Rails 2.1.1

Among other things, a security fix.

vendor/rails/activeresource/lib/active_resource/connection.rb

@@ -63,6 +63,13 @@ module ActiveResource
   # This class is used by ActiveResource::Base to interface with REST
   # services.
   class Connection
+
+    HTTP_FORMAT_HEADER_NAMES = {  :get => 'Accept',
+      :put => 'Content-Type',
+      :post => 'Content-Type',
+      :delete => 'Accept'
+    }
+
     attr_reader :site, :user, :password, :timeout
     attr_accessor :format
 
@@ -106,25 +113,25 @@ module ActiveResource
     # Execute a GET request.
     # Used to get (find) resources.
     def get(path, headers = {})
-      format.decode(request(:get, path, build_request_headers(headers)).body)
+      format.decode(request(:get, path, build_request_headers(headers, :get)).body)
     end
 
     # Execute a DELETE request (see HTTP protocol documentation if unfamiliar).
     # Used to delete resources.
     def delete(path, headers = {})
-      request(:delete, path, build_request_headers(headers))
+      request(:delete, path, build_request_headers(headers, :delete))
     end
 
     # Execute a PUT request (see HTTP protocol documentation if unfamiliar).
     # Used to update resources.
     def put(path, body = '', headers = {})
-      request(:put, path, body.to_s, build_request_headers(headers))
+      request(:put, path, body.to_s, build_request_headers(headers, :put))
     end
 
     # Execute a POST request.
     # Used to create new resources.
     def post(path, body = '', headers = {})
-      request(:post, path, body.to_s, build_request_headers(headers))
+      request(:post, path, body.to_s, build_request_headers(headers, :post))
     end
 
     # Execute a HEAD request.
@@ -187,12 +194,12 @@ module ActiveResource
       end
 
       def default_header
-        @default_header ||= { 'Content-Type' => format.mime_type }
+        @default_header ||= {}
       end
 
       # Builds headers for request to remote service.
-      def build_request_headers(headers)
-        authorization_header.update(default_header).update(headers)
+      def build_request_headers(headers, http_method=nil)
+        authorization_header.update(default_header).update(headers).update(http_format_header(http_method))
       end
 
       # Sets authorization header
@@ -200,6 +207,10 @@ module ActiveResource
         (@user || @password ? { 'Authorization' => 'Basic ' + ["#{@user}:#{ @password}"].pack('m').delete("\r\n") } : {})
       end
 
+      def http_format_header(http_method)
+        {HTTP_FORMAT_HEADER_NAMES[http_method] => format.mime_type}
+      end
+
       def logger #:nodoc:
         ActiveResource::Base.logger
       end