Upgrading From Rails < 2.0.1 - Security Notice

September 8th, 2009

So when you’re upgrading your ghetto rails app that hasn’t been touched in a couple of years to the new hottness, make sure you check your filters.

Previously, in Rails < 2.0.1 if you returned false in a before filter, it would stop the processing of the action. In Rails >= 2.0.1, before_filters _must_ now redirect or render in order to halt the calling of the controller action.

This can be a large security issue if you are returning false in an authorize component. Make sure to update them to redirect or render a 403.

In our case, we also created a “errors” directory in our views directory to hold our 403.erb view which we now call where we used to return false only.

Previously:

return false

Now:

render ‘errors/403′, :status => 403 and return false

Spore Creature Creator and DirectX woes

September 14th, 2008

Just some info to hopefully save some time for others. During the installation of the Spore Creature Creator Demo you are prompted to install DirectX 9 (wtf?). I went and started the installation until it came up with this error:

A cabinet file necessary for installation cannot be trusted. Please verify
Cryptographic Services are enabled and the cabinet file certificate is valid.

After searching the web and trying everything under the sun, it came down to deleting the “websetup” folder in the %systemroot%\system32\directx folder. After it was removed I ran the setup again and everything went as planned.

Moving to Corvallis

April 7th, 2008

Looks like we are moving to Corvallis. Erin found this nice ’70s house that needs some updating. It is in a nice neighborhood and we should be able to fit in well. Now, to sell our current house!

PCR: When you need to know who the daddy is.

March 2nd, 2008

BeaverBarCamp

March 2nd, 2008

 beaver_barcamp_logo2.jpg

BeaverBarCamp. Was it worth going to? I say yes.

There were definitely some smart/cool projects happening. The next BarCamp I’ll try and attend more events. Our BeaverSource presentation went well, Eric Betts did a great job describing it. Hopson++ for getting the SSO module done so quickly.

Things that would be nice:

  • Planned sessions please. People have lives. Lives don’t bend around “There might be a session between 9 and 5 that sounds cool.”
  • Having people silence their phones during talks.  Rude++
  • Theme for the meet, or possible topic areas.

Things that were nice:

  • The creative atmosphere.
  • The people.
  • The food.

Topics that I should at least read up on:

Barry, Jose, Wil, and Jeremy were present, all looking like they have been to more events like this than me.

SortHelper2 - Multiple Table / Coumn Sorting

August 2nd, 2007

When working with Rails for the rewrite of our site management utility I had the need to perform sorting on multiple columns of a result set. SortHelper2 is clean and works well for one table but it doesn’t support multiple tables. I present:

SortHelper2 - Multiple Tables

Please leave a comment with any bugs/issues you find.

Todo:

  • Add Tests

Wedding

July 1st, 2007

Just married this weekend. Yay!

:)

Pictures.

Plone and Ubuntu Edgy Eft 6.10

March 27th, 2007

While looking into Plone I wanted to get a development environment up quickly. Searching the webs revealed a few sites which described the process on Dapper. Applying those tutorials failed because of a few package changes.

Here are the commands to get things up and running:

sudo aptitude install zope2.9

sudo aptitude install plone-site

This will ask you for some admin settings and then start the Zope server.

The default port is 8081, so you can float on over to http://localhost:8081/

HTMs

March 8th, 2007

I have found an interest in HTMs or “Hierarchical Temporal Memorys”. Jeff Hawkins, the creator of Palm Inc. and Handspring has started a community around this technology. The aim is to allow computers to learn the same way that the brain does, through patterns in hierarchy and time.

Currently, I’m reading Hierarchical Temporal Memory: Concepts, Theory and Terminology

Robert, from work, thought of a good use for this technology.

Monitoring live web access logs for our servers at work to see if a site has been hacked or we are receiving a DOS attack.

This is a fairly encompassing idea, but I think that HTMs will be able to accomplish it easily.

Hi.

March 6th, 2007

Welcome. A change, for the better, I hope.
Please look around, at my Activities and l earn About Me. Leave a comment.