From f674a57440cfac29c1845411f8a600621e4a3026 Mon Sep 17 00:00:00 2001 From: Ken Johnson Date: Thu, 23 May 2013 15:18:39 -0400 Subject: [PATCH] awesome. now we show code snippets in a much better way. Peeps who add to the tutorials will need to enclose code w/
 elements with the class "js"
+    // and snippet highlights the JAVASCRIPT code within
+    // using a random style from the selection of 39
+    // with a transparent background
+    // without showing line numbers.
+
+};
+
+$(document).ready(function(){
+	rubyCodeFormat()
+});
\ No newline at end of file
diff --git a/app/assets/javascripts/jquery.snippet.js b/app/assets/javascripts/jquery.snippet.js
new file mode 100644
index 0000000..70ef3bf
--- /dev/null
+++ b/app/assets/javascripts/jquery.snippet.js
@@ -0,0 +1,814 @@
+/*
+ * Snippet :: jQuery Syntax Highlighter v2.0.0
+ * http://steamdev.com/snippet
+ *
+ * Copyright 2011, SteamDev
+ * Released under the MIT license.
+ * http://www.opensource.org/licenses/mit-license.php
+ *
+ * Date: Wed Jan 19, 2011
+ */
+
+(function($) {
+	
+	//enables console.log() in all browsers for error messages
+	window.log=function(){log.history=log.history||[];log.history.push(arguments);if(this.console){console.log(Array.prototype.slice.call(arguments))}};		  
+
+	$.fn.snippet = function(language,settings) {
+	
+		if(typeof language == "object"){settings = language;}
+		
+		if(typeof language == "string"){
+			language = language.toLowerCase();
+		}
+		
+		var defaults = {
+			style:"random",
+			showNum:true,
+			transparent:false,
+			collapse:false,
+			menu:true,
+			showMsg:"Expand Code",
+			hideMsg:"Collapse Code",
+			clipboard:"",
+			startCollapsed:true,
+			startText:false,
+			box:"",
+			boxColor:"",
+			boxFill:""
+		};
+		
+		// array containing all style names
+		var styleArr = ["acid","berries-dark","berries-light","bipolar","blacknblue","bright","contrast","darkblue","darkness","desert","dull","easter","emacs","golden","greenlcd","ide-anjuta","ide-codewarrior","ide-devcpp","ide-eclipse","ide-kdev","ide-msvcpp","kwrite","matlab","navy","nedit","neon","night","pablo","peachpuff","print","rand01","the","typical","vampire","vim","vim-dark","whatis","whitengrey","zellner"];
+		
+		if(settings){$.extend(defaults,settings)}
+
+		return this.each(function() {
+
+			// variable containing the style to be used
+			var useStyle = defaults.style.toLowerCase();
+			if(defaults.style == "random"){
+				var randomnumber=Math.floor(Math.random()*(styleArr.length));		   
+				useStyle = styleArr[randomnumber];	
+			}
+
+			// variable containing the selected node
+			var o = $(this);
+			
+			// the name of the selected node
+			var node = this.nodeName.toLowerCase();
+			
+			// if the node is indeed a 
 element...
+			if(node == "pre"){
+				
+				// saves the original html as a data on the node
+				if(o.data('orgHtml')==undefined || o.data('orgHtml')==null){
+					var orgHtml = o.html();
+					o.data('orgHtml',orgHtml);
+				}
+				
+				// if node IS NOT an existing Snippet...
+				if(!o.parent().hasClass("snippet-wrap")){
+					
+					// if language is NOT a string...
+					if(typeof language != "string"){
+						if(o.attr('class').length>0){var errclass=" class=\""+o.attr('class')+"\""}else{var errclass="";}
+						if(o.attr('id').length>0){var errid=" id=\""+o.attr('id')+"\""}else{var errid="";}
+						var error = "Snippet Error: You must specify a language on inital usage of Snippet. Reference ";
+						console.log(error);
+						return false;
+					}
+					
+					o.addClass("sh_"+language).addClass("snippet-formatted").wrap("
"); + o.removeAttr('style'); + sh_highlightDocument(); + + // build an ordered list if showNum is true + if(defaults.showNum){ + var newhtml = o.html(); + newhtml=newhtml.replace(/\n/g, "
