}.keys.sort_by { |x| x.object_id }]
+          routes = Routing.generate_best_match ? deprecated_routes : future_routes
+
+          routes.each_with_index do |route, index|
+            results = route.__send__(method, options, merged, expire_on)
+            if results && (!results.is_a?(Array) || results.first)
+              return results
+            end
+          end
+        end
+
+        raise RoutingError, "No route matches #{options.inspect}"
+      end
+
+      # try to give a helpful error message when named route generation fails
+      def raise_named_route_error(options, named_route, named_route_name)
+        diff = named_route.requirements.diff(options)
+        unless diff.empty?
+          raise RoutingError, "#{named_route_name}_url failed to generate from #{options.inspect}, expected: #{named_route.requirements.inspect}, diff: #{named_route.requirements.diff(options).inspect}"
+        else
+          required_segments = named_route.segments.select {|seg| (!seg.optional?) && (!seg.is_a?(DividerSegment)) }
+          required_keys_or_values = required_segments.map { |seg| seg.key rescue seg.value } # we want either the key or the value from the segment
+          raise RoutingError, "#{named_route_name}_url failed to generate from #{options.inspect} - you may have ambiguous routes, or you may need to supply additional parameters for this route.  content_url has the following required parameters: #{required_keys_or_values.inspect} - are they all satisfied?"
+        end
+      end
+
+      def call(env)
+        request = Request.new(env)
+        app = Routing::Routes.recognize(request)
+        app.call(env).to_a
+      end
+
+      def recognize(request)
+        params = recognize_path(request.path, extract_request_environment(request))
+        request.path_parameters = params.with_indifferent_access
+        "#{params[:controller].to_s.camelize}Controller".constantize
+      end
+
+      def recognize_path(path, environment={})
+        raise "Not optimized! Check that routing/recognition_optimisation overrides RouteSet#recognize_path."
+      end
+
+      def routes_by_controller
+        @routes_by_controller ||= Hash.new do |controller_hash, controller|
+          controller_hash[controller] = Hash.new do |action_hash, action|
+            action_hash[action] = Hash.new do |key_hash, keys|
+              key_hash[keys] = [
+                routes_for_controller_and_action_and_keys(controller, action, keys),
+                deprecated_routes_for_controller_and_action_and_keys(controller, action, keys)
+              ]
+            end
+          end
+        end
+      end
+
+      def routes_for(options, merged, expire_on)
+        raise "Need controller and action!" unless controller && action
+        controller = merged[:controller]
+        merged = options if expire_on[:controller]
+        action = merged[:action] || 'index'
+
+        routes_by_controller[controller][action][merged.keys][1]
+      end
+
+      def routes_for_controller_and_action(controller, action)
+        ActiveSupport::Deprecation.warn "routes_for_controller_and_action() has been deprecated. Please use routes_for()"
+        selected = routes.select do |route|
+          route.matches_controller_and_action? controller, action
+        end
+        (selected.length == routes.length) ? routes : selected
+      end
+
+      def routes_for_controller_and_action_and_keys(controller, action, keys)
+        routes.select do |route|
+          route.matches_controller_and_action? controller, action
+        end
+      end
+
+      def deprecated_routes_for_controller_and_action_and_keys(controller, action, keys)
+        selected = routes.select do |route|
+          route.matches_controller_and_action? controller, action
+        end
+        selected.sort_by do |route|
+          (keys - route.significant_keys).length
+        end
+      end
+
+      # Subclasses and plugins may override this method to extract further attributes
+      # from the request, for use by route conditions and such.
+      def extract_request_environment(request)
+        { :method => request.method }
+      end
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/routing/routing_ext.rb

@@ -0,0 +1,49 @@
+class Object
+  def to_param
+    to_s
+  end
+end
+
+class TrueClass
+  def to_param
+    self
+  end
+end
+
+class FalseClass
+  def to_param
+    self
+  end
+end
+
+class NilClass
+  def to_param
+    self
+  end
+end
+
+class Regexp #:nodoc:
+  def number_of_captures
+    Regexp.new("|#{source}").match('').captures.length
+  end
+
+  def multiline?
+    options & MULTILINE == MULTILINE
+  end
+
+  class << self
+    def optionalize(pattern)
+      case unoptionalize(pattern)
+        when /\A(.|\(.*\))\Z/ then "#{pattern}?"
+        else "(?:#{pattern})?"
+      end
+    end
+
+    def unoptionalize(pattern)
+      [/\A\(\?:(.*)\)\?\Z/, /\A(.|\(.*\))\?\Z/].each do |regexp|
+        return $1 if regexp =~ pattern
+      end
+      return pattern
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/routing/segments.rb

@@ -0,0 +1,343 @@
+module ActionController
+  module Routing
+    class Segment #:nodoc:
+      RESERVED_PCHAR = ':@&=+$,;'
+      SAFE_PCHAR = "#{URI::REGEXP::PATTERN::UNRESERVED}#{RESERVED_PCHAR}"
+      if RUBY_VERSION >= '1.9'
+        UNSAFE_PCHAR = Regexp.new("[^#{SAFE_PCHAR}]", false).freeze
+      else
+        UNSAFE_PCHAR = Regexp.new("[^#{SAFE_PCHAR}]", false, 'N').freeze
+      end
+
+      # TODO: Convert :is_optional accessor to read only
+      attr_accessor :is_optional
+      alias_method :optional?, :is_optional
+
+      def initialize
+        @is_optional = false
+      end
+
+      def number_of_captures
+        Regexp.new(regexp_chunk).number_of_captures
+      end
+
+      def extraction_code
+        nil
+      end
+
+      # Continue generating string for the prior segments.
+      def continue_string_structure(prior_segments)
+        if prior_segments.empty?
+          interpolation_statement(prior_segments)
+        else
+          new_priors = prior_segments[0..-2]
+          prior_segments.last.string_structure(new_priors)
+        end
+      end
+
+      def interpolation_chunk
+        URI.escape(value, UNSAFE_PCHAR)
+      end
+
+      # Return a string interpolation statement for this segment and those before it.
+      def interpolation_statement(prior_segments)
+        chunks = prior_segments.collect { |s| s.interpolation_chunk }
+        chunks << interpolation_chunk
+        "\"#{chunks * ''}\"#{all_optionals_available_condition(prior_segments)}"
+      end
+
+      def string_structure(prior_segments)
+        optional? ? continue_string_structure(prior_segments) : interpolation_statement(prior_segments)
+      end
+
+      # Return an if condition that is true if all the prior segments can be generated.
+      # If there are no optional segments before this one, then nil is returned.
+      def all_optionals_available_condition(prior_segments)
+        optional_locals = prior_segments.collect { |s| s.local_name if s.optional? && s.respond_to?(:local_name) }.compact
+        optional_locals.empty? ? nil : " if #{optional_locals * ' && '}"
+      end
+
+      # Recognition
+
+      def match_extraction(next_capture)
+        nil
+      end
+
+      # Warning
+
+      # Returns true if this segment is optional? because of a default. If so, then
+      # no warning will be emitted regarding this segment.
+      def optionality_implied?
+        false
+      end
+    end
+
+    class StaticSegment < Segment #:nodoc:
+      attr_reader :value, :raw
+      alias_method :raw?, :raw
+
+      def initialize(value = nil, options = {})
+        super()
+        @value = value
+        @raw = options[:raw] if options.key?(:raw)
+        @is_optional = options[:optional] if options.key?(:optional)
+      end
+
+      def interpolation_chunk
+        raw? ? value : super
+      end
+
+      def regexp_chunk
+        chunk = Regexp.escape(value)
+        optional? ? Regexp.optionalize(chunk) : chunk
+      end
+
+      def number_of_captures
+        0
+      end
+
+      def build_pattern(pattern)
+        escaped = Regexp.escape(value)
+        if optional? && ! pattern.empty?
+          "(?:#{Regexp.optionalize escaped}\\Z|#{escaped}#{Regexp.unoptionalize pattern})"
+        elsif optional?
+          Regexp.optionalize escaped
+        else
+          escaped + pattern
+        end
+      end
+
+      def to_s
+        value
+      end
+    end
+
+    class DividerSegment < StaticSegment #:nodoc:
+      def initialize(value = nil, options = {})
+        super(value, {:raw => true, :optional => true}.merge(options))
+      end
+
+      def optionality_implied?
+        true
+      end
+    end
+
+    class DynamicSegment < Segment #:nodoc:
+      attr_reader :key
+
+      # TODO: Convert these accessors to read only
+      attr_accessor :default, :regexp
+
+      def initialize(key = nil, options = {})
+        super()
+        @key = key
+        @default = options[:default] if options.key?(:default)
+        @regexp = options[:regexp] if options.key?(:regexp)
+        @is_optional = true if options[:optional] || options.key?(:default)
+      end
+
+      def to_s
+        ":#{key}"
+      end
+
+      # The local variable name that the value of this segment will be extracted to.
+      def local_name
+        "#{key}_value"
+      end
+
+      def extract_value
+        "#{local_name} = hash[:#{key}] && hash[:#{key}].to_param #{"|| #{default.inspect}" if default}"
+      end
+
+      def value_check
+        if default # Then we know it won't be nil
+          "#{value_regexp.inspect} =~ #{local_name}" if regexp
+        elsif optional?
+          # If we have a regexp check that the value is not given, or that it matches.
+          # If we have no regexp, return nil since we do not require a condition.
+          "#{local_name}.nil? || #{value_regexp.inspect} =~ #{local_name}" if regexp
+        else # Then it must be present, and if we have a regexp, it must match too.
+          "#{local_name} #{"&& #{value_regexp.inspect} =~ #{local_name}" if regexp}"
+        end
+      end
+
+      def expiry_statement
+        "expired, hash = true, options if !expired && expire_on[:#{key}]"
+      end
+
+      def extraction_code
+        s = extract_value
+        vc = value_check
+        s << "\nreturn [nil,nil] unless #{vc}" if vc
+        s << "\n#{expiry_statement}"
+      end
+
+      def interpolation_chunk(value_code = local_name)
+        "\#{URI.escape(#{value_code}.to_s, ActionController::Routing::Segment::UNSAFE_PCHAR)}"
+      end
+
+      def string_structure(prior_segments)
+        if optional? # We have a conditional to do...
+          # If we should not appear in the url, just write the code for the prior
+          # segments. This occurs if our value is the default value, or, if we are
+          # optional, if we have nil as our value.
+          "if #{local_name} == #{default.inspect}\n" +
+            continue_string_structure(prior_segments) +
+          "\nelse\n" + # Otherwise, write the code up to here
+            "#{interpolation_statement(prior_segments)}\nend"
+        else
+          interpolation_statement(prior_segments)
+        end
+      end
+
+      def value_regexp
+        Regexp.new "\\A#{regexp.to_s}\\Z" if regexp
+      end
+
+      def regexp_chunk
+        regexp ? regexp_string : default_regexp_chunk
+      end
+
+      def regexp_string
+        regexp_has_modifiers? ? "(#{regexp.to_s})" : "(#{regexp.source})"
+      end
+
+      def default_regexp_chunk
+        "([^#{Routing::SEPARATORS.join}]+)"
+      end
+
+      def number_of_captures
+        regexp ? regexp.number_of_captures + 1 : 1
+      end
+
+      def build_pattern(pattern)
+        pattern = "#{regexp_chunk}#{pattern}"
+        optional? ? Regexp.optionalize(pattern) : pattern
+      end
+
+      def match_extraction(next_capture)
+        # All non code-related keys (such as :id, :slug) are URI-unescaped as
+        # path parameters.
+        default_value = default ? default.inspect : nil
+        %[
+          value = if (m = match[#{next_capture}])
+            URI.unescape(m)
+          else
+            #{default_value}
+          end
+          params[:#{key}] = value if value
+        ]
+      end
+
+      def optionality_implied?
+        [:action, :id].include? key
+      end
+
+      def regexp_has_modifiers?
+        regexp.options & (Regexp::IGNORECASE | Regexp::EXTENDED) != 0
+      end
+    end
+
+    class ControllerSegment < DynamicSegment #:nodoc:
+      def regexp_chunk
+        possible_names = Routing.possible_controllers.collect { |name| Regexp.escape name }
+        "(?i-:(#{(regexp || Regexp.union(*possible_names)).source}))"
+      end
+
+      # Don't URI.escape the controller name since it may contain slashes.
+      def interpolation_chunk(value_code = local_name)
+        "\#{#{value_code}.to_s}"
+      end
+
+      # Make sure controller names like Admin/Content are correctly normalized to
+      # admin/content
+      def extract_value
+        "#{local_name} = (hash[:#{key}] #{"|| #{default.inspect}" if default}).downcase"
+      end
+
+      def match_extraction(next_capture)
+        if default
+          "params[:#{key}] = match[#{next_capture}] ? match[#{next_capture}].downcase : '#{default}'"
+        else
+          "params[:#{key}] = match[#{next_capture}].downcase if match[#{next_capture}]"
+        end
+      end
+    end
+
+    class PathSegment < DynamicSegment #:nodoc:
+      def interpolation_chunk(value_code = local_name)
+        "\#{#{value_code}}"
+      end
+
+      def extract_value
+        "#{local_name} = hash[:#{key}] && Array(hash[:#{key}]).collect { |path_component| URI.escape(path_component.to_param, ActionController::Routing::Segment::UNSAFE_PCHAR) }.to_param #{"|| #{default.inspect}" if default}"
+      end
+
+      def default
+        ''
+      end
+
+      def default=(path)
+        raise RoutingError, "paths cannot have non-empty default values" unless path.blank?
+      end
+
+      def match_extraction(next_capture)
+        "params[:#{key}] = PathSegment::Result.new_escaped((match[#{next_capture}]#{" || " + default.inspect if default}).split('/'))#{" if match[" + next_capture + "]" if !default}"
+      end
+
+      def default_regexp_chunk
+        "(.*)"
+      end
+
+      def number_of_captures
+        regexp ? regexp.number_of_captures : 1
+      end
+
+      def optionality_implied?
+        true
+      end
+
+      class Result < ::Array #:nodoc:
+        def to_s() join '/' end
+        def self.new_escaped(strings)
+          new strings.collect {|str| URI.unescape str}
+        end
+      end
+    end
+    
+    # The OptionalFormatSegment allows for any resource route to have an optional
+    # :format, which decreases the amount of routes created by 50%.
+    class OptionalFormatSegment < DynamicSegment
+    
+      def initialize(key = nil, options = {})
+        super(:format, {:optional => true}.merge(options))            
+      end
+    
+      def interpolation_chunk
+        "." + super
+      end
+    
+      def regexp_chunk
+        '/|(\.[^/?\.]+)?'
+      end
+    
+      def to_s
+        '(.:format)?'
+      end
+
+      def extract_value
+        "#{local_name} = options[:#{key}] && options[:#{key}].to_s.downcase"
+      end
+
+      #the value should not include the period (.)
+      def match_extraction(next_capture)
+        %[
+          if (m = match[#{next_capture}])
+            params[:#{key}] = URI.unescape(m.from(1))
+          end
+        ]
+      end
+    end
+    
+  end
+end

vendor/rails/actionpack/lib/action_controller/session/abstract_store.rb

@@ -0,0 +1,283 @@
+require 'rack/utils'
+
+module ActionController
+  module Session
+    class AbstractStore  
+      ENV_SESSION_KEY = 'rack.session'.freeze
+      ENV_SESSION_OPTIONS_KEY = 'rack.session.options'.freeze
+
+      HTTP_COOKIE = 'HTTP_COOKIE'.freeze
+      SET_COOKIE = 'Set-Cookie'.freeze
+
+      # thin wrapper around Hash that allows us to lazily
+      # load session id into session_options
+      class OptionsHash < Hash
+        def initialize(by, env, default_options)
+          @by = by
+          @env = env
+          @session_id_loaded = false
+          merge!(default_options)
+        end
+
+        def [](key)
+          if key == :id
+            load_session_id! unless super(:id) || has_session_id?
+          end
+          super(key)
+        end
+
+        private
+
+          def has_session_id?
+            @session_id_loaded
+          end
+
+          def load_session_id!
+            self[:id] = @by.send(:extract_session_id, @env)
+            @session_id_loaded = true
+          end
+      end
+
+      class SessionHash < Hash
+        def initialize(by, env)
+          super()
+          @by = by
+          @env = env
+          @loaded = false
+        end
+
+        def session_id
+          ActiveSupport::Deprecation.warn(
+            "ActionController::Session::AbstractStore::SessionHash#session_id " +
+            "has been deprecated. Please use request.session_options[:id] instead.", caller)
+          @env[ENV_SESSION_OPTIONS_KEY][:id]
+        end
+
+        def [](key)
+          load_for_read!
+          super
+        end
+
+        def has_key?(key)
+          load_for_read!
+          super
+        end
+
+        def []=(key, value)
+          load_for_write!
+          super
+        end
+
+        def clear
+          load_for_write!
+          super
+        end
+
+        def to_hash
+          load_for_read!
+          h = {}.replace(self)
+          h.delete_if { |k,v| v.nil? }
+          h
+        end
+
+        def update(hash)
+          load_for_write!
+          super
+        end
+
+        def delete(key)
+          load_for_write!
+          super
+        end
+
+        def data
+         ActiveSupport::Deprecation.warn(
+           "ActionController::Session::AbstractStore::SessionHash#data " +
+           "has been deprecated. Please use #to_hash instead.", caller)
+          to_hash
+        end
+
+        def inspect
+          load_for_read!
+          super
+        end
+
+        def exists?
+          return @exists if instance_variable_defined?(:@exists)
+          @exists = @by.send(:exists?, @env)
+        end
+
+        def loaded?
+          @loaded
+        end
+
+        def destroy
+          clear
+          @by.send(:destroy, @env) if @by
+          @env[ENV_SESSION_OPTIONS_KEY][:id] = nil if @env && @env[ENV_SESSION_OPTIONS_KEY]
+          @loaded = false
+        end
+
+        private
+          
+          def load_for_read!
+            load! if !loaded? && exists?
+          end
+
+          def load_for_write!
+            load! unless loaded?
+          end
+
+          def load!
+            id, session = @by.send(:load_session, @env)
+            @env[ENV_SESSION_OPTIONS_KEY][:id] = id
+            replace(session)
+            @loaded = true
+          end
+
+      end
+
+      DEFAULT_OPTIONS = {
+        :key =>           '_session_id',
+        :path =>          '/',
+        :domain =>        nil,
+        :expire_after =>  nil,
+        :secure =>        false,
+        :httponly =>      true,
+        :cookie_only =>   true
+      }
+
+      def initialize(app, options = {})
+        # Process legacy CGI options
+        options = options.symbolize_keys
+        if options.has_key?(:session_path)
+          ActiveSupport::Deprecation.warn "Giving :session_path to SessionStore is deprecated, " <<
+            "please use :path instead", caller
+          options[:path] = options.delete(:session_path)
+        end
+        if options.has_key?(:session_key)
+          ActiveSupport::Deprecation.warn "Giving :session_key to SessionStore is deprecated, " <<
+            "please use :key instead", caller
+          options[:key] = options.delete(:session_key)
+        end
+        if options.has_key?(:session_http_only)
+          ActiveSupport::Deprecation.warn "Giving :session_http_only to SessionStore is deprecated, " <<
+            "please use :httponly instead", caller
+          options[:httponly] = options.delete(:session_http_only)
+        end
+
+        @app = app
+        @default_options = DEFAULT_OPTIONS.merge(options)
+        @key = @default_options[:key]
+        @cookie_only = @default_options[:cookie_only]
+      end
+
+      def call(env)
+        prepare!(env)
+        response = @app.call(env)
+
+        session_data = env[ENV_SESSION_KEY]
+        options = env[ENV_SESSION_OPTIONS_KEY]
+
+        if !session_data.is_a?(AbstractStore::SessionHash) || session_data.loaded? || options[:expire_after]
+          session_data.send(:load!) if session_data.is_a?(AbstractStore::SessionHash) && !session_data.loaded?
+
+          sid = options[:id] || generate_sid
+
+          unless set_session(env, sid, session_data.to_hash)
+            return response
+          end
+
+          if (env["rack.request.cookie_hash"] && env["rack.request.cookie_hash"][@key] != sid) || options[:expire_after]
+            cookie = Rack::Utils.escape(@key) + '=' + Rack::Utils.escape(sid)
+            cookie << "; domain=#{options[:domain]}" if options[:domain]
+            cookie << "; path=#{options[:path]}" if options[:path]
+            if options[:expire_after]
+              expiry = Time.now + options[:expire_after]
+              cookie << "; expires=#{expiry.httpdate}"
+            end
+            cookie << "; Secure" if options[:secure]
+            cookie << "; HttpOnly" if options[:httponly]
+
+            headers = response[1]
+            unless headers[SET_COOKIE].blank?
+              headers[SET_COOKIE] << "\n#{cookie}"
+            else
+              headers[SET_COOKIE] = cookie
+            end
+          end
+        end
+
+        response
+      end
+
+      private
+      
+        def prepare!(env)
+          env[ENV_SESSION_KEY] = SessionHash.new(self, env)
+          env[ENV_SESSION_OPTIONS_KEY] = OptionsHash.new(self, env, @default_options)
+        end
+      
+        def generate_sid
+          ActiveSupport::SecureRandom.hex(16)
+        end
+
+        def load_session(env)
+          stale_session_check! do
+            sid = current_session_id(env)
+            sid, session = get_session(env, sid)
+            [sid, session]
+          end
+        end
+        
+        def extract_session_id(env)
+          stale_session_check! do
+            request = Rack::Request.new(env)
+            sid = request.cookies[@key]
+            sid ||= request.params[@key] unless @cookie_only
+            sid
+          end
+        end
+
+        def current_session_id(env)
+          env[ENV_SESSION_OPTIONS_KEY][:id]
+        end
+        
+        def exists?(env)
+          current_session_id(env).present?
+        end
+
+        def get_session(env, sid)
+          raise '#get_session needs to be implemented.'
+        end
+
+        def set_session(env, sid, session_data)
+          raise '#set_session needs to be implemented.'
+        end
+        
+        def destroy(env)
+          raise '#destroy needs to be implemented.'
+        end
+        
+        module SessionUtils
+          private
+          def stale_session_check!
+            yield
+          rescue ArgumentError => argument_error
+            if argument_error.message =~ %r{undefined class/module ([\w:]*\w)}
+              begin
+                # Note that the regexp does not allow $1 to end with a ':'
+                $1.constantize
+              rescue LoadError, NameError => const_error
+                raise ActionController::SessionRestoreError, "Session contains objects whose class definition isn\\'t available.\nRemember to require the classes for all objects kept in the session.\n(Original exception: \#{const_error.message} [\#{const_error.class}])\n"
+              end
+              retry
+            else
+              raise
+            end
+          end
+        end
+        include SessionUtils
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/session/cookie_store.rb

