I'm not mélanchonien but this initiative is quite laudable.
I saw you took some precautions while disclosing the source code, but you missed some points.
In config/initializers/secret_token.rb :
PartiDeGauche::Application.config.secret_token = 'c38ac477282636ad9940105aa8445d626f281ea543def898337c77bbcb2979ffdd62085ad456dd5cf36c35c37ce02ffa21cfdf5bb6f444db86bb43090fe0aa31'
This is called secret for a reason. It is used to sign your cookies. You let your users vulnerable to a session hijacking.
In config/environment.rb :
PBX_SITE = "5133308"
PBX_SITE_TEST = "1999888"
These are part of a payment gateway credentials. For these ones, you're stuck with them being public, you can't regenerate them. Try calling Paybox.
In config/initializers/devise.rb :
require "omniauth-facebook"
config.omniauth :facebook, "293257790720210", "47c73941bce3de72e4dae13d0dd0b8b0", :strategy_class => OmniAuth::Strategies::Facebook
Here are the APP_ID and APP_SECRET for your facebook app.
Here is a little help. I wanted to talk about SettingsLogic, addressing such issues, so I jumped on the occasion :
http://emaxime.com/2012/managing-private-settings-with-settingslogic/
I'm not mélanchonien but this initiative is quite laudable.
I saw you took some precautions while disclosing the source code, but you missed some points.
In
config/initializers/secret_token.rb:This is called secret for a reason. It is used to sign your cookies. You let your users vulnerable to a session hijacking.
In
config/environment.rb:These are part of a payment gateway credentials. For these ones, you're stuck with them being public, you can't regenerate them. Try calling Paybox.
In
config/initializers/devise.rb:Here are the APP_ID and APP_SECRET for your facebook app.
Here is a little help. I wanted to talk about SettingsLogic, addressing such issues, so I jumped on the occasion :
http://emaxime.com/2012/managing-private-settings-with-settingslogic/