  • "); + newhtml="
    1. "+newhtml+"
    "; + while(newhtml.indexOf("
  • ") != -1){ + newhtml=newhtml.replace("
  • ",""); + } + } + // build an unordered list if showNum is false + else { + var newhtml = o.html(); + newhtml=newhtml.replace(/\n/g, "
  • "); + newhtml="
    • "+newhtml+"
    "; + while(newhtml.indexOf("
  • ") != -1){ + newhtml=newhtml.replace("
  • ",""); + } + } + + // normalizes tab space by replacing them with 4 non-breaking spaces + newhtml=newhtml.replace(/\t/g, "    "); + + + // insert highlighted code into
     element
    +					o.html(newhtml);					
    +					
    +					// cleans up the highlighted html
    +					while(o.find("li").eq(0).html() == ""){
    +						o.find("li").eq(0).remove();
    +					}
    +					o.find("li").each(function(){
    +						if($(this).html().length<2){
    +							var rep = ($(this).html()).replace(/\s/g,"");
    +							if(rep==""){
    +								if($.browser.opera){
    +									$(this).html(" ");
    +								} else {
    +									$(this).html(" ");	
    +								}
    +							}
    +						}
    +					});
    +					
    +					// builds text-only view and hover menu
    +					var txtOnly = "";
    +					var controls = "";
    +								  
    +					o.parent().append(txtOnly);	  
    +					o.parent().prepend(controls);
    +					o.parent().hover(function(){$(this).find('.snippet-menu').fadeIn("fast");},function(){$(this).find('.snippet-menu').fadeOut("fast");});
    +					
    +					// builds clipboard
    +					if(defaults.clipboard!="" && defaults.clipboard!=false){
    +						var cpy = o.parent().find('a.snippet-copy');
    +						cpy.show();
    +						cpy.parents('.snippet-menu').show();
    +						var txt = o.parents('.snippet-wrap').find('.snippet-textonly').text();
    +						ZeroClipboard.setMoviePath(defaults.clipboard);	
    +						var clip = new ZeroClipboard.Client();
    +						clip.setText(txt);
    +						clip.glue(cpy[0], cpy.parents('.snippet-menu')[0]);
    +						clip.addEventListener( 'complete', function(client, text) {
    +							if(text.length > 500){
    +								text = text.substr(0,500)+"...\n\n("+(text.length-500)+" characters not shown)";	
    +							}
    +							alert("Copied text to clipboard:\n\n " + text );
    +						});
    +
    +						cpy.parents('.snippet-menu').hide();
    +
    +					} else {
    +						o.parent().find('a.snippet-copy').hide();	
    +					}
    +					
    +					// click event for text-only view
    +					o.parent().find("a.snippet-text").click(function(){
    +						var org = $(this).parents('.snippet-wrap').find('.snippet-formatted');
    +						var txt = $(this).parents('.snippet-wrap').find('.snippet-textonly');
    +						org.toggle();
    +						txt.toggle();
    +						
    +						if(txt.is(':visible')){
    +							$(this).html("html");
    +						} else {
    +							$(this).html("text");
    +						}
    +						$(this).blur();
    +						return false;
    +					});
    +					
    +					// click event for popup view
    +					o.parent().find("a.snippet-window").click(function(){
    +						var txt = $(this).parents('.snippet-wrap').find('.snippet-textonly').html();
    +						snippetPopup(txt);
    +						$(this).blur();
    +						return false;
    +					});						
    +					
    +					// disables menu
    +					if(!defaults.menu){
    +						o.prev('.snippet-menu').find('pre,.snippet-clipboard').hide();
    +					}
    +					
    +					// collapse functionality
    +					if(defaults.collapse){
    +						var styleClass = o.parent().attr('class');
    +						var collapseShow = "";
    +						var collapseHide = "";
    +						
    +						o.parents('.snippet-container').append(collapseShow);
    +						o.parent().append(collapseHide);
    +						
    +						var root = o.parents('.snippet-container');
