Search Results

Search found 9920 results on 397 pages for 'ruby prof'.

Page 229/397 | < Previous Page | 225 226 227 228 229 230 231 232 233 234 235 236  | Next Page >

  • Is Rails default CSRF protection insecure

    - by schickb
    By default the form post CSRF protection in Rails creates an authenticity token for a user that only changes when the user's session changes. One of our customers did a security audit of our site and flagged that as an issue. The auditor's statement was that if we also had a XSS vulnerability that an attacker could grab another user's authenticity token and make use of it for CSRF attacks until the user's session expired. But is seems to me that if we had an XSS vulnerability like that an attacker could just as easily grab another user's session cookie and login as that user directly. Or even just make call to our REST Api as the user being attacked. No secondary CSRF attack needed. Have I missed something? Is there a real problem with the default CSRF protection in Rails?

    Read the article

  • Rails 2.3 session

    - by Sam Kong
    Hi, I am developing a rails 2.3.2 app. I need to keep session_id for an order record, retrieve it and finally delete the session_id when the order is completed. It worked when I used cookies as session store but it doesn't for active_record store. (I restarted my browser, so no cache issue.) I know rails 2.3 implements lazy session load. I read some info about it but am still confused. Can somebody clarify how I use session_id for such a case? What I am doing is... A user make an order going through several pages. There is no sign-up, neither login. So I keep session_id in the order record so that no other user can access the order. @order = Order.last :conditions = {:id = params[:id], :session_id = session[:session_id] } When the order is finished, I set nil to session_id column. How would you implement such a case in lazy session(and active_record store) environment? Thanks. Sam

    Read the article

  • Rails Multiple Checkboxes with Javascript Dynamic Select

    - by Jack
    Hi, I have followed the Railscast episode 88 to implement a set of dependant drop down menus. In the students-new view, when the student's year is selected, the javascript figures out which courses are available to that year and offers the selection in a new drop down menu. My javascript erb file is here: var courses = new Array(); <% for course in @courses -%> <%for year in course.years -%> courses.push(new Array(<%= year.year_id%>, '<%=h course.title%>', <%= course.id%>)); <%end -%> <% end -%> function yearSelected() { year_id = $('student_year_id').getValue(); options = $('student_course_ids').options; options.length = 1; courses.each(function(course) { if (course[0] == year_id) { options[options.length] = new Option(course[1], course[2]); } }); if (options.length == 1) { $('course_field').hide(); } else { $('course_field').show(); } } document.observe('dom:loaded', function() { yearSelected(); $('student_year_id').observe('change', yearSelected); }); Any my view is as follows: <% form_for(@student) do |f| %> <%= f.error_messages %> <p> <%= f.label :name %><br /> <%= f.text_field :name %> </p> <p> <%= f.label :cid, "CID" %><br /> <%= f.text_field :cid %> </p> <p> <label for="student_year_id">Year:</label> <%= collection_select(:student, :year_id, Year.all, :id, :title, {:prompt => true})%> </p> <p id="course_field"> <label for="student_course_ids">Course:</label> <%= collection_select(:student, :course_ids, Course.find(:all), :id, :title, {:prompt => true}, {:multiple => true})%> </p> <p> <%= f.submit 'Save' %> </p> <% end %> What I would like to do is to add checkboxes instead of the drop down menu. Any suggestions? I previously was using this method, but was not able to get it to work with the new javascript. Cheers

    Read the article

  • Problem using form builder & DOM manipulation in Rails with multiple levels of nested partials

