mirror/growstuff
1
0 Fork 0
mirror of https://github.com/Growstuff/growstuff.git synced 2026-11-04 20:22:47 -05:00
Code Issues Packages Projects Releases Wiki Activity
13,034 Commits 98 Branches 96 Tags
8e3814e615dd409ded29a341d03237fcaa4e94de
Commit Graph
13034 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Daniel O'Connor a10f6e4783 Name: actionpack 
Version: 4.1.11
Advisory: CVE-2015-7581
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/dthJ5wL69JE
Title: Object leak vulnerability for wildcard controller routes in Action Pack
Solution: upgrade to >= 4.2.5.1, ~> 4.2.5, >= 4.1.14.1, ~> 4.1.14

Name: actionpack
Version: 4.1.11
Advisory: CVE-2016-0751
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/9oLY_FCzvoc
Title: Possible Object Leak and Denial of Service attack in Action Pack
Solution: upgrade to ~> 5.0.0.beta1.1, >= 4.2.5.1, ~> 4.2.5, >= 4.1.14.1, ~> 4.1.14, ~> 3.2.22.1

Name: actionpack
Version: 4.1.11
Advisory: CVE-2015-7576
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/ANv0HDHEC3k
Title: Timing attack vulnerability in basic authentication in Action Controller.
Solution: upgrade to ~> 5.0.0.beta1.1, >= 4.2.5.1, ~> 4.2.5, >= 4.1.14.1, ~> 4.1.14, ~> 3.2.22.1

Name: actionpack
Version: 4.1.11
Advisory: CVE-2016-2098
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/ly-IH-fxr_Q
Title: Possible remote code execution vulnerability in Action Pack
Solution: upgrade to ~> 3.2.22.2, >= 4.2.5.2, ~> 4.2.5, >= 4.1.14.2, ~> 4.1.14

Name: actionview
Version: 4.1.11
Advisory: CVE-2016-2097
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/ddY6HgqB2z4
Title: Possible Information Leak Vulnerability in Action View
Solution: upgrade to ~> 3.2.22.2, >= 4.1.14.2, ~> 4.1.14

Name: actionview
Version: 4.1.11
Advisory: CVE-2016-0752
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/335P1DcLG00
Title: Possible Information Leak Vulnerability in Action View
Solution: upgrade to ~> 5.0.0.beta1.1, >= 4.2.5.1, ~> 4.2.5, >= 4.1.14.1, ~> 4.1.14, ~> 3.2.22.1

Name: activemodel
Version: 4.1.11
Advisory: CVE-2016-0753
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/6jQVC1geukQ
Title: Possible Input Validation Circumvention in Active Model
Solution: upgrade to ~> 5.0.0.beta1.1, >= 4.2.5.1, ~> 4.2.5, >= 4.1.14.1, ~> 4.1.14

Name: activerecord
Version: 4.1.11
Advisory: CVE-2015-7577
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/cawsWcQ6c8g
Title: Nested attributes rejection proc bypass in Active Record
Solution: upgrade to ~> 5.0.0.beta1.1, >= 4.2.5.1, ~> 4.2.5, >= 4.1.14.1, ~> 4.1.14, ~> 3.2.22.1
 2016-03-28 23:17:55 +10:30
Daniel O'Connor a76d2a3eb0 Name: devise 
Version: 3.4.1
Advisory: CVE-2015-8314
Criticality: Unknown
URL: http://blog.plataformatec.com.br/2016/01/improve-remember-me-cookie-expiration-in-devise/
Title: Devise Gem for Ruby Unauthorized Access Using Remember Me Cookie
Solution: upgrade to >= 3.5.4
 2016-03-28 23:16:21 +10:30
Daniel O'Connor 049886459a Name: nokogiri 
Version: 1.6.5
Advisory: CVE-2015-1819
Criticality: Unknown
URL: https://github.com/sparklemotion/nokogiri/issues/1374
Title: Nokogiri gem contains several vulnerabilities in libxml2 and libxslt
Solution: upgrade to ~> 1.6.6.4, >= 1.6.7.rc4