    +						if(defaults.startCollapsed){
    +							root.find('.snippet-reveal').show();
    +							root.find('.snippet-wrap').eq(0).hide();
    +						} else {
    +							root.find('.snippet-reveal').hide();
    +							root.find('.snippet-wrap').eq(0).show();
    +						}
    +						
    +						root.find('a.snippet-toggle').click(function(){
    +							root.find('.snippet-wrap').toggle();
    +							return false;
    +						});
    +						
    +					}
    +					
    +					// makes snippet background transparent
    +					if(defaults.transparent){
    +						var styleObj = {"background-color":"transparent","box-shadow":"none","-moz-box-shadow":"none","-webkit-box-shadow":"none"} 
    +						o.css(styleObj);
    +						o.next(".snippet-textonly").css(styleObj);	
    +						o.parents('.snippet-container').find('.snippet-reveal pre').css(styleObj);
    +					}
    +					
    +					// starts snippet on text-only view
    +					if(defaults.startText){
    +						o.hide();
    +						o.next(".snippet-textonly").show();
    +						o.parent().find(".snippet-text").html("html");
    +						
    +					}
    +					
    +					// boxes in specified lines of code
    +					if(defaults.box!=""){
    +						var spacer = " ";
    +						var boxNums = defaults.box.split(',');
    +						for(var i=0;i to 
      + if(defaults.showNum){ + + var list = o.find("li").eq(0).parent(); + if(list.hasClass("snippet-no-num")){ + list.wrap("
        "); + var li = o.find("li").eq(0); + li.unwrap(); + } + } + // hide numbers by switching
          to
            + else { + var list = o.find("li").eq(0).parent(); + if(list.hasClass("snippet-num")){ + list.wrap("
              "); + var li = o.find("li").eq(0); + li.unwrap(); + } + } + + // box in specified lines + if(defaults.box!=""){ + var spacer = " "; + var boxNums = defaults.box.split(','); + for(var i=0;i' elements are currently unsupported."; + console.log(error); + return false; + } + + }); + + }; + +})(jQuery); + + +// snippet new window popup function +function snippetPopup(content) { + top.consoleRef=window.open('','myconsole', + 'width=600,height=300' + +',left=50,top=50' + +',menubar=0' + +',toolbar=0' + +',location=0' + +',status=0' + +',scrollbars=1' + +',resizable=1'); + top.consoleRef.document.writeln( + 'Snippet :: Code View :: '+location.href+'' + +'' + +'
              '+content+'
              ' + +'' + ); + top.consoleRef.document.close(); +} + + + + + +// ZeroClipboard +// Simple Set Clipboard System +// Author: Joseph Huckaby + +var ZeroClipboard = { + + version: "1.0.7", + clients: {}, // registered upload clients on page, indexed by id + moviePath: 'ZeroClipboard.swf', // URL to movie + nextId: 1, // ID of next movie + + $: function(thingy) { + // simple DOM lookup utility function + if (typeof(thingy) == 'string') thingy = document.getElementById(thingy); + if (!thingy.addClass) { + // extend element with a few useful methods + thingy.hide = function() { this.style.display = 'none'; }; + thingy.show = function() { this.style.display = ''; }; + thingy.addClass = function(name) { this.removeClass(name); this.className += ' ' + name; }; + thingy.removeClass = function(name) { + var classes = this.className.split(/\s+/); + var idx = -1; + for (var k = 0; k < classes.length; k++) { + if (classes[k] == name) { idx = k; k = classes.length; } + } + if (idx > -1) { + classes.splice( idx, 1 ); + this.className = classes.join(' '); + } + return this; + }; + thingy.hasClass = function(name) { + return !!this.className.match( new RegExp("\\s*" + name + "\\s*") ); + }; + } + return thingy; + }, + + setMoviePath: function(path) { + // set path to ZeroClipboard.swf + this.moviePath = path; + }, + + dispatch: function(id, eventName, args) { + // receive event from flash movie, send to client + var client = this.clients[id]; + if (client) { + client.receiveEvent(eventName, args); + } + }, + + register: function(id, client) { + // register new client to receive events + this.clients[id] = client; + }, + + getDOMObjectPosition: function(obj, stopObj) { + // get absolute coordinates for dom element + var info = { + left: 0, + top: 0, + width: obj.width ? obj.width : obj.offsetWidth, + height: obj.height ? obj.height : obj.offsetHeight + }; + + while (obj && (obj != stopObj)) { + info.left += obj.offsetLeft; + info.top += obj.offsetTop; + obj = obj.offsetParent; + } + + return info; + }, + + Client: function(elem) { + // constructor for new simple upload client + this.handlers = {}; + + // unique ID + this.id = ZeroClipboard.nextId++; + this.movieId = 'ZeroClipboardMovie_' + this.id; + + // register client with singleton to receive flash events + ZeroClipboard.register(this.id, this); + + // create movie + if (elem) this.glue(elem); + } +}; + +ZeroClipboard.Client.prototype = { + + id: 0, // unique ID for us + ready: false, // whether movie is ready to receive events or not + movie: null, // reference to movie object + clipText: '', // text to copy to clipboard + handCursorEnabled: true, // whether to show hand cursor, or default pointer cursor + cssEffects: true, // enable CSS mouse effects on dom container + handlers: null, // user event handlers + + glue: function(elem, appendElem, stylesToAdd) { + // glue to DOM element + // elem can be ID or actual DOM element object + this.domElement = ZeroClipboard.$(elem); + + // float just above object, or zIndex 99 if dom element isn't set + var zIndex = 99; + if (this.domElement.style.zIndex) { + zIndex = parseInt(this.domElement.style.zIndex, 10) + 1; + } + + if (typeof(appendElem) == 'string') { + appendElem = ZeroClipboard.$(appendElem); + } + else if (typeof(appendElem) == 'undefined') { + appendElem = document.getElementsByTagName('body')[0]; + } + + // find X/Y position of domElement + var box = ZeroClipboard.getDOMObjectPosition(this.domElement, appendElem); + + // create floating DIV above element + this.div = document.createElement('div'); + this.div.className = "snippet-clipboard"; + var style = this.div.style; + style.position = 'absolute'; + style.left = '' + box.left + 'px'; + style.top = '' + box.top + 'px'; + style.width = '' + box.width + 'px'; + style.height = '' + box.height + 'px'; + style.zIndex = zIndex; + + if (typeof(stylesToAdd) == 'object') { + for (addedStyle in stylesToAdd) { + style[addedStyle] = stylesToAdd[addedStyle]; + } + } + + // style.backgroundColor = '#f00'; // debug + + appendElem.appendChild(this.div); + + this.div.innerHTML = this.getHTML( box.width, box.height ); + }, + + getHTML: function(width, height) { + // return HTML for movie + var html = ''; + var flashvars = 'id=' + this.id + + '&width=' + width + + '&height=' + height; + + if (navigator.userAgent.match(/MSIE/)) { + // IE gets an OBJECT tag + var protocol = location.href.match(/^https/i) ? 'https://' : 'http://'; + html += ''; + } + else { + // all other browsers get an EMBED tag + html += ''; + } + return html; + }, + + hide: function() { + // temporarily hide floater offscreen + if (this.div) { + this.div.style.left = '-2000px'; + } + }, + + show: function() { + // show ourselves after a call to hide() + this.reposition(); + }, + + destroy: function() { + // destroy control and floater + if (this.domElement && this.div) { + this.hide(); + this.div.innerHTML = ''; + + var body = document.getElementsByTagName('body')[0]; + try { body.removeChild( this.div ); } catch(e) {;} + + this.domElement = null; + this.div = null; + } + }, + + reposition: function(elem) { + // reposition our floating div, optionally to new container + // warning: container CANNOT change size, only position + if (elem) { + this.domElement = ZeroClipboard.