    - by Chris Hart
    I'm having a problem using nested partials with dynamic form builder code (from the "complex form example" code on github) in Rails. I have my top level view "new" (where I attempt to generate the template): <% form_for (@transaction_group) do |txngroup_form| %> <%= txngroup_form.error_messages %> <% content_for :jstemplates do -%> <%= "var transaction='#{generate_template(txngroup_form, :transactions)}'" %> <% end -%> <%= render :partial => 'transaction_group', :locals => { :f => txngroup_form, :txn_group => @transaction_group }%> <% end -%> This renders the transaction_group partial: <div class="content"> <% logger.debug "in partial, class name = " + txn_group.class.name %> <% f.fields_for txn_group.transactions do |txn_form| %> <table id="transactions" class="form"> <tr class="header"><td>Price</td><td>Quantity</td></tr> <%= render :partial => 'transaction', :locals => { :tf => txn_form } %> </table> <% end %> <div>&nbsp;</div><div id="container"> <%= link_to 'Add a transaction', '#transaction', :class => "add_nested_item", :rel => "transactions" %> </div> <div>&nbsp;</div> ... which in turn renders the transaction partial: <tr><td><%= tf.text_field :price, :size => 5 %></td> <td><%= tf.text_field :quantity, :size => 2 %></td></tr> The generate_template code looks like this: def generate_html(form_builder, method, options = {}) options[:object] ||= form_builder.object.class.reflect_on_association(method).klass.new options[:partial] ||= method.to_s.singularize options[:form_builder_local] ||= :f form_builder.fields_for(method, options[:object], :child_index => 'NEW_RECORD') do |f| render(:partial => options[:partial], :locals => { options[:form_builder_local] => f }) end end def generate_template(form_builder, method, options = {}) escape_javascript generate_html(form_builder, method, options) end (Obviously my code is not the most elegant - I was trying to get this nested partial thing worked out first.) My problem is that I get an undefined variable exception from the transaction partial when loading the view: /Users/chris/dev/ss/app/views/transaction_groups/_transaction.html.erb:2:in _run_erb_app47views47transaction_groups47_transaction46html46erb_locals_f_object_transaction' /Users/chris/dev/ss/app/helpers/customers_helper.rb:29:in generate_html' /Users/chris/dev/ss/app/helpers/customers_helper.rb:28:in generate_html' /Users/chris/dev/ss/app/helpers/customers_helper.rb:34:in generate_template' /Users/chris/dev/ss/app/views/transaction_groups/new.html.erb:4:in _run_erb_app47views47transaction_groups47new46html46erb' /Users/chris/dev/ss/app/views/transaction_groups/new.html.erb:3:in _run_erb_app47views47transaction_groups47new46html46erb' /Users/chris/dev/ss/app/views/transaction_groups/new.html.erb:1:in _run_erb_app47views47transaction_groups47new46html46erb' /Users/chris/dev/ss/app/controllers/transaction_groups_controller.rb:17:in new' I'm pretty sure this is because the do loop for form_for hasn't executed yet (?)... I'm not sure that my approach to this problem is the best, but I haven't been able to find a better solution for dynamically adding form partials to the DOM. Basically I need a way to add records to a has_many model dynamically on a nested form. Any recommendations on a way to fix this particular problem or (even better!) a cleaner solution are appreciated. Thanks in advance. Chris

    Read the article

  • Rails: Custom template for email "deliver_" method?

    - by neezer
    I'm building an email system that stores my different emails in the database and calls the appropriate "deliver_" method via method_missing (since I can't explicitly declare methods since they're user-generated). My problem is that my rails app still tries to render the template for whatever the generated email is, though those templates don't exist. I want to force all emails to use the same template (views/test_email.html.haml), which will be setup to draw their formatting from my database records. How can I accomplish this? I tried adding render :template => 'test_email' in the test_email method in emailer_controller with no luck. models/emailer.rb: class Emailer < ActionMailer::Base def method_missing(method, *args) # not been implemented yet logger.info "method missing was called!!" end end controller/emailer_controller.rb: class EmailerController < ApplicationController def test_email @email = Email.find(params[:id]) Emailer.send("deliver_#{@email.name}") end end views/emails/index.html.haml: %h1 Listing emails %table{ :cellspacing => 0 } %tr %th Name %th Subject - @emails.each do |email| %tr %td=h email.name %td=h email.subject %td= link_to 'Show', email %td= link_to 'Edit', edit_email_path(email) %td= link_to 'Send Test Message', :controller => 'emailer', :action => 'test_email', :params => { :id => email.id } %td= link_to 'Destroy', email, :confirm => 'Are you sure?', :method => :delete %p= link_to 'New email', new_email_path Error I'm getting with the above: Template is missing Missing template emailer/name_of_email_in_database.erb in view path app/views

    Read the article

  • rails override default getter for a relationship (belongs_to)

    - by brad
    So I know how to override the default getters for attributes of an ActiveRecord object using def custom_getter return self[:custom_getter] || some_default_value end I'm trying to achieve the same thing however for a belongs to association. For instance. class Foo < AR belongs_to :bar def bar return self[:bar] || Bar.last end end class Bar < AR has_one :foo end When I say: f = Foo.last I'd like to have the method f.bar return the last Bar, rather than nil if that association doesn't exist yet. This doesn't work however. The reason is that self[:bar] is always undefined. It's actually self[:bar_id]. I can do something naive like: def bar if self[:bar_id] return Bar.find(self[:bar_id]) else return Bar.last end end However this will always make a db call, even if Bar has already been fetched, which is certainly not ideal. Does anyone have an insight as to how I might have a relationship such that the belongs_to attribute is only loaded once and has a default value if not set.