@@ -0,0 +1,262 @@
+module ActionController
+  module Session
+    # This cookie-based session store is the Rails default. Sessions typically
+    # contain at most a user_id and flash message; both fit within the 4K cookie
+    # size limit. Cookie-based sessions are dramatically faster than the
+    # alternatives.
+    #
+    # If you have more than 4K of session data or don't want your data to be
+    # visible to the user, pick another session store.
+    #
+    # CookieOverflow is raised if you attempt to store more than 4K of data.
+    #
+    # A message digest is included with the cookie to ensure data integrity:
+    # a user cannot alter his +user_id+ without knowing the secret key
+    # included in the hash. New apps are generated with a pregenerated secret
+    # in config/environment.rb. Set your own for old apps you're upgrading.
+    #
+    # Session options:
+    #
+    # * <tt>:secret</tt>: An application-wide key string or block returning a
+    #   string called per generated digest. The block is called with the
+    #   CGI::Session instance as an argument. It's important that the secret
+    #   is not vulnerable to a dictionary attack. Therefore, you should choose
+    #   a secret consisting of random numbers and letters and more than 30
+    #   characters. Examples:
+    #
+    #     :secret => '449fe2e7daee471bffae2fd8dc02313d'
+    #     :secret => Proc.new { User.current_user.secret_key }
+    #
+    # * <tt>:digest</tt>: The message digest algorithm used to verify session
+    #   integrity defaults to 'SHA1' but may be any digest provided by OpenSSL,
+    #   such as 'MD5', 'RIPEMD160', 'SHA256', etc.
+    #
+    # To generate a secret key for an existing application, run
+    # "rake secret" and set the key in config/environment.rb.
+    #
+    # Note that changing digest or secret invalidates all existing sessions!
+    class CookieStore
+      include AbstractStore::SessionUtils
+      
+      # Cookies can typically store 4096 bytes.
+      MAX = 4096
+      SECRET_MIN_LENGTH = 30 # characters
+
+      DEFAULT_OPTIONS = {
+        :key          => '_session_id',
+        :domain       => nil,
+        :path         => "/",
+        :expire_after => nil,
+        :httponly     => true
+      }.freeze
+
+      ENV_SESSION_KEY = "rack.session".freeze
+      ENV_SESSION_OPTIONS_KEY = "rack.session.options".freeze
+      HTTP_SET_COOKIE = "Set-Cookie".freeze
+
+      # Raised when storing more than 4K of session data.
+      class CookieOverflow < StandardError; end
+
+      def initialize(app, options = {})
+        # Process legacy CGI options
+        options = options.symbolize_keys
+        if options.has_key?(:session_path)
+          ActiveSupport::Deprecation.warn "Giving :session_path to SessionStore is deprecated, " <<
+            "please use :path instead", caller
+          options[:path] = options.delete(:session_path)
+        end
+        if options.has_key?(:session_key)
+          ActiveSupport::Deprecation.warn "Giving :session_key to SessionStore is deprecated, " <<
+            "please use :key instead", caller
+          options[:key] = options.delete(:session_key)
+        end
+        if options.has_key?(:session_http_only)
+          ActiveSupport::Deprecation.warn "Giving :session_http_only to SessionStore is deprecated, " <<
+            "please use :httponly instead", caller
+          options[:httponly] = options.delete(:session_http_only)
+        end
+
+        @app = app
+
+        # The session_key option is required.
+        ensure_session_key(options[:key])
+        @key = options.delete(:key).freeze
+
+        # The secret option is required.
+        ensure_secret_secure(options[:secret])
+        @secret = options.delete(:secret).freeze
+
+        @digest = options.delete(:digest) || 'SHA1'
+        @verifier = verifier_for(@secret, @digest)
+
+        @default_options = DEFAULT_OPTIONS.merge(options).freeze
+
+        freeze
+      end
+
+      def call(env)
+        prepare!(env)
+        
+        status, headers, body = @app.call(env)
+
+        session_data = env[ENV_SESSION_KEY]
+        options = env[ENV_SESSION_OPTIONS_KEY]
+
+        if !session_data.is_a?(AbstractStore::SessionHash) || session_data.loaded? || options[:expire_after]
+          session_data.send(:load!) if session_data.is_a?(AbstractStore::SessionHash) && !session_data.loaded?
+
+          persistent_session_id!(session_data)
+          session_data = marshal(session_data.to_hash)
+
+          raise CookieOverflow if session_data.size > MAX
+          cookie = Hash.new
+          cookie[:value] = session_data
+          unless options[:expire_after].nil?
+            cookie[:expires] = Time.now + options[:expire_after]
+          end
+
+          cookie = build_cookie(@key, cookie.merge(options))
+          headers[HTTP_SET_COOKIE] = [] if headers[HTTP_SET_COOKIE].blank?
+          headers[HTTP_SET_COOKIE] << cookie
+        end
+
+        [status, headers, body]
+      end
+
+      private
+      
+        def prepare!(env)
+          env[ENV_SESSION_KEY] = AbstractStore::SessionHash.new(self, env)
+          env[ENV_SESSION_OPTIONS_KEY] = AbstractStore::OptionsHash.new(self, env, @default_options)
+        end
+      
+        # Should be in Rack::Utils soon
+        def build_cookie(key, value)
+          case value
+          when Hash
+            domain  = "; domain="  + value[:domain] if value[:domain]
+            path    = "; path="    + value[:path]   if value[:path]
+            # According to RFC 2109, we need dashes here.
+            # N.B.: cgi.rb uses spaces...
+            expires = "; expires=" + value[:expires].clone.gmtime.
+              strftime("%a, %d-%b-%Y %H:%M:%S GMT") if value[:expires]
+            secure = "; secure" if value[:secure]
+            httponly = "; HttpOnly" if value[:httponly]
+            value = value[:value]
+          end
+          value = [value] unless Array === value
+          cookie = Rack::Utils.escape(key) + "=" +
+            value.map { |v| Rack::Utils.escape(v) }.join("&") +
+            "#{domain}#{path}#{expires}#{secure}#{httponly}"
+        end
+
+        def load_session(env)
+          data = unpacked_cookie_data(env)
+          data = persistent_session_id!(data)
+          [data[:session_id], data]
+        end
+        
+        def extract_session_id(env)
+          if data = unpacked_cookie_data(env)
+            persistent_session_id!(data) unless data.empty?
+            data[:session_id]
+          else
+            nil
+          end
+        end
+
+        def current_session_id(env)
+          env[ENV_SESSION_OPTIONS_KEY][:id]
+        end
+
+        def exists?(env)
+          current_session_id(env).present?
+        end
+
+        def unpacked_cookie_data(env)
+          env["action_dispatch.request.unsigned_session_cookie"] ||= begin
+            stale_session_check! do
+              request = Rack::Request.new(env)
+              session_data = request.cookies[@key]
+              unmarshal(session_data) || {}
+            end
+          end
+        end
+
+        # Marshal a session hash into safe cookie data. Include an integrity hash.
+        def marshal(session)
+          @verifier.generate(session)
+        end
+
+        # Unmarshal cookie data to a hash and verify its integrity.
+        def unmarshal(cookie)
+          @verifier.verify(cookie) if cookie
+        rescue ActiveSupport::MessageVerifier::InvalidSignature
+          nil
+        end
+
+        def ensure_session_key(key)
+          if key.blank?
+            raise ArgumentError, 'A key is required to write a ' +
+              'cookie containing the session data. Use ' +
+              'config.action_controller.session = { :key => ' +
+              '"_myapp_session", :secret => "some secret phrase" } in ' +
+              'config/environment.rb'
+          end
+        end
+
+        # To prevent users from using something insecure like "Password" we make sure that the
+        # secret they've provided is at least 30 characters in length.
+        def ensure_secret_secure(secret)
+          # There's no way we can do this check if they've provided a proc for the
+          # secret.
+          return true if secret.is_a?(Proc)
+
+          if secret.blank?
+            raise ArgumentError, "A secret is required to generate an " +
+              "integrity hash for cookie session data. Use " +
+              "config.action_controller.session = { :key => " +
+              "\"_myapp_session\", :secret => \"some secret phrase of at " +
+              "least #{SECRET_MIN_LENGTH} characters\" } " +
+              "in config/environment.rb"
+          end
+
+          if secret.length < SECRET_MIN_LENGTH
+            raise ArgumentError, "Secret should be something secure, " +
+              "like \"#{ActiveSupport::SecureRandom.hex(16)}\".  The value you " +
+              "provided, \"#{secret}\", is shorter than the minimum length " +
+              "of #{SECRET_MIN_LENGTH} characters"
+          end
+        end
+
+        def verifier_for(secret, digest)
+          key = secret.respond_to?(:call) ? secret.call : secret
+          ActiveSupport::MessageVerifier.new(key, digest)
+        end
+
+        def generate_sid
+          ActiveSupport::SecureRandom.hex(16)
+        end
+
+        def destroy(env)
+          # session data is stored on client; nothing to do here
+        end
+
+        def persistent_session_id!(data)
+          (data ||= {}).merge!(inject_persistent_session_id(data))
+        end
+
+        def inject_persistent_session_id(data)
+          requires_session_id?(data) ? { :session_id => generate_sid } : {}
+        end
+
+        def requires_session_id?(data)
+          if data
+            data.respond_to?(:key?) && !data.key?(:session_id)
+          else
+            true
+          end
+        end
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/session/mem_cache_store.rb

@@ -0,0 +1,60 @@
+begin
+  require_library_or_gem 'memcache'
+
+  module ActionController
+    module Session
+      class MemCacheStore < AbstractStore
+        def initialize(app, options = {})
+          # Support old :expires option
+          options[:expire_after] ||= options[:expires]
+
+          super
+
+          @default_options = {
+            :namespace => 'rack:session',
+            :memcache_server => 'localhost:11211'
+          }.merge(@default_options)
+
+          @pool = options[:cache] || MemCache.new(@default_options[:memcache_server], @default_options)
+          unless @pool.servers.any? { |s| s.alive? }
+            raise "#{self} unable to find server during initialization."
+          end
+          @mutex = Mutex.new
+
+          super
+        end
+
+        private
+          def get_session(env, sid)
+            sid ||= generate_sid
+            begin
+              session = @pool.get(sid) || {}
+            rescue MemCache::MemCacheError, Errno::ECONNREFUSED
+              session = {}
+            end
+            [sid, session]
+          end
+
+          def set_session(env, sid, session_data)
+            options = env['rack.session.options']
+            expiry  = options[:expire_after] || 0
+            @pool.set(sid, session_data, expiry)
+            return true
+          rescue MemCache::MemCacheError, Errno::ECONNREFUSED
+            return false
+          end
+          
+          def destroy(env)
+            if sid = current_session_id(env)
+              @pool.delete(sid)
+            end
+          rescue MemCache::MemCacheError, Errno::ECONNREFUSED
+            false
+          end
+          
+      end
+    end
+  end
+rescue LoadError
+  # MemCache wasn't available so neither can the store be
+end

vendor/rails/actionpack/lib/action_controller/session_management.rb

@@ -0,0 +1,54 @@
+module ActionController #:nodoc:
+  module SessionManagement #:nodoc:
+    def self.included(base)
+      base.class_eval do
+        extend ClassMethods
+      end
+    end
+
+    module ClassMethods
+      # Set the session store to be used for keeping the session data between requests.
+      # By default, sessions are stored in browser cookies (<tt>:cookie_store</tt>),
+      # but you can also specify one of the other included stores (<tt>:active_record_store</tt>,
+      # <tt>:mem_cache_store</tt>, or your own custom class.
+      def session_store=(store)
+        if store == :active_record_store
+          self.session_store = ActiveRecord::SessionStore
+        else
+          @@session_store = store.is_a?(Symbol) ?
+            Session.const_get(store.to_s.camelize) :
+            store
+        end
+      end
+
+      # Returns the session store class currently used.
+      def session_store
+        if defined? @@session_store
+          @@session_store
+        else
+          Session::CookieStore
+        end
+      end
+
+      def session=(options = {})
+        self.session_store = nil if options.delete(:disabled)
+        session_options.merge!(options)
+      end
+
+      # Returns the hash used to configure the session. Example use:
+      #
+      #   ActionController::Base.session_options[:secure] = true # session only available over HTTPS
+      def session_options
+        @session_options ||= {}
+      end
+
+      def session(*args)
+        ActiveSupport::Deprecation.warn(
+          "Disabling sessions for a single controller has been deprecated. " +
+          "Sessions are now lazy loaded. So if you don't access them, " +
+          "consider them off. You can still modify the session cookie " +
+          "options with request.session_options.", caller)
+      end
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/status_codes.rb

