You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: source/active_record_callbacks.md
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -15,7 +15,7 @@ After reading this guide, you will know:
15
15
The Object Life Cycle
16
16
---------------------
17
17
18
-
During the normal operation of a Rails application, objects may be created, updated, and destroyed. Active Record provides hooks into this <em>object life cycle</em> so that you can control your application and its data.
18
+
During the normal operation of a Rails application, objects may be created, updated, and destroyed. Active Record provides hooks into this *object life cycle* so that you can control your application and its data.
19
19
20
20
Callbacks allow you to trigger logic before or after an alteration of an object's state.
Copy file name to clipboardExpand all lines: source/active_support_core_extensions.md
+2-2Lines changed: 2 additions & 2 deletions
Original file line number
Diff line number
Diff line change
@@ -1165,9 +1165,9 @@ Inserting data into HTML templates needs extra care. For example, you can't just
1165
1165
1166
1166
#### Safe Strings
1167
1167
1168
-
Active Support has the concept of <i>(html) safe</i> strings. A safe string is one that is marked as being insertable into HTML as is. It is trusted, no matter whether it has been escaped or not.
1168
+
Active Support has the concept of _(html) safe_ strings. A safe string is one that is marked as being insertable into HTML as is. It is trusted, no matter whether it has been escaped or not.
1169
1169
1170
-
Strings are considered to be <i>unsafe</i> by default:
Copy file name to clipboardExpand all lines: source/api_documentation_guidelines.md
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -79,7 +79,7 @@ used. Instead of:
79
79
English
80
80
-------
81
81
82
-
Please use American English (<em>color</em>, <em>center</em>, <em>modularize</em>, etc). See [a list of American and British English spelling differences here](http://en.wikipedia.org/wiki/American_and_British_English_spelling_differences).
82
+
Please use American English (*color*, *center*, *modularize*, etc). See [a list of American and British English spelling differences here](http://en.wikipedia.org/wiki/American_and_British_English_spelling_differences).
Copy file name to clipboardExpand all lines: source/association_basics.md
+6-6Lines changed: 6 additions & 6 deletions
Original file line number
Diff line number
Diff line change
@@ -1131,7 +1131,7 @@ The `has_one` association supports these options:
1131
1131
1132
1132
##### `:as`
1133
1133
1134
-
Setting the `:as` option indicates that this is a polymorphic association. Polymorphic associations were discussed in detail <ahref="#polymorphic-associations">earlier in this guide</a>.
1134
+
Setting the `:as` option indicates that this is a polymorphic association. Polymorphic associations were discussed in detail [earlier in this guide](#polymorphic-associations).
1135
1135
1136
1136
##### `:autosave`
1137
1137
@@ -1203,7 +1203,7 @@ The `:source_type` option specifies the source association type for a `has_one :
1203
1203
1204
1204
##### `:through`
1205
1205
1206
-
The `:through` option specifies a join model through which to perform the query. `has_one :through` associations were discussed in detail <ahref="#the-has-one-through-association">earlier in this guide</a>.
1206
+
The `:through` option specifies a join model through which to perform the query. `has_one :through` associations were discussed in detail [earlier in this guide](#the-has-one-through-association).
1207
1207
1208
1208
##### `:validate`
1209
1209
@@ -1497,7 +1497,7 @@ The `has_many` association supports these options:
1497
1497
1498
1498
##### `:as`
1499
1499
1500
-
Setting the `:as` option indicates that this is a polymorphic association, as discussed <ahref="#polymorphic-associations">earlier in this guide</a>.
1500
+
Setting the `:as` option indicates that this is a polymorphic association, as discussed [earlier in this guide](#polymorphic-associations).
1501
1501
1502
1502
##### `:autosave`
1503
1503
@@ -1579,7 +1579,7 @@ The `:source_type` option specifies the source association type for a `has_many
1579
1579
1580
1580
##### `:through`
1581
1581
1582
-
The `:through` option specifies a join model through which to perform the query. `has_many :through` associations provide a way to implement many-to-many relationships, as discussed <ahref="#the-has-many-through-association">earlier in this guide</a>.