    Read the article

  • Mongomapper query collection problem

    - by kylemac
    When I define the User has_many meetings, it automatically creates a "user_id" key/value pair to relate to the User collections. Except I can't run any mongo_mapper finds using this value, without it returning nil or []. Meeting.first(:user_id = "1234") Meeting.all(:user_id = "1234") Meeting.find(:user_id = "1234") All return nil. Is there another syntax? Basically I can't run a query on the automatically generated associative ObjectId. # Methods class User include MongoMapper::Document key :user_name, String, :required = true key :password, String many :meetings end class Meeting include MongoMapper::Document key :name, String, :required = true key :count, Integer, :default = 1 end # Sinatra get '/add' do user = User.new user.meetings "foobar") #should read: Meeting.new(:name = "foobar") user.save end get '/find' do test = Meeting.first(:user_id = "4b4f9d6d348f82370b000001") #this is the _id of the newly create user p test # WTF! returns [] end

    Read the article

  • How do you diagnose a 500 error on Heroku when there is no error message in the logs?

    - by lala
    I have a Rails app on Heroku that is serving 500 errors at random intervals. Web pages will display "Internal server error" in plain text, instead of the usual "We're sorry. Something went wrong." page. When I refresh the page, it works fine. The logs don't show me an error message, just » 14:20:34.107 2013-10-11 12:20:33.763690+00:00 heroku router - - at=info method=HEAD path=/ host=www.mydomain.com fwd="184.73.237.85/ec2-184-73-237-85.compute-1.amazonaws.com" dyno=web.1 connect=1ms service=63ms status=200 bytes=0 » 14:21:03.957 2013-10-11 12:21:03.561867+00:00 heroku router - - at=info method=GET path=/ host=www.mydomain.com fwd="50.112.95.211/ec2-50-112-95-211.us-west-2.compute.amazonaws.com" dyno=web.1 connect=0ms service=1ms status=500 bytes=21 Support has told me to look at request queuing in New Relic, but New Relic only shows a big red mark saying the server is down (even though the site works fine when refreshed). With no error messages, I'm at a loss for how to diagnose this issue.

    Read the article

  • Serving static files with Sinatra

    - by TK
    I have one page website only using HTML, CSS and JavaScript. I want to deploy the app to Heroku, but I cannot find a way to do it. I am now trying to make the app working with Sinatra. . |-- application.css |-- application.js |-- index.html |-- jquery.js `-- myapp.rb And the following is the content of myapp.rb. require 'rubygems' require 'sinatra' get "/" do # What should I write here to point to the `index.html` end

    Read the article

  • Help with rails collection select

    - by NachoF
    I need to add different values for each option tag in my collection_select cause Im trying to use this jquery plugin.... How do I do that? Heres my collection select code <%= e.collection_select(:id,State.all,:id,:name) %> The output should be something like <select name="state[id]" id="state_id" class="selectable"> <option value="">-- select --</option> <option value="1" title="florida">Florida</option> <option value="2" title="georgia">Georgia</option> </select> Please help.

    Read the article

  • Rake tasks in other files

    - by Arcath
    Im trying to use rake in a project, and if I put everything into Rakefile it will be huge and hard to read/find things, so I tried to stick each namesapce in its own file in lib/rake, i added this to the top of my rake file: Dir['#{File.dirname(__FILE__)}/lib/rake/*.rake'].map { |f| require f } it loads the file no problem, but doesn't have the tasks. I only have one .rake file as a test for now called "servers.rake" and it looks like this: namespace :server do task :test do puts "test" end end so when I run rake server:test id expect to see one line appear saying "test", instead I get rake aborted! Don't know how to build task 'server:test' at first I thought my codes wrong but if I copy the contents of lib/rake/servers.rake into Rakefile it works fine. How do I get rake tasks to work that are in another file?

    Read the article

  • How do I insert an input's value into a separate form?