@@ -0,0 +1,88 @@
+module ActionController
+  module StatusCodes #:nodoc:
+    # Defines the standard HTTP status codes, by integer, with their
+    # corresponding default message texts.
+    # Source: http://www.iana.org/assignments/http-status-codes
+    STATUS_CODES = {
+      100 => "Continue",
+      101 => "Switching Protocols",
+      102 => "Processing",
+
+      200 => "OK",
+      201 => "Created",
+      202 => "Accepted",
+      203 => "Non-Authoritative Information",
+      204 => "No Content",
+      205 => "Reset Content",
+      206 => "Partial Content",
+      207 => "Multi-Status",
+      226 => "IM Used",
+
+      300 => "Multiple Choices",
+      301 => "Moved Permanently",
+      302 => "Found",
+      303 => "See Other",
+      304 => "Not Modified",
+      305 => "Use Proxy",
+      307 => "Temporary Redirect",
+
+      400 => "Bad Request",
+      401 => "Unauthorized",
+      402 => "Payment Required",
+      403 => "Forbidden",
+      404 => "Not Found",
+      405 => "Method Not Allowed",
+      406 => "Not Acceptable",
+      407 => "Proxy Authentication Required",
+      408 => "Request Timeout",
+      409 => "Conflict",
+      410 => "Gone",
+      411 => "Length Required",
+      412 => "Precondition Failed",
+      413 => "Request Entity Too Large",
+      414 => "Request-URI Too Long",
+      415 => "Unsupported Media Type",
+      416 => "Requested Range Not Satisfiable",
+      417 => "Expectation Failed",
+      422 => "Unprocessable Entity",
+      423 => "Locked",
+      424 => "Failed Dependency",
+      426 => "Upgrade Required",
+
+      500 => "Internal Server Error",
+      501 => "Not Implemented",
+      502 => "Bad Gateway",
+      503 => "Service Unavailable",
+      504 => "Gateway Timeout",
+      505 => "HTTP Version Not Supported",
+      507 => "Insufficient Storage",
+      510 => "Not Extended"
+    }
+
+    # Provides a symbol-to-fixnum lookup for converting a symbol (like
+    # :created or :not_implemented) into its corresponding HTTP status
+    # code (like 200 or 501).
+    SYMBOL_TO_STATUS_CODE = STATUS_CODES.inject({}) do |hash, (code, message)|
+      hash[message.gsub(/ /, "").underscore.to_sym] = code
+      hash
+    end
+
+    # Given a status parameter, determine whether it needs to be converted
+    # to a string. If it is a fixnum, use the STATUS_CODES hash to lookup
+    # the default message. If it is a symbol, use the SYMBOL_TO_STATUS_CODE
+    # hash to convert it.
+    def interpret_status(status)
+      case status
+      when Fixnum then
+        "#{status} #{STATUS_CODES[status]}".strip
+      when Symbol then
+        interpret_status(SYMBOL_TO_STATUS_CODE[status] ||
+          "500 Unknown Status #{status.inspect}")
+      else
+        status.to_s
+      end
+    end
+    private :interpret_status
+
+  end
+end

vendor/rails/actionpack/lib/action_controller/streaming.rb

@@ -0,0 +1,181 @@
+require 'active_support/core_ext/string/bytesize'
+
+module ActionController #:nodoc:
+  # Methods for sending arbitrary data and for streaming files to the browser,
+  # instead of rendering.
+  module Streaming
+    DEFAULT_SEND_FILE_OPTIONS = {
+      :type         => 'application/octet-stream'.freeze,
+      :disposition  => 'attachment'.freeze,
+      :stream       => true,
+      :buffer_size  => 4096,
+      :x_sendfile   => false
+    }.freeze
+
+    X_SENDFILE_HEADER = 'X-Sendfile'.freeze
+
+    protected
+      # Sends the file, by default streaming it 4096 bytes at a time. This way the
+      # whole file doesn't need to be read into memory at once. This makes it
+      # feasible to send even large files. You can optionally turn off streaming
+      # and send the whole file at once.
+      #
+      # Be careful to sanitize the path parameter if it is coming from a web
+      # page. <tt>send_file(params[:path])</tt> allows a malicious user to
+      # download any file on your server.
+      #
+      # Options:
+      # * <tt>:filename</tt> - suggests a filename for the browser to use.
+      #   Defaults to <tt>File.basename(path)</tt>.
+      # * <tt>:type</tt> - specifies an HTTP content type. Defaults to 'application/octet-stream'. You can specify
+      #   either a string or a symbol for a registered type register with <tt>Mime::Type.register</tt>, for example :json
+      # * <tt>:length</tt> - used to manually override the length (in bytes) of the content that
+      #   is going to be sent to the client. Defaults to <tt>File.size(path)</tt>.
+      # * <tt>:disposition</tt> - specifies whether the file will be shown inline or downloaded.
+      #   Valid values are 'inline' and 'attachment' (default).
+      # * <tt>:stream</tt> - whether to send the file to the user agent as it is read (+true+)
+      #   or to read the entire file before sending (+false+). Defaults to +true+.
+      # * <tt>:buffer_size</tt> - specifies size (in bytes) of the buffer used to stream the file.
+      #   Defaults to 4096.
+      # * <tt>:status</tt> - specifies the status code to send with the response. Defaults to '200 OK'.
+      # * <tt>:url_based_filename</tt> - set to +true+ if you want the browser guess the filename from
+      #   the URL, which is necessary for i18n filenames on certain browsers
+      #   (setting <tt>:filename</tt> overrides this option).
+      # * <tt>:x_sendfile</tt> - uses X-Sendfile to send the file when set to +true+. This is currently
+      #   only available with Lighttpd/Apache2 and specific modules installed and activated. Since this
+      #   uses the web server to send the file, this may lower memory consumption on your server and
+      #   it will not block your application for further requests.
+      #   See http://blog.lighttpd.net/articles/2006/07/02/x-sendfile and
+      #   http://tn123.ath.cx/mod_xsendfile/ for details. Defaults to +false+.
+      #
+      # The default Content-Type and Content-Disposition headers are
+      # set to download arbitrary binary files in as many browsers as
+      # possible.  IE versions 4, 5, 5.5, and 6 are all known to have
+      # a variety of quirks (especially when downloading over SSL).
+      #
+      # Simple download:
+      #
+      #   send_file '/path/to.zip'
+      #
+      # Show a JPEG in the browser:
+      #
+      #   send_file '/path/to.jpeg', :type => 'image/jpeg', :disposition => 'inline'
+      #
+      # Show a 404 page in the browser:
+      #
+      #   send_file '/path/to/404.html', :type => 'text/html; charset=utf-8', :status => 404
+      #
+      # Read about the other Content-* HTTP headers if you'd like to
+      # provide the user with more information (such as Content-Description) in
+      # http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.11.
+      #
+      # Also be aware that the document may be cached by proxies and browsers.
+      # The Pragma and Cache-Control headers declare how the file may be cached
+      # by intermediaries.  They default to require clients to validate with
+      # the server before releasing cached responses.  See
+      # http://www.mnot.net/cache_docs/ for an overview of web caching and
+      # http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9
+      # for the Cache-Control header spec.
+      def send_file(path, options = {}) #:doc:
+        raise MissingFile, "Cannot read file #{path}" unless File.file?(path) and File.readable?(path)
+
+        options[:length]   ||= File.size(path)
+        options[:filename] ||= File.basename(path) unless options[:url_based_filename]
+        send_file_headers! options
+
+        @performed_render = false
+
+        if options[:x_sendfile]
+          logger.info "Sending #{X_SENDFILE_HEADER} header #{path}" if logger
+          head options[:status], X_SENDFILE_HEADER => path
+        else
+          if options[:stream]
+            render :status => options[:status], :text => Proc.new { |response, output|
+              logger.info "Streaming file #{path}" unless logger.nil?
+              len = options[:buffer_size] || 4096
+              File.open(path, 'rb') do |file|
+                while buf = file.read(len)
+                  output.write(buf)
+                end
+              end
+            }
+          else
+            logger.info "Sending file #{path}" unless logger.nil?
+            File.open(path, 'rb') { |file| render :status => options[:status], :text => file.read }
+          end
+        end
+      end
+
+      # Sends the given binary data to the browser. This method is similar to
+      # <tt>render :text => data</tt>, but also allows you to specify whether
+      # the browser should display the response as a file attachment (i.e. in a
+      # download dialog) or as inline data. You may also set the content type,
+      # the apparent file name, and other things.
+      #
+      # Options:
+      # * <tt>:filename</tt> - suggests a filename for the browser to use.
+      # * <tt>:type</tt> - specifies an HTTP content type. Defaults to 'application/octet-stream'. You can specify
+      #   either a string or a symbol for a registered type register with <tt>Mime::Type.register</tt>, for example :json
+      # * <tt>:disposition</tt> - specifies whether the file will be shown inline or downloaded.
+      #   Valid values are 'inline' and 'attachment' (default).
+      # * <tt>:status</tt> - specifies the status code to send with the response. Defaults to '200 OK'.
+      #
+      # Generic data download:
+      #
+      #   send_data buffer
+      #
+      # Download a dynamically-generated tarball:
+      #
+      #   send_data generate_tgz('dir'), :filename => 'dir.tgz'
+      #
+      # Display an image Active Record in the browser:
+      #
+      #   send_data image.data, :type => image.content_type, :disposition => 'inline'
+      #
+      # See +send_file+ for more information on HTTP Content-* headers and caching.
+      #
+      # <b>Tip:</b> if you want to stream large amounts of on-the-fly generated
+      # data to the browser, then use <tt>render :text => proc { ... }</tt>
+      # instead. See ActionController::Base#render for more information.
+      def send_data(data, options = {}) #:doc:
+        logger.info "Sending data #{options[:filename]}" if logger
+        send_file_headers! options.merge(:length => data.bytesize)
+        @performed_render = false
+        render :status => options[:status], :text => data
+      end
+
+    private
+      def send_file_headers!(options)
+        options.update(DEFAULT_SEND_FILE_OPTIONS.merge(options))
+        [:length, :type, :disposition].each do |arg|
+          raise ArgumentError, ":#{arg} option required" if options[arg].nil?
+        end
+
+        disposition = options[:disposition].dup || 'attachment'
+
+        disposition <<= %(; filename="#{options[:filename]}") if options[:filename]
+
+        content_type = options[:type]
+        if content_type.is_a?(Symbol)
+          raise ArgumentError, "Unknown MIME type #{options[:type]}" unless Mime::EXTENSION_LOOKUP.has_key?(content_type.to_s)
+          content_type = Mime::Type.lookup_by_extension(content_type.to_s)
+        end
+        content_type = content_type.to_s.strip # fixes a problem with extra '\r' with some browsers
+
+        headers.merge!(
+          'Content-Length'            => options[:length].to_s,
+          'Content-Type'              => content_type,
+          'Content-Disposition'       => disposition,
+          'Content-Transfer-Encoding' => 'binary'
+        )
+
+        # Fix a problem with IE 6.0 on opening downloaded files:
+        # If Cache-Control: no-cache is set (which Rails does by default),
+        # IE removes the file it just downloaded from its cache immediately
+        # after it displays the "open/save" dialog, which means that if you
+        # hit "open" the file isn't there anymore when the application that
+        # is called for handling the download is run, so let's workaround that
+        headers['Cache-Control'] = 'private' if headers['Cache-Control'] == 'no-cache'
+      end
+  end
+end

vendor/rails/actionpack/lib/action_controller/string_coercion.rb

@@ -0,0 +1,29 @@
+module ActionController
+  class StringCoercion
+    class UglyBody < ActiveSupport::BasicObject
+      def initialize(body)
+        @body = body
+      end
+
+      def each
+        @body.each do |part|
+          yield part.to_s
+        end
+      end
+
+      private
+        def method_missing(*args, &block)
+          @body.__send__(*args, &block)
+        end
+    end
+
+    def initialize(app)
+      @app = app
+    end
+
+    def call(env)
+      status, headers, body = @app.call(env)
+      [status, headers, UglyBody.new(body)]
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/templates/rescues/_request_and_response.erb

@@ -0,0 +1,24 @@
+<% unless @exception.blamed_files.blank? %>
+  <% if (hide = @exception.blamed_files.length > 8) %>
+    <a href="#" onclick="document.getElementById('blame_trace').style.display='block'; return false;">Show blamed files</a>
+  <% end %>
+  <pre id="blame_trace" <%='style="display:none"' if hide %>><code><%=h @exception.describe_blame %></code></pre>
+<% end %>
+
+<%
+  clean_params = request.parameters.clone
+  clean_params.delete("action")
+  clean_params.delete("controller")
+
+  request_dump = clean_params.empty? ? 'None' : clean_params.inspect.gsub(',', ",\n")
+%>
+
+<h2 style="margin-top: 30px">Request</h2>
+<p><b>Parameters</b>: <pre><%=h request_dump %></pre></p>
+
+<p><a href="#" onclick="document.getElementById('session_dump').style.display='block'; return false;">Show session dump</a></p>
+<div id="session_dump" style="display:none"><%= debug(request.session.instance_variable_get("@data")) %></div>
+
+
+<h2 style="margin-top: 30px">Response</h2>
+<p><b>Headers</b>: <pre><%=h response ? response.headers.inspect.gsub(',', ",\n") : 'None' %></pre></p>

vendor/rails/actionpack/lib/action_controller/templates/rescues/_trace.erb

@@ -0,0 +1,26 @@
+<%
+  traces = [
+    ["Application Trace", @exception.application_backtrace],
+    ["Framework Trace", @exception.framework_backtrace],
+    ["Full Trace", @exception.clean_backtrace]
+  ]
+  names = traces.collect {|name, trace| name}
+%>
+
+<p><code>RAILS_ROOT: <%= defined?(RAILS_ROOT) ? RAILS_ROOT : "unset" %></code></p>
+
+<div id="traces">
+  <% names.each do |name| %>
+    <%
+      show = "document.getElementById('#{name.gsub /\s/, '-'}').style.display='block';"
+      hide = (names - [name]).collect {|hide_name| "document.getElementById('#{hide_name.gsub /\s/, '-'}').style.display='none';"}
+    %>
+    <a href="#" onclick="<%= hide.join %><%= show %>; return false;"><%= name %></a> <%= '|' unless names.last == name %>
+  <% end %>
+
+  <% traces.each do |name, trace| %>
+    <div id="<%= name.gsub /\s/, '-' %>" style="display: <%= name == "Application Trace" ? 'block' : 'none' %>;">
+      <pre><code><%=h trace.join "\n" %></code></pre>
+    </div>
+  <% end %>
+</div>

vendor/rails/actionpack/lib/action_controller/templates/rescues/diagnostics.erb

@@ -0,0 +1,11 @@
+<h1>
+  <%=h @exception.class.to_s %>
+  <% if request.parameters['controller'] %>
+    in <%=h request.parameters['controller'].humanize %>Controller<% if request.parameters['action'] %>#<%=h request.parameters['action'] %><% end %>
+  <% end %>
+</h1>
+<pre><%=h @exception.clean_message %></pre>
+
+<%= render :file => @rescues_path["rescues/_trace.erb"] %>
+
+<%= render :file => @rescues_path["rescues/_request_and_response.erb"] %>

vendor/rails/actionpack/lib/action_controller/templates/rescues/layout.erb

@@ -0,0 +1,29 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+  <title>Action Controller: Exception caught</title>
+  <style>
+    body { background-color: #fff; color: #333; }
+
+    body, p, ol, ul, td {
+      font-family: verdana, arial, helvetica, sans-serif;
+      font-size:   13px;
+      line-height: 18px;
+    }
+
+    pre {
+      background-color: #eee;
+      padding: 10px;
+      font-size: 11px;
+    }
+
+    a { color: #000; }
+    a:visited { color: #666; }
+    a:hover { color: #fff; background-color:#000; }
+  </style>
+</head>
+<body>
+
+<%= @contents %>
+
+</body>
+</html>

vendor/rails/actionpack/lib/action_controller/templates/rescues/missing_template.erb

@@ -0,0 +1,2 @@
+<h1>Template is missing</h1>
+<p><%=h @exception.message %></p>

vendor/rails/actionpack/lib/action_controller/templates/rescues/routing_error.erb

@@ -0,0 +1,10 @@
+<h1>Routing Error</h1>
+<p><pre><%=h @exception.message %></pre></p>
+<% unless @exception.failures.empty? %><p>
+  <h2>Failure reasons:</h2>
+  <ol>
+  <% @exception.failures.each do |route, reason| %>
+    <li><code><%=h route.inspect.gsub('\\', '') %></code> failed because <%=h reason.downcase %></li>
+  <% end %>
+  </ol>
+</p><% end %>

vendor/rails/actionpack/lib/action_controller/templates/rescues/template_error.erb

@@ -0,0 +1,21 @@
+<h1>
+  <%=h @exception.original_exception.class.to_s %> in
+  <%=h request.parameters["controller"].capitalize if request.parameters["controller"]%>#<%=h request.parameters["action"] %>
+</h1>
+
+<p>
+  Showing <i><%=h @exception.file_name %></i> where line <b>#<%=h @exception.line_number %></b> raised:
+  <pre><code><%=h @exception.message %></code></pre>
+</p>
+
+<p>Extracted source (around line <b>#<%=h @exception.line_number %></b>):
+<pre><code><%=h @exception.source_extract %></code></pre></p>
+
+<p><%=h @exception.sub_template_message %></p>
+
+<% @real_exception = @exception
+   @exception = @exception.original_exception || @exception %>
+<%= render :file => @rescues_path["rescues/_trace.erb"] %>
+<% @exception = @real_exception %>
+
+<%= render :file => @rescues_path["rescues/_request_and_response.erb"] %>

vendor/rails/actionpack/lib/action_controller/templates/rescues/unknown_action.erb

@@ -0,0 +1,2 @@
+<h1>Unknown action</h1>
+<p><%=h @exception.message %></p>

vendor/rails/actionpack/lib/action_controller/test_case.rb

@@ -0,0 +1,209 @@
+require 'active_support/test_case'
+require 'action_controller/test_process'
+
+module ActionController
+  # Superclass for ActionController functional tests. Functional tests allow you to
+  # test a single controller action per test method. This should not be confused with
+  # integration tests (see ActionController::IntegrationTest), which are more like
+  # "stories" that can involve multiple controllers and mutliple actions (i.e. multiple
+  # different HTTP requests).
+  #
+  # == Basic example
+  #
+  # Functional tests are written as follows:
+  # 1. First, one uses the +get+, +post+, +put+, +delete+ or +head+ method to simulate
+  #    an HTTP request.
+  # 2. Then, one asserts whether the current state is as expected. "State" can be anything:
+  #    the controller's HTTP response, the database contents, etc.
+  #
+  # For example:
+  #
+  #   class BooksControllerTest < ActionController::TestCase
+  #     def test_create
+  #       # Simulate a POST response with the given HTTP parameters.
+  #       post(:create, :book => { :title => "Love Hina" })
+  #
+  #       # Assert that the controller tried to redirect us to
+  #       # the created book's URI.
+  #       assert_response :found
+  #
+  #       # Assert that the controller really put the book in the database.
+  #       assert_not_nil Book.find_by_title("Love Hina")
+  #     end
+  #   end
+  #
+  # == Special instance variables
+  #
+  # ActionController::TestCase will also automatically provide the following instance
+  # variables for use in the tests:
+  #
+  # <b>@controller</b>::
+  #      The controller instance that will be tested.
+  # <b>@request</b>::
+  #      An ActionController::TestRequest, representing the current HTTP
+  #      request. You can modify this object before sending the HTTP request. For example,
+  #      you might want to set some session properties before sending a GET request.
+  # <b>@response</b>::
+  #      An ActionController::TestResponse object, representing the response
+  #      of the last HTTP response. In the above example, <tt>@response</tt> becomes valid
+  #      after calling +post+. If the various assert methods are not sufficient, then you
+  #      may use this object to inspect the HTTP response in detail.
+  #
+  # (Earlier versions of Rails required each functional test to subclass
+  # Test::Unit::TestCase and define @controller, @request, @response in +setup+.)
+  #
+  # == Controller is automatically inferred
+  #
+  # ActionController::TestCase will automatically infer the controller under test
+  # from the test class name. If the controller cannot be inferred from the test
+  # class name, you can explicity set it with +tests+.
+  #
+  #   class SpecialEdgeCaseWidgetsControllerTest < ActionController::TestCase
+  #     tests WidgetController
+  #   end
+  #
+  # == Testing controller internals
+  #
+  # In addition to these specific assertions, you also have easy access to various collections that the regular test/unit assertions
+  # can be used against. These collections are:
+  #
+  # * assigns: Instance variables assigned in the action that are available for the view.
+  # * session: Objects being saved in the session.
+  # * flash: The flash objects currently in the session.
+  # * cookies: Cookies being sent to the user on this request.
+  #
+  # These collections can be used just like any other hash:
+  #
+  #   assert_not_nil assigns(:person) # makes sure that a @person instance variable was set
+  #   assert_equal "Dave", cookies[:name] # makes sure that a cookie called :name was set as "Dave"
+  #   assert flash.empty? # makes sure that there's nothing in the flash
+  #
+  # For historic reasons, the assigns hash uses string-based keys. So assigns[:person] won't work, but assigns["person"] will. To
+  # appease our yearning for symbols, though, an alternative accessor has been devised using a method call instead of index referencing.
+  # So assigns(:person) will work just like assigns["person"], but again, assigns[:person] will not work.
+  #
+  # On top of the collections, you have the complete url that a given action redirected to available in redirect_to_url.
+  #
+  # For redirects within the same controller, you can even call follow_redirect and the redirect will be followed, triggering another
+  # action call which can then be asserted against.
+  #
+  # == Manipulating the request collections
+  #
+  # The collections described above link to the response, so you can test if what the actions were expected to do happened. But
+  # sometimes you also want to manipulate these collections in the incoming request. This is really only relevant for sessions
+  # and cookies, though. For sessions, you just do:
+  #
+  #   @request.session[:key] = "value"
+  #   @request.cookies["key"] = "value"
+  #
+  # == Testing named routes
+  #
+  # If you're using named routes, they can be easily tested using the original named routes' methods straight in the test case.
+  # Example:
+  #
+  #  assert_redirected_to page_url(:title => 'foo')
+  class TestCase < ActiveSupport::TestCase
+    include TestProcess
+
+    def initialize(*args)
+      super
+      @controller = nil
+    end
+
+    module Assertions
+      %w(response selector tag dom routing model).each do |kind|
+        include ActionController::Assertions.const_get("#{kind.camelize}Assertions")
+      end
+
+      def clean_backtrace(&block)
+        yield
+      rescue ActiveSupport::TestCase::Assertion => error
+        framework_path = Regexp.new(File.expand_path("#{File.dirname(__FILE__)}/assertions"))
+        error.backtrace.reject! { |line| File.expand_path(line) =~ framework_path }
+        raise
+      end
+    end
+    include Assertions
+
+    # When the request.remote_addr remains the default for testing, which is 0.0.0.0, the exception is simply raised inline
+    # (bystepping the regular exception handling from rescue_action). If the request.remote_addr is anything else, the regular
+    # rescue_action process takes place. This means you can test your rescue_action code by setting remote_addr to something else
+    # than 0.0.0.0.
+    #
+    # The exception is stored in the exception accessor for further inspection.
+    module RaiseActionExceptions
+      def self.included(base)
+        base.class_eval do
+          attr_accessor :exception
+          protected :exception, :exception=
+        end
+      end
+
+      protected
+        def rescue_action_without_handler(e)
+          self.exception = e
+
+          if request.remote_addr == "0.0.0.0"
+            raise(e)
+          else
+            super(e)
+          end
+        end
+    end
+
+    setup :setup_controller_request_and_response
+
+    @@controller_class = nil
+
+    class << self
+      # Sets the controller class name. Useful if the name can't be inferred from test class.
+      # Expects +controller_class+ as a constant. Example: <tt>tests WidgetController</tt>.
+      def tests(controller_class)
+        self.controller_class = controller_class
+      end
+
+      def controller_class=(new_class)
+        prepare_controller_class(new_class) if new_class
+        write_inheritable_attribute(:controller_class, new_class)
+      end
+
+      def controller_class
+        if current_controller_class = read_inheritable_attribute(:controller_class)
+          current_controller_class
+        else
+          self.controller_class = determine_default_controller_class(name)
+        end
+      end
+
+      def determine_default_controller_class(name)
+        name.sub(/Test$/, '').constantize
+      rescue NameError
+        nil
+      end
+
+      def prepare_controller_class(new_class)
+        new_class.send :include, RaiseActionExceptions
+      end
+    end
+
+    def setup_controller_request_and_response
+      @request = TestRequest.new
+      @response = TestResponse.new
+
+      if klass = self.class.controller_class
+        @controller ||= klass.new rescue nil
+      end
+
+      if @controller
+        @controller.request = @request
+        @controller.params = {}
+        @controller.send(:initialize_current_url)
+      end
+    end
+
+    # Cause the action to be rescued according to the regular rules for rescue_action when the visitor is not local
+    def rescue_action_in_public!
+      @request.remote_addr = '208.77.188.166' # example.com
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/test_process.rb