1582
+
The `:through` option specifies a join model through which to perform the query. `has_many :through` associations provide a way to implement many-to-many relationships, as discussed [earlier in this guide](#the-has-many-through-association).
1583
1583
1584
1584
##### `:validate`
1585
1585
@@ -1632,7 +1632,7 @@ If you use a hash-style `where` option, then record creation via this associatio
1632
1632
1633
1633
##### `extending`
1634
1634
1635
-
The `extending` method specifies a named module to extend the association proxy. Association extensions are discussed in detail <ahref="#association-extensions">later in this guide</a>.
1635
+
The `extending` method specifies a named module to extend the association proxy. Association extensions are discussed in detail [later in this guide](#association-extensions).
1636
1636
1637
1637
##### `group`
1638
1638
@@ -2082,7 +2082,7 @@ If you use a hash-style `where`, then record creation via this association will
2082
2082
2083
2083
##### `extending`
2084
2084
2085
-
The `extending` method specifies a named module to extend the association proxy. Association extensions are discussed in detail <ahref="#association-extensions">later in this guide</a>.
2085
+
The `extending` method specifies a named module to extend the association proxy. Association extensions are discussed in detail [later in this guide](#association-extensions).
Copy file name to clipboardExpand all lines: source/contributing_to_ruby_on_rails.md
+1-3Lines changed: 1 addition & 3 deletions
Original file line number
Diff line number
Diff line change
@@ -109,9 +109,7 @@ After applying their branch, test it out! Here are some things to think about:
109
109
110
110
Once you're happy that the pull request contains a good change, comment on the GitHub issue indicating your approval. Your comment should indicate that you like the change and what you like about it. Something like:
111
111
112
-
<blockquote>
113
-
I like the way you've restructured that code in generate_finder_sql - much nicer. The tests look good too.
114
-
</blockquote>
112
+
>I like the way you've restructured that code in generate_finder_sql - much nicer. The tests look good too.
115
113
116
114
If your comment simply says "+1", then odds are that other reviewers aren't going to take it too seriously. Show that you took the time to review the pull request.
Copy file name to clipboardExpand all lines: source/i18n.md
+3-3Lines changed: 3 additions & 3 deletions
Original file line number
Diff line number
Diff line change
@@ -107,7 +107,7 @@ The **translations load path** (`I18n.load_path`) is just a Ruby Array of paths
107
107
108
108
NOTE: The backend will lazy-load these translations when a translation is looked up for the first time. This makes it possible to just swap the backend with something else even after translations have already been announced.
109
109
110
-
The default `application.rb` files has instructions on how to add locales from another directory and how to set a different default locale. Just uncomment and edit the specific lines.
110
+
The default `application.rb` file has instructions on how to add locales from another directory and how to set a different default locale. Just uncomment and edit the specific lines.
111
111
112
112
```ruby
113
113
# The default locale is :en and all translations from config/locales/*.rb,yml are auto loaded.
@@ -137,7 +137,7 @@ If you want to translate your Rails application to a **single language other tha
137
137
138
138
However, you would probably like to **provide support for more locales** in your application. In such case, you need to set and pass the locale between requests.
139
139
140
-
WARNING: You may be tempted to store the chosen locale in a _session_ or a <em>cookie</em>. However, **do not do this**. The locale should be transparent and a part of the URL. This way you won't break people's basic assumptions about the web itself: if you send a URL to a friend, they should see the same page and content as you. A fancy word for this would be that you're being [<em>RESTful</em>](http://en.wikipedia.org/wiki/Representational_State_Transfer). Read more about the RESTful approach in [Stefan Tilkov's articles](http://www.infoq.com/articles/rest-introduction). Sometimes there are exceptions to this rule and those are discussed below.
