Ruby on Rails Love-In

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > Ruby on Rails Love-In

«‹›178 »

Flobbster: Feb 17, 2005; "Cadet Kirk, after the way you cheated on the Kobayashi Maru test I oughta punch you in tha face!"

So I'm developing a system that involves managing assignments and courses for programming classes, and I have this nested resource structure that might belong in the Coding Horrors thread instead:

Ruby code:

  resources :institutions, shallow: true do
    resources :departments do
      resources :courses do
        resources :assignments
        resources :course_offerings do
          resources :course_enrollments
        end
      end
    end
  end

All the reading I've done indicates that nesting resources more than 1 deep is A Bad Idea, but that advice seems to have been written before shallow routes came along. Since the routes are shallow, the URLs are clean (never more than 1 deep) and everything Just Works with my route helpers and Cancan's load_and_authorize_resource mechanism, but am I still doing things here that could be better done a different way?

# ? Dec 29, 2012 02:55

Adbot: ADBOT LOVES YOU

# ? May 15, 2024 23:58

Kallikrates: Jul 7, 2002; Pro Lurker

Sounds like if you are throwing shallow (had to look it up; neat) you could also break it down by

Ruby code:


resources :institutions do
  resources :departments
end

resources :departments do
  resources :courses
end

resources :courses do
  resources :assignments
  resources :course_offerings
end

resources :course_offerings do
  resources :course_enrollments
end

I'm not sure what the thought behind shallow is in edge rails it seems to allow you to sidestep the common practice of not deeply nesting routes. I would say if its working for you and and shallow is there go crazy, it makes your routes easier to read.

Also your enrollment(able) model may be a good use of a concern (in models and in routes) I would think it possible for a student to be enrolled in an institution and a course, but that might be academic and not something you care about.

# ? Dec 29, 2012 18:45

rugbert: Mar 26, 2003; yea, fuck you

I recently started working at a trade association and apparently trade associations are computer retarded. The past developers here hand built all their apps using the worse practices so Im trying to get them up to speed. I havent used rails in a while so I'd like to take that route to brush up and continue learning, plus its mad quick to build these dinky apps with Rails.

While it looks like each app has it's own database, they use an external DB for membership called iMIS which we use to authenticate access to our apps and sites. I'm pretty sure its just a mySQL db with some custom interface, that being said, would it be easy to configure Devise to authenticate against that DB?

I found a couple articles about setting up multiple DBs and then tying in specific models to those DBs, would I be on the right track if I pointed my user model (created with devise) to the external DB that way?

# ? Jan 2, 2013 20:03

Kallikrates: Jul 7, 2002; Pro Lurker

We're currently mid migration from "all apps authenticate a user against stored in the same X db" to: "auth service hands out authenticity tokens to apps". There's a lot of moving parts and setting up all the integration and selenium tests for redirects was a big learning curve. Going back, having a User model located in a separate DB is pretty easy, and you might not even need to write any migrations for it. Have fun trying to reverse engineer whatever authentication scheme they thought up, though.

# ? Jan 2, 2013 21:16

double sulk: Jul 2, 2010

For everyone's reference, since this is now floating around; a SQL injection vulnerability across almost all versions of ActiveRecord:

https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/DCNTNp_qjFM

# ? Jan 2, 2013 23:31

Smol: Jun 1, 2011; Stat rosa pristina nomine, nomina nuda tenemus.

That vulnerability itself isn't super-serious (it needs to be combined with an another vulnerability that allows the attacker to inject a symbol-keyed Hash to the find_by_ methods), but there have been been some rumours of other much more serious vulnerabilities that will be revealed in the near future. So be ready to upgrade your apps in any case.

# ? Jan 3, 2013 20:44

prom candy: Dec 16, 2005; Only I may dance

It's times like this that I hate managing 150+ Rails applications across a ton of different versions.

# ? Jan 3, 2013 22:15

Novo: May 13, 2003; ^{Stercorem pro cerebro habes}; Soiled Meat

prom candy posted:

It's times like this that I hate managing 150+ Rails applications across a ton of different versions.

I feel your pain. I provide infrastructure support for almost 40 Rails apps ranging from 2.3 to 3.2, and maintain a few of those apps myself as well. There are days where I end up hating the entire Ruby ecosystem. We're still on 1.8.7 so I'm simultaneously dreading and looking forward to moving to 1.9.

