小编Kei*_*thP的帖子

Rails 5.0.0.beta1 - 从非清理的请求参数生成URL是不安全的

我们正在从Rails 4.2.5升级到5.0.0.beta1

在测试时,我们希望看到像以前一样使用分页链接呈现的索引视图.但是我们现在得到一个ArgumentError错误页面,例如:

ArgumentError in Transactions#index 
/app/views/kaminari/_paginator.html.erb where line #10 raised:


<%= paginator.render do -%>

Generating an URL from non sanitized request parameters is insecure!

Application Trace | Framework Trace | Full Trace

app/views/kaminari/_paginator.html.erb:10:in block in _app_views_kaminari__paginator_html_erb___4026289994022119719_69904100316060' app/views/kaminari/_paginator.html.erb:9:in_app_views_kaminari__paginator_html_erb___4026289994022119719_69904100316060'
app/views/transactions/index.html.erb:2:in `_app_views_transactions_index_html_erb__422882858554400818_60602560'
Run Code Online (Sandbox Code Playgroud)

kaminari提出了一个问题

进一步研究这里是新的Rails 5.0.0.beta1代码,现在抛出错误: ActionPack的/ lib目录/ action_dispatch /路由/ url_for.rb

将它添加到config/application.rb'修复'它,但不是一个好主意:

config.action_controller.permit_all_parameters = true
Run Code Online (Sandbox Code Playgroud)

而是添加这个并不能解决问题,不确定原因:

config.action_controller.always_permitted_parameters =  [:current_page, :page, :total_pages, :per_page, :remote, :paginator]
Run Code Online (Sandbox Code Playgroud)

ruby-on-rails upgrade sanitize kaminari ruby-on-rails-5

17
推荐指数
1
解决办法
3543
查看次数

Rails 5 db migration:如何修复ActiveRecord :: ConcurrentMigrationError

之前的rake db:rollback停滞不前.现在,在尝试新迁移时,我们收到以下错误:

rake aborted!
ActiveRecord::ConcurrentMigrationError: 

Cannot run migrations because another migration process is currently running.

/home/me/.rvm/gems/ruby-2.4.1@global/gems/activerecord-    5.1.4/lib/active_record/migration.rb:1315:in `with_advisory_lock'
/home/me/.rvm/gems/ruby-2.4.1@global/gems/activerecord-5.1.4/lib/active_record/migration.rb:1148:in `migrate'
/home/me/.rvm/gems/ruby-2.4.1@global/gems/activerecord-5.1.4/lib/active_record/migration.rb:1007:in `up'
/home/me/.rvm/gems/ruby-2.4.1@global/gems/activerecord-5.1.4/lib/active_record/migration.rb:985:in `migrate'
/home/me/.rvm/gems/ruby-2.4.1@global/gems/activerecord-5.1.4/lib/active_record/tasks/database_tasks.rb:171:in `migrate'
/home/me/.rvm/gems/ruby-2.4.1@global/gems/activerecord-5.1.4/lib/active_record/railties/databases.rake:58:in `block (2 levels) in <top (required)>'
/home/me/.rvm/gems/ruby-2.4.1/gems/rake-12.1.0/exe/rake:27:in `<top (required)>'
/home/me/.rvm/gems/ruby-2.4.1/bin/ruby_executable_hooks:15:in `eval'
/home/me/.rvm/gems/ruby-2.4.1/bin/ruby_executable_hooks:15:in `<main>'
Tasks: TOP => db:migrate
(See full trace by running task with --trace)
Run Code Online (Sandbox Code Playgroud)

我们正在使用Postresql

ruby postgresql activerecord ruby-on-rails-5

15
推荐指数
3
解决办法
4233
查看次数

AWS上的ActionCable:WebSocket握手期间出错:意外响应代码:404

我们正在尝试将DHH的简单Rails 5聊天示例部署到AWS上的单个自包含EC2实例.代码可在此处获取:https://github.com/HectorPerez/chat-in-rails5

我们使用Elastic Beanstalk来启动单个实例:

eb create dev-env -p “64bit Amazon Linux 2015.09 v2.0.4 running Ruby
2.2 (Puma)” –single -i t2.micro --envvars
SECRET_KEY_BASE=g5dh9cg614a37d4bdece9126b42d50d0ab8b2fc785daa1e0dac0383d6387f36b
Run Code Online (Sandbox Code Playgroud)

这是一个最小的安装,因此没有Elasticache,也没有负载均衡器.要在EC2实例上安装redis,我们添加了一个.ebextensions配置文件,如下所示:https://gist.github.com/KeithP/08b38189372b7fd241e5#file-ebextensions-redis-config ; Git提交和部署.

但是websocket不起作用:检查浏览器控制台,我们看到这个错误一遍又一遍地重复:

application-a57354de3399cd895ca366df9bd7316ab69e81d266b63be7d7be563ebc78ab9d.js:27 
WebSocket connection to ‘ws://dev-env-y2e5dcrxqk.elasticbeanstalk.com/cable’ failed: 
Error during WebSocket handshake: Unexpected response code: 404
Run Code Online (Sandbox Code Playgroud)

在此输入图像描述

服务器production.log为每个"Finished/cable"呼叫显示2"Started GET/cable".ActiveCable没有DEBUG消息:

/var/app/containerfiles/logs/production.log
-------------------------------------

INFO -- : Processing by RoomsController#show as HTML 
DEBUG -- :   [1m[36mMessage Load (0.1ms)[0m  [1m[34mSELECT "messages".* FROM "messages"[0m INFO -- :   Rendered collection (0.0ms) 
INFO -- :   Rendered rooms/show.html.erb within layouts/application …
Run Code Online (Sandbox Code Playgroud)

deployment amazon-web-services redis ruby-on-rails-5 actioncable

7
推荐指数
1
解决办法
3164
查看次数

Rails 5.2 Active Storage直接上传失败:缺少CORS标题"Access-Control-Allow-Origin"

我正在尝试Rail 5.2.0.rc1 Active Storage,使用其包含的JavaScript库将PDF文档直接从客户端上传到云端.但在提交表单时,我在Firefox和Chrome中都出现了浏览器错误:

Cross-Origin Request Blocked... (Reason: CORS header ‘Access-Control-Allow-Origin’ missing).
Run Code Online (Sandbox Code Playgroud)

因此,在activestorage.js中设置标题为this.xhr.setRequestHeader ...并且似乎不可配置:https://github.com/rails/rails/blob/master/activestorage/app/javascript/activestorage/blob_record. JS

有人建议吗?

amazon-s3 rails-activestorage ruby-on-rails-5.2

4
推荐指数
1
解决办法
2147
查看次数