140
+
WARNING: You may be tempted to store the chosen locale in a _session_ or a *cookie*. However, **do not do this**. The locale should be transparent and a part of the URL. This way you won't break people's basic assumptions about the web itself: if you send a URL to a friend, they should see the same page and content as you. A fancy word for this would be that you're being [*RESTful*](http://en.wikipedia.org/wiki/Representational_State_Transfer). Read more about the RESTful approach in [Stefan Tilkov's articles](http://www.infoq.com/articles/rest-introduction). Sometimes there are exceptions to this rule and those are discussed below.
141
141
142
142
The _setting part_ is easy. You can set the locale in a `before_action` in the `ApplicationController` like this:
143
143
@@ -262,7 +262,7 @@ get '/:locale' => 'dashboard#index'
262
262
263
263
Do take special care about the **order of your routes**, so this route declaration does not "eat" other ones. (You may want to add it directly before the `root :to` declaration.)
264
264
265
-
NOTE: Have a look at two plugins which simplify work with routes in this way: Sven Fuchs's [routing_filter](https://github.com/svenfuchs/routing-filter/tree/master) and Raul Murciano's [translate_routes](https://github.com/raul/translate_routes/tree/master).
265
+
NOTE: Have a look at two plugins which simplify working with routes in this way: Sven Fuchs's [routing_filter](https://github.com/svenfuchs/routing-filter/tree/master) and Raul Murciano's [translate_routes](https://github.com/raul/translate_routes/tree/master).
266
266
267
267
### Setting the Locale from the Client Supplied Information
Copy file name to clipboardExpand all lines: source/security.md
+6-6Lines changed: 6 additions & 6 deletions
Original file line number
Diff line number
Diff line change
@@ -25,7 +25,7 @@ The Gartner Group however estimates that 75% of attacks are at the web applicati
25
25
26
26
The threats against web applications include user account hijacking, bypass of access control, reading or modifying sensitive data, or presenting fraudulent content. Or an attacker might be able to install a Trojan horse program or unsolicited e-mail sending software, aim at financial enrichment or cause brand name damage by modifying company resources. In order to prevent attacks, minimize their impact and remove points of attack, first of all, you have to fully understand the attack methods in order to find the correct countermeasures. That is what this guide aims at.
27
27
28
-
In order to develop secure web applications you have to keep up to date on all layers and know your enemies. To keep up to date subscribe to security mailing lists, read security blogs and make updating and security checks a habit (check the <ahref="#additional-resources">Additional Resources</a> chapter). It is done manually because that's how you find the nasty logical security problems.
28
+
In order to develop secure web applications you have to keep up to date on all layers and know your enemies. To keep up to date subscribe to security mailing lists, read security blogs and make updating and security checks a habit (check the [Additional Resources](#additional-resources) chapter). It is done manually because that's how you find the nasty logical security problems.
29
29
30
30
Sessions
31
31
--------
@@ -68,7 +68,7 @@ Hence, the cookie serves as temporary authentication for the web application. An
68
68
69
69
*Most people don't clear out the cookies after working at a public terminal. So if the last user didn't log out of a web application, you would be able to use it as this user. Provide the user with a _log-out button_ in the web application, and_make it prominent_.
70
70
71
-
*Many cross-site scripting (XSS) exploits aim at obtaining the user's cookie. You'll read <a href="#cross-site-scripting-xss">more about XSS</a> later.
71
+
*Many cross-site scripting (XSS) exploits aim at obtaining the user's cookie. You'll read [more about XSS](#cross-site-scripting-xss) later.
72
72
73
73
*Instead of stealing a cookie unknown to the attacker, they fix a user's session identifier (in the cookie) known to them. Read more about this so-called session fixation later.