# ? Jan 4, 2013 01:14

Smol: Jun 1, 2011; Stat rosa pristina nomine, nomina nuda tenemus.

Yeah, I'm already prepared to have to update like 20 apps during the weekend. :smith:

# ? Jan 4, 2013 01:16

The Sweetling: May 13, 2005; BOOMSHAKALAKA; Fun Shoe

Jumping on the tutorial bandwagon here: please recommend some good resources for brushing up on my PostgeSQL. I haven't had the need to write complex queries in ages and feel a bit rusty.

# ? Jan 7, 2013 18:13

Oh My Science: Dec 29, 2008

The Sweetling posted:

Jumping on the tutorial bandwagon here: please recommend some good resources for brushing up on my PostgeSQL. I haven't had the need to write complex queries in ages and feel a bit rusty.

Ryan Bates has some fairly recent screencasts covering PostgreSQL & its features. Most of the good ones are "subscription only" though, and you'll have to cough up $9 to view them.

I found this http://www.postgresqltutorial.com/.

# ? Jan 7, 2013 18:32

raej: Sep 25, 2003; "Being drunk is the worst feeling of all. Except for all those other feelings."

For those familiar with the rails tutorial app:

Is there an easy way to have other actions create a micropost? Like say, when someone follows another person, it posts a micropost saying "Now following <user>"

# ? Jan 8, 2013 00:22

kitten smoothie: Dec 29, 2001

Anyone have a link to a good example Puppet deploy config for Rails? The stuff I have found from googling around seems a year or more old and I am not sure if I should trust its advice.

Barring that does the Pragmatic book on deploying Rails have some deep discussion on Puppet?

# ? Jan 8, 2013 00:39

Anveo: Mar 23, 2002

kitten smoothie posted:

Anyone have a link to a good example Puppet deploy config for Rails? The stuff I have found from googling around seems a year or more old and I am not sure if I should trust its advice.

Barring that does the Pragmatic book on deploying Rails have some deep discussion on Puppet?

I wouldn't suggest using puppet to deploy your applications. Have puppet configure the environment supporting the app (rubies, gems, packages, sensitive configs, etc) and then use capistrano to orchestrate the actual deployment as needed.

# ? Jan 8, 2013 01:13

A MIRACLE: Sep 17, 2007; All right. It's Saturday night; I have no date, a two-liter bottle of Shasta and my all-Rush mix-tape... Let's rock.

raej posted:

For those familiar with the rails tutorial app:

Is there an easy way to have other actions create a micropost? Like say, when someone follows another person, it posts a micropost saying "Now following <user>"

Sure, it's just ruby. You can use callbacks or just do it directly in the action. Might look something like`Micropost.create(:content => "Now following #{target_user.name}", :other_param => ... )`

# ? Jan 8, 2013 01:17

Pardot: Jul 25, 2001

The Sweetling posted:

Jumping on the tutorial bandwagon here: please recommend some good resources for brushing up on my PostgeSQL. I haven't had the need to write complex queries in ages and feel a bit rusty.

Also check out postgresguide.com, and if you have any specific questions, I'm happy to help.

# ? Jan 8, 2013 09:03

Nolgthorn: Jan 30, 2001; The pendulum of the mind alternates between sense and nonsense

I've been toying around in Rails 4 using the screencast from Ryan Bates (that stuff is good).

Rails 4 is using minitest, which is awesome. But by default when you create a new model tests in Rails are being wrapped in TestCase which I guess is designed to make minitest look and act like test unit. Is there any way to tell Rails "no I want minitest I don't need your ridiculous extra pointless layers of complexity". Or do I just hack at the tests to make them use minitest and minitest::spec myself?

# ? Jan 8, 2013 15:20

prom candy: Dec 16, 2005; Only I may dance

raej posted:

For those familiar with the rails tutorial app:

Is there an easy way to have other actions create a micropost? Like say, when someone follows another person, it posts a micropost saying "Now following <user>"

You'll probably want to implement some sort of observer pattern if this is going on all over your app, or use something like http://jamesgolick.com/2009/8/5/observational-better-observers-for-activerecord.html

# ? Jan 8, 2013 18:21

Civil Twilight: Apr 2, 2011

There are multiple weaknesses in the parameter parsing code for Ruby on Rails which allows attackers to bypass authentication systems, inject arbitrary SQL, inject and execute arbitrary code, or perform a DoS attack on a Rails application.

