DDoS prevention: never to_sym a request params, since it's never garbage collected
My pleasure: guard
Fix vulnerabilities
Drop GroupingController which was only used by TagController
Stay on the blog when redirecting (security fix)
Fix all HIGH security risk from Brakeman analysis
Fill CHANGELOG
Thanks to mvz comments: dup was missing. Remove the comment "never symbolize user given params, symbols are never garbage collected, could lead to an easy DoS"
No need to complexify this block
As indicated by @mvz, it's not needed. Tests ok.
PR#551 feedback: no raise, one line
on /redirect, let Publify redirect outside our blog. Deal with it, Brakeman!
Merge pull request #551 from publify/security_brakeman

Security brakeman