 cktricky
|
14bff998dd
|
Merge branch 'master' of github.com:OWASP/railsgoat into top-10-2013
|
2013-11-12 16:07:23 -05:00 |
|
|
cktricky
|
86035a1cbd
|
appears to have solved the issue with our code printing stderrs
|
2013-10-27 22:38:38 -04:00 |
|
|
cktricky
|
11480ac853
|
tests are working again, I will work on surpressing the errors. Also merged @jasnow work
|
2013-10-27 21:46:12 -04:00 |
|
|
cktricky
|
6d1c0c7869
|
merging
|
2013-10-27 20:17:52 -04:00 |
|
|
cktricky
|
7c1d52320a
|
does not fix the error that occurs (as it should, but that we want to obfuscate) when a command is injected into, however, it does pass the build and does not break the entire call
|
2013-10-23 17:11:28 -05:00 |
|
|
cktricky
|
c6e42901c7
|
fixing a mistake
|
2013-10-22 10:38:23 -04:00 |
|
|
cktricky
|
1817251af5
|
changes
|
2013-10-22 10:38:00 -04:00 |
|
|
Mike McCabe
|
3820b78066
|
fixing this function that was not explicitly using the params
|
2013-10-22 10:16:09 -04:00 |
|
|
cktricky
|
b7c3b04c74
|
this seems to have fixed a nuisance error within our unit-tests. Issue #57
|
2013-10-22 00:58:48 -04:00 |
|
|
cktricky
|
753840a276
|
this seems to have fixed a nuisance error within our unit-tests. Issue #57
|
2013-10-22 00:57:32 -04:00 |
|
|
cktricky
|
a65a20a647
|
Merge branch 'master' of github.com:OWASP/railsgoat into top-10-2013
|
2013-10-14 08:29:39 -04:00 |
|
|
Mike McCabe
|
8c17a3df0e
|
adding messaging function, needs tests...
|
2013-10-13 21:49:17 -04:00 |
|
|
Mike McCabe
|
8686f6b9d3
|
adding messages mvc to allow users to send messages.
|
2013-10-11 16:03:37 -04:00 |
|
|
Mike McCabe
|
dbd0c2548d
|
making full_name method public
|
2013-10-11 16:03:37 -04:00 |
|
|
cktricky
|
e2c4fb4bd8
|
change to the user model based on a merge with master. Master is the correct code
|
2013-10-11 12:04:19 -04:00 |
|
|
cktricky
|
da061c79b6
|
intended to remove some of the weirdness when updating a users account. A blank password basically ends up causing the previously existing password to be hashed twice. Probably move to has_secure_password at some point although that may end up screwing up the intent of the particular tutorial item
|
2013-09-30 13:03:03 -04:00 |
|
|
cktricky
|
ef8a9c1a46
|
merged with master
|
2013-09-27 21:55:50 -04:00 |
|
|
chrismo
|
e0bca0139e
|
Added command injection Capybara spec.
|
2013-09-27 14:59:30 -05:00 |
|
|
cktricky
|
c56dbe54a7
|
no change really
|
2013-09-11 10:58:46 -04:00 |
|
|
cktricky
|
aab489ef40
|
fix for performance bug
|
2013-09-10 21:58:29 -04:00 |
|
|
cktricky
|
6f71d7eda7
|
bug fix w/ the performance section
|
2013-09-10 21:57:03 -04:00 |
|
|
cktricky
|
d5801f0684
|
Merge branch 'master' of github.com:OWASP/railsgoat into top-10-2013
|
2013-09-10 13:31:48 -04:00 |
|
|
Michael McCabe
|
69c180e845
|
minor changes to spec_helper and user model
|
2013-09-06 15:54:06 -04:00 |
|
|
cktricky
|
bc74edf28d
|
lastest work towards the secure_compare tutorial
|
2013-08-18 20:10:36 -04:00 |
|
|
cktricky
|
3c7a3fc9e4
|
still working on the timing attack prevention tutorial
|
2013-08-18 17:39:13 -04:00 |
|
|
cktricky
|
979b6a229a
|
working on avoiding timing attacks piece
|
2013-08-17 21:27:33 -04:00 |
|
|
cktricky
|
65eb2caeaf
|
made a suggestion based on digininjas comment on Rails tutorials blog post. Better to change method name to hash_password than encrypt_password
|
2013-08-08 16:57:58 -04:00 |
|
|
Ken Johnson
|
14c1fb367d
|
added a tutorial for command injection
|
2013-07-10 20:42:04 -04:00 |
|
|
Ken Johnson
|
ce6f32a1a2
|
working command injection in fileupload, closes issue #23
|
2013-07-09 16:36:03 -04:00 |
|
|
Ken Johnson
|
ea2014b637
|