Name: nokogiri
Version: 1.6.5
Advisory: CVE-2015-7499
Criticality: Medium
URL: https://groups.google.com/forum/#!topic/ruby-security-ann/Dy7YiKb_pMM
Title: Nokogiri gem contains a heap-based buffer overflow vulnerability in libxml2
Solution: upgrade to >= 1.6.7.2

Name: nokogiri
Version: 1.6.5
Advisory: CVE-2015-5312
Criticality: High
URL: https://groups.google.com/forum/#!topic/ruby-security-ann/aSbgDiwb24s
Title: Nokogiri gem contains several vulnerabilities in libxml2
Solution: upgrade to >= 1.6.7.1
 2016-03-28 23:13:31 +10:30
Daniel O'Connor b57cb581dd #840 Eager load photos 2016-03-28 23:08:26 +10:30
Daniel O'Connor f23cb78dcb #840 Eager load photos, which are used in the .interesting? call; so we don't have to do a photos.size call on every single crop. 2016-03-28 23:08:20 +10:30
Daniel O'Connor bfffaab77f Have to stub the controller load_and_authorize_resource behaviour, as these tests aren't run in that context. 2016-03-28 22:26:36 +10:30
Daniel O'Connor 32af1b28a8 Update the expectations: an edit link is visible to crop wranglers (which used to be an expectation about the id appearing in a link) 2016-03-28 22:03:59 +10:30
Daniel O'Connor 9fa72fa5f7 Only render a pipe if there are multiple options like edit rights available 2016-03-28 21:41:06 +10:30
Daniel O'Connor e35b15c868 Only render an edit control if the permission exists 2016-03-28 21:40:58 +10:30
Cesy 22e0e8fba0 Merge pull request #836 from gustavor-souza/patch-2 
Fixing a spec timezone problem.
 2015-10-09 09:17:15 +01:00
gustavor-souza 8caea57c47 Fixing a spec timezone problem. 2015-09-29 22:40:13 -03:00
Jim Stallings 2f561aaa47 Add myself to contributors 2015-09-26 11:54:51 -04:00
Jim Stallings e02a6e569c Remove example file, add documentation 2015-09-26 11:54:02 -04:00
pozorvlak 24dd02a439 Merge pull request #829 from CloCkWeRX/upgrade_db_cleaner 
Upgrade database cleaner gem
 2015-09-23 21:17:14 +01:00
Cesy 45c8092a94 Merge pull request #832 from CloCkWeRX/ruby217 
Bump to ruby 2.1.7 for CVE-2015-3900
 2015-09-23 11:35:26 +01:00
Daniel O'Connor 48829dba3c Bump to ruby 2.1.7 for CVE-2015-3900 Request hijacking vulnerability in RubyGems 2.4.6 and earlier; and others - https://www.ruby-lang.org/en/news/2015/08/18/ruby-2-1-7-released/ 2015-09-22 11:14:50 +09:30
Jim Stallings 98581801c3 GS-658 - i18n automation POC 2015-09-19 17:45:31 -04:00
Jim Stallings 93f9435fb9 GS-658: sort locale keys, add rake task for it 2015-09-19 16:24:01 -04:00
Cesy 46ee2168e1 Merge pull request #831 from CloCkWeRX/add_selenium 
Add additional capyabara driver options
 2015-09-16 11:59:22 +01:00
Cesy 5dd52ba17f Merge pull request #830 from CloCkWeRX/sprellin 
Fix minor typo in specs
 2015-09-16 11:52:30 +01:00
Daniel O'Connor 78a65f26c6 Add configuration into example file 2015-09-16 14:16:42 +09:30
Daniel O'Connor f81666da5e And cleanup authentications 2015-09-15 12:58:35 +09:30
Daniel O'Connor 4a1bc9f6c0 Avoid test data conflicts and update expectations 2015-09-15 12:44:12 +09:30
Daniel O'Connor 0652c40c52 Avoid test data conflicts causing signup to act as signin-for-existing 2015-09-15 12:34:20 +09:30
Daniel O'Connor a99145b705 Implement pending spec 2015-09-15 12:27:17 +09:30
Daniel O'Connor 222f875c42 Add more coverage of various scenarios and expected behaviours 2015-09-15 12:26:32 +09:30