@@ -0,0 +1,580 @@
+require 'rack/session/abstract/id'
+module ActionController #:nodoc:
+  class TestRequest < Request #:nodoc:
+    attr_accessor :cookies, :session_options
+    attr_accessor :query_parameters, :path, :session
+    attr_accessor :host
+
+    def self.new(env = {})
+      super
+    end
+
+    def initialize(env = {})
+      super(Rack::MockRequest.env_for("/").merge(env))
+
+      @query_parameters   = {}
+      @session            = TestSession.new
+      default_rack_options = Rack::Session::Abstract::ID::DEFAULT_OPTIONS
+      @session_options    ||= {:id => generate_sid(default_rack_options[:sidbits])}.merge(default_rack_options)
+
+      initialize_default_values
+      initialize_containers
+    end
+
+    def reset_session
+      @session.reset
+    end
+
+    # Wraps raw_post in a StringIO.
+    def body_stream #:nodoc:
+      StringIO.new(raw_post)
+    end
+
+    # Either the RAW_POST_DATA environment variable or the URL-encoded request
+    # parameters.
+    def raw_post
+      @env['RAW_POST_DATA'] ||= begin
+        data = url_encoded_request_parameters
+        data.force_encoding(Encoding::BINARY) if data.respond_to?(:force_encoding)
+        data
+      end
+    end
+
+    def port=(number)
+      @env["SERVER_PORT"] = number.to_i
+    end
+
+    def action=(action_name)
+      @query_parameters.update({ "action" => action_name })
+      @parameters = nil
+    end
+
+    # Used to check AbstractRequest's request_uri functionality.
+    # Disables the use of @path and @request_uri so superclass can handle those.
+    def set_REQUEST_URI(value)
+      @env["REQUEST_URI"] = value
+      @request_uri = nil
+      @path = nil
+    end
+
+    def request_uri=(uri)
+      @request_uri = uri
+      @path = uri.split("?").first
+    end
+
+    def request_method=(method)
+      @request_method = method
+    end
+
+    def accept=(mime_types)
+      @env["HTTP_ACCEPT"] = Array(mime_types).collect { |mime_types| mime_types.to_s }.join(",")
+      @accepts = nil
+    end
+
+    def if_modified_since=(last_modified)
+      @env["HTTP_IF_MODIFIED_SINCE"] = last_modified
+    end
+
+    def if_none_match=(etag)
+      @env["HTTP_IF_NONE_MATCH"] = etag
+    end
+
+    def remote_addr=(addr)
+      @env['REMOTE_ADDR'] = addr
+    end
+
+    def request_uri(*args)
+      @request_uri || super()
+    end
+
+    def path(*args)
+      @path || super()
+    end
+
+    def assign_parameters(controller_path, action, parameters = {})
+      parameters = parameters.symbolize_keys.merge(:controller => controller_path, :action => action)
+      extra_keys = ActionController::Routing::Routes.extra_keys(parameters)
+      non_path_parameters = get? ? query_parameters : request_parameters
+      parameters.each do |key, value|
+        if value.is_a? Fixnum
+          value = value.to_s
+        elsif value.is_a? Array
+          value = ActionController::Routing::PathSegment::Result.new(value)
+        end
+
+        if extra_keys.include?(key.to_sym)
+          non_path_parameters[key] = value
+        else
+          path_parameters[key.to_s] = value
+        end
+      end
+      raw_post # populate env['RAW_POST_DATA']
+      @parameters = nil # reset TestRequest#parameters to use the new path_parameters
+    end
+
+    def recycle!
+      @env["action_controller.request.request_parameters"] = {}
+      self.query_parameters   = {}
+      self.path_parameters    = {}
+      @headers, @request_method, @accepts, @content_type = nil, nil, nil, nil
+    end
+
+    def user_agent=(user_agent)
+      @env['HTTP_USER_AGENT'] = user_agent
+    end
+
+    private
+      def generate_sid(sidbits)
+        "%0#{sidbits / 4}x" % rand(2**sidbits - 1)
+      end
+
+      def initialize_containers
+        @cookies = {}
+      end
+
+      def initialize_default_values
+        @host                    = "test.host"
+        @request_uri             = "/"
+        @env['HTTP_USER_AGENT']  = "Rails Testing"
+        @env['REMOTE_ADDR']      = "0.0.0.0"
+        @env["SERVER_PORT"]      = 80
+        @env['REQUEST_METHOD']   = "GET"
+      end
+
+      def url_encoded_request_parameters
+        params = self.request_parameters.dup
+
+        %w(controller action only_path).each do |k|
+          params.delete(k)
+          params.delete(k.to_sym)
+        end
+
+        params.to_query
+      end
+  end
+
+  # A refactoring of TestResponse to allow the same behavior to be applied
+  # to the "real" CgiResponse class in integration tests.
+  module TestResponseBehavior #:nodoc:
+    # The response code of the request
+    def response_code
+      status.to_s[0,3].to_i rescue 0
+    end
+
+    # Returns a String to ensure compatibility with Net::HTTPResponse
+    def code
+      status.to_s.split(' ')[0]
+    end
+
+    def message
+      status.to_s.split(' ',2)[1]
+    end
+
+    # Was the response successful?
+    def success?
+      (200..299).include?(response_code)
+    end
+
+    # Was the URL not found?
+    def missing?
+      response_code == 404
+    end
+
+    # Were we redirected?
+    def redirect?
+      (300..399).include?(response_code)
+    end
+
+    # Was there a server-side error?
+    def error?
+      (500..599).include?(response_code)
+    end
+
+    alias_method :server_error?, :error?
+
+    # Was there a client client?
+    def client_error?
+      (400..499).include?(response_code)
+    end
+
+    # Returns the redirection location or nil
+    def redirect_url
+      headers['Location']
+    end
+
+    # Does the redirect location match this regexp pattern?
+    def redirect_url_match?( pattern )
+      return false if redirect_url.nil?
+      p = Regexp.new(pattern) if pattern.class == String
+      p = pattern if pattern.class == Regexp
+      return false if p.nil?
+      p.match(redirect_url) != nil
+    end
+
+    # Returns the template of the file which was used to
+    # render this response (or nil)
+    def rendered
+      template.instance_variable_get(:@_rendered)
+    end
+
+    # A shortcut to the flash. Returns an empty hash if no session flash exists.
+    def flash
+      session['flash'] || {}
+    end
+
+    # Do we have a flash?
+    def has_flash?
+      !flash.empty?
+    end
+
+    # Do we have a flash that has contents?
+    def has_flash_with_contents?
+      !flash.empty?
+    end
+
+    # Does the specified flash object exist?
+    def has_flash_object?(name=nil)
+      !flash[name].nil?
+    end
+
+    # Does the specified object exist in the session?
+    def has_session_object?(name=nil)
+      !session[name].nil?
+    end
+
+    # A shortcut to the template.assigns
+    def template_objects
+      template.assigns || {}
+    end
+
+    # Does the specified template object exist?
+    def has_template_object?(name=nil)
+      !template_objects[name].nil?
+    end
+
+    # Returns the response cookies, converted to a Hash of (name => value) pairs
+    #
+    #   assert_equal 'AuthorOfNewPage', r.cookies['author']
+    def cookies
+      cookies = {}
+      Array(headers['Set-Cookie']).each do |cookie|
+        key, value = cookie.split(";").first.split("=").map {|val| Rack::Utils.unescape(val)}
+        cookies[key] = value
+      end
+      cookies
+    end
+
+    # Returns binary content (downloadable file), converted to a String
+    def binary_content
+      raise "Response body is not a Proc: #{body.inspect}" unless body.kind_of?(Proc)
+      require 'stringio'
+
+      sio = StringIO.new
+      body.call(self, sio)
+
+      sio.rewind
+      sio.read
+    end
+  end
+
+  # Integration test methods such as ActionController::Integration::Session#get
+  # and ActionController::Integration::Session#post return objects of class
+  # TestResponse, which represent the HTTP response results of the requested
+  # controller actions.
+  #
+  # See Response for more information on controller response objects.
+  class TestResponse < Response
+    include TestResponseBehavior
+
+    def recycle!
+      headers.delete('ETag')
+      headers.delete('Last-Modified')
+    end
+  end
+
+  class TestSession < Hash #:nodoc:
+    attr_accessor :session_id
+
+    def initialize(attributes = nil)
+      reset_session_id
+      replace_attributes(attributes)
+    end
+
+    def reset
+      reset_session_id
+      replace_attributes({ })
+    end
+
+    def data
+      to_hash
+    end
+
+    def [](key)
+      super(key.to_s)
+    end
+
+    def []=(key, value)
+      super(key.to_s, value)
+    end
+
+    def update(hash = nil)
+      if hash.nil?
+        ActiveSupport::Deprecation.warn('use replace instead', caller)
+        replace({})
+      else
+        super(hash)
+      end
+    end
+
+    def delete(key = nil)
+      if key.nil?
+        ActiveSupport::Deprecation.warn('use clear instead', caller)
+        clear
+      else
+        super(key.to_s)
+      end
+    end
+
+    def close
+      ActiveSupport::Deprecation.warn('sessions should no longer be closed', caller)
+    end
+
+  private
+
+    def reset_session_id
+      @session_id = ''
+    end
+
+    def replace_attributes(attributes = nil)
+      attributes ||= {}
+      replace(attributes.stringify_keys)
+    end
+  end
+
+  # Essentially generates a modified Tempfile object similar to the object
+  # you'd get from the standard library CGI module in a multipart
+  # request. This means you can use an ActionController::TestUploadedFile
+  # object in the params of a test request in order to simulate
+  # a file upload.
+  #
+  # Usage example, within a functional test:
+  #   post :change_avatar, :avatar => ActionController::TestUploadedFile.new(ActionController::TestCase.fixture_path + '/files/spongebob.png', 'image/png')
+  #
+  # Pass a true third parameter to ensure the uploaded file is opened in binary mode (only required for Windows):
+  #   post :change_avatar, :avatar => ActionController::TestUploadedFile.new(ActionController::TestCase.fixture_path + '/files/spongebob.png', 'image/png', :binary)
+  require 'tempfile'
+  class TestUploadedFile
+    # The filename, *not* including the path, of the "uploaded" file
+    attr_reader :original_filename
+
+    # The content type of the "uploaded" file
+    attr_accessor :content_type
+
+    def initialize(path, content_type = Mime::TEXT, binary = false)
+      raise "#{path} file does not exist" unless File.exist?(path)
+      @content_type = content_type
+      @original_filename = path.sub(/^.*#{File::SEPARATOR}([^#{File::SEPARATOR}]+)$/) { $1 }
+      @tempfile = Tempfile.new(@original_filename)
+      @tempfile.set_encoding(Encoding::BINARY) if @tempfile.respond_to?(:set_encoding)
+      @tempfile.binmode if binary
+      FileUtils.copy_file(path, @tempfile.path)
+    end
+
+    def path #:nodoc:
+      @tempfile.path
+    end
+
+    alias local_path path
+
+    def method_missing(method_name, *args, &block) #:nodoc:
+      @tempfile.__send__(method_name, *args, &block)
+    end
+  end
+
+  module TestProcess
+    def self.included(base)
+      # Executes a request simulating GET HTTP method and set/volley the response
+      def get(action, parameters = nil, session = nil, flash = nil)
+        process(action, parameters, session, flash, "GET")
+      end
+
+      # Executes a request simulating POST HTTP method and set/volley the response
+      def post(action, parameters = nil, session = nil, flash = nil)
+        process(action, parameters, session, flash, "POST")
+      end
+
+      # Executes a request simulating PUT HTTP method and set/volley the response
+      def put(action, parameters = nil, session = nil, flash = nil)
+        process(action, parameters, session, flash, "PUT")
+      end
+
+      # Executes a request simulating DELETE HTTP method and set/volley the response
+      def delete(action, parameters = nil, session = nil, flash = nil)
+        process(action, parameters, session, flash, "DELETE")
+      end
+
+      # Executes a request simulating HEAD HTTP method and set/volley the response
+      def head(action, parameters = nil, session = nil, flash = nil)
+        process(action, parameters, session, flash, "HEAD")
+      end
+    end
+
+    def process(action, parameters = nil, session = nil, flash = nil, http_method = 'GET')
+      # Sanity check for required instance variables so we can give an
+      # understandable error message.
+      %w(@controller @request @response).each do |iv_name|
+        if !(instance_variable_names.include?(iv_name) || instance_variable_names.include?(iv_name.to_sym)) || instance_variable_get(iv_name).nil?
+          raise "#{iv_name} is nil: make sure you set it in your test's setup method."
+        end
+      end
+
+      @request.recycle!
+      @response.recycle!
+
+      @html_document = nil
+      @request.env['REQUEST_METHOD'] = http_method
+
+      @request.action = action.to_s
+
+      parameters ||= {}
+      @request.assign_parameters(@controller.class.controller_path, action.to_s, parameters)
+
+      @request.session = ActionController::TestSession.new(session) unless session.nil?
+      @request.session["flash"] = ActionController::Flash::FlashHash.new.update(flash) if flash
+      build_request_uri(action, parameters)
+
+      Base.class_eval { include ProcessWithTest } unless Base < ProcessWithTest
+      @controller.process_with_test(@request, @response)
+    end
+
+    def xml_http_request(request_method, action, parameters = nil, session = nil, flash = nil)
+      @request.env['HTTP_X_REQUESTED_WITH'] = 'XMLHttpRequest'
+      @request.env['HTTP_ACCEPT'] =  [Mime::JS, Mime::HTML, Mime::XML, 'text/xml', Mime::ALL].join(', ')
+      __send__(request_method, action, parameters, session, flash).tap do
+        @request.env.delete 'HTTP_X_REQUESTED_WITH'
+        @request.env.delete 'HTTP_ACCEPT'
+      end
+    end
+    alias xhr :xml_http_request
+
+    def assigns(key = nil)
+      if key.nil?
+        @response.template.assigns
+      else
+        @response.template.assigns[key.to_s]
+      end
+    end
+
+    def session
+      @request.session
+    end
+
+    def flash
+      @response.flash
+    end
+
+    def cookies
+      @response.cookies
+    end
+
+    def redirect_to_url
+      @response.redirect_url
+    end
+
+    def build_request_uri(action, parameters)
+      unless @request.env['REQUEST_URI']
+        options = @controller.__send__(:rewrite_options, parameters)
+        options.update(:only_path => true, :action => action)
+
+        url = ActionController::UrlRewriter.new(@request, parameters)
+        @request.set_REQUEST_URI(url.rewrite(options))
+      end
+    end
+
+    def html_document
+      xml = @response.content_type =~ /xml$/
+      @html_document ||= HTML::Document.new(@response.body, false, xml)
+    end
+
+    def find_tag(conditions)
+      html_document.find(conditions)
+    end
+
+    def find_all_tag(conditions)
+      html_document.find_all(conditions)
+    end
+
+    def method_missing(selector, *args, &block)
+      if @controller && ActionController::Routing::Routes.named_routes.helpers.include?(selector)
+        @controller.send(selector, *args, &block)
+      else
+        super
+      end
+    end
+
+    # Shortcut for <tt>ActionController::TestUploadedFile.new(ActionController::TestCase.fixture_path + path, type)</tt>:
+    #
+    #   post :change_avatar, :avatar => fixture_file_upload('/files/spongebob.png', 'image/png')
+    #
+    # To upload binary files on Windows, pass <tt>:binary</tt> as the last parameter.
+    # This will not affect other platforms:
+    #
+    #   post :change_avatar, :avatar => fixture_file_upload('/files/spongebob.png', 'image/png', :binary)
+    def fixture_file_upload(path, mime_type = nil, binary = false)
+      fixture_path = ActionController::TestCase.send(:fixture_path) if ActionController::TestCase.respond_to?(:fixture_path)
+      ActionController::TestUploadedFile.new("#{fixture_path}#{path}", mime_type, binary)
+    end
+
+    # A helper to make it easier to test different route configurations.
+    # This method temporarily replaces ActionController::Routing::Routes
+    # with a new RouteSet instance.
+    #
+    # The new instance is yielded to the passed block. Typically the block
+    # will create some routes using <tt>map.draw { map.connect ... }</tt>:
+    #
+    #   with_routing do |set|
+    #     set.draw do |map|
+    #       map.connect ':controller/:action/:id'
+    #         assert_equal(
+    #           ['/content/10/show', {}],
+    #           map.generate(:controller => 'content', :id => 10, :action => 'show')
+    #       end
+    #     end
+    #   end
+    #
+    def with_routing
+      real_routes = ActionController::Routing::Routes
+      ActionController::Routing.module_eval { remove_const :Routes }
+
+      temporary_routes = ActionController::Routing::RouteSet.new
+      ActionController::Routing.module_eval { const_set :Routes, temporary_routes }
+
+      yield temporary_routes
+    ensure
+      if ActionController::Routing.const_defined? :Routes
+        ActionController::Routing.module_eval { remove_const :Routes }
+      end
+      ActionController::Routing.const_set(:Routes, real_routes) if real_routes
+    end
+  end
+
+  module ProcessWithTest #:nodoc:
+    def self.included(base)
+      base.class_eval { attr_reader :assigns }
+    end
+
+    def process_with_test(*args)
+      process(*args).tap { set_test_assigns }
+    end
+
+    private
+      def set_test_assigns
+        @assigns = {}
+        (instance_variable_names - self.class.protected_instance_variables).each do |var|
+          name, value = var[1..-1], instance_variable_get(var)
+          @assigns[name] = value
+          response.template.assigns[name] = value if response
+        end
+      end
+  end
+end