    - by ryan
    I'm making a tool for my university that allows students to create a list of classes by doing the following: Searching by course title for their course via an autocomplete input field. Adding that course to a separate form that upon being submitted creates a course list. I am trying to link the autocomplete and the course list form with an 'add to course list' button that inserts a hidden input field into the course list form which can subsequently be submitted by a 'create course list' button. My question is this: How do I take the value of the autocomplete input and insert it into the course list form without using AJAX? So far I have something like the following: <%= text_field_with_auto_complete :course, :title, :size => 40 %> <%= link_to_function "Add to Course List" do |page| page.insert_html :top, :course_list, hidden_field(:courses, :course, {:value => "$('course_title').value"}) %> <% form_for(@course_list) do |f|%> <div id="course_list">Insert selected courses here.</div> <% end %>

    Read the article

  • Rails uniqueness constraint and matching db unique index for null column

    - by Dave
    I have the following in my migration file def self.up create_table :payment_agreements do |t| t.boolean :automatic, :default => true, :null => false t.string :payment_trigger_on_order t.references :supplier t.references :seller t.references :product t.timestamps end end I want to ensure that if a product_id is specified it is unique but I also want to allow null so I have the following in my model: validates :product_id, :uniqueness => true, :allow_nil => true Works great but I should then add an index to the migration file add_index :payment_agreements, :product_id, :unique => true Obviously this will throw an exception when two null values are inserted for product_id. I could just simply omit the index in the migration but then there's the chance that I'll get two PaymentAgreements with the same product_id as shown here: Concurrency and integrity My question is what is the best/most common way to deal with this problem

    Read the article

  • Define a regex, which matches one digit twice and all others once

    - by Amin
    As part of a larger regex I would like to match the following restrictions: The string has 11 digits All digits are numbers Within the first 10 digits one number [0-9] (and one only!) must be listed twice This means the following should match: 12345678914 12235879600 Whereas these should not: 12345678903 -> none of the numbers at digits 1 to 10 appears twice 14427823482 -> one number appears more than twice 72349121762 -> two numbers appear twice I have tried to use a lookahead, but all I'm managing is that the regex counts a certain digit, i.e.: (?!.*0\1{2}) That does not do what I need. Is my query even possible with regex?

    Read the article

  • Declarative authorization and the if_attribute not working...

    - by ro
    I've been having almost the same issues as Victor Martin (you can see the questions asked here). I've got declarative authorization working for just about everything that doesn't involve using conditionals. E.g. has_permission_on :users, :to => [:edit, :update, :destroy] do if_attribute :user => is { current_user } end Are there any common pitfalls with Declarative Authorization? I'm using authlogic and I'm suspicious the 'current_user' method in the application controller might be the source of the problem.

    Read the article

  • GIT Exclude Specific Files when Pushing to Specific Repository

    - by Kevin Sylvestre
    Is it possible to exclude specific files (*.ai, *.psd) when pushing to certain repositories with GIT? My need comes from trying to use GIT for both version control and deployment to Heroku. If I include my graphic assets in the deploy, they slug size is larger than desired. However, I do need to include all project files in my main github repository. Thanks, Kevin

    Read the article

  • weird behavior with acts_as_taggable_on

    - by macek
    For some reason, tags aren't showing up on a taggable object when an tagger is specified. testing the post class Post < ActiveRecord::Base acts_as_taggable_on :tags belongs_to :user end >> p = Post.first => #<Post id: 1, ...> >> p.is_taggable? => true >> p.tag_list = "foo, bar" => "foo, bar" >> p.save => true >> p.tags => [#<Tag id: 1, name: "foo">, #<Tag id: 2, name: "bar">] testing the user class User < ActiveRecord::Base acts_as_tagger has_many :posts end >> u = User.first => #<User id: 1, ...> >> u.is_tagger? => true >> u.tag(p, :with => "hello, world", :on => :tags) => true >> u.owned_tags => [#<Tag id: 3, name: "hello">, #<Tag id: 4, name: "world">] refresh the post >> p = Post.first => #<Post id: 1 ...> >> p.tags => [#<Tag id: 2, name: "bar">, #<Tag id: 1, name: "foo">] Where's the hello and world tags? Miraculously, if I modify the database directly to set tagger_id and tagger_type to NULL, the two missing tags will show up. I suspect there's something wrong with my User model? What gives?

