Updated rails to avoid ActionPack vuls.

https://groups.google.com/forum/#!topic/rubyonrails-security/61bkgvnSGTQ/discussion
kandanapp · Jan 8, 2013 · a1fd6f9 · a1fd6f9
1 parent 9227519
commit a1fd6f9
Show file tree

Hide file tree

Showing 3 changed files with 117 additions and 52 deletions.
diff --git a/Gemfile b/Gemfile
@@ -1,9 +1,9 @@
 source 'https://rubygems.org'
 
 # Core gems
-gem 'rails', '3.2.2'
+gem 'rails', '3.2.11'
 
-group :development do  
+group :development, :test do  
   gem 'sqlite3'
 end
 # Database adapters
@@ -42,9 +42,9 @@ group :assets do
 end
 
 # Test gems, obviously
-# group :test do
-#  gem 'rspec-rails'
-#  gem 'shoulda-matchers'
-#  gem 'factory_girl_rails'
-#  gem 'jasmine', :git => "https://github.com/pivotal/jasmine-gem.git", :branch => "1.2.rc1", :group => [:development, :test]
-# end
+group :test do
+  gem 'rspec-rails'
+  gem 'shoulda-matchers'
+  gem 'factory_girl_rails'
+  gem 'jasmine', :git => "https://github.com/pivotal/jasmine-gem.git", :branch => "1.2.rc1", :group => [:development, :test]
+end
diff --git a/Gemfile.lock b/Gemfile.lock
@@ -1,3 +1,14 @@
+GIT
+  remote: https://github.com/pivotal/jasmine-gem.git
+  revision: 5a7524ae9eaea4fe106a7aaa90ccfb1bc137abe7
+  branch: 1.2.rc1
+  specs:
+    jasmine (1.2.0.rc1)
+      jasmine-core (>= 1.2.0.rc1)
+      rack (>= 1.1)
+      rspec (>= 1.3.1)
+      selenium-webdriver (>= 0.1.3)
+
 GEM
   remote: https://rubygems.org/
   specs:
@@ -10,31 +21,31 @@ GEM
       yajl-ruby (>= 1.0.0)
     _bushido-faye-websocket (0.4.4)
       eventmachine (>= 0.12.0)
-    actionmailer (3.2.2)
-      actionpack (= 3.2.2)
-      mail (~> 2.4.0)
-    actionpack (3.2.2)
-      activemodel (= 3.2.2)
-      activesupport (= 3.2.2)
+    actionmailer (3.2.11)
+      actionpack (= 3.2.11)
+      mail (~> 2.4.4)
+    actionpack (3.2.11)
+      activemodel (= 3.2.11)
+      activesupport (= 3.2.11)
       builder (~> 3.0.0)
       erubis (~> 2.7.0)
-      journey (~> 1.0.1)
+      journey (~> 1.0.4)
       rack (~> 1.4.0)
-      rack-cache (~> 1.1)
+      rack-cache (~> 1.2)
       rack-test (~> 0.6.1)
-      sprockets (~> 2.1.2)
-    activemodel (3.2.2)
-      activesupport (= 3.2.2)
+      sprockets (~> 2.2.1)
+    activemodel (3.2.11)
+      activesupport (= 3.2.11)
       builder (~> 3.0.0)
-    activerecord (3.2.2)
-      activemodel (= 3.2.2)
-      activesupport (= 3.2.2)
+    activerecord (3.2.11)
+      activemodel (= 3.2.11)
+      activesupport (= 3.2.11)
       arel (~> 3.0.2)
       tzinfo (~> 0.3.29)
-    activeresource (3.2.2)
-      activemodel (= 3.2.2)
-      activesupport (= 3.2.2)
-    activesupport (3.2.2)
+    activeresource (3.2.11)
+      activemodel (= 3.2.11)
+      activesupport (= 3.2.11)
+    activesupport (3.2.11)
       i18n (~> 0.6)
       multi_json (~> 1.0)
     addressable (2.2.7)
@@ -50,7 +61,11 @@ GEM
     bcrypt-ruby (3.0.1)
     bourbon (1.4.0)
       sass (>= 3.1)
-    builder (3.0.0)
+    bourne (1.1.2)
+      mocha (= 0.10.5)
+    builder (3.0.4)
+    childprocess (0.3.6)
+      ffi (~> 1.0, >= 1.0.6)
     cloudfuji (0.0.39)
       highline (>= 1.6.1)
       json (>= 1.4.6)
@@ -79,6 +94,7 @@ GEM
     devise_cloudfuji_authenticatable (1.0.5)
       devise (= 1.5.3)
       rubycas-client (>= 2.2.1)
+    diff-lcs (1.1.3)
     eco (1.0.0)
       coffee-script
       eco-source
@@ -93,88 +109,127 @@ GEM
     eventmachine (0.12.10)
     execjs (1.3.0)
       multi_json (~> 1.0)
+    factory_girl (4.1.0)
+      activesupport (>= 3.0.0)
+    factory_girl_rails (4.1.0)
+      factory_girl (~> 4.1.0)
+      railties (>= 3.0.0)
+    ffi (1.3.0)
     highline (1.6.11)
     hike (1.2.1)
     httparty (0.8.1)
       multi_json
       multi_xml
-    i18n (0.6.0)
-    journey (1.0.3)
+    i18n (0.6.1)
+    jasmine-core (1.3.1)