vendor/rails/actionpack/lib/action_controller/translation.rb

@@ -0,0 +1,13 @@
+module ActionController
+  module Translation
+    def translate(*args)
+      I18n.translate(*args)
+    end
+    alias :t :translate
+
+    def localize(*args)
+      I18n.localize(*args)
+    end
+    alias :l :localize
+  end
+end

vendor/rails/actionpack/lib/action_controller/uploaded_file.rb

@@ -0,0 +1,44 @@
+module ActionController
+  module UploadedFile
+    def self.included(base)
+      base.class_eval do
+        attr_accessor :original_path, :content_type
+        alias_method :local_path, :path if method_defined?(:path)
+      end
+    end
+
+    def self.extended(object)
+      object.class_eval do
+        attr_accessor :original_path, :content_type
+        alias_method :local_path, :path if method_defined?(:path)
+      end
+    end
+
+    # Take the basename of the upload's original filename.
+    # This handles the full Windows paths given by Internet Explorer
+    # (and perhaps other broken user agents) without affecting
+    # those which give the lone filename.
+    # The Windows regexp is adapted from Perl's File::Basename.
+    def original_filename
+      unless defined? @original_filename
+        @original_filename =
+          unless original_path.blank?
+            if original_path =~ /^(?:.*[:\\\/])?(.*)/m
+              $1
+            else
+              File.basename original_path
+            end
+          end
+      end
+      @original_filename
+    end
+  end
+
+  class UploadedStringIO < StringIO
+    include UploadedFile
+  end
+
+  class UploadedTempfile < Tempfile
+    include UploadedFile
+  end
+end

vendor/rails/actionpack/lib/action_controller/url_rewriter.rb

@@ -0,0 +1,227 @@
+module ActionController
+  # In <b>routes.rb</b> one defines URL-to-controller mappings, but the reverse
+  # is also possible: an URL can be generated from one of your routing definitions.
+  # URL generation functionality is centralized in this module.
+  #
+  # See ActionController::Routing and ActionController::Resources for general
+  # information about routing and routes.rb.
+  #
+  # <b>Tip:</b> If you need to generate URLs from your models or some other place,
+  # then ActionController::UrlWriter is what you're looking for. Read on for
+  # an introduction.
+  #
+  # == URL generation from parameters
+  #
+  # As you may know, some functions - such as ActionController::Base#url_for
+  # and ActionView::Helpers::UrlHelper#link_to, can generate URLs given a set
+  # of parameters. For example, you've probably had the chance to write code
+  # like this in one of your views:
+  #
+  #   <%= link_to('Click here', :controller => 'users',
+  #           :action => 'new', :message => 'Welcome!') %>
+  #
+  #   #=> Generates a link to: /users/new?message=Welcome%21
+  #
+  # link_to, and all other functions that require URL generation functionality,
+  # actually use ActionController::UrlWriter under the hood. And in particular,
+  # they use the ActionController::UrlWriter#url_for method. One can generate
+  # the same path as the above example by using the following code:
+  #
+  #   include UrlWriter
+  #   url_for(:controller => 'users',
+  #           :action => 'new',
+  #           :message => 'Welcome!',
+  #           :only_path => true)
+  #   # => "/users/new?message=Welcome%21"
+  #
+  # Notice the <tt>:only_path => true</tt> part. This is because UrlWriter has no
+  # information about the website hostname that your Rails app is serving. So if you
+  # want to include the hostname as well, then you must also pass the <tt>:host</tt>
+  # argument:
+  #
+  #   include UrlWriter
+  #   url_for(:controller => 'users',
+  #           :action => 'new',
+  #           :message => 'Welcome!',
+  #           :host => 'www.example.com')        # Changed this.
+  #   # => "http://www.example.com/users/new?message=Welcome%21"
+  #
+  # By default, all controllers and views have access to a special version of url_for,
+  # that already knows what the current hostname is. So if you use url_for in your
+  # controllers or your views, then you don't need to explicitly pass the <tt>:host</tt>
+  # argument.
+  #
+  # For convenience reasons, mailers provide a shortcut for ActionController::UrlWriter#url_for.
+  # So within mailers, you only have to type 'url_for' instead of 'ActionController::UrlWriter#url_for'
+  # in full. However, mailers don't have hostname information, and what's why you'll still
+  # have to specify the <tt>:host</tt> argument when generating URLs in mailers.
+  #
+  #
+  # == URL generation for named routes
+  #
+  # UrlWriter also allows one to access methods that have been auto-generated from
+  # named routes. For example, suppose that you have a 'users' resource in your
+  # <b>routes.rb</b>:
+  #
+  #   map.resources :users
+  #
+  # This generates, among other things, the method <tt>users_path</tt>. By default,
+  # this method is accessible from your controllers, views and mailers. If you need
+  # to access this auto-generated method from other places (such as a model), then
+  # you can do that in two ways.
+  #
+  # The first way is to include ActionController::UrlWriter in your class:
+  #
+  #   class User < ActiveRecord::Base
+  #     include ActionController::UrlWriter         # !!!
+  #
+  #     def name=(value)
+  #       write_attribute('name', value)
+  #       write_attribute('base_uri', users_path)   # !!!
+  #     end
+  #   end
+  #
+  # The second way is to access them through ActionController::UrlWriter.
+  # The autogenerated named routes methods are available as class methods:
+  #
+  #   class User < ActiveRecord::Base
+  #     def name=(value)
+  #       write_attribute('name', value)
+  #       path = ActionController::UrlWriter.users_path   # !!!
+  #       write_attribute('base_uri', path)               # !!!
+  #     end
+  #   end
+  module UrlWriter
+    RESERVED_PCHAR = ':@&=+$,;%'
+    SAFE_PCHAR = "#{URI::REGEXP::PATTERN::UNRESERVED}#{RESERVED_PCHAR}"
+    if RUBY_VERSION >= '1.9'
+      UNSAFE_PCHAR = Regexp.new("[^#{SAFE_PCHAR}]", false).freeze
+    else
+      UNSAFE_PCHAR = Regexp.new("[^#{SAFE_PCHAR}]", false, 'N').freeze
+    end
+
+    def self.included(base) #:nodoc:
+      ActionController::Routing::Routes.install_helpers(base)
+      base.mattr_accessor :default_url_options
+
+      # The default options for urls written by this writer. Typically a <tt>:host</tt> pair is provided.
+      base.default_url_options ||= {}
+    end
+
+    # Generate a url based on the options provided, default_url_options and the
+    # routes defined in routes.rb.  The following options are supported:
+    #
+    # * <tt>:only_path</tt> - If true, the relative url is returned. Defaults to +false+.
+    # * <tt>:protocol</tt> - The protocol to connect to. Defaults to 'http'.
+    # * <tt>:host</tt> - Specifies the host the link should be targetted at.
+    #   If <tt>:only_path</tt> is false, this option must be
+    #   provided either explicitly, or via +default_url_options+.
+    # * <tt>:port</tt> - Optionally specify the port to connect to.
+    # * <tt>:anchor</tt> - An anchor name to be appended to the path.
+    # * <tt>:skip_relative_url_root</tt> - If true, the url is not constructed using the
+    #   +relative_url_root+ set in ActionController::Base.relative_url_root.
+    # * <tt>:trailing_slash</tt> - If true, adds a trailing slash, as in "/archive/2009/"
+    #
+    # Any other key (<tt>:controller</tt>, <tt>:action</tt>, etc.) given to
+    # +url_for+ is forwarded to the Routes module.
+    #
+    # Examples:
+    #
+    #    url_for :controller => 'tasks', :action => 'testing', :host=>'somehost.org', :port=>'8080'    # => 'http://somehost.org:8080/tasks/testing'
+    #    url_for :controller => 'tasks', :action => 'testing', :host=>'somehost.org', :anchor => 'ok', :only_path => true    # => '/tasks/testing#ok'
+    #    url_for :controller => 'tasks', :action => 'testing', :trailing_slash=>true  # => 'http://somehost.org/tasks/testing/'
+    #    url_for :controller => 'tasks', :action => 'testing', :host=>'somehost.org', :number => '33'  # => 'http://somehost.org/tasks/testing?number=33'
+    def url_for(options)
+      options = self.class.default_url_options.merge(options)
+
+      url = ''
+
+      unless options.delete(:only_path)
+        url << (options.delete(:protocol) || 'http')
+        url << '://' unless url.match("://")
+
+        raise "Missing host to link to! Please provide :host parameter or set default_url_options[:host]" unless options[:host]
+
+        url << options.delete(:host)
+        url << ":#{options.delete(:port)}" if options.key?(:port)
+      else
+        # Delete the unused options to prevent their appearance in the query string.
+        [:protocol, :host, :port, :skip_relative_url_root].each { |k| options.delete(k) }
+      end
+      trailing_slash = options.delete(:trailing_slash) if options.key?(:trailing_slash)
+      url << ActionController::Base.relative_url_root.to_s unless options[:skip_relative_url_root]
+      anchor = "##{URI.escape(options.delete(:anchor).to_param.to_s, UNSAFE_PCHAR)}" if options[:anchor]
+      generated = Routing::Routes.generate(options, {})
+      url << (trailing_slash ? generated.sub(/\?|\z/) { "/" + $& } : generated)
+      url << anchor if anchor
+
+      url
+    end
+  end
+
+  # Rewrites URLs for Base.redirect_to and Base.url_for in the controller.
+  class UrlRewriter #:nodoc:
+    RESERVED_OPTIONS = [:anchor, :params, :only_path, :host, :protocol, :port, :trailing_slash, :skip_relative_url_root]
+    def initialize(request, parameters)
+      @request, @parameters = request, parameters
+    end
+
+    def rewrite(options = {})
+      if options.include?(:overwrite_params)
+        ActiveSupport::Deprecation.warn 'The :overwrite_params option is deprecated. Specify all the necessary parameters instead', caller
+      end
+      rewrite_url(options)
+    end
+
+    def to_str
+      "#{@request.protocol}, #{@request.host_with_port}, #{@request.path}, #{@parameters[:controller]}, #{@parameters[:action]}, #{@request.parameters.inspect}"
+    end
+
+    alias_method :to_s, :to_str
+
+    private
+      # Given a path and options, returns a rewritten URL string
+      def rewrite_url(options)
+        rewritten_url = ""
+
+        unless options[:only_path]
+          rewritten_url << (options[:protocol] || @request.protocol)
+          rewritten_url << "://" unless rewritten_url.match("://")
+          rewritten_url << rewrite_authentication(options)
+          rewritten_url << (options[:host] || @request.host_with_port)
+          rewritten_url << ":#{options.delete(:port)}" if options.key?(:port)
+        end
+
+        path = rewrite_path(options)
+        rewritten_url << ActionController::Base.relative_url_root.to_s unless options[:skip_relative_url_root]
+        rewritten_url << (options[:trailing_slash] ? path.sub(/\?|\z/) { "/" + $& } : path)
+        rewritten_url << "##{CGI.escape(options[:anchor].to_param.to_s)}" if options[:anchor]
+
+        rewritten_url
+      end
+
+      # Given a Hash of options, generates a route
+      def rewrite_path(options)
+        options = options.symbolize_keys
+        options.update(options[:params].symbolize_keys) if options[:params]
+
+        if overwrite = options.delete(:overwrite_params)
+          options.update(@parameters.symbolize_keys)
+          options.update(overwrite.symbolize_keys)
+        end
+
+        RESERVED_OPTIONS.each { |k| options.delete(k) }
+
+        # Generates the query string, too
+        Routing::Routes.generate(options, @request.symbolized_path_parameters)
+      end
+
+      def rewrite_authentication(options)
+        if options[:user] && options[:password]
+          "#{CGI.escape(options.delete(:user))}:#{CGI.escape(options.delete(:password))}@"
+        else
+          ""
+        end
+      end
+  end
+end

vendor/rails/actionpack/lib/action_controller/vendor/html-scanner.rb

@@ -0,0 +1,16 @@
+$LOAD_PATH << "#{File.dirname(__FILE__)}/html-scanner"
+
+module HTML
+  autoload :CDATA, 'html/node'
+  autoload :Document, 'html/document'
+  autoload :FullSanitizer, 'html/sanitizer'
+  autoload :LinkSanitizer, 'html/sanitizer'
+  autoload :Node, 'html/node'
+  autoload :Sanitizer, 'html/sanitizer'
+  autoload :Selector, 'html/selector'
+  autoload :Tag, 'html/node'
+  autoload :Text, 'html/node'
+  autoload :Tokenizer, 'html/tokenizer'
+  autoload :Version, 'html/version'
+  autoload :WhiteListSanitizer, 'html/sanitizer'
+end

vendor/rails/actionpack/lib/action_controller/vendor/html-scanner/html/document.rb

@@ -0,0 +1,68 @@
+require 'html/tokenizer'
+require 'html/node'
+require 'html/selector'
+require 'html/sanitizer'
+
+module HTML #:nodoc:
+  # A top-level HTMl document. You give it a body of text, and it will parse that
+  # text into a tree of nodes.
+  class Document #:nodoc:
+
+    # The root of the parsed document.
+    attr_reader :root
+
+    # Create a new Document from the given text.
+    def initialize(text, strict=false, xml=false)
+      tokenizer = Tokenizer.new(text)
+      @root = Node.new(nil)
+      node_stack = [ @root ]
+      while token = tokenizer.next
+        node = Node.parse(node_stack.last, tokenizer.line, tokenizer.position, token, strict)
+
+        node_stack.last.children << node unless node.tag? && node.closing == :close
+        if node.tag?
+          if node_stack.length > 1 && node.closing == :close
+            if node_stack.last.name == node.name
+              if node_stack.last.children.empty?
+                node_stack.last.children << Text.new(node_stack.last, node.line, node.position, "")
+              end
+              node_stack.pop
+            else
+              open_start = node_stack.last.position - 20
+              open_start = 0 if open_start < 0
+              close_start = node.position - 20
+              close_start = 0 if close_start < 0
+              msg = <<EOF.strip
+ignoring attempt to close #{node_stack.last.name} with #{node.name}
+  opened at byte #{node_stack.last.position}, line #{node_stack.last.line}
+  closed at byte #{node.position}, line #{node.line}
+  attributes at open: #{node_stack.last.attributes.inspect}
+  text around open: #{text[open_start,40].inspect}
+  text around close: #{text[close_start,40].inspect}
+EOF
+              strict ? raise(msg) : warn(msg)
+            end
+          elsif !node.childless?(xml) && node.closing != :close
+            node_stack.push node
+          end
+        end
+      end
+    end
+  
+    # Search the tree for (and return) the first node that matches the given
+    # conditions. The conditions are interpreted differently for different node
+    # types, see HTML::Text#find and HTML::Tag#find.
+    def find(conditions)
+      @root.find(conditions)
+    end
+
+    # Search the tree for (and return) all nodes that match the given
+    # conditions. The conditions are interpreted differently for different node
+    # types, see HTML::Text#find and HTML::Tag#find.
+    def find_all(conditions)
+      @root.find_all(conditions)
+    end
+    
+  end
+
+end