Daniel O'Connor dc983d4863 Add more coverage of various scenarios and expected behaviours 2015-09-15 12:24:37 +09:30
Daniel O'Connor 7256c28038 Refactor to a separate class, containing domain logic 2015-09-15 12:13:47 +09:30
Daniel O'Connor 021cb4f93b Use #{ENV['GROWSTUFF_SITE_NAME']} 2015-09-15 11:38:20 +09:30
Daniel O'Connor 83929cc8ee Add the ability to run feature tests via selenium if you configure it, or run specs with GROWSTUFF_CAPYBARA_DRIVER=selenium bundle exec rake spec:features/ 2015-09-15 11:28:30 +09:30
Daniel O'Connor 00ca01dc33 Add coverage of the most basic scenarios around sign up and login 2015-09-15 11:20:33 +09:30
Daniel O'Connor a49f359f9e Fix minor typo in specs 2015-09-15 10:40:41 +09:30
Daniel O'Connor be87d2861a Upgrade database cleaner gem, so that https://github.com/DatabaseCleaner/database_cleaner/pull/364 is available to us. 2015-09-15 10:29:29 +09:30
Cesy 481ca79cc1 Merge pull request #825 from sksavant/pr_member_notify 
Notify members when mentioned in a post
 2015-09-11 11:26:52 +01:00
Savant Krishna 346979c640 Merge remote-tracking branch 'upstream/dev' into pr_member_notify 2015-09-09 21:30:45 -04:00
Mackenzie ec891fc0b2 Merge pull request #821 from CloCkWeRX/fix_empty_garden 
Fix #818 by removing the .thumbnail around the button.
 2015-09-09 16:07:02 -04:00
pozorvlak ef6dd88b1e Merge pull request #820 from CloCkWeRX/fix_popover_better 
Fix #819 by removing the popover behaviour for a standard avatar
 2015-09-09 20:04:55 +00:00
twconquest b2f3755196 Additional config fix to point to correct list id 2015-09-09 19:48:35 +00:00
pozorvlak 5884718fd0 Merge pull request #824 from sksavant/member_quicklink_md 
Quick links to members in markdown
 2015-09-09 17:46:24 +00:00
Savant Krishna 0c315981df Merge remote-tracking branch 'upstream/dev' into member_quicklink_md 
Conflicts:
	lib/haml/filters/growstuff_markdown.rb
 2015-09-07 20:08:57 -04:00
Savant Krishna 342323e566 Add test for trying to quicklink non-existent @ member 2015-09-07 20:05:24 -04:00
pozorvlak d7582625c5 Merge pull request #828 from sksavant/csv_planting_fix 
Fix bug #827 : Error in generating csv file for plantings with owner filter
 2015-09-07 15:40:26 +00:00
pozorvlak 1cb4181ffc Merge pull request #826 from sksavant/escape_crop_link 
Fix #721 : Escape quick crop link in markdown
 2015-09-07 15:39:43 +00:00
Savant Krishna 9e7a80cb86 Fix bug #827 : Error in generating csv file for plantings with owner filter 2015-09-07 04:01:20 -04:00
Savant Krishna a8924f95a7 Escape member links for [name](member) and @name using backslash 
Change regex to lookforward

When escaping \@name remove \
 2015-09-06 05:41:35 -04:00
Savant Krishna 7afd38a1ee Fix #721 : Escape quick crop link in markdown 
Lookahead in markdown to verify \ is not present

Test for escaping crop link
 2015-09-06 04:20:14 -04:00
Savant Krishna 1908f670d9 Tests for feature #505 : Notifying members when mentioned 2015-09-06 14:41:04 +10:00
Savant Krishna 7ef1eb5852 Create a notification to all members mentioned in a post : Feature #505 2015-09-06 14:41:04 +10:00
Savant Krishna f36e9d726e Change @ regex to match alphanumeric or _ and modify test string 2015-09-06 14:35:35 +10:00
Savant Krishna 0adb24fa4d Add quick member link help to markdown help 2015-09-06 09:10:18 +10:00