$(elem); + if (!this.domElement) this.hide(); + } + + if (this.domElement && this.div) { + var box = ZeroClipboard.getDOMObjectPosition(this.domElement); + var style = this.div.style; + style.left = '' + box.left + 'px'; + style.top = '' + box.top + 'px'; + } + }, + + setText: function(newText) { + // set text to be copied to clipboard + this.clipText = newText; + if (this.ready){ this.movie.setText(newText);} + }, + + addEventListener: function(eventName, func) { + // add user event listener for event + // event types: load, queueStart, fileStart, fileComplete, queueComplete, progress, error, cancel + eventName = eventName.toString().toLowerCase().replace(/^on/, ''); + if (!this.handlers[eventName]){ this.handlers[eventName] = [];} + this.handlers[eventName].push(func); + }, + + setHandCursor: function(enabled) { + // enable hand cursor (true), or default arrow cursor (false) + this.handCursorEnabled = enabled; + if (this.ready){ this.movie.setHandCursor(enabled);} + }, + + setCSSEffects: function(enabled) { + // enable or disable CSS effects on DOM container + this.cssEffects = !!enabled; + }, + + receiveEvent: function(eventName, args) { + // receive event from flash + eventName = eventName.toString().toLowerCase().replace(/^on/, ''); + + // special behavior for certain events + switch (eventName) { + case 'load': + // movie claims it is ready, but in IE this isn't always the case... + // bug fix: Cannot extend EMBED DOM elements in Firefox, must use traditional function + this.movie = document.getElementById(this.movieId); + if (!this.movie) { + var self = this; + setTimeout( function() { self.receiveEvent('load', null); }, 1 ); + return; + } + + // firefox on pc needs a "kick" in order to set these in certain cases + if (!this.ready && navigator.userAgent.match(/Firefox/) && navigator.userAgent.match(/Windows/)) { + var self = this; + setTimeout( function() { self.receiveEvent('load', null); }, 100 ); + this.ready = true; + return; + } + + this.ready = true; + try{ + this.movie.setText( this.clipText ); + }catch(e){} + try{ + this.movie.setHandCursor( this.handCursorEnabled ); + }catch(e){} + break; + + case 'mouseover': + if (this.domElement && this.cssEffects) { + this.domElement.addClass('hover'); + if (this.recoverActive){ this.domElement.addClass('active');} + } + break; + + case 'mouseout': + if (this.domElement && this.cssEffects) { + this.recoverActive = false; + if (this.domElement.hasClass('active')) { + this.domElement.removeClass('active'); + this.recoverActive = true; + } + this.domElement.removeClass('hover'); + } + break; + + case 'mousedown': + if (this.domElement && this.cssEffects) { + this.domElement.addClass('active'); + } + break; + + case 'mouseup': + if (this.domElement && this.cssEffects) { + this.domElement.removeClass('active'); + this.recoverActive = false; + } + break; + } // switch eventName + + if (this.handlers[eventName]) { + for (var idx = 0, len = this.handlers[eventName].length; idx < len; idx++) { + var func = this.handlers[eventName][idx]; + + if (typeof(func) == 'function') { + // actual function reference + func(this, args); + } + else if ((typeof(func) == 'object') && (func.length == 2)) { + // PHP style object + method, i.e. [myObject, 'myMethod'] + func[0][ func[1] ](this, args); + } + else if (typeof(func) == 'string') { + // name of function + window[func](this, args); + } + } // foreach event handler defined + } // user defined handler for event + } + +}; + + +/* SHJS */ +/* Copyright (C) 2007, 2008 gnombat@users.sourceforge.net */ +/* License: http://shjs.sourceforge.net/doc/gplv3.html */ + +if(!this.sh_languages){this.sh_languages={}}var sh_requests={};function sh_isEmailAddress(a){if(/^mailto:/.test(a)){return false}return a.indexOf("@")!