vendor/rails/actionpack/lib/action_controller/vendor/html-scanner/html/node.rb

@@ -0,0 +1,537 @@
+require 'strscan'
+
+module HTML #:nodoc:
+  
+  class Conditions < Hash #:nodoc:
+    def initialize(hash)
+      super()
+      hash = { :content => hash } unless Hash === hash
+      hash = keys_to_symbols(hash)
+      hash.each do |k,v|
+        case k
+          when :tag, :content then
+            # keys are valid, and require no further processing
+          when :attributes then
+            hash[k] = keys_to_strings(v)
+          when :parent, :child, :ancestor, :descendant, :sibling, :before,
+                  :after
+            hash[k] = Conditions.new(v)
+          when :children
+            hash[k] = v = keys_to_symbols(v)
+            v.each do |k,v2|
+              case k
+                when :count, :greater_than, :less_than
+                  # keys are valid, and require no further processing
+                when :only
+                  v[k] = Conditions.new(v2)
+                else
+                  raise "illegal key #{k.inspect} => #{v2.inspect}"
+              end
+            end
+          else
+            raise "illegal key #{k.inspect} => #{v.inspect}"
+        end
+      end
+      update hash
+    end
+
+    private
+
+      def keys_to_strings(hash)
+        hash.keys.inject({}) do |h,k|
+          h[k.to_s] = hash[k]
+          h
+        end
+      end
+
+      def keys_to_symbols(hash)
+        hash.keys.inject({}) do |h,k|
+          raise "illegal key #{k.inspect}" unless k.respond_to?(:to_sym)
+          h[k.to_sym] = hash[k]
+          h
+        end
+      end
+  end
+
+  # The base class of all nodes, textual and otherwise, in an HTML document.
+  class Node #:nodoc:
+    # The array of children of this node. Not all nodes have children.
+    attr_reader :children
+    
+    # The parent node of this node. All nodes have a parent, except for the
+    # root node.
+    attr_reader :parent
+    
+    # The line number of the input where this node was begun
+    attr_reader :line
+    
+    # The byte position in the input where this node was begun
+    attr_reader :position
+    
+    # Create a new node as a child of the given parent.
+    def initialize(parent, line=0, pos=0)
+      @parent = parent
+      @children = []
+      @line, @position = line, pos
+    end
+
+    # Return a textual representation of the node.
+    def to_s
+      s = ""
+      @children.each { |child| s << child.to_s }
+      s
+    end
+
+    # Return false (subclasses must override this to provide specific matching
+    # behavior.) +conditions+ may be of any type.
+    def match(conditions)
+      false
+    end
+
+    # Search the children of this node for the first node for which #find
+    # returns non +nil+. Returns the result of the #find call that succeeded.
+    def find(conditions)
+      conditions = validate_conditions(conditions)
+      @children.each do |child|        
+        node = child.find(conditions)
+        return node if node
+      end
+      nil
+    end
+
+    # Search for all nodes that match the given conditions, and return them
+    # as an array.
+    def find_all(conditions)
+      conditions = validate_conditions(conditions)
+
+      matches = []
+      matches << self if match(conditions)
+      @children.each do |child|
+        matches.concat child.find_all(conditions)
+      end
+      matches
+    end
+
+    # Returns +false+. Subclasses may override this if they define a kind of
+    # tag.
+    def tag?
+      false
+    end
+
+    def validate_conditions(conditions)
+      Conditions === conditions ? conditions : Conditions.new(conditions)
+    end
+
+    def ==(node)
+      return false unless self.class == node.class && children.size == node.children.size
+
+      equivalent = true
+
+      children.size.times do |i|
+        equivalent &&= children[i] == node.children[i]
+      end
+
+      equivalent
+    end
+    
+    class <<self
+      def parse(parent, line, pos, content, strict=true)
+        if content !~ /^<\S/
+          Text.new(parent, line, pos, content)
+        else
+          scanner = StringScanner.new(content)
+
+          unless scanner.skip(/</)
+            if strict
+              raise "expected <"
+            else
+              return Text.new(parent, line, pos, content)
+            end
+          end
+
+          if scanner.skip(/!\[CDATA\[/)
+            unless scanner.skip_until(/\]\]>/)
+              if strict
+                raise "expected ]]> (got #{scanner.rest.inspect} for #{content})"
+              else
+                scanner.skip_until(/\Z/)
+              end
+            end
+
+            return CDATA.new(parent, line, pos, scanner.pre_match.gsub(/<!\[CDATA\[/, ''))
+          end
+          
+          closing = ( scanner.scan(/\//) ? :close : nil )
+          return Text.new(parent, line, pos, content) unless name = scanner.scan(/[-:\w\x00-\x09\x0b-\x0c\x0e-\x1f]+/)
+          name.downcase!
+  
+          unless closing
+            scanner.skip(/\s*/)
+            attributes = {}
+            while attr = scanner.scan(/[-\w:]+/)
+              value = true
+              if scanner.scan(/\s*=\s*/)
+                if delim = scanner.scan(/['"]/)
+                  value = ""
+                  while text = scanner.scan(/[^#{delim}\\]+|./)
+                    case text
+                      when "\\" then
+                        value << text
+                        value << scanner.getch
+                      when delim
+                        break
+                      else value << text
+                    end
+                  end
+                else
+                  value = scanner.scan(/[^\s>\/]+/)
+                end
+              end
+              attributes[attr.downcase] = value
+              scanner.skip(/\s*/)
+            end
+    
+            closing = ( scanner.scan(/\//) ? :self : nil )
+          end
+          
+          unless scanner.scan(/\s*>/)
+            if strict
+              raise "expected > (got #{scanner.rest.inspect} for #{content}, #{attributes.inspect})" 
+            else
+              # throw away all text until we find what we're looking for
+              scanner.skip_until(/>/) or scanner.terminate
+            end
+          end
+
+          Tag.new(parent, line, pos, name, attributes, closing)
+        end
+      end
+    end
+  end
+
+  # A node that represents text, rather than markup.
+  class Text < Node #:nodoc:
+    
+    attr_reader :content
+    
+    # Creates a new text node as a child of the given parent, with the given
+    # content.
+    def initialize(parent, line, pos, content)
+      super(parent, line, pos)
+      @content = content
+    end
+
+    # Returns the content of this node.
+    def to_s
+      @content
+    end
+
+    # Returns +self+ if this node meets the given conditions. Text nodes support
+    # conditions of the following kinds:
+    #
+    # * if +conditions+ is a string, it must be a substring of the node's
+    #   content
+    # * if +conditions+ is a regular expression, it must match the node's
+    #   content
+    # * if +conditions+ is a hash, it must contain a <tt>:content</tt> key that
+    #   is either a string or a regexp, and which is interpreted as described
+    #   above.
+    def find(conditions)
+      match(conditions) && self
+    end
+    
+    # Returns non-+nil+ if this node meets the given conditions, or +nil+
+    # otherwise. See the discussion of #find for the valid conditions.
+    def match(conditions)
+      case conditions
+        when String
+          @content == conditions
+        when Regexp
+          @content =~ conditions
+        when Hash
+          conditions = validate_conditions(conditions)
+
+          # Text nodes only have :content, :parent, :ancestor
+          unless (conditions.keys - [:content, :parent, :ancestor]).empty?
+            return false
+          end
+
+          match(conditions[:content])
+        else
+          nil
+      end
+    end
+
+    def ==(node)
+      return false unless super
+      content == node.content
+    end
+  end
+  
+  # A CDATA node is simply a text node with a specialized way of displaying
+  # itself.
+  class CDATA < Text #:nodoc:
+    def to_s
+      "<![CDATA[#{super}]]>"
+    end
+  end
+
+  # A Tag is any node that represents markup. It may be an opening tag, a
+  # closing tag, or a self-closing tag. It has a name, and may have a hash of
+  # attributes.
+  class Tag < Node #:nodoc:
+    
+    # Either +nil+, <tt>:close</tt>, or <tt>:self</tt>
+    attr_reader :closing
+    
+    # Either +nil+, or a hash of attributes for this node.
+    attr_reader :attributes
+
+    # The name of this tag.
+    attr_reader :name
+        
+    # Create a new node as a child of the given parent, using the given content
+    # to describe the node. It will be parsed and the node name, attributes and
+    # closing status extracted.
+    def initialize(parent, line, pos, name, attributes, closing)
+      super(parent, line, pos)
+      @name = name
+      @attributes = attributes
+      @closing = closing
+    end
+
+    # A convenience for obtaining an attribute of the node. Returns +nil+ if
+    # the node has no attributes.
+    def [](attr)
+      @attributes ? @attributes[attr] : nil
+    end
+
+    # Returns non-+nil+ if this tag can contain child nodes.
+    def childless?(xml = false)
+      return false if xml && @closing.nil?
+      !@closing.nil? ||
+        @name =~ /^(img|br|hr|link|meta|area|base|basefont|
+                    col|frame|input|isindex|param)$/ox
+    end
+
+    # Returns a textual representation of the node
+    def to_s
+      if @closing == :close
+        "</#{@name}>"
+      else
+        s = "<#{@name}"
+        @attributes.each do |k,v|
+          s << " #{k}"
+          s << "=\"#{v}\"" if String === v
+        end
+        s << " /" if @closing == :self
+        s << ">"
+        @children.each { |child| s << child.to_s }
+        s << "</#{@name}>" if @closing != :self && !@children.empty?
+        s
+      end
+    end
+
+    # If either the node or any of its children meet the given conditions, the
+    # matching node is returned. Otherwise, +nil+ is returned. (See the
+    # description of the valid conditions in the +match+ method.)
+    def find(conditions)
+      match(conditions) && self || super
+    end
+
+    # Returns +true+, indicating that this node represents an HTML tag.
+    def tag?
+      true
+    end
+    
+    # Returns +true+ if the node meets any of the given conditions. The
+    # +conditions+ parameter must be a hash of any of the following keys
+    # (all are optional):
+    #
+    # * <tt>:tag</tt>: the node name must match the corresponding value
+    # * <tt>:attributes</tt>: a hash. The node's values must match the
+    #   corresponding values in the hash.
+    # * <tt>:parent</tt>: a hash. The node's parent must match the
+    #   corresponding hash.
+    # * <tt>:child</tt>: a hash. At least one of the node's immediate children
+    #   must meet the criteria described by the hash.
+    # * <tt>:ancestor</tt>: a hash. At least one of the node's ancestors must
+    #   meet the criteria described by the hash.
+    # * <tt>:descendant</tt>: a hash. At least one of the node's descendants
+    #   must meet the criteria described by the hash.
+    # * <tt>:sibling</tt>: a hash. At least one of the node's siblings must
+    #   meet the criteria described by the hash.
+    # * <tt>:after</tt>: a hash. The node must be after any sibling meeting
+    #   the criteria described by the hash, and at least one sibling must match.
+    # * <tt>:before</tt>: a hash. The node must be before any sibling meeting
+    #   the criteria described by the hash, and at least one sibling must match.
+    # * <tt>:children</tt>: a hash, for counting children of a node. Accepts the
+    #   keys:
+    # ** <tt>:count</tt>: either a number or a range which must equal (or
+    #    include) the number of children that match.
+    # ** <tt>:less_than</tt>: the number of matching children must be less than
+    #    this number.
+    # ** <tt>:greater_than</tt>: the number of matching children must be
+    #    greater than this number.
+    # ** <tt>:only</tt>: another hash consisting of the keys to use
+    #    to match on the children, and only matching children will be
+    #    counted.
+    #
+    # Conditions are matched using the following algorithm:
+    #
+    # * if the condition is a string, it must be a substring of the value.
+    # * if the condition is a regexp, it must match the value.
+    # * if the condition is a number, the value must match number.to_s.
+    # * if the condition is +true+, the value must not be +nil+.
+    # * if the condition is +false+ or +nil+, the value must be +nil+.
+    #
+    # Usage:
+    #
+    #   # test if the node is a "span" tag
+    #   node.match :tag => "span"
+    #
+    #   # test if the node's parent is a "div"
+    #   node.match :parent => { :tag => "div" }
+    #
+    #   # test if any of the node's ancestors are "table" tags
+    #   node.match :ancestor => { :tag => "table" }
+    #
+    #   # test if any of the node's immediate children are "em" tags
+    #   node.match :child => { :tag => "em" }
+    #
+    #   # test if any of the node's descendants are "strong" tags
+    #   node.match :descendant => { :tag => "strong" }
+    #
+    #   # test if the node has between 2 and 4 span tags as immediate children
+    #   node.match :children => { :count => 2..4, :only => { :tag => "span" } } 
+    #
+    #   # get funky: test to see if the node is a "div", has a "ul" ancestor
+    #   # and an "li" parent (with "class" = "enum"), and whether or not it has
+    #   # a "span" descendant that contains # text matching /hello world/:
+    #   node.match :tag => "div",
+    #              :ancestor => { :tag => "ul" },
+    #              :parent => { :tag => "li",
+    #                           :attributes => { :class => "enum" } },
+    #              :descendant => { :tag => "span",
+    #                               :child => /hello world/ }
+    def match(conditions)
+      conditions = validate_conditions(conditions)
+      # check content of child nodes
+      if conditions[:content]
+        if children.empty?
+          return false unless match_condition("", conditions[:content])
+        else
+          return false unless children.find { |child| child.match(conditions[:content]) }
+        end
+      end
+
+      # test the name
+      return false unless match_condition(@name, conditions[:tag]) if conditions[:tag]
+
+      # test attributes
+      (conditions[:attributes] || {}).each do |key, value|
+        return false unless match_condition(self[key], value)
+      end
+
+      # test parent
+      return false unless parent.match(conditions[:parent]) if conditions[:parent]
+
+      # test children
+      return false unless children.find { |child| child.match(conditions[:child]) } if conditions[:child]
+   
+      # test ancestors
+      if conditions[:ancestor]
+        return false unless catch :found do
+          p = self
+          throw :found, true if p.match(conditions[:ancestor]) while p = p.parent
+        end
+      end
+
+      # test descendants
+      if conditions[:descendant]
+        return false unless children.find do |child|
+          # test the child
+          child.match(conditions[:descendant]) ||
+          # test the child's descendants
+          child.match(:descendant => conditions[:descendant])
+        end
+      end
+      
+      # count children
+      if opts = conditions[:children]
+        matches = children.select do |c|
+          (c.kind_of?(HTML::Tag) and (c.closing == :self or ! c.childless?))
+        end
+        
+        matches = matches.select { |c| c.match(opts[:only]) } if opts[:only]
+        opts.each do |key, value|
+          next if key == :only
+          case key
+            when :count
+              if Integer === value
+                return false if matches.length != value
+              else
+                return false unless value.include?(matches.length)
+              end
+            when :less_than
+              return false unless matches.length < value
+            when :greater_than
+              return false unless matches.length > value
+            else raise "unknown count condition #{key}"
+          end
+        end
+      end
+
+      # test siblings
+      if conditions[:sibling] || conditions[:before] || conditions[:after]
+        siblings = parent ? parent.children : []
+        self_index = siblings.index(self)
+
+        if conditions[:sibling]
+          return false unless siblings.detect do |s| 
+            s != self && s.match(conditions[:sibling])
+          end
+        end
+
+        if conditions[:before]
+          return false unless siblings[self_index+1..-1].detect do |s| 
+            s != self && s.match(conditions[:before])
+          end
+        end
+
+        if conditions[:after]
+          return false unless siblings[0,self_index].detect do |s| 
+            s != self && s.match(conditions[:after])
+          end
+        end
+      end
+  
+      true
+    end
+
+    def ==(node)
+      return false unless super
+      return false unless closing == node.closing && self.name == node.name
+      attributes == node.attributes
+    end
+    
+    private
+      # Match the given value to the given condition.
+      def match_condition(value, condition)
+        case condition
+          when String
+            value && value == condition
+          when Regexp
+            value && value.match(condition)
+          when Numeric
+            value == condition.to_s
+          when true
+            !value.nil?
+          when false, nil
+            value.nil?
+          else
+            false
+        end
+      end
+  end
+end

vendor/rails/actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb

@@ -0,0 +1,173 @@
+module HTML
+  class Sanitizer
+    def sanitize(text, options = {})
+      return text unless sanitizeable?(text)
+      tokenize(text, options).join
+    end
+    
+    def sanitizeable?(text)
+      !(text.nil? || text.empty? || !text.index("<"))
+    end
+    
+  protected
+    def tokenize(text, options)
+      tokenizer = HTML::Tokenizer.new(text)
+      result = []
+      while token = tokenizer.next
+        node = Node.parse(nil, 0, 0, token, false)
+        process_node node, result, options
+      end
+      result
+    end
+    
+    def process_node(node, result, options)
+      result << node.to_s
+    end
+  end
+  
+  class FullSanitizer < Sanitizer
+    def sanitize(text, options = {})
+      result = super
+      # strip any comments, and if they have a newline at the end (ie. line with
+      # only a comment) strip that too
+      result.gsub!(/<!--(.*?)-->[\n]?/m, "") if result
+      # Recurse - handle all dirty nested tags
+      result == text ? result : sanitize(result, options)
+    end
+    
+    def process_node(node, result, options)
+      result << node.to_s if node.class == HTML::Text
+    end
+  end
+  
+  class LinkSanitizer < FullSanitizer
+    cattr_accessor :included_tags, :instance_writer => false
+    self.included_tags = Set.new(%w(a href))
+
+    def sanitizeable?(text)
+      !(text.nil? || text.empty? || !((text.index("<a") || text.index("<href")) && text.index(">")))
+    end
+    
+  protected
+    def process_node(node, result, options)
+      result << node.to_s unless node.is_a?(HTML::Tag) && included_tags.include?(node.name) 
+    end
+  end
+  
+  class WhiteListSanitizer < Sanitizer
+    [:protocol_separator, :uri_attributes, :allowed_attributes, :allowed_tags, :allowed_protocols, :bad_tags,
+     :allowed_css_properties, :allowed_css_keywords, :shorthand_css_properties].each do |attr|
+      class_inheritable_accessor attr, :instance_writer => false
+    end
+
+    # A regular expression of the valid characters used to separate protocols like
+    # the ':' in 'http://foo.com'
+    self.protocol_separator     = /:|(&#0*58)|(&#x70)|(%|&#37;)3A/
+    
+    # Specifies a Set of HTML attributes that can have URIs.
+    self.uri_attributes         = Set.new(%w(href src cite action longdesc xlink:href lowsrc))
+
+    # Specifies a Set of 'bad' tags that the #sanitize helper will remove completely, as opposed
+    # to just escaping harmless tags like &lt;font&gt;
+    self.bad_tags               = Set.new(%w(script))
+    
+    # Specifies the default Set of tags that the #sanitize helper will allow unscathed.
+    self.allowed_tags           = Set.new(%w(strong em b i p code pre tt samp kbd var sub 
+      sup dfn cite big small address hr br div span h1 h2 h3 h4 h5 h6 ul ol li dt dd abbr 
+      acronym a img blockquote del ins))
+
+    # Specifies the default Set of html attributes that the #sanitize helper will leave 
+    # in the allowed tag.
+    self.allowed_attributes     = Set.new(%w(href src width height alt cite datetime title class name xml:lang abbr))
+    
+    # Specifies the default Set of acceptable css properties that #sanitize and #sanitize_css will accept.
+    self.allowed_protocols      = Set.new(%w(ed2k ftp http https irc mailto news gopher nntp telnet webcal xmpp callto 
+      feed svn urn aim rsync tag ssh sftp rtsp afs))
+    
+    # Specifies the default Set of acceptable css keywords that #sanitize and #sanitize_css will accept.
+    self.allowed_css_properties = Set.new(%w(azimuth background-color border-bottom-color border-collapse 
+      border-color border-left-color border-right-color border-top-color clear color cursor direction display 
+      elevation float font font-family font-size font-style font-variant font-weight height letter-spacing line-height
+      overflow pause pause-after pause-before pitch pitch-range richness speak speak-header speak-numeral speak-punctuation
+      speech-rate stress text-align text-decoration text-indent unicode-bidi vertical-align voice-family volume white-space
+      width))
+  
+    # Specifies the default Set of acceptable css keywords that #sanitize and #sanitize_css will accept.
+    self.allowed_css_keywords   = Set.new(%w(auto aqua black block blue bold both bottom brown center
+      collapse dashed dotted fuchsia gray green !important italic left lime maroon medium none navy normal
+      nowrap olive pointer purple red right solid silver teal top transparent underline white yellow))
+
+    # Specifies the default Set of allowed shorthand css properties for the #sanitize and #sanitize_css helpers.
+    self.shorthand_css_properties = Set.new(%w(background border margin padding))
+
+    # Sanitizes a block of css code.  Used by #sanitize when it comes across a style attribute
+    def sanitize_css(style)
+      # disallow urls
+      style = style.to_s.gsub(/url\s*\(\s*[^\s)]+?\s*\)\s*/, ' ')
+
+      # gauntlet
+      if style !~ /^([:,;#%.\sa-zA-Z0-9!]|\w-\w|\'[\s\w]+\'|\"[\s\w]+\"|\([\d,\s]+\))*$/ ||
+          style !~ /^(\s*[-\w]+\s*:\s*[^:;]*(;|$)\s*)*$/
+        return ''
+      end
+
+      clean = []
+      style.scan(/([-\w]+)\s*:\s*([^:;]*)/) do |prop,val|
+        if allowed_css_properties.include?(prop.downcase)
+          clean <<  prop + ': ' + val + ';'
+        elsif shorthand_css_properties.include?(prop.split('-')[0].downcase) 
+          unless val.split().any? do |keyword|
+            !allowed_css_keywords.include?(keyword) && 
+              keyword !~ /^(#[0-9a-f]+|rgb\(\d+%?,\d*%?,?\d*%?\)?|\d{0,2}\.?\d{0,2}(cm|em|ex|in|mm|pc|pt|px|%|,|\))?)$/
+          end
+            clean << prop + ': ' + val + ';'
+          end
+        end
+      end
+      clean.join(' ')
+    end
+
+  protected
+    def tokenize(text, options)
+      options[:parent] = []
+      options[:attributes] ||= allowed_attributes
+      options[:tags]       ||= allowed_tags
+      super
+    end
+
+    def process_node(node, result, options)
+      result << case node
+        when HTML::Tag
+          if node.closing == :close
+            options[:parent].shift
+          else
+            options[:parent].unshift node.name
+          end
+          
+          process_attributes_for node, options
+
+          options[:tags].include?(node.name) ? node : nil
+        else
+          bad_tags.include?(options[:parent].first) ? nil : node.to_s.gsub(/</, "&lt;")
+      end
+    end
+    
+    def process_attributes_for(node, options)
+      return unless node.attributes
+      node.attributes.keys.each do |attr_name|
+        value = node.attributes[attr_name].to_s
+
+        if !options[:attributes].include?(attr_name) || contains_bad_protocols?(attr_name, value)
+          node.attributes.delete(attr_name)
+        else
+          node.attributes[attr_name] = attr_name == 'style' ? sanitize_css(value) : CGI::escapeHTML(CGI::unescapeHTML(value))
+        end
+      end
+    end
+
+    def contains_bad_protocols?(attr_name, value)
+      uri_attributes.include?(attr_name) && 
+      (value =~ /(^[^\/:]*):|(&#0*58)|(&#x70)|(%|&#37;)3A/ && !allowed_protocols.include?(value.split(protocol_separator).first))
+    end
+  end
+end

vendor/rails/actionpack/lib/action_controller/vendor/html-scanner/html/selector.rb

