Security fixes for Rails 2.3

Posted Almost 12 years ago. Visible to the public.

Last week saw a security issue with rails 2.3 that required a fix. While an official patch was provided, the 2.3 branch is no longer maintained. So we forked it Show archive.org snapshot .

(I'm sure there are already 100 other forks doing absolutely the same, but they are not very easily discoverable.)

To use our fork, change the gem "rails"... line in your Gemfile to this:

gem 'rails', :git => 'https://github.com/makandra/rails.git', :branch => '2-3-fixes'

The intent is to make as few changes to the fork as absolutely necessary. We will at no time add new features.

Tobias Kraze
makandra.de
Say thanks1
Last edit
Over 11 years ago
License
Source code in this card is licensed under the MIT License.

Related cards:

Upgrading Rails 2 from 2.3.8 through 2.3.18 to Rails LTS

This card shows how to upgrade a Rails 2 application from Rails 2.3.8 through every single patch level up to 2.3.18, and then, hopefully, Rails LTS.

2.3.8 to 2.3.9

This release has [many minor changes and fi...

Upgrade from Rails 2.3.10 to Rails 2.3.11

See our new comprehensive guide for upgrading every Rails 2 version ever.

Security issues with hash conditions in Rails 2 and Rails 3

Find conditions for scopes can be given either as an array (:conditions => ['state = ?', 'draft']) or a hash (:conditions => { 'state' => 'draft' }). The later is nicer to read, but has horrible security implications in some versions of Ru...

Bundler for Rails 2.3.x

Update RubyGems and Passenger

Bundler requires Rubygems >= 1.3.6. Run gem update --system if you have an older version.
It also is not compatible with older versions of passenger, so bring that up to date ...

Good real world example for form models / presenters in Rails

We have often felt the pain where our models need to serve too many masters. E.g. we are adding a lot of logic and callbacks for a particular form screen, but then the model becomes a pain in tests, where all those callbacks just get in the way. O...

Remove resource fork files from a FAT volume on MacOS

Be careful!
The following solution will delete files on a volume. If you don't know exactly what you're doing, you can run into big trouble with your computer.

I play mp3 files on my car stereo that are stored on a SD-C...

Using mime types with send_file

When using send_file (for example for attachments of any kind), make sure your application knows the correct mime types so that all browsers can handle the files. It is much more convenient for users if they can decide to open a file directly in...

Upgrading Cucumber and Capybara to the latest versions available for Rails 2

Specify these gem versions in your Gemfile:

gem 'cucumber', '~> 1.3.0'
gem 'cucumber-rails', '= 0.3.2' # max version for Rails 2
gem 'capybara', '< 2' # capybara 2+ requires Rails 3
gem 'mime-types', '< 2' # dependeny of capybara

...

Rails: Assigning associations via HTML forms

Let's say we have posts with an attribute title that is mandatory.

Our example feature request is to tag these posts with a limited number of tags. The following chapters explain different approaches in Rails, how you can assign such a...

Passenger ignores RailsEnv directive for Rails 3 applications

You might find that your Passenger ignores all RailsSomething directives in the vhost for your new Rails 3 application. The culprit is a file config.ru which makes Passenger consider your application a Rack (non-Rails) application.

To fix thi...

Posted by Tobias Kraze to makandra dev (2012-06-15 12:39)
This website uses short-lived cookies to improve usability.
or learn more