Happy new year, everyone.

# ? Jan 8, 2013 21:21

Physical: Sep 26, 2007; by T. Finninho

Civil Twilight posted:

There are multiple weaknesses in the parameter parsing code for Ruby on Rails which allows attackers to bypass authentication systems, inject arbitrary SQL, inject and execute arbitrary code, or perform a DoS attack on a Rails application.

Happy new year, everyone.

You forgot the :toot:

# ? Jan 8, 2013 21:42

asveepay: Jul 7, 2005; internobody

Haha! fortunately my company's rails stack is so old this vulnerability doesn't apply.

# ? Jan 8, 2013 22:58

Smol: Jun 1, 2011; Stat rosa pristina nomine, nomina nuda tenemus.

gently caress gently caress gently caress gently caress.

E: At least they released 2.3.15. I was prepared to to patch all our 2.3.x apps manually.

# ? Jan 8, 2013 23:04

prom candy: Dec 16, 2005; Only I may dance

We have a ton of apps on 2.3.5 so updating isn't an option for us (because of the stupid forced HTML escaping they introduced). Luckily we were able to manually patch our 2.3.5 install but still.

# ? Jan 9, 2013 21:22

Cock Democracy: Jan 1, 2003; Now that is the finest piece of chilean sea bass I have ever smelled

prom candy posted:

We have a ton of apps on 2.3.5 so updating isn't an option for us (because of the stupid forced HTML escaping they introduced). Luckily we were able to manually patch our 2.3.5 install but still.

Can't you work around that by using the raw method?

# ? Jan 9, 2013 23:31

prom candy: Dec 16, 2005; Only I may dance

We have at least 100 apps running on 2.3.5. Editing every view in every app to add raw in the right places would take days, if not weeks. Adding that functionality in a non-major release was the most frustrating thing the Rails team has ever done.

# ? Jan 10, 2013 05:44

Cocoa Crispies: Jul 20, 2001; Vehicular Manslaughter!; Pillbug

If you haven't patched yet, better fuckin' get that going: https://community.rapid7.com/community/metasploit/blog/2013/01/09/serialization-mischief-in-ruby-land-cve-2013-0156?x=1

quote:

Update 2: An anonymous contributor pointed us to a specific class that is exploitable using the ruby/hash method (#3 above). The class is
ActionDispatch::Routing::RouteSet::NamedRouteCollection. Expect a Metasploit module in the next 4-12 hours.

Metasploit is a lot of fun and if you don't update it will be a lot of fun figuring out what somebody did to your app.

# ? Jan 10, 2013 05:48

hmm yes: Dec 2, 2000; College Slice

prom candy posted:

We have at least 100 apps running on 2.3.5. Editing every view in every app to add raw in the right places would take days, if not weeks. Adding that functionality in a non-major release was the most frustrating thing the Rails team has ever done.

I'm in a similar boat: fewer apps but also I suspect fewer resources to deal with it. I still don't understand why they released that in 2.3.x instead of just waiting until 3

# ? Jan 10, 2013 16:45

b0lt: Apr 29, 2005

~rails is omakase~

# ? Jan 11, 2013 07:55

A MIRACLE: Sep 17, 2007; All right. It's Saturday night; I have no date, a two-liter bottle of Shasta and my all-Rush mix-tape... Let's rock.

noob question time: I'm using a bit of raw ajax on a page with jQuery's `$.getJSON` method and relative pathing. It works fine on my local machine, but breaks on staging, which has an SSL cert. So Chrome complains that `the page at https://mydomain.com/my/path has displayed insecure content from http://mydomain.com/my/path`, and interrupts the GET request.

I guess my question is, is there a way to retain relative pathing (as opposed to hardcoding the URIs, which would be a pain to manage between production, staging, dev etc) while ensuring that the AJAX method uses the `https` protocol in it's request URI?

