...not necessary to add a version constraint next to your gems in the Gemfile. Since all versions are saved in the Gemfile.lock, everyone running bundle install will get exactly the...
...You are not checking in the Gemfile.lock into the version control (not recommended) A specific gem has a bug in a more recent version (adding a comment for the reason...
...If you want the actions element to float on the left, you'd just say this in your CSS: #actions { float: left; } Unfortunately, any content of the content's text...
If you don't want that but actually wish for longer text to stay on the same vertical boundaries, use overflow: hidden on the element whose content you don...
When you load a with a nonce, that script can await import() additional sources from any hostname. The nonce is propagated automatically for the one purpose of importing more scripts. This is not related to strict-dynamic, which propagates nonces for any propose not limited to imports (e.g. inserting elements). Example We have a restrictive CSP that only allows nonces: Content-Security-Policy: default-src 'none'; script-src 'nonce-secret123' Our HTML loads script.js using that nonce: Our script.js imports other.js without a nonce: let other = await import('other.js') console.log("Look, script.js has imported %o", other) The import succeeds without a nonce, due to implicit nonce propagation. Why this is useful In modern build pipelines, code splitting (chunking) is implemented using dynamic imports. Nonce propagation allows us to use automatic chunking with restrictive, nonce-based CSPs without using strict-dynamic. E.g. esbuild automatically groups dynamically imported modules into chunks, and writes that chunk to disk. The compiled build has an await import('assets/chunk-NAXSMFJV.js'). There's no way to inject a nonce into that import(), but implicit nonce propagation still allows the request. Should I worry about this? It would require some truly strange code for user input to make it into an import() argument. I wouldn't lose sleep over this. Is this a browser bug? It is by design. Here are some sources: HTML Spec Section 8 (Web Application APIs) (search for "descendant script fetch options") Chromium test ensuring none propagation Firefox bug implementing nonce propagation CSP issue: Someone concerned about propagation being a vulnerability CSP issue: Proposal for import-src that went nowhere Are other CSP sources also propagated? No, only nonces. In particular host-based CSPs do not propagate trust. For example, you only allow scripts from our own host (no nonces): Content-Security-Policy: default-src 'none'; script-src 'self' Our HTML loads script.js from our own host: Our script.js imports other.js from a different host: let other = await import('https://other-host.com/other.js') This fails with a CSP violation: Executing inline script violates the following Content Security Policy directive 'script-src 'self''
options.add_option(:web_socket_url, true) options.add_option(:page_load_strategy, 'none') # required for selenium-webdriver 4.27+ end Capybara::Selenium::Driver.new(app, browser: :chrome, options: options) In combination with...
...stay open until handled. Note Setting the unhandled prompt to a hash is supported since selenium-webdriver 4.36 Note that you also need to set the :page_load_strategy to...
By default, Devise sends all emails synchronously with deliver_now. To change that, Devise's readme suggests overwriting the send_devise_notification method like this: class User def send_devise...
...notification(notification, *args) devise_mailer.send(notification, self, *args).deliver_later end end However, there is one problem: When deliver_later enqueues the mail with ActiveJob, the job arguments are logged. In...
...any of the gems that GEM depends on. For the example above you would say: bundle update cucumber-rails --conservative If Bundler cannot update due to transitive dependencies, check if...
...for old versions of bundler The options below might be relevant if you're stuck with Bundler < 1.14: Option 1 This will work if all dependencies for the update are...
This note shows how to merge an ugly feature branch with multiple dirty WIP commits back into the master as one pretty commit. Squashing commits with git rebase
...here will destroy commit history and can go wrong. For this reason, do the squashing on a separate branch: git checkout -b squashed_feature This way, if you screw up...
...yml files. You may override those application-wide error messages using model or attribute scope like this: en: activerecord: errors: messages: invalid: is invalid # used for any invalid attribute in...
...old to match the format created by pg_dump. The version of the PostgreSQL server doesn't matter here. For example, the official Ubuntu 20.04 sources include only PostgreSQL...
...amd64] after deb so that it reads deb [arch=amd64] https://... or deb [arch=amd64 signed-by=.... Workaround Step 2: Connect with host option The latest PostgresQL client will only...
When your public-facing application has a longer downtime for server maintenance or long migrations, it's nice to setup a maintenance page to inform your users. When delivering the...
...maintenance page, be very careful to send the correct HTTP status code. Sending the wrong status code might get you kicked out of Google, or undo years of SEO work...
The change_column method for rails migrations support casting with a custom SQL statement. This allows us to change a column type and keep the former content as the new...