@@ -0,0 +1,828 @@
+#--
+# Copyright (c) 2006 Assaf Arkin (http://labnotes.org)
+# Under MIT and/or CC By license.
+#++
+
+module HTML
+
+  # Selects HTML elements using CSS 2 selectors.
+  #
+  # The +Selector+ class uses CSS selector expressions to match and select
+  # HTML elements.
+  #
+  # For example:
+  #   selector = HTML::Selector.new "form.login[action=/login]"
+  # creates a new selector that matches any +form+ element with the class
+  # +login+ and an attribute +action+ with the value <tt>/login</tt>.
+  #
+  # === Matching Elements
+  #
+  # Use the #match method to determine if an element matches the selector.
+  #
+  # For simple selectors, the method returns an array with that element,
+  # or +nil+ if the element does not match. For complex selectors (see below)
+  # the method returns an array with all matched elements, of +nil+ if no
+  # match found.
+  #
+  # For example:
+  #   if selector.match(element)
+  #     puts "Element is a login form"
+  #   end
+  #
+  # === Selecting Elements
+  #
+  # Use the #select method to select all matching elements starting with
+  # one element and going through all children in depth-first order.
+  #
+  # This method returns an array of all matching elements, an empty array
+  # if no match is found
+  #
+  # For example:
+  #   selector = HTML::Selector.new "input[type=text]"
+  #   matches = selector.select(element)
+  #   matches.each do |match|
+  #     puts "Found text field with name #{match.attributes['name']}"
+  #   end
+  #
+  # === Expressions
+  #
+  # Selectors can match elements using any of the following criteria:
+  # * <tt>name</tt> -- Match an element based on its name (tag name).
+  #   For example, <tt>p</tt> to match a paragraph. You can use <tt>*</tt>
+  #   to match any element.
+  # * <tt>#</tt><tt>id</tt> -- Match an element based on its identifier (the
+  #   <tt>id</tt> attribute). For example, <tt>#</tt><tt>page</tt>.
+  # * <tt>.class</tt> -- Match an element based on its class name, all
+  #   class names if more than one specified.
+  # * <tt>[attr]</tt> -- Match an element that has the specified attribute.
+  # * <tt>[attr=value]</tt> -- Match an element that has the specified
+  #   attribute and value. (More operators are supported see below)
+  # * <tt>:pseudo-class</tt> -- Match an element based on a pseudo class,
+  #   such as <tt>:nth-child</tt> and <tt>:empty</tt>.
+  # * <tt>:not(expr)</tt> -- Match an element that does not match the
+  #   negation expression.
+  #
+  # When using a combination of the above, the element name comes first
+  # followed by identifier, class names, attributes, pseudo classes and
+  # negation in any order. Do not separate these parts with spaces!
+  # Space separation is used for descendant selectors.
+  #
+  # For example:
+  #   selector = HTML::Selector.new "form.login[action=/login]"
+  # The matched element must be of type +form+ and have the class +login+.
+  # It may have other classes, but the class +login+ is required to match.
+  # It must also have an attribute called +action+ with the value
+  # <tt>/login</tt>.
+  #
+  # This selector will match the following element:
+  #   <form class="login form" method="post" action="/login">
+  # but will not match the element:
+  #   <form method="post" action="/logout">
+  #
+  # === Attribute Values
+  #
+  # Several operators are supported for matching attributes:
+  # * <tt>name</tt> -- The element must have an attribute with that name.
+  # * <tt>name=value</tt> -- The element must have an attribute with that
+  #   name and value.
+  # * <tt>name^=value</tt> -- The attribute value must start with the
+  #   specified value.
+  # * <tt>name$=value</tt> -- The attribute value must end with the
+  #   specified value.
+  # * <tt>name*=value</tt> -- The attribute value must contain the
+  #   specified value.
+  # * <tt>name~=word</tt> -- The attribute value must contain the specified
+  #   word (space separated).
+  # * <tt>name|=word</tt> -- The attribute value must start with specified
+  #   word.
+  #
+  # For example, the following two selectors match the same element:
+  #   #my_id
+  #   [id=my_id]
+  # and so do the following two selectors:
+  #   .my_class
+  #   [class~=my_class]
+  #
+  # === Alternatives, siblings, children
+  #
+  # Complex selectors use a combination of expressions to match elements:
+  # * <tt>expr1 expr2</tt> -- Match any element against the second expression
+  #   if it has some parent element that matches the first expression.
+  # * <tt>expr1 > expr2</tt> -- Match any element against the second expression
+  #   if it is the child of an element that matches the first expression.
+  # * <tt>expr1 + expr2</tt> -- Match any element against the second expression
+  #   if it immediately follows an element that matches the first expression.
+  # * <tt>expr1 ~ expr2</tt> -- Match any element against the second expression
+  #   that comes after an element that matches the first expression.
+  # * <tt>expr1, expr2</tt> -- Match any element against the first expression,
+  #   or against the second expression.
+  #
+  # Since children and sibling selectors may match more than one element given
+  # the first element, the #match method may return more than one match.
+  #
+  # === Pseudo classes
+  #
+  # Pseudo classes were introduced in CSS 3. They are most often used to select
+  # elements in a given position:
+  # * <tt>:root</tt> -- Match the element only if it is the root element
+  #   (no parent element).
+  # * <tt>:empty</tt> -- Match the element only if it has no child elements,
+  #   and no text content.
+  # * <tt>:only-child</tt> -- Match the element if it is the only child (element)
+  #   of its parent element.
+  # * <tt>:only-of-type</tt> -- Match the element if it is the only child (element)
+  #   of its parent element and its type.
+  # * <tt>:first-child</tt> -- Match the element if it is the first child (element)
+  #   of its parent element.
+  # * <tt>:first-of-type</tt> -- Match the element if it is the first child (element)
+  #   of its parent element of its type.
+  # * <tt>:last-child</tt> -- Match the element if it is the last child (element)
+  #   of its parent element.
+  # * <tt>:last-of-type</tt> -- Match the element if it is the last child (element)
+  #   of its parent element of its type.
+  # * <tt>:nth-child(b)</tt> -- Match the element if it is the b-th child (element)
+  #   of its parent element. The value <tt>b</tt> specifies its index, starting with 1.
+  # * <tt>:nth-child(an+b)</tt> -- Match the element if it is the b-th child (element)
+  #   in each group of <tt>a</tt> child elements of its parent element.
+  # * <tt>:nth-child(-an+b)</tt> -- Match the element if it is the first child (element)
+  #   in each group of <tt>a</tt> child elements, up to the first <tt>b</tt> child
+  #   elements of its parent element.
+  # * <tt>:nth-child(odd)</tt> -- Match element in the odd position (i.e. first, third).
+  #   Same as <tt>:nth-child(2n+1)</tt>.
+  # * <tt>:nth-child(even)</tt> -- Match element in the even position (i.e. second,
+  #   fourth). Same as <tt>:nth-child(2n+2)</tt>.
+  # * <tt>:nth-of-type(..)</tt> -- As above, but only counts elements of its type.
+  # * <tt>:nth-last-child(..)</tt> -- As above, but counts from the last child.
+  # * <tt>:nth-last-of-type(..)</tt> -- As above, but counts from the last child and
+  #   only elements of its type.
+  # * <tt>:not(selector)</tt> -- Match the element only if the element does not
+  #   match the simple selector.
+  #
+  # As you can see, <tt>:nth-child<tt> pseudo class and its variant can get quite
+  # tricky and the CSS specification doesn't do a much better job explaining it.
+  # But after reading the examples and trying a few combinations, it's easy to
+  # figure out.
+  #
+  # For example:
+  #   table tr:nth-child(odd)
+  # Selects every second row in the table starting with the first one.
+  #
+  #   div p:nth-child(4)
+  # Selects the fourth paragraph in the +div+, but not if the +div+ contains
+  # other elements, since those are also counted.
+  #
+  #   div p:nth-of-type(4)
+  # Selects the fourth paragraph in the +div+, counting only paragraphs, and
+  # ignoring all other elements.
+  #
+  #   div p:nth-of-type(-n+4)
+  # Selects the first four paragraphs, ignoring all others.
+  #
+  # And you can always select an element that matches one set of rules but
+  # not another using <tt>:not</tt>. For example:
+  #   p:not(.post)
+  # Matches all paragraphs that do not have the class <tt>.post</tt>.
+  #   
+  # === Substitution Values
+  #
+  # You can use substitution with identifiers, class names and element values.
+  # A substitution takes the form of a question mark (<tt>?</tt>) and uses the
+  # next value in the argument list following the CSS expression.
+  #
+  # The substitution value may be a string or a regular expression. All other
+  # values are converted to strings.
+  #
+  # For example:
+  #   selector = HTML::Selector.new "#?", /^\d+$/
+  # matches any element whose identifier consists of one or more digits.
+  #
+  # See http://www.w3.org/TR/css3-selectors/
+  class Selector
+
+
+    # An invalid selector.
+    class InvalidSelectorError < StandardError #:nodoc:
+    end
+
+
+    class << self
+
+      # :call-seq:
+      #   Selector.for_class(cls) => selector
+      #
+      # Creates a new selector for the given class name.
+      def for_class(cls)
+        self.new([".?", cls])
+      end
+
+
+      # :call-seq:
+      #   Selector.for_id(id) => selector
+      #
+      # Creates a new selector for the given id.
+      def for_id(id)
+        self.new(["#?", id])
+      end
+
+    end
+
+
+    # :call-seq:
+    #   Selector.new(string, [values ...]) => selector
+    #
+    # Creates a new selector from a CSS 2 selector expression.
+    #
+    # The first argument is the selector expression. All other arguments
+    # are used for value substitution.
+    #
+    # Throws InvalidSelectorError is the selector expression is invalid.
+    def initialize(selector, *values)
+      raise ArgumentError, "CSS expression cannot be empty" if selector.empty?
+      @source = ""
+      values = values[0] if values.size == 1 && values[0].is_a?(Array)
+
+      # We need a copy to determine if we failed to parse, and also
+      # preserve the original pass by-ref statement.
+      statement = selector.strip.dup
+
+      # Create a simple selector, along with negation.
+      simple_selector(statement, values).each { |name, value| instance_variable_set("@#{name}", value) }
+
+      @alternates = []
+      @depends = nil
+
+      # Alternative selector.
+      if statement.sub!(/^\s*,\s*/, "")
+        second = Selector.new(statement, values)
+        @alternates << second
+        # If there are alternate selectors, we group them in the top selector.
+        if alternates = second.instance_variable_get(:@alternates)
+          second.instance_variable_set(:@alternates, [])
+          @alternates.concat alternates
+        end
+        @source << " , " << second.to_s
+      # Sibling selector: create a dependency into second selector that will
+      # match element immediately following this one.
+      elsif statement.sub!(/^\s*\+\s*/, "")
+        second = next_selector(statement, values)
+        @depends = lambda do |element, first|
+          if element = next_element(element)
+            second.match(element, first)
+          end
+        end
+        @source << " + " << second.to_s
+      # Adjacent selector: create a dependency into second selector that will
+      # match all elements following this one.
+      elsif statement.sub!(/^\s*~\s*/, "")
+        second = next_selector(statement, values)
+        @depends = lambda do |element, first|
+          matches = []
+          while element = next_element(element)
+            if subset = second.match(element, first)
+              if first && !subset.empty?
+                matches << subset.first
+                break
+              else
+                matches.concat subset
+              end
+            end
+          end
+          matches.empty? ? nil : matches
+        end
+        @source << " ~ " << second.to_s
+      # Child selector: create a dependency into second selector that will
+      # match a child element of this one.
+      elsif statement.sub!(/^\s*>\s*/, "")
+        second = next_selector(statement, values)
+        @depends = lambda do |element, first|
+          matches = []
+          element.children.each do |child|
+            if child.tag? && subset = second.match(child, first)
+              if first && !subset.empty?
+                matches << subset.first
+                break
+              else
+                matches.concat subset
+              end
+            end
+          end
+          matches.empty? ? nil : matches
+        end
+        @source << " > " << second.to_s
+      # Descendant selector: create a dependency into second selector that
+      # will match all descendant elements of this one. Note,
+      elsif statement =~ /^\s+\S+/ && statement != selector
+        second = next_selector(statement, values)
+        @depends = lambda do |element, first|
+          matches = []
+          stack = element.children.reverse
+          while node = stack.pop
+            next unless node.tag?
+            if subset = second.match(node, first)
+              if first && !subset.empty?
+                matches << subset.first
+                break
+              else
+                matches.concat subset
+              end
+            elsif children = node.children
+              stack.concat children.reverse
+            end
+          end
+          matches.empty? ? nil : matches
+        end
+        @source << " " << second.to_s
+      else
+        # The last selector is where we check that we parsed
+        # all the parts.
+        unless statement.empty? || statement.strip.empty?
+          raise ArgumentError, "Invalid selector: #{statement}"
+        end
+      end
+    end
+
+
+    # :call-seq:
+    #   match(element, first?) => array or nil
+    #
+    # Matches an element against the selector.
+    #
+    # For a simple selector this method returns an array with the
+    # element if the element matches, nil otherwise.
+    #
+    # For a complex selector (sibling and descendant) this method
+    # returns an array with all matching elements, nil if no match is
+    # found.
+    #
+    # Use +first_only=true+ if you are only interested in the first element.
+    #
+    # For example:
+    #   if selector.match(element)
+    #     puts "Element is a login form"
+    #   end
+    def match(element, first_only = false)
+      # Match element if no element name or element name same as element name
+      if matched = (!@tag_name || @tag_name == element.name)
+        # No match if one of the attribute matches failed
+        for attr in @attributes
+          if element.attributes[attr[0]] !~ attr[1]
+            matched = false
+            break
+          end
+        end
+      end
+
+      # Pseudo class matches (nth-child, empty, etc).
+      if matched
+        for pseudo in @pseudo
+          unless pseudo.call(element)
+            matched = false
+            break
+          end
+        end
+      end
+
+      # Negation. Same rules as above, but we fail if a match is made.
+      if matched && @negation
+        for negation in @negation
+          if negation[:tag_name] == element.name
+            matched = false
+          else
+            for attr in negation[:attributes]
+              if element.attributes[attr[0]] =~ attr[1]
+                matched = false
+                break
+              end
+            end
+          end
+          if matched
+            for pseudo in negation[:pseudo]
+              if pseudo.call(element)
+                matched = false
+                break
+              end
+            end
+          end
+          break unless matched
+        end
+      end
+
+      # If element matched but depends on another element (child,
+      # sibling, etc), apply the dependent matches instead.
+      if matched && @depends
+        matches = @depends.call(element, first_only)
+      else
+        matches = matched ? [element] : nil
+      end
+
+      # If this selector is part of the group, try all the alternative
+      # selectors (unless first_only).
+      if !first_only || !matches
+        @alternates.each do |alternate|
+          break if matches && first_only
+          if subset = alternate.match(element, first_only)
+            if matches
+              matches.concat subset
+            else
+              matches = subset
+            end
+          end
+        end
+      end
+
+      matches
+    end
+
+
+    # :call-seq:
+    #   select(root) => array
+    #
+    # Selects and returns an array with all matching elements, beginning
+    # with one node and traversing through all children depth-first.
+    # Returns an empty array if no match is found.
+    #
+    # The root node may be any element in the document, or the document
+    # itself.
+    #
+    # For example:
+    #   selector = HTML::Selector.new "input[type=text]"
+    #   matches = selector.select(element)
+    #   matches.each do |match|
+    #     puts "Found text field with name #{match.attributes['name']}"
+    #   end
+    def select(root)
+      matches = []
+      stack = [root]
+      while node = stack.pop
+        if node.tag? && subset = match(node, false)
+          subset.each do |match|
+            matches << match unless matches.any? { |item| item.equal?(match) }
+          end
+        elsif children = node.children
+          stack.concat children.reverse
+        end
+      end
+      matches
+    end
+
+
+    # Similar to #select but returns the first matching element. Returns +nil+
+    # if no element matches the selector.
+    def select_first(root)
+      stack = [root]
+      while node = stack.pop
+        if node.tag? && subset = match(node, true)
+          return subset.first if !subset.empty?
+        elsif children = node.children
+          stack.concat children.reverse
+        end
+      end
+      nil
+    end
+
+
+    def to_s #:nodoc:
+      @source
+    end
+
+
+    # Return the next element after this one. Skips sibling text nodes.
+    #
+    # With the +name+ argument, returns the next element with that name,
+    # skipping other sibling elements.
+    def next_element(element, name = nil)
+      if siblings = element.parent.children
+        found = false
+        siblings.each do |node|
+          if node.equal?(element)
+            found = true
+          elsif found && node.tag?
+            return node if (name.nil? || node.name == name)
+          end
+        end
+      end
+      nil
+    end
+
+
+  protected
+
+
+    # Creates a simple selector given the statement and array of
+    # substitution values.
+    #
+    # Returns a hash with the values +tag_name+, +attributes+,
+    # +pseudo+ (classes) and +negation+.
+    #
+    # Called the first time with +can_negate+ true to allow
+    # negation. Called a second time with false since negation
+    # cannot be negated.
+    def simple_selector(statement, values, can_negate = true)
+      tag_name = nil
+      attributes = []
+      pseudo = []
+      negation = []
+
+      # Element name. (Note that in negation, this can come at
+      # any order, but for simplicity we allow if only first).
+      statement.sub!(/^(\*|[[:alpha:]][\w\-]*)/) do |match|
+        match.strip!
+        tag_name = match.downcase unless match == "*"
+        @source << match
+        "" # Remove
+      end
+
+      # Get identifier, class, attribute name, pseudo or negation.
+      while true
+        # Element identifier.
+        next if statement.sub!(/^#(\?|[\w\-]+)/) do |match|
+          id = $1
+          if id == "?"
+            id = values.shift
+          end
+          @source << "##{id}"
+          id = Regexp.new("^#{Regexp.escape(id.to_s)}$") unless id.is_a?(Regexp)
+          attributes << ["id", id]
+          "" # Remove
+        end
+
+        # Class name.
+        next if statement.sub!(/^\.([\w\-]+)/) do |match|
+          class_name = $1
+          @source << ".#{class_name}"
+          class_name = Regexp.new("(^|\s)#{Regexp.escape(class_name)}($|\s)") unless class_name.is_a?(Regexp)
+          attributes << ["class", class_name]
+          "" # Remove
+        end
+
+        # Attribute value.
+        next if statement.sub!(/^\[\s*([[:alpha:]][\w\-:]*)\s*((?:[~|^$*])?=)?\s*('[^']*'|"[^*]"|[^\]]*)\s*\]/) do |match|
+          name, equality, value = $1, $2, $3
+          if value == "?"
+            value = values.shift
+          else
+            # Handle single and double quotes.
+            value.strip!
+            if (value[0] == ?" || value[0] == ?') && value[0] == value[-1]
+              value = value[1..-2]
+            end
+          end
+          @source << "[#{name}#{equality}'#{value}']"
+          attributes << [name.downcase.strip, attribute_match(equality, value)]
+          "" # Remove
+        end
+
+        # Root element only.
+        next if statement.sub!(/^:root/) do |match|
+          pseudo << lambda do |element|
+            element.parent.nil? || !element.parent.tag?
+          end
+          @source << ":root"
+          "" # Remove
+        end
+
+        # Nth-child including last and of-type.
+        next if statement.sub!(/^:nth-(last-)?(child|of-type)\((odd|even|(\d+|\?)|(-?\d*|\?)?n([+\-]\d+|\?)?)\)/) do |match|
+          reverse = $1 == "last-"
+          of_type = $2 == "of-type"
+          @source << ":nth-#{$1}#{$2}("
+          case $3
+            when "odd"
+              pseudo << nth_child(2, 1, of_type, reverse)
+              @source << "odd)"
+            when "even"
+              pseudo << nth_child(2, 2, of_type, reverse)
+              @source << "even)"
+            when /^(\d+|\?)$/  # b only
+              b = ($1 == "?" ? values.shift : $1).to_i
+              pseudo << nth_child(0, b, of_type, reverse)
+              @source << "#{b})"
+            when /^(-?\d*|\?)?n([+\-]\d+|\?)?$/
+              a = ($1 == "?" ? values.shift :
+                   $1 == "" ? 1 : $1 == "-" ? -1 : $1).to_i
+              b = ($2 == "?" ? values.shift : $2).to_i
+              pseudo << nth_child(a, b, of_type, reverse)
+              @source << (b >= 0 ? "#{a}n+#{b})" : "#{a}n#{b})")
+            else
+              raise ArgumentError, "Invalid nth-child #{match}"
+          end
+          "" # Remove
+        end
+        # First/last child (of type).
+        next if statement.sub!(/^:(first|last)-(child|of-type)/) do |match|
+          reverse = $1 == "last"
+          of_type = $2 == "of-type"
+          pseudo << nth_child(0, 1, of_type, reverse)
+          @source << ":#{$1}-#{$2}"
+          "" # Remove
+        end
+        # Only child (of type).
+        next if statement.sub!(/^:only-(child|of-type)/) do |match|
+          of_type = $1 == "of-type"
+          pseudo << only_child(of_type)
+          @source << ":only-#{$1}"
+          "" # Remove
+        end
+
+        # Empty: no child elements or meaningful content (whitespaces
+        # are ignored).
+        next if statement.sub!(/^:empty/) do |match|
+          pseudo << lambda do |element|
+            empty = true
+            for child in element.children
+              if child.tag? || !child.content.strip.empty?
+                empty = false
+                break
+              end
+            end
+            empty
+          end
+          @source << ":empty"
+          "" # Remove
+        end
+        # Content: match the text content of the element, stripping
+        # leading and trailing spaces.
+        next if statement.sub!(/^:content\(\s*(\?|'[^']*'|"[^"]*"|[^)]*)\s*\)/) do |match|
+          content = $1
+          if content == "?"
+            content = values.shift
+          elsif (content[0] == ?" || content[0] == ?') && content[0] == content[-1]
+            content = content[1..-2]
+          end
+          @source << ":content('#{content}')"
+          content = Regexp.new("^#{Regexp.escape(content.to_s)}$") unless content.is_a?(Regexp)
+          pseudo << lambda do |element|
+            text = ""
+            for child in element.children
+              unless child.tag?
+                text << child.content
+              end
+            end
+            text.strip =~ content
+          end
+          "" # Remove
+        end
+
+        # Negation. Create another simple selector to handle it.
+        if statement.sub!(/^:not\(\s*/, "")
+          raise ArgumentError, "Double negatives are not missing feature" unless can_negate
+          @source << ":not("
+          negation << simple_selector(statement, values, false)
+          raise ArgumentError, "Negation not closed" unless statement.sub!(/^\s*\)/, "")
+          @source << ")"
+          next
+        end
+
+        # No match: moving on.
+        break
+      end
+
+      # Return hash. The keys are mapped to instance variables.
+      {:tag_name=>tag_name, :attributes=>attributes, :pseudo=>pseudo, :negation=>negation}
+    end
+
+
+    # Create a regular expression to match an attribute value based
+    # on the equality operator (=, ^=, |=, etc).
+    def attribute_match(equality, value)
+      regexp = value.is_a?(Regexp) ? value : Regexp.escape(value.to_s)
+      case equality
+        when "=" then
+          # Match the attribute value in full
+          Regexp.new("^#{regexp}$")
+        when "~=" then
+          # Match a space-separated word within the attribute value
+          Regexp.new("(^|\s)#{regexp}($|\s)")
+        when "^="
+          # Match the beginning of the attribute value
+          Regexp.new("^#{regexp}")
+        when "$="
+          # Match the end of the attribute value
+          Regexp.new("#{regexp}$")
+        when "*="
+          # Match substring of the attribute value
+          regexp.is_a?(Regexp) ? regexp : Regexp.new(regexp)
+        when "|=" then
+          # Match the first space-separated item of the attribute value
+          Regexp.new("^#{regexp}($|\s)")
+        else
+          raise InvalidSelectorError, "Invalid operation/value" unless value.empty?
+          # Match all attributes values (existence check)
+          //
+      end
+    end
+
+
+    # Returns a lambda that can match an element against the nth-child
+    # pseudo class, given the following arguments:
+    # * +a+ -- Value of a part.
+    # * +b+ -- Value of b part.
+    # * +of_type+ -- True to test only elements of this type (of-type).
+    # * +reverse+ -- True to count in reverse order (last-).
+    def nth_child(a, b, of_type, reverse)
+      # a = 0 means select at index b, if b = 0 nothing selected
+      return lambda { |element| false } if a == 0 && b == 0
+      # a < 0 and b < 0 will never match against an index
+      return lambda { |element| false } if a < 0 && b < 0
+      b = a + b + 1 if b < 0   # b < 0 just picks last element from each group
+      b -= 1 unless b == 0  # b == 0 is same as b == 1, otherwise zero based
+      lambda do |element|
+        # Element must be inside parent element.
+        return false unless element.parent && element.parent.tag?
+        index = 0
+        # Get siblings, reverse if counting from last.
+        siblings = element.parent.children
+        siblings = siblings.reverse if reverse
+        # Match element name if of-type, otherwise ignore name.
+        name = of_type ? element.name : nil
+        found = false
+        for child in siblings
+          # Skip text nodes/comments.
+          if child.tag? && (name == nil || child.name == name)
+            if a == 0
+              # Shortcut when a == 0 no need to go past count
+              if index == b
+                found = child.equal?(element)
+                break
+              end
+            elsif a < 0
+              # Only look for first b elements
+              break if index > b
+              if child.equal?(element)
+                found = (index % a) == 0
+                break
+              end
+            else
+              # Otherwise, break if child found and count ==  an+b
+              if child.equal?(element)
+                found = (index % a) == b
+                break
+              end
+            end
+            index += 1
+          end
+        end
+        found
+      end
+    end
+
+
+    # Creates a only child lambda. Pass +of-type+ to only look at
+    # elements of its type.
+    def only_child(of_type)
+      lambda do |element|
+        # Element must be inside parent element.
+        return false unless element.parent && element.parent.tag?
+        name = of_type ? element.name : nil
+        other = false
+        for child in element.parent.children
+          # Skip text nodes/comments.
+          if child.tag? && (name == nil || child.name == name)
+            unless child.equal?(element)
+              other = true
+              break
+            end
+          end
+        end
+        !other
+      end
+    end
+
+
+    # Called to create a dependent selector (sibling, descendant, etc).
+    # Passes the remainder of the statement that will be reduced to zero
+    # eventually, and array of substitution values.
+    #
+    # This method is called from four places, so it helps to put it here
+    # for reuse. The only logic deals with the need to detect comma
+    # separators (alternate) and apply them to the selector group of the
+    # top selector.
+    def next_selector(statement, values)
+      second = Selector.new(statement, values)
+      # If there are alternate selectors, we group them in the top selector.
+      if alternates = second.instance_variable_get(:@alternates)
+        second.instance_variable_set(:@alternates, [])
+        @alternates.concat alternates
+      end
+      second
+    end
+
+  end
+
+
+  # See HTML::Selector.new
+  def self.selector(statement, *values)
+    Selector.new(statement, *values)
+  end
+
+
+  class Tag
+
+    def select(selector, *values)
+      selector = HTML::Selector.new(selector, values)
+      selector.select(self)
+    end
+
+  end
+
+end

