Rails' url_for is useful for generating routes from a Hash, but can lead to an open redirect vulnerability. Your application's generated route methods with a _url suffix are...
...Open Redirect vulnerability. It's as simple as passing a host=evil.tld URL parameter. Rails would see url_for(..., host: "evil.tld") and happily generate a URL to that foreign host...
When running migrations with rake db:migrate, there's the STEP and VERSION parameters that you can pass to nearly...
...builds/webpack-resolver -- failed pretty hard for Webpack 2. The following works for Ruby on Rails with Webpacker / Webpack 2. Do not use the ace-builds NPM package, because you won...
...performance due to the cost of reindexing. Minidusen is currently compatible with MySQL, PostgreSQL, Rails 3.2, Rails 4.2 and Rails 5.0. Basic Usage Our example will be a simple address...
...for cronjobs, the "craken" plugin, is no longer maintained and does not work on Rails 3.2+. We will instead use the whenever gem. "Whenever" works just like "craken", by putting...
...ActiveRecord::Rollback, read on. The basic problem Not all databases support nested transactions. Therefore, Rails will sometimes silently ignore a nested transaction and simply reuse the other transaction. However, a...
...cause a roll back! To avoid this unexpected behaviour, you have to explicitly tell rails for each transaction to indeed use proper nesting: ActiveRecord::Base.transaction(joinable: false, requires_new: true...
When you put a Rake task into lib/tasks, but running it fails with... Don't know how to build task...
...has enabled the only_full_group_by setting by default to prevent this. In Rails this could lead to some trouble, because scopes do not have specific select columns in...
There are different ways to run rake: On Rails 4.1+ projects, you have Spring and its binstubs which dramatically improve boot-up time for Rake and similar. You need to...
rake is a function rake () ... Next, try running rake routes on a Rails 4.1+ project -- the 2nd time should be significantly faster. On older projects you should always...
If you have a FooController and also have a layout app/views/layouts/foo.html, Rails will use this without being told so. This is super convenient except never...
If your rails application is unable to send mails, it might be useful to debug your settings using the rails console. Here is a snippet that shows the current settings...
Rails guide that covers PostgreSQL-specific column types and usages for Active Record. You should especially keep in mind the special datatypes that PostgreSQL offers. \ Types like json and array...
...param is a string and you don't get the magic type casting that Rails would give you if it was an actual database column. E.g. when you set an...
Provide a stable API for working with scopes across multiple versions of Rails, since Rails has a tradition of breaking details of its scope API every other release...
.../../../../../../../../../etc/passwd%%0000.html) Someone tries to exploit CVE-2019-5418. If you use the latest Rails (or latest Rails LTS) you're safe. The exact versions that fix this issue are...
...Rails 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, 4.2.11.1, Rails LTS 3.2.22.13 and Rails LTS...
...fixing errors as they occur: Update gems as listed below, and bundle Boot a Rails console - see below for a list of changes you will probably need Run Specs with...
...constraints as possible. Boot the application in different environements to spot further issues, e.g. rails console staging Gem updates Replace ruby-debug with byebug or pry Replace mysql with mysql2...
I got this error when running Rails 2.3 tests for Rails LTS. More stacktrace: NoMethodError: undefined method `cache' for Gem:Module /vagrant/rails-2-3-lts-repository/railties/lib/rails_generator/lookup.rb:212:in `each' /vagrant/rails-2-3-lts-repository/railties/lib/rails_generator/lookup.rb:146:in `to_a...
...Prepare Sunspot on your development machine What you want in your Gemfile: gem 'sunspot_rails' gem 'sunspot_solr' gem 'progress_bar' # for sunspot:solr:reindex Now define what should be...
...troublesome upgrade to 1.9.3 and go straight to 2.1. When trying to make a Rails app run on Ruby 1.9, you're likely to encounter several issues. Here are a...
Resque comes with its own dashboard (Resque server) that you can mount inside your Rails 3 application with #config/routes.rb: require 'resque/server' My::Application.routes.draw do # ... mount Resque::Server => '/resque' end
...e 'create database IF NOT EXISTS minidusen_test;'" failed and exited with 1 during . Rails 2/3 migrations don't work anymore bundle exec rspec spec -- create_table(:users) bundler: failed...
...transactions and locking. Examples will be given for the ActiveRecord ORM (from Ruby on Rails), but apply to all technologies. Use transactions to group related changes Use a transaction to...
...than a single database row, you should always use a transaction. Note that in Rails, ActiveRecord::Base#save automatically opens a transaction. Hence changes you make in callbacks, nested attributes...
You will get this when you are using the latest version of Rails with a recent version of Rack: SECURITY WARNING: No secret option provided to Rack::Session::Cookie.
...future versions will even invalidate your existing user cookies. The warning is caused by Rails calling Rack incorrectly. It is unclear when this is going to be fixed in Rails...
...column representing the filename of the file. To do this, add a new migration (rails g migration ) with the following content: class AddAttachmentToNotes < ActiveRecord::Migration[6.0] def change add_column...
...change the column details to fit your purpose. Run it. 1) Deliver attachments through Rails The first way is to store your Carrierwave attachments not in the default public/system, but...