    Read the article

  • Rails - how can I query the db w/o touching the sessions table

    - by sa125
    Hi - I'm trying to provide a HTTP api to my app that queries a db that's read-only (for replication purposes). I find that my app crashes repeatedly when making a request b/c the call is trying to update the sessions table whenever I query the db. This doesn't happen when I return some text without hitting the database for info. class APIController < AplicationController def view data = Product.find(params[:id]).to_json # will fail data = { :one => 1, :two => 2 }.to_json # will succeed respond_to do |format| format.html { render :json => data } end end end How do I restrict it from touching the sessions table on this request (it's currently issuing an UPDATE on the updated_at field for that session). thanks.

    Read the article

  • Base-camp Style Subdomains and IDs of Models

    - by Newy
    I have an app that has Basecamp-style subdomains, that is, I have Projects, Users, Apples and Oranges. The Users, Apples and Oranges are all keyed to a Project and only exist in the http://project.myapp.com. I added a project_id to Users, Apples and Oranges and everything works, except of course that the ids of those three objects increment globally, and throughout my app I lookup objects by that id. This doesn't seem like best practice. Should I instead do lookups by a secondary key? How does that affect efficiency? If there's a good blog post that covers this, would be wesome.

    Read the article

  • has_many :through formtastic multi-select field

    - by Tristan O'Neil
    I'm trying to set up a many to many relationship using the has_many :through method and then use a multi-select field to setup the relationships. I'm following this tutorial: http://asciicasts.com/episodes/185-formtastic-part-2 However for some reason the form displays a strange hex number and it changes each page refresh, I'm not exactly sure what I'm doing wrong. Below is my model/view code. company.rb has_many :classifications has_many :sics, :through => :classifications sic.rb has_many :classifications has_many :companies, :through => :classifications classification.rb belongs_to :company belongs_to :sic _form.html.erb <% semantic_form_for @company do |f| %> <% f.inputs do %> <%= f.input :company %> <%= f.input :sics %> <% end %> <%= f.buttons %> <% end %> Also here is the the form looks like it's showing the correct number of entries for the field but it is clearly not showing the correct name for the relationship.

    Read the article

  • Easier way to generate paths

    - by Horace Loeb
    Songs on Rap Genius have paths like /lyrics/The-notorious-b-i-g-ft-mase-and-puff-daddy/Mo-money-mo-problems which are defined in routes.rb as: map.song '/lyrics/:artist_slug/:title_slug', :controller => 'songs', :action => 'show' When I want to generate such a path, I use song_url(:title_slug => song.title_slug, :artist_slug => song.artist_slug). However, I'd much prefer to be able to type song_url(some_song). Is there a way I can make this happen besides defining a helper like: def x_song_path(song) song_path(:title_slug => song.title_slug, :artist_slug => song.artist_slug) end

    Read the article

  • Save has_and_belongs_to_many link in basic RoR app

    - by Stéphane V
    I try to learn the has_and_belongs_to_many relationship between my 2 fresh new and simple models Product and Author, where a Product can have many authors and where author can have a lots of products. I wrote this : class Author < ActiveRecord::Base has_and_belongs_to_many :products end class Product < ActiveRecord::Base has_and_belongs_to_many :authors end In the partial form of view for the products, I have : <p>Products</p> <%= collection_select(:product, :author_ids, @authors, :id, :name, :prompt => " ", :multiple => true) %> but when I hit the update button, I get this strange message I can't resolve myself : NoMethodError in ProductsController#update undefined method `reject' for "1":String Rails.root: /home/stephane/www/HABTM Application Trace | Framework Trace | Full Trace app/controllers/products_controller.rb:63:in block in update' app/controllers/products_controller.rb:62:inupdate' Request Parameters: {"utf8"="✓", "_method"="put", "authenticity_token"="2GlTssOFjTVZ9BikrIFgx22cdTOIJuAB70liYhhLf+4=", "product"={"title"="Le trésor des Templiers", "original_title"="", "number"="1", "added_by"="", "author_ids"="1"}, "commit"="Update Product", "id"="1"} What's wrong ? Is there a problem with :product_ids... I saw on internet I had to pu a "s" but I'm not sure of what it represents.... How can I link the table authors_products to the key which is given back by the drop-down menu ? (here "author_ids"="1") Thx !

    Read the article

< Previous Page | 225 226 227 228 229 230 231 232 233 234 235 236  | Next Page >