51–60 of 91 posts
What's the recommended alternative to ActiveRecord Observers? I know they aren't perfect, but I wasn't a fan of cluttering my models with lots of after_commit - is there a better way?
Earlier quoted context omitted.
In my opinion the easy way is to look through the github issues and pull requests and understand what's going on. From there, try reading docs and seeing what does / doesn't make sense and editing it. You pretty much always get feedback if you send a decently put together pull request. Look for places the code might not currently be clear, and try to improve clarity without changing behavior. Once you've done that ki…
Is there any sort of prioritized TODO list, either by difficultly or importance? And that's not so I can knock out some big feature and be the hero, but so I can whittle away at some of the more nagging edge cases and make some random developers day when things just work.
That's one of the only things I'm frustrated about - I wish there were a clearer list so that I didn't have to troll for tasks that need doing, or ask a core member on IRC/campfire
Earlier quoted context omitted.
I'm not sure what you mean by 'forking the entire codebase'. Even if Rails3, though, Rails supported multi-threaded request dispatching IF you had an app server stack that supported it. In Rails3, you just had to explicitly turn it on with `config.threadsafe!`. Rails4 makes that the default, always on. That's really the only difference. There are at least a few concurrency-related bugs that have been fixed in Rails4…
> Finding a mature, reliable, well-documented app server stack that supports multi-threaded concurrent request dispatch may be harder. Try Jruby and Puma.
Hello everyone! I am MEGA EXCITED for this release, as it's the first version in which I'm a committer. Wooo! In addition, 954 other intrepid Rubyists in total contributed to this release: http://contributors.rubyonrails.org/edge/contributors Please note that this is a beta, not an rc, so some things may be a bit wonky. Please file an issue on GitHub and I will do everything I can to help you help us iron out all the…
I'm curious to know if these examples of potential SQL injection tested against 3.2.11 have been dealt with in 4.0? Would be great to see these possible problems tidied up. http://rails-sqli.org/
What would you like to have changed here? The methods work fine as long as you do not explicitly embed a user-supplied string in a larger SQL fragment.
Earlier quoted context omitted.
Rails 4 uses turbolinks. It is a mechanism that instead of loading a new page loads up the HTML via AJAX and replaces the entire content of the page without reloading all the resources(css, js, etc...) So instead of having to deal with plenty of small ajax calls you just build an app as it would work in plain HTML and just use turbolinks to leverage AJAX.
Funny that ASP.NET had the same thing, called Smart Navigation, back in 2003.
Earlier quoted context omitted.
I'm curious to know if these examples of potential SQL injection tested against 3.2.11 have been dealt with in 4.0? Would be great to see these possible problems tidied up. http://rails-sqli.org/
The examples here do not include SQL injection from known CVEs and are not vulnerabilites themselves, only potential misuses of the methods. What would you like to have changed here? The methods work fine as long as you do not explicitly embed a user-supplied string in a larger SQL fragment.
Order.calculate(:sum, params[:column])
And do a simple sum in the controller:
sum = Advert.calculate(:sum, params[:column])
# or
sum = Advert.sum(params[:column])
SELECT SUM(id) FROM users WHERE name = 'Bob' SUM(id) FROM "adverts"
Now the intended use of sum, count etc is to deal with symbols chosen by the programmer, but a naive implementation of say an admin form for summing some record attributes might use a param from a form, and pass that in to the sum method for column name, just as they might use params[:id] with find. I think Rails should deal with that.
Also the example given of User.exists? params[:id] is probably commonly used, but vulnerable to manipulation of results at the very least.
I'm not the original author of this page (which is already public and probably has been for some time), and am aware this is not an appropriate place to report bugs, but it would be reassuring if the Rails team looked at this link and fixed anything which is dangerous like the usage above.
IMHO all rails ActiveRecord methods should guard against sqli as much as possible, not just the commonly used ones, and if they don't currently it needs to be fixed.
Earlier quoted context omitted.
I'm curious to know if these examples of potential SQL injection tested against 3.2.11 have been dealt with in 4.0? Would be great to see these possible problems tidied up. http://rails-sqli.org/
I am not a member of the security team, but it's my understanding that all security patches were also applied against master where appropriate. (The security team is a subset of the core team, in accordance with least privilege and all that.)
Thanks for contributing Rails 4.0 - I'm excited to try it out, in particular the new caching looks great.
I'm not a rubyist but I'm really excited for the russian-doll caching and really hope it catches on in other frameworks. Data dependency tracking makes everything from straight-up caching to real-time updates effortless and I think is one of the few places where an ORM can be really helpful (queue the two hard problems quote about cache-invalidation and naming things). Quora has been doing this since the beginning an…
I think you meant "cue", otherwise please help a foreigner with this english expression's meaning.. queue onto what?
I'm not a rubyist but I'm really excited for the russian-doll caching and really hope it catches on in other frameworks. Data dependency tracking makes everything from straight-up caching to real-time updates effortless and I think is one of the few places where an ORM can be really helpful (queue the two hard problems quote about cache-invalidation and naming things). Quora has been doing this since the beginning an…
> (queue the two hard problems quote about cache-invalidation and naming things) I think you meant "cue", otherwise please help a foreigner with this english expression's meaning.. queue onto what?