74
74
@@ -187,7 +187,7 @@ This attack method works by including malicious code or a link in a page that ac
187
187
188
188

189
189
190
-
In the <ahref="#sessions">session chapter</a> you have learned that most Rails applications use cookie-based sessions. Either they store the session id in the cookie and have a server-side session hash, or the entire session hash is on the client-side. In either case the browser will automatically send along the cookie on every request to a domain, if it can find a cookie for that domain. The controversial point is, that it will also send the cookie, if the request comes from a site of a different domain. Let's start with an example:
190
+
In the [session chapter](#sessions) you have learned that most Rails applications use cookie-based sessions. Either they store the session id in the cookie and have a server-side session hash, or the entire session hash is on the client-side. In either case the browser will automatically send along the cookie on every request to a domain, if it can find a cookie for that domain. The controversial point is, that it will also send the cookie, if the request comes from a site of a different domain. Let's start with an example:
191
191
192
192
* Bob browses a message board and views a post from a hacker where there is a crafted HTML image element. The element references a command in Bob's project management application, rather than an image file.
The above method can be placed in the `ApplicationController` and will be called when a CSRF token is not present or is incorrect on a non-GET request.
259
259
260
-
Note that _cross-site scripting (XSS) vulnerabilities bypass all CSRF protections_. XSS gives the attacker access to all elements on a page, so they can read the CSRF security token from a form or directly submit the form. Read <ahref="#cross-site-scripting-xss">more about XSS</a> later.
260
+
Note that _cross-site scripting (XSS) vulnerabilities bypass all CSRF protections_. XSS gives the attacker access to all elements on a page, so they can read the CSRF security token from a form or directly submit the form. Read [more about XSS](#cross-site-scripting-xss) later.
INFO: _Do you find it hard to remember all your passwords? Don't write them down, but use the initial letters of each word in an easy to remember sentence._
479
479
480
-
Bruce Schneier, a security technologist, [has analyzed](http://www.schneier.com/blog/archives/2006/12/realworld_passw.html) 34,000 real-world user names and passwords from the MySpace phishing attack mentioned <ahref="#examples-from-the-underground">below</a>. It turns out that most of the passwords are quite easy to crack. The 20 most common passwords are:
480
+
Bruce Schneier, a security technologist, [has analyzed](http://www.schneier.com/blog/archives/2006/12/realworld_passw.html) 34,000 real-world user names and passwords from the MySpace phishing attack mentioned [below](#examples-from-the-underground). It turns out that most of the passwords are quite easy to crack. The 20 most common passwords are:
@@ -630,7 +630,7 @@ Also, the second query renames some columns with the AS statement so that the we
630
630
631
631
#### Countermeasures
632
632
633
-
Ruby on Rails has a built-in filter for special SQL characters, which will escape ' , " , NULL character and line breaks. <emclass="highlight">Using `Model.find(id)` or `Model.find_by_some thing(something)` automatically applies this countermeasure</em>. But in SQL fragments, especially <emclass="highlight">in conditions fragments (`where("...")`), the `connection.execute()` or `Model.find_by_sql()` methods, it has to be applied manually</em>.
633
+
Ruby on Rails has a built-in filter for special SQL characters, which will escape ' , " , NULL character and line breaks. *Using `Model.find(id)` or `Model.find_by_some thing(something)` automatically applies this countermeasure*. But in SQL fragments, especially *in conditions fragments (`where("...")`), the `connection.execute()` or `Model.find_by_sql()` methods, it has to be applied manually*.
634
634
635
635
Instead of passing a string to the conditions option, you can pass an array to sanitize tainted strings like this:
Copy file name to clipboardExpand all lines: source/testing.md
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -144,7 +144,7 @@ In Rails, models tests are what you write to test your models.
144
144
145
145
For this guide we will be using Rails _scaffolding_. It will create the model, a migration, controller and views for the new resource in a single operation. It will also create a full test suite following Rails best practices. We will be using examples from this generated code and will be supplementing it with additional examples where necessary.
146
146
147
-
NOTE: For more information on Rails <i>scaffolding</i>, refer to [Getting Started with Rails](getting_started.html)
147
+
NOTE: For more information on Rails _scaffolding_, refer to [Getting Started with Rails](getting_started.html)
148
148
149
149
When you use `rails generate scaffold`, for a resource among other things it creates a test stub in the `test/models` folder:
0 commit comments