80e1ede02b
Added Fred's Strong Parameter work
2014-12-28 17:20:39 -05:00
feb51d077c
Add changes
2014-12-28 17:05:46 -05:00
ea8e9901f4
On branch strong-params
...
Your branch is behind 'origin/strong-params' by 1 commit, and can be fast-forwarded.
I'll pull to catch up after this commit
Change code to whitelist params
Remove attr_accessible lines
Add strong_params to Gemfile, since this branch is still on Rails 3
Mixin to ActiveRecord::Base ActiveModel::ForbiddenAttributesProtection
Use an initializer for the mixin
2014-12-05 15:04:01 -05:00
87fed3a305
Rebuilt Gemfile.lock file; Fixed Time.now issue
2014-10-28 13:45:12 -04:00
d6f5d38f77
removing the send tutorial for now
2014-10-23 16:41:54 -05:00
789ccff349
Upgraded 2 gems by rebuilding Gemfile.lock file; Fixed find/first dep warning #158
2014-10-10 15:38:00 -04:00
71c994575e
Update to railsgoat
2014-10-04 10:41:14 -04:00
925ff9b360
Resolves #152
2014-09-26 20:37:11 -04:00
d6a6864f73
Undid my find/first fix
2014-09-17 14:11:01 -04:00
1ea0c2ddbb
More Rails 4.0 upgrade changes
...
1. Compared existing branch with empty Rails 4.0 project and
made changes as needed.
2. Fix find/first warning.
3. Fix sqlite timeout issue.
-- config/database.yml
-- spec/vulnerabilities/insecure_dor_spec.rb
2014-09-13 13:44:07 -04:00
ed5f2796a4
Merge branch 'master' of https://github.com/OWASP/railsgoat into rails4
2014-09-13 10:53:42 -04:00
7e38ac845f
oops, omitted a couple important features/vulnerabilities
2014-09-11 11:13:15 -04:00
a50cad0cf3
Resolves #133
2014-09-11 11:11:55 -04:00
ef2bc20c97
working on the httponly tutorial
2014-09-11 11:01:56 -04:00
23513cf8d2
Initial Rails 4.0.x upgrade
2014-09-07 13:00:54 -04:00
4f2bfc1a8f
fixing tutorial it should be != to match code not ==
2014-08-22 19:44:35 -04:00
61c5981cb7
Merge branch 'pr-145'
2014-08-19 12:33:22 -04:00
286e89ea36
removed the tutorial snippet about using Rails 3.2.11 since this is no longer the case; under the insecure components section. Also, changed the partials name to first (from second), and renumbered the collapsable sections. Ran tests, all seems good to go
2014-08-19 12:32:19 -04:00
a4c68989f0
keeping changes for now
2014-08-04 12:58:17 -04:00
e2546f4eeb
moved the conditional statement out of the primary view and into the layout itself
2014-07-29 18:00:42 -05:00
88ed0e2b50
need to create the bar graph version, write up the remaining parts of the tutorial, and ensure it did not break the DOM vuln
2014-07-29 17:56:33 -05:00
b3d254f5bf
Merge branch 'pr-144'
2014-07-29 08:23:52 -05:00
2baf57780c
added a button which will be used for our send vuln
2014-07-28 15:25:41 -04:00
04109a2366
working on a new vulnerability
2014-07-28 14:43:14 -04:00
561e404e29
Fixes #142 with dynamic ActionMailer url options
2014-07-25 23:04:19 -05:00
b5c202ef40
Resolves issue #138
2014-07-11 06:38:36 -04:00
7e4fad462b
Convert file indentation to spaces
2014-07-05 20:17:27 -05:00
68e6a01743
Clean up trailing and leading whitespace
2014-07-05 19:15:32 -05:00
ad784fd099
Remove placeholders from non-empty directories
2014-07-03 07:38:12 -05:00
e727ff9fd6
added API keys to the tutorial credentials section
2014-06-11 08:08:14 -04:00
8595954096
removed alert when an error is thrown
2014-05-26 16:58:26 -04:00
1594255251
added coerceToString sot hat hogan functions properly
2014-05-26 13:51:20 -04:00
2f5dbb7d82
Merge branch 'metaprogramming'
2014-05-22 15:39:39 -06:00
239c96039b
Update benefits.rb accept binary file types.
...
The modification allows binary file types (e.g. MS word docs) to be uploaded without encountering encoding errors
2014-05-22 19:31:33 +01:00
7acc17aea3
everything checks out re: unit tests. Additionally, this closes issue #112 (seriously, are we up to 112 issues already?)
2014-05-22 10:56:29 -06:00
8ed2714f3f
changed constantize to metaprogramming for the addition of tutorials specific to metaprogramming flaws. In addition, the messages portion of the app needed some generic TLC so I have removed the "new" view in order to bring that functionality into the seed message page/view.
2014-05-20 14:25:45 -04:00
2ef2209f70
resolves issue #121 by saving JSAPI and HTML5 shim locally within Railsgoat
2014-05-19 08:54:58 -04:00
d2bd77a461
the latest sqli tutorial leveraging @forced_request modifications. We really need some more unit-tests for all this new functionality
2014-04-17 22:07:58 -04:00
77fcf26abd
working on a tutorial for the scope injection / sql injection
2014-04-17 20:51:16 -04:00
6975f94381
adding routes. catching nulls
2014-04-17 20:18:39 -04:00
4bff205e81
added in johns constantize change as well as some other stuff like CSS fun
2014-04-17 20:10:53 -04:00
5bb9c75f06
Added fix for Analytics SQLi
2014-04-17 20:05:07 -04:00
196b732b91
Fixed bug in analytics view
2014-04-17 20:04:32 -04:00
3f63480022
Added Analytics function to track user hits by ip address, referrer and user agent
2014-04-17 20:03:50 -04:00
5056f77395
Added codefix example for CSS context XSS.
2014-04-17 20:03:17 -04:00
e760fc0087
merging
2014-04-17 20:03:14 -04:00
9fd91a8224
initial commit of mobile controller
2014-04-17 20:00:30 -04:00
8bc20e8f91
fixing name in messages
2014-04-17 19:56:48 -04:00
8e4e084dc9
Fixes #99 . We have added the hogan method for escaping user input and added a tutorial
2014-04-17 12:51:02 -04:00
8cb6ff36ac
removed needless diff stuff
2014-04-17 11:37:02 -04:00
Al Snow