# \[ANN\] Rails 1.2.5: Security and maintenance release

**URL:** <https://www.ruby-forum.com/t/ann-rails-1-2-5-security-and-maintenance-release/117076>\
**Category:** Rails\
**Created:** [October 12, 2007, 6:49pm UTC](https://www.ruby-forum.com/t/ann-rails-1-2-5-security-and-maintenance-release/117076 "2007-10-12T18:49:47Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![DHH](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/258eb7/32.png) [@DHH](https://www.ruby-forum.com/u/DHH)\
**Post date:** [October 12, 2007, 6:49pm UTC](https://www.ruby-forum.com/t/ann-rails-1-2-5-security-and-maintenance-release/117076/1 "2007-10-12T18:49:47Z")

</div>

This release closes a JSON XSS vulnerability, fixes a couple of minor  
regressions introduced in 1.2.4, and backports a handful of features  
and fixes from the 2.0 preview release.

All users of Rails 1.2.4 or earlier are advised to upgrade to 1.2.5,  
though it isn’t strictly necessary if you aren’t working with JSON.  
For more information the JSON vulnerability, see CVE-2007-3227.

Summary of changes:

- acts\_as\_list: fixed an edge case where removing an item from the  
list then destroying the item leads to incorrect item positioning
- deprecated calling .create on has\_many associations with an unsaved  
owner (like post = Post.new; post.comments.create)
- backport array and hash query parameters
- fix in place editor’s setter action with non-string fields
- updated config/boot.rb to correctly recognize RAILS\_GEM\_VERSION

To upgrade, `gem install rails`, set RAILS\_GEM\_VERSION to ‘1.2.5’ in  
config/environment.rb, and `rake rails:update:configs`.

---

<div class="post-metadata">

**Author:** ![DHH](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/258eb7/32.png) [@DHH](https://www.ruby-forum.com/u/DHH)\
**Post date:** [October 12, 2007, 7:01pm UTC](https://www.ruby-forum.com/t/ann-rails-1-2-5-security-and-maintenance-release/117076/2 "2007-10-12T19:01:31Z")

</div>

Thank you. Installed. I love how hassle-free that is.

It seems like the default page on the installation should have the  
version on it. Maybe that’s just me.

–Colin

---

<div class="post-metadata">

**Author:** ![DHH](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/258eb7/32.png) [@DHH](https://www.ruby-forum.com/u/DHH)\
**Post date:** [October 12, 2007, 8:14pm UTC](https://www.ruby-forum.com/t/ann-rails-1-2-5-security-and-maintenance-release/117076/3 "2007-10-12T20:14:08Z")

</div>

Oh. It’s there, under the environment. Got it.