+    journey (1.0.4)
     jquery-rails (2.0.1)
       railties (>= 3.2.0, < 5.0)
       thor (~> 0.14)
-    json (1.6.5)
+    json (1.7.6)
     kaminari (0.13.0)
       actionpack (>= 3.0.0)
       activesupport (>= 3.0.0)
       railties (>= 3.0.0)
-    mail (2.4.3)
+    libwebsocket (0.1.7.1)
+      addressable
+      websocket
+    mail (2.4.4)
       i18n (>= 0.4.0)
       mime-types (~> 1.16)
       treetop (~> 1.4.8)
-    mime-types (1.18)
-    multi_json (1.3.2)
+    metaclass (0.0.1)
+    mime-types (1.19)
+    mocha (0.10.5)
+      metaclass (~> 0.0.1)
+    multi_json (1.5.0)
     multi_xml (0.4.2)
     nokogiri (1.5.0)
     orm_adapter (0.0.6)
     pg (0.12.2)
     polyglot (0.3.3)
-    rack (1.4.1)
+    rack (1.4.3)
     rack-cache (1.2)
       rack (>= 0.4)
     rack-ssl (1.3.2)
       rack
-    rack-test (0.6.1)
+    rack-test (0.6.2)
       rack (>= 1.0)
-    rails (3.2.2)
-      actionmailer (= 3.2.2)
-      actionpack (= 3.2.2)
-      activerecord (= 3.2.2)
-      activeresource (= 3.2.2)
-      activesupport (= 3.2.2)
+    rails (3.2.11)
+      actionmailer (= 3.2.11)
+      actionpack (= 3.2.11)
+      activerecord (= 3.2.11)
+      activeresource (= 3.2.11)
+      activesupport (= 3.2.11)
       bundler (~> 1.0)
-      railties (= 3.2.2)
-    railties (3.2.2)
-      actionpack (= 3.2.2)
-      activesupport (= 3.2.2)
+      railties (= 3.2.11)
+    railties (3.2.11)
+      actionpack (= 3.2.11)
+      activesupport (= 3.2.11)
       rack-ssl (~> 1.3.2)
       rake (>= 0.8.7)
       rdoc (~> 3.4)
-      thor (~> 0.14.6)
-    rake (0.9.2.2)
+      thor (>= 0.14.6, < 2.0)
+    rake (10.0.3)
     rdoc (3.12)
       json (~> 1.4)
     remotipart (1.0.2)
     rest-client (1.6.7)
       mime-types (>= 1.16)
+    rspec (2.12.0)
+      rspec-core (~> 2.12.0)
+      rspec-expectations (~> 2.12.0)
+      rspec-mocks (~> 2.12.0)
+    rspec-core (2.12.2)
+    rspec-expectations (2.12.1)
+      diff-lcs (~> 1.1.3)
+    rspec-mocks (2.12.1)
+    rspec-rails (2.12.1)
+      actionpack (>= 3.0)
+      activesupport (>= 3.0)
+      railties (>= 3.0)
+      rspec-core (~> 2.12.0)
+      rspec-expectations (~> 2.12.0)
+      rspec-mocks (~> 2.12.0)
     rubycas-client (2.3.8)
       activesupport
+    rubyzip (0.9.9)
     sass (3.1.15)
     sass-rails (3.2.4)
       railties (~> 3.2.0)
       sass (>= 3.1.10)
       tilt (~> 1.3)
-    sprockets (2.1.2)
+    selenium-webdriver (2.27.2)
+      childprocess (>= 0.2.5)
+      libwebsocket (~> 0.1.3)
+      multi_json (~> 1.0)
+      rubyzip
+    shoulda-matchers (1.4.2)
+      activesupport (>= 3.0.0)
+      bourne (~> 1.1.2)
+    sprockets (2.2.2)
       hike (~> 1.2)
+      multi_json (~> 1.0)
       rack (~> 1.0)
       tilt (~> 1.1, != 1.3.0)
     sqlite3 (1.3.6)
     thin (1.3.1)
       daemons (>= 1.0.9)
       eventmachine (>= 0.12.6)
       rack (>= 1.0.0)
-    thor (0.14.6)
+    thor (0.16.0)
     tilt (1.3.3)
-    treetop (1.4.10)
+    treetop (1.4.12)
       polyglot
       polyglot (>= 0.3.1)
-    tzinfo (0.3.33)
+    tzinfo (0.3.35)
     uglifier (1.2.3)
       execjs (>= 0.3.0)
       multi_json (>= 1.0.2)
     uuidtools (2.1.2)
     warden (1.1.1)
       rack (>= 1.0)
+    websocket (1.0.6)
     yajl-ruby (1.1.0)
 
 PLATFORMS
@@ -192,12 +247,16 @@ DEPENDENCIES
   devise_cloudfuji_authenticatable
   eco
   execjs
+  factory_girl_rails
+  jasmine!
   jquery-rails
   kaminari
   pg (= 0.12.2)
-  rails (= 3.2.2)
+  rails (= 3.2.11)
   remotipart
+  rspec-rails
   sass-rails (~> 3.2.3)
+  shoulda-matchers
   sqlite3
   thin
   uglifier (>= 1.0.3)
diff --git a/config/database.yml b/config/database.yml
@@ -12,3 +12,9 @@ development:
   database: db/development.sqlite3
   pool: 5
   timeout: 5000
+
+test:
+  adapter: sqlite3
+  database: db/test.sqlite3
+  pool: 5
+  timeout: 5000