Thanks for any tips :-)

# ? Jan 11, 2013 15:27

manero: Jan 30, 2006

A MIRACLE posted:

noob question time: I'm using a bit of raw ajax on a page with jQuery's `$.getJSON` method and relative pathing. It works fine on my local machine, but breaks on staging, which has an SSL cert. So Chrome complains that `the page at https://mydomain.com/my/path has displayed insecure content from http://mydomain.com/my/path`, and interrupts the GET request.

I guess my question is, is there a way to retain relative pathing (as opposed to hardcoding the URIs, which would be a pain to manage between production, staging, dev etc) while ensuring that the AJAX method uses the `https` protocol in it's request URI?

Thanks for any tips :-)

Paste the JS somewhere (like pastie.org) and we can look at it.

Usually you can just do something like:

code:

$.getJSON('/my/path/url', ...

And it should keep the protocol regardless of HTTP or HTTPS

# ? Jan 11, 2013 15:39

A MIRACLE: Sep 17, 2007; All right. It's Saturday night; I have no date, a two-liter bottle of Shasta and my all-Rush mix-tape... Let's rock.

Ok, you're right. I tried just getting a simple request from the console using the full https path and got the same error. I found this thread on stack overflow which suggests it may be an nginx problem.

# ? Jan 11, 2013 15:46

Physical: Sep 26, 2007; by T. Finninho

Where can I find info on RubyCon and other RoR convetions?

e: durrrr http://www.railsconf.com/ But are there any others?

Physical fucked around with this message at 15:53 on Jan 11, 2013

# ? Jan 11, 2013 15:49

A MIRACLE: Sep 17, 2007; All right. It's Saturday night; I have no date, a two-liter bottle of Shasta and my all-Rush mix-tape... Let's rock.

Ruby Conf was a few months ago. Heroku just announced this year's Waza if you're interested.

# ? Jan 11, 2013 15:57

Physical: Sep 26, 2007; by T. Finninho

A MIRACLE posted:

Ruby Conf was a few months ago. Heroku just announced this year's Waza if you're interested.

Yes yes, more! I need more to submit for training this year!

# ? Jan 11, 2013 16:02

prom candy: Dec 16, 2005; Only I may dance

RailsConf is going to be in April.

# ? Jan 11, 2013 16:04

Civil Twilight: Apr 2, 2011

Physical posted:

Where can I find info on RubyCon and other RoR convetions?

e: durrrr http://www.railsconf.com/ But are there any others?

http://lanyrd.com/topics/ruby-on-rails/ seems to know.

# ? Jan 11, 2013 16:28

Physical: Sep 26, 2007; by T. Finninho

http://magic-ruby.com/ Hopefully they do it again this year :negative:

# ? Jan 11, 2013 16:57

tima: Mar 1, 2001; No longer a newbie

Physical posted:

Where can I find info on RubyCon and other RoR convetions?

e: durrrr http://www.railsconf.com/ But are there any others?

Here is one on the west end of us http://mtnwestrubyconf.org/

# ? Jan 11, 2013 17:47

Cocoa Crispies: Jul 20, 2001; Vehicular Manslaughter!; Pillbug

Physical posted:

http://magic-ruby.com/ Hopefully they do it again this year

I spoke at it last year, and for various reasons I wouldn't expect it to be inside a theme park again.

RubyConf is going to be in Miami Beach this November, so that'll be nice.

# ? Jan 11, 2013 18:25

Adbot: ADBOT LOVES YOU

# ? May 15, 2024 23:58

dexter: Jun 24, 2003

A MIRACLE posted:

noob question time: I'm using a bit of raw ajax on a page with jQuery's `$.getJSON` method and relative pathing. It works fine on my local machine, but breaks on staging, which has an SSL cert. So Chrome complains that `the page at https://mydomain.com/my/path has displayed insecure content from http://mydomain.com/my/path`, and interrupts the GET request.

I guess my question is, is there a way to retain relative pathing (as opposed to hardcoding the URIs, which would be a pain to manage between production, staging, dev etc) while ensuring that the AJAX method uses the `https` protocol in it's request URI?

Thanks for any tips :-)

You can use /my/path as the path as long as it's the same hostname. You should be using SSL in all environments (including development) though if you're using it in production.

# ? Jan 11, 2013 19:48

The Something Awful Forums > Discussion > Serious Hardware/Software Crap > The Cavern of COBOL > Ruby on Rails Love-In

«‹›178 »