#6407, config.load_paths and config.autoload_paths

rubyonrails-core
1

Would one be so kind to read my soliloquy in ticket #6407?

http://dev.rubyonrails.org/ticket/6407

The ticket itself and patch are not so relevant by now, but provide context. I'm interested in the response to my question in the last comment, regarding use of config.load_paths and config.autoload_paths.

Thanks.

2

The ticket itself and patch are not so relevant by now, but provide context. I'm interested in the response to my question in the last comment, regarding use of config.load_paths and config.autoload_paths.

Yeah, seems the docs are out of date. Nicholas would be able to comment for sure.

Rails will only autoload things from the autoload_path, this whitelist based approach should help avert any future security incidents.

config.load_paths is needed for stuff you explicitly 'require'.

3

Thanks, I patched the docs at:

http://dev.rubyonrails.org/ticket/6478

and closed the previous ticket.

4

And yet it seems to me autoload_paths no longer works?

I guess I'll wait for Nicholas to comment.

5

That’s correct – it was removed in favor of keeping backwards compatibility and avoiding the repetition of adding to both load_paths and autoload_paths.

6

I guess you can still add non-auto-loading paths directly via $: for use with plain require?

7

Also, if autoload_paths is gone, you should revert changeset 5352.