==-1}function sh_setHref(b,c,d){var a=d.substring(b[c-2].pos,b[c-1].pos);if(a.length>=2&&a.charAt(0)==="<"&&a.charAt(a.length-1)===">"){a=a.substr(1,a.length-2)}if(sh_isEmailAddress(a)){a="mailto:"+a}b[c-2].node.href=a}function sh_konquerorExec(b){var a=[""];a.index=b.length;a.input=b;return a}function sh_highlightString(B,o){if(/Konqueror/.test(navigator.userAgent)){if(!o.konquered){for(var F=0;FI){x(g.substring(I,E.index),null)}var e=O[u];var J=e[1];var b;if(J instanceof Array){for(var L=0;L0){var e=b.split(" ");for(var c=0;c0){a.push(e[c])}}}return a}function sh_addClass(c,a){var d=sh_getClasses(c);for(var b=0;b element with class="' + htmlClass + '", but no such language exists'); + continue; + } + break; + } + } +} + + + +/* C language (http://shjs.sourceforge.net/lang/sh_c.min.js) */ +if(!this.sh_languages){this.sh_languages={}}sh_languages.c=[[[/\/\/\//g,"sh_comment",1],[/\/\//g,"sh_comment",7],[/\/\*\*/g,"sh_comment",8],[/\/\*/g,"sh_comment",9],[/(\bstruct)([ \t]+)([A-Za-z0-9_]+)/g,["sh_keyword","sh_normal","sh_classname"],-1],[/^[ \t]*#(?:[ \t]*include)/g,"sh_preproc",10,1],[/^[ \t]*#(?:[ \t]*[A-Za-z0-9_]*)/g,"sh_preproc",-1],[/\b[+-]?(?:(?:0x[A-Fa-f0-9]+)|(?:(?:[\d]*\.)?[\d]+(?:[eE][+-]?[\d]+)?))u?(?:(?:int(?:8|16|32|64))|L)?\b/g,"sh_number",-1],[/"/g,"sh_string",13],[/'/g,"sh_string",14],[/\b(?:__asm|__cdecl|__declspec|__export|__far16|__fastcall|__fortran|__import|__pascal|__rtti|__stdcall|_asm|_cdecl|__except|_export|_far16|_fastcall|__finally|_fortran|_import|_pascal|_stdcall|__thread|__try|asm|auto|break|case|catch|cdecl|const|continue|default|do|else|enum|extern|for|goto|if|pascal|register|return|sizeof|static|struct|switch|typedef|union|volatile|while)\b/g,"sh_keyword",-1],[/\b(?:bool|char|double|float|int|long|short|signed|unsigned|void|wchar_t)\b/g,"sh_type",-1],[/~|!|%|\^|\*|\(|\)|-|\+|=|\[|\]|\\|:|;|,|\.|\/|\?|&|<|>|\|/g,"sh_symbol",-1],[/\{|\}/g,"sh_cbracket",-1],[/(?:[A-Za-z]|_)[A-Za-z0-9_]*(?=[ \t]*\()/g,"sh_function",-1],[/([A-Za-z](?:[^`~!@#$%&*()_=+{}|;:",<.>\/?'\\[\]\^\-\s]|[_])*)((?:<.*>)?)(\s+(?=[*&]*[A-Za-z][^`~!@#$%&*()_=+{}|;:",<.>\/?'\\[\]\^\-\s]*\s*[`~!@#$%&*()_=+{}|;:",<.>\/?'\\[\]\^\-\[\]]+))/g,["sh_usertype","sh_usertype","sh_normal"],-1]],[[/$/g,null,-2],[/(?:?)|(?:?)/g,"sh_url",-1],[/<\?xml/g,"sh_preproc",2,1],[//g,"sh_keyword",-1],[/<(?:\/)?[A-Za-z](?:[A-Za-z0-9_:.-]*)/g,"sh_keyword",6,1],[/&(?:[A-Za-z0-9]+);/g,"sh_preproc",-1],[/<(?:\/)?[A-Za-z][A-Za-z0-9]*(?:\/)?>/g,"sh_keyword",-1],[/<(?:\/)?[A-Za-z][A-Za-z0-9]*/g,"sh_keyword",6,1],[/@[A-Za-z]+/g,"sh_type",-1],[/(?:TODO|FIXME|BUG)(?:[:]?)/g,"sh_todo",-1]],[[/\?>/g,"sh_preproc",-2],[/([^=" \t>]+)([ \t]*)(=?)/g,["sh_type","sh_normal","sh_symbol"],-1],[/"/g,"sh_string",3]],[[/\\(?:\\|")/g,null,-1],[/"/g,"sh_string",-2]],[[/>/g,"sh_preproc",-2],[/([^=" \t>]+)([ \t]*)(=?)/g,["sh_type","sh_normal","sh_symbol"],-1],[/"/g,"sh_string",3]],[[/-->/g,"sh_comment",-2],[//g,"sh_comment",-2],[//g,"sh_comment",-2],[//g,"sh_comment",-2],[//g,"sh_comment",-2],[//g,"sh_comment",-2],[//g,"sh_comment",-2],[//g,"sh_comment",-2],[//g,"sh_comment",-2],[//g,"sh_comment",-2],[//g,"sh_comment",-2],[//g,"sh_comment",-2],[/ Welcome, <%= current_user.first_name.html_safe %> - } + + } end def broken_auth diff --git a/app/views/layouts/tutorial/broken_auth_sess/_user_pass_enum.html.erb b/app/views/layouts/tutorial/broken_auth_sess/_user_pass_enum.html.erb index f307ef6..92005fb 100644 --- a/app/views/layouts/tutorial/broken_auth_sess/_user_pass_enum.html.erb +++ b/app/views/layouts/tutorial/broken_auth_sess/_user_pass_enum.html.erb @@ -1,7 +1,7 @@
              - A3 - Broken Authentication and Session Management (Instance #1) + A3 - Broken Authentication and Session Management - Username/Pass Enumeration
              @@ -17,7 +17,7 @@