I have exhausted all thoughts on how to actually get jquery file upload to work, so screw it, I am just going to make something homegrown for tomorrow
|
2013-07-09 13:53:00 -04:00 |
|
|
Ken Johnson
|
ef2b2e8e11
|
okay, finally got a working redirect vuln
|
2013-06-04 11:00:01 -04:00 |
|
|
Ken Johnson
|
e1dfb8309c
|
finished the write-up for crytpo vuln, close issue #5
|
2013-06-03 18:08:21 -04:00 |
|
|
Ken Johnson
|
0b09e0d4c1
|
added the primary insecure crypto storage vuln
|
2013-06-03 12:52:24 -04:00 |
|
|
Ken Johnson
|
912c34a26e
|
finished the writeup for password complexity
|
2013-06-03 01:11:51 -04:00 |
|
|
Ken Johnson
|
06dce1f8b2
|
I believe this has resolved the dependent destruction and we can close issue #18
|
2013-06-02 13:08:56 -04:00 |
|
|
Ken Johnson
|
0319cc4768
|
added a few things here. Firstly, I fixed the broken delete function with the admin page. Secondly, whenever you register for this application, we will automatically populate your user data to make the application functional. Seemed like the easiest way to do this
|
2013-06-01 00:19:07 -04:00 |
|
|
Ken Johnson
|
c63275b3b3
|
dashboard figures actually indicate correct values now
|
2013-05-31 15:54:25 -04:00 |
|
|
Ken Johnson
|
4813ba9349
|
added visualization chart for performance history
|
2013-05-31 15:20:58 -04:00 |
|
|
Ken Johnson
|
379c442049
|
I have added the performance model, controller, route and seed data, now I am working on the actual visual aspects of the page
|
2013-05-31 14:45:31 -04:00 |
|
|
Ken Johnson
|
f8e21af3e0
|
added a new vulnerability plus completed the work info page
|
2013-05-31 11:41:54 -04:00 |
|
|
Ken Johnson
|
97ca13632d
|
removed mass assignment of user_id in the users model
|
2013-05-31 11:08:38 -04:00 |
|
|
Ken Johnson
|
08a8c60276
|
added route, controller, model, sidebar link, and basic index page for the work info section so that we can render user data
|
2013-05-31 10:48:20 -04:00 |
|
|
Ken Johnson
|
a6a38c773e
|
added validation for all schedule fields (presence of) and working on a new way to dynamically update your calendar upon submission of a new calendar event
|
2013-05-31 00:31:13 -04:00 |
|
|
Ken Johnson
|
23bc521787
|
got rid of mass assignment in certain areas
|
2013-05-30 12:52:43 -04:00 |
|
|
Ken Johnson
|
ff36b0fab5
|
working way to update your scheduled PTO
|
2013-05-30 12:11:50 -04:00 |
|
|
Ken Johnson
|
caf348f189
|
made some big changes here. The schedule had a has_one relationship with the PTO model. That is a problem since we only get one result back. meaning, a user cant have multiple scheduled events. This has been fixed with the use of has_many within the PTO model. Now, in relation to the PTO section, the next changes to happen are to be a fully functional create action that allows an event to be schedule, the form and controller has already been created. Umm, also, a calendar has been added and when we get the results back from a call to the create event action we will update that calendar. Think that is about it for now
|
2013-05-28 12:48:35 -04:00 |
|
|
Ken Johnson
|
a1712f78a3
|
added another chart for PTO and fixed badly named method
|
2013-05-28 10:41:04 -04:00 |
|
|
Ken Johnson
|
657db353c4
|
working on new chart for PTO
|
2013-05-28 10:12:31 -04:00 |
|
|
Ken Johnson
|
9feae35f5f
|
switching to a different graph
|
2013-05-28 09:44:17 -04:00 |
|
|
Ken Johnson
|
21752fab7e
|
I am setting this up, in this way, so that we have some extensibility. We may wish to have some sort of a polymorphic association where multiple models need to have a scheduling model available to them. That being said, as of right now, only the pto model needs it so I am doing a belong_to and has_one association between the two
|
2013-05-27 13:09:33 -04:00 |
|