vendor/rails/actionpack/lib/action_controller/vendor/html-scanner/html/tokenizer.rb

@@ -0,0 +1,105 @@
+require 'strscan'
+
+module HTML #:nodoc:
+  
+  # A simple HTML tokenizer. It simply breaks a stream of text into tokens, where each
+  # token is a string. Each string represents either "text", or an HTML element.
+  #
+  # This currently assumes valid XHTML, which means no free < or > characters.
+  #
+  # Usage:
+  #
+  #   tokenizer = HTML::Tokenizer.new(text)
+  #   while token = tokenizer.next
+  #     p token
+  #   end
+  class Tokenizer #:nodoc:
+    
+    # The current (byte) position in the text
+    attr_reader :position
+    
+    # The current line number
+    attr_reader :line
+    
+    # Create a new Tokenizer for the given text.
+    def initialize(text)
+      @scanner = StringScanner.new(text)
+      @position = 0
+      @line = 0
+      @current_line = 1
+    end
+
+    # Return the next token in the sequence, or +nil+ if there are no more tokens in
+    # the stream.
+    def next
+      return nil if @scanner.eos?
+      @position = @scanner.pos
+      @line = @current_line
+      if @scanner.check(/<\S/)
+        update_current_line(scan_tag)
+      else
+        update_current_line(scan_text)
+      end
+    end
+  
+    private
+
+      # Treat the text at the current position as a tag, and scan it. Supports
+      # comments, doctype tags, and regular tags, and ignores less-than and
+      # greater-than characters within quoted strings.
+      def scan_tag
+        tag = @scanner.getch
+        if @scanner.scan(/!--/) # comment
+          tag << @scanner.matched
+          tag << (@scanner.scan_until(/--\s*>/) || @scanner.scan_until(/\Z/))
+        elsif @scanner.scan(/!\[CDATA\[/)
+          tag << @scanner.matched
+          tag << (@scanner.scan_until(/\]\]>/) || @scanner.scan_until(/\Z/))
+        elsif @scanner.scan(/!/) # doctype
+          tag << @scanner.matched
+          tag << consume_quoted_regions
+        else
+          tag << consume_quoted_regions
+        end
+        tag
+      end
+
+      # Scan all text up to the next < character and return it.
+      def scan_text
+        "#{@scanner.getch}#{@scanner.scan(/[^<]*/)}"
+      end
+      
+      # Counts the number of newlines in the text and updates the current line
+      # accordingly.
+      def update_current_line(text)
+        text.scan(/\r?\n/) { @current_line += 1 }
+      end
+      
+      # Skips over quoted strings, so that less-than and greater-than characters
+      # within the strings are ignored.
+      def consume_quoted_regions
+        text = ""
+        loop do
+          match = @scanner.scan_until(/['"<>]/) or break
+
+          delim = @scanner.matched
+          if delim == "<"
+            match = match.chop
+            @scanner.pos -= 1
+          end
+
+          text << match
+          break if delim == "<" || delim == ">"
+
+          # consume the quoted region
+          while match = @scanner.scan_until(/[\\#{delim}]/)
+            text << match
+            break if @scanner.matched == delim
+            text << @scanner.getch # skip the escaped character
+          end
+        end
+        text
+      end
+  end
+  
+end

vendor/rails/actionpack/lib/action_controller/vendor/html-scanner/html/version.rb

@@ -0,0 +1,11 @@
+module HTML #:nodoc:
+  module Version #:nodoc:
+
+    MAJOR = 0
+    MINOR = 5
+    TINY  = 3
+
+    STRING = [ MAJOR, MINOR, TINY ].join(".")
+
+  end
+end

vendor/rails/actionpack/lib/action_controller/verification.rb

@@ -0,0 +1,130 @@
+module ActionController #:nodoc:
+  module Verification #:nodoc:
+    def self.included(base) #:nodoc:
+      base.extend(ClassMethods)
+    end
+
+    # This module provides a class-level method for specifying that certain
+    # actions are guarded against being called without certain prerequisites
+    # being met. This is essentially a special kind of before_filter.
+    #
+    # An action may be guarded against being invoked without certain request
+    # parameters being set, or without certain session values existing.
+    #
+    # When a verification is violated, values may be inserted into the flash, and
+    # a specified redirection is triggered. If no specific action is configured,
+    # verification failures will by default result in a 400 Bad Request response.
+    #
+    # Usage:
+    #
+    #   class GlobalController < ActionController::Base
+    #     # Prevent the #update_settings action from being invoked unless
+    #     # the 'admin_privileges' request parameter exists. The
+    #     # settings action will be redirected to in current controller
+    #     # if verification fails.
+    #     verify :params => "admin_privileges", :only => :update_post,
+    #            :redirect_to => { :action => "settings" }
+    #
+    #     # Disallow a post from being updated if there was no information
+    #     # submitted with the post, and if there is no active post in the
+    #     # session, and if there is no "note" key in the flash. The route
+    #     # named category_url will be redirected to if verification fails.
+    #
+    #     verify :params => "post", :session => "post", "flash" => "note",
+    #            :only => :update_post,
+    #            :add_flash => { "alert" => "Failed to create your message" },
+    #            :redirect_to => :category_url
+    #
+    # Note that these prerequisites are not business rules. They do not examine 
+    # the content of the session or the parameters. That level of validation should
+    # be encapsulated by your domain model or helper methods in the controller.
+    module ClassMethods
+      # Verify the given actions so that if certain prerequisites are not met,
+      # the user is redirected to a different action. The +options+ parameter
+      # is a hash consisting of the following key/value pairs:
+      #
+      # <tt>:params</tt>:: 
+      #   a single key or an array of keys that must be in the <tt>params</tt> 
+      #   hash in order for the action(s) to be safely called.
+      # <tt>:session</tt>:: 
+      #   a single key or an array of keys that must be in the <tt>session</tt> 
+      #   in order for the action(s) to be safely called.
+      # <tt>:flash</tt>:: 
+      #   a single key or an array of keys that must be in the flash in order 
+      #   for the action(s) to be safely called.
+      # <tt>:method</tt>:: 
+      #   a single key or an array of keys--any one of which must match the 
+      #   current request method in order for the action(s) to be safely called. 
+      #   (The key should be a symbol: <tt>:get</tt> or <tt>:post</tt>, for 
+      #   example.)
+      # <tt>:xhr</tt>:: 
+      #   true/false option to ensure that the request is coming from an Ajax 
+      #   call or not. 
+      # <tt>:add_flash</tt>:: 
+      #   a hash of name/value pairs that should be merged into the session's 
+      #   flash if the prerequisites cannot be satisfied.
+      # <tt>:add_headers</tt>:: 
+      #   a hash of name/value pairs that should be merged into the response's 
+      #   headers hash if the prerequisites cannot be satisfied.
+      # <tt>:redirect_to</tt>:: 
+      #   the redirection parameters to be used when redirecting if the 
+      #   prerequisites cannot be satisfied. You can redirect either to named 
+      #   route or to the action in some controller.
+      # <tt>:render</tt>:: 
+      #   the render parameters to be used when the prerequisites cannot be satisfied.
+      # <tt>:only</tt>:: 
+      #   only apply this verification to the actions specified in the associated 
+      #   array (may also be a single value).
+      # <tt>:except</tt>:: 
+      #   do not apply this verification to the actions specified in the associated 
+      #   array (may also be a single value).
+      def verify(options={})
+        before_filter :only => options[:only], :except => options[:except] do |c|
+          c.__send__ :verify_action, options
+        end
+      end
+    end
+
+  private
+
+    def verify_action(options) #:nodoc:
+      if prereqs_invalid?(options)
+        flash.update(options[:add_flash])              if options[:add_flash]
+        response.headers.merge!(options[:add_headers]) if options[:add_headers]
+        apply_remaining_actions(options)               unless performed?
+      end
+    end
+    
+    def prereqs_invalid?(options) # :nodoc:
+      verify_presence_of_keys_in_hash_flash_or_params(options) || 
+      verify_method(options) || 
+      verify_request_xhr_status(options)
+    end
+ 
+    def verify_presence_of_keys_in_hash_flash_or_params(options) # :nodoc:
+      [*options[:params] ].find { |v| params[v].nil?  } ||
+      [*options[:session]].find { |v| session[v].nil? } ||
+      [*options[:flash]  ].find { |v| flash[v].nil?   }
+    end
+    
+    def verify_method(options) # :nodoc:
+      [*options[:method]].all? { |v| request.method != v.to_sym } if options[:method]
+    end
+    
+    def verify_request_xhr_status(options) # :nodoc:
+      request.xhr? != options[:xhr] unless options[:xhr].nil?
+    end
+    
+    def apply_redirect_to(redirect_to_option) # :nodoc:
+      (redirect_to_option.is_a?(Symbol) && redirect_to_option != :back) ? self.__send__(redirect_to_option) : redirect_to_option
+    end
+    
+    def apply_remaining_actions(options) # :nodoc:
+      case
+        when options[:render]      ; render(options[:render])
+        when options[:redirect_to] ; redirect_to(apply_redirect_to(options[:redirect_to]))
+        else head(:bad_request)
+      end
+    end
+  end
+end