              -Application functions related to authentication and session management are often not implemented correctly, allowing attackers to compromise passwords, keys, session tokens, or exploit other implementation flaws to assume other users’ identities. + Overly verbose error messages that indicate whether or not a user exists can assist an attacker with brute-forcing accounts. In attempting to harvest valid usernames for a password-guessing campaign, these messages can prove very useful.

              @@ -32,7 +32,28 @@ Application functions related to authentication and session management are often
              -

              Broken Authentication and Session Management

              +

              Username and Password Enumeration

              +

              Within /app/models/user.rb:

              + + +

              +						def self.authenticate(email, password)
              +					       	auth = nil
              +					       	user = find_by_email(email)
              +					       	# I heard something about hashing, dunno, why bother really. Nobody will get access to my stuff!
              +					       	if user
              +					       	  if user.password == password
              +					       	    auth = user
              +					       	  else
              +					       	   raise "Incorrect Password!"
              +					       	  end 
              +					       	else
              +					       	   raise "#{email} doesn't exist!"
              +					       	end
              +					       	return auth
              +					   end
              +					  
              +
              @@ -66,4 +87,4 @@ Application functions related to authentication and session management are often - \ No newline at end of file + diff --git a/app/views/tutorials/csrf.html.erb b/app/views/tutorials/csrf.html.erb index ac729c6..287f244 100644 --- a/app/views/tutorials/csrf.html.erb +++ b/app/views/tutorials/csrf.html.erb @@ -37,19 +37,17 @@

              Cross-Site Request Forgery (CSRF) - The following code was taken from: /app/controllers/application_controller.rb and /app/views/layouts/application.html.erb

              application_controller.rb<

              - - <%= %{# Our security guy keep talking about sea-surfing, cool story bro.}%> -
              <%= %{ - # protect_from_forgery - } - %> -
              +

              +							 # Our security guy keep talking about sea-surfing, cool story bro.
              +							 # protect_from_forgery
              +							
              +

              application.html.erb

              - - <%= @meta_code_bad %> - +

              +								<%= @meta_code_bad %>
              +							  

              @@ -83,9 +81,9 @@ By Default, the protect_from_forgery directive is added under the application_controller.rb at project creation. However, occasionally developers turn it off (comment out) because of issues with JS. The solution around the JS problem is to add the following code within the header section of the application.html.erb file (or any other application layout file).

              - +

               									<%= @meta_code_good %>
              -								
              +								

              diff --git a/app/views/tutorials/xss.html.erb b/app/views/tutorials/xss.html.erb index 45b97c4..69e0148 100644 --- a/app/views/tutorials/xss.html.erb +++ b/app/views/tutorials/xss.html.erb @@ -36,7 +36,11 @@

              Stored Cross-Site Scripting - The following code was taken from app/views/layouts/shared/_header.html.erb

              -

              <%= @code %>

              +

              +

              +								  <%= @code %>
              +				 				
              +