...number, 'int USING CAST(rating AS int)' end end Warning This migration's rollback strategy will fail, if any existing entry can't be casted. This is likely to happen...
...in development. Note that there are services like badssl.com to test against weird SSL behavior. Self-signed certificates Talking to a host using a self-signed certificate will fail because...
...the certificate can not be verified. >> RestClient.get('https://self-signed.badssl.com/') RestClient::SSLCertificateNotVerified: SSL_connect returned=1 errno=0 state=SSLv3 read server certificate B: certificate verify failed Self-signed certificates...
To apply transparency to an element, you can use opacity in CSS. However, sometimes you don't want to make the entire element transparent, only a color.
...modern CSS, you can simply generate non-opaque versions of a color without any preprocessor like Sass. This card describes how to do that. Note that we're not talking...
To work with other type of nodes (like text, comment or CDATA sections) you need to: Retrieve child nodes contents() (which behaves like children() except that it returns...
...element and returns an array of all child nodes that are text nodes: function selectTextNodes($container) { return $container.contents().filter(function() { return this.nodeType === 3; }); } Also check out this list of existing...
...will tell you if there are any and you should not commit when you see them. So go ahead and switch your editor/IDE to automatically remove them for you.
Note that except for RubyMine, the following changes will remove trailing white-space on all lines, not only those that you changed. While this should not be a...
Simplecov is a code coverage tool. This helps you to find out which parts of your application are not tested. Integrating this in a rails project with rspec, cucumber and...
Add it to your Gemfile and bundle group :test do gem 'simplecov', require: false end Add a .simplecov file in your project root: SimpleCov.start 'rails' do
# features/support/database_cleaner.rb DatabaseCleaner.clean_with(:deletion) # clean once, now DatabaseCleaner.strategy = :transaction Cucumber::Rails::Database.javascript_strategy = :deletion Cucumber & Rails 2 The latest available cucumber-rails for Rails 2 automatically uses database...
...off. To have database_cleaner work correctly: Add the attached database_cleaner.rb to features/support/ Make sure features/support/env.rb contains the following lines in this order: # features/support/env.rb require 'features/support/database_cleaner' require 'cucumber/rails/active_record' require 'cucumber/rails/world...
...Optionen können optional enthalten sein? Für was dient der User-Agent Header? Was tut der Set-Cookie Header? Was sind Cookies? Was hat es mit HTTP keepalive auf sich?
...Beyond with Socket.io WebSockets Explained Cross-Origin Resource Sharing (CORS) Content Security Policy (CSP) HTTP Strict-Transport-Security (HSTS) HTTP authentication Nginx Nginx Admin Guide Nginx docs -> Es ist empfehlenswert...
...with VCR, the recorded cassettes will contain the full base64-encoded image payloads. A single image can easily be hundreds of kilobytes; a handful of recorded interactions will balloon your...
...repository size significantly. The VCR configuration below solves two problems: It scrubs base64 image data from cassettes before they are written to disk, replacing each image with a placeholder string...
If you migrate a Rails application from Sprockets to Webpack(er), you can either transpile your CoffeeScript files to JavaScript or integrate a CoffeeScript compiler to your new process. This...
...to the global namespace, define them on window directly: -class @User +class window.User Replace Sprocket's require statement with Webpacker's import statement to load dependencies. -#= require ./person +import './person...
First, go to the webinterface of your phone. Choose Software Update in the navigation on the left. Next, you have to find the current firmware version for your model in...
...the snom wiki. To do this, you have to follow the ? next to the Firmware text field to this page and then follow the link of the current firmware below...
Ubuntu 18.04 uses systemd to manage services. There are basically two commands for listing all services and manipulating the state of a certain service: service and systemctl: service manages System...
...which system V init scripts are available and running / not running, you can use service --status-all: >service --status-all [ + ] acpid [ - ] alsa-utils [ - ] anacron [ + ] apache-htcacheclean [ - ] apache2 [ + ] apparmor [ + ] apport
By activating strict_loading you force developers to address n+1 queries by preloading all associations used in the index view. Using an association that is not preloaded will raise...
...an ActiveRecord::StrictLoadingViolationError. I think it's a good default to activate strict_loading in your controllers' #index actions. This way, when a change introduces an n+1 query, your...
The File System Access API is a new capability of modern browsers that allows us to iterate over selected folders and files on a user's machine. Browser support is...
...not great yet, but if the feature is only relevant for e.g. a single admin user it could still be worth using it prior to wider adaption instead of building...