autoforme 1.7.0 → 1.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: 83fda57cc1135158108ed30103403c23d0600ccf
-  data.tar.gz: 42e3f1e0bae263ea3e5babc767cb3492bf2f5efe
+SHA256:
+  metadata.gz: 5112ef1a062e3fa4a586f605365004eb733e25c7e49c7d52d0399d2d5596a692
+  data.tar.gz: 3142feb7e88e43ec825eedb9dfa700dd2c710cdce59b7839241117ad66b6568a
 SHA512:
-  metadata.gz: 0d716b34aec6a9b8a7e85e6c3928a029240ff1959b3e94358cdbcd974164f34a6a68206d698977d5cdfedbf253b6973ae04713574693f20d18c6933647e7c47f
-  data.tar.gz: fc8efa80a2e498952c10c1052b9eccee17d20a5d488e7416537e3eae89b76f6505cddf3058be80580f139e959f5d3a9f82c2c8bbfb411b172f7783e704b5f0c0
+  metadata.gz: 937e7ced506f742fbd9ec7632cf69a6a93b1996d884a63996162a38ad949c0ef3b6022a910fe51748f9792c9d9ce3703ffa6691e321f93bcd9917e05f3f24677
+  data.tar.gz: a369fc3b50aef5cf9546fb512c0d92a63de9cc0f15b8ac16f84b5fa2291f688ea10f0a711ddf9573b3e1c6257015174c147f05af6e7f073ae37be1e392386c85

data/CHANGELOG

@@ -1,3 +1,9 @@
+=== 1.8.0 (2018-06-11)
+
+* Add support for Roda route_csrf plugin for request-specific CSRF tokens (jeremyevans)
+
+* Default to size of 10 for select multiple inputs (jeremyevans)
+
 === 1.7.0 (2017-10-27)
 
 * Respect Model#forme_namespace method for parameter names (adam12, jeremyevans) (#9)

data/MIT-LICENSE

@@ -1,4 +1,4 @@
-Copyright (c) 2013-2017 Jeremy Evans
+Copyright (c) 2013-2018 Jeremy Evans
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to

data/README.rdoc

@@ -197,7 +197,7 @@ symbol and request).
 
 Additionally, AutoForme.for accepts a :prefix option that controls where the forms are mounted:
 
-  AutoForm.for(:sinatra, self, :prefix=>'/path/to') do
+  AutoForme.for(:sinatra, self, :prefix=>'/path/to') do
     model Artist
   end
 

data/lib/autoforme/action.rb

@@ -225,11 +225,11 @@ module AutoForme
     end
 
     # Options to use for the form.  If the form uses POST, automatically adds the CSRF token.
-    def form_opts
+    def form_opts(action=nil)
       opts = model.form_options_for(type, request).dup
       hidden_tags = opts[:hidden_tags] = []
-      if csrf = request.csrf_token_hash
-        hidden_tags << lambda{|tag| csrf if tag.attr[:method].to_s.upcase == 'POST'}
+      if csrf = request.csrf_token_hash(action)
+        hidden_tags << lambda{|tag| csrf if (tag.attr[:method] || tag.attr['method']).to_s.upcase == 'POST'}
       end
       opts
     end
@@ -243,7 +243,8 @@ module AutoForme
     # HTML content used for the new action
     def new_page(obj, opts={})
       page do
-        Forme.form(obj, form_attributes(:action=>url_for("create")), form_opts) do |f|
+        form_attr = form_attributes(:action=>url_for("create"))
+        Forme.form(obj, form_attr, form_opts(form_attr[:action])) do |f|
           model.columns_for(:new, request).each do |column|
             col_opts = column_options_for(:new, request, obj, column)
             if html = model.edit_html_for(obj, column, :new, request)
@@ -318,7 +319,8 @@ module AutoForme
           end.to_s
         end
         if type == :delete
-          t << Forme.form(form_attributes(:action=>url_for("destroy/#{model.primary_key_value(obj)}"), :method=>:post), form_opts) do |f1|
+          form_attr = form_attributes(:action=>url_for("destroy/#{model.primary_key_value(obj)}"), :method=>:post)
+          t << Forme.form(form_attr, form_opts(form_attr[:action])) do |f1|
             f1.button(:value=>'Delete', :class=>'btn btn-danger')
           end.to_s
         else
@@ -341,7 +343,8 @@ module AutoForme
     def edit_page(obj)
       page do
         t = String.new
-        t << Forme.form(obj, form_attributes(:action=>url_for("update/#{model.primary_key_value(obj)}")), form_opts) do |f|
+        form_attr = form_attributes(:action=>url_for("update/#{model.primary_key_value(obj)}"))
+        t << Forme.form(obj, form_attr, form_opts(form_attr[:action])) do |f|
           model.columns_for(:edit, request).each do |column|
             col_opts = column_options_for(:edit, request, obj, column)
             if html = model.edit_html_for(obj, column, :edit, request)
@@ -479,7 +482,8 @@ module AutoForme
           page do
             t = String.new
             t << "<h2>Edit #{humanize(assoc)} for #{h model.object_display_name(type, request, obj)}</h2>"
-            t << Forme.form(obj, form_attributes(:action=>url_for("mtm_update/#{model.primary_key_value(obj)}?association=#{assoc}")), form_opts) do |f|
+            form_attr = form_attributes(:action=>url_for("mtm_update/#{model.primary_key_value(obj)}?association=#{assoc}"))
+            t << Forme.form(obj, form_attr, form_opts(form_attr[:action])) do |f|
               opts = model.column_options_for(:mtm_edit, request, assoc)
               add_opts = opts[:add] ? opts.merge(opts.delete(:add)) : opts
               remove_opts = opts[:remove] ? opts.merge(opts.delete(:remove)) : opts
@@ -487,9 +491,9 @@ module AutoForme
               if model.association_autocomplete?(assoc, request)
                 f.input(assoc, {:type=>'text', :class=>'autoforme_autocomplete', :attr=>{'data-type'=>'association', 'data-column'=>assoc, 'data-exclude'=>model.primary_key_value(obj)}, :value=>''}.merge(add_opts))
               else
-                f.input(assoc, {:dataset=>model.unassociated_mtm_objects(request, assoc, obj)}.merge(add_opts))
+                f.input(assoc, {:dataset=>model.unassociated_mtm_objects(request, assoc, obj), :size=>10}.merge(add_opts))
               end
-              f.input(assoc, {:name=>'remove[]', :id=>'remove', :label=>'Disassociate From', :dataset=>model.associated_mtm_objects(request, assoc, obj), :value=>[]}.merge(remove_opts))
+              f.input(assoc, {:name=>'remove[]', :id=>'remove', :label=>'Disassociate From', :dataset=>model.associated_mtm_objects(request, assoc, obj), :value=>[], :size=>10}.merge(remove_opts))
               f.button(:value=>'Update', :class=>'btn btn-primary')
             end.to_s
           end
@@ -641,7 +645,7 @@ module AutoForme
       t << "<div class='inline_mtm_add_associations'>"
       assocs.each do |assoc|
         form_attr = form_attributes(:action=>url_for("mtm_update/#{model.primary_key_value(obj)}?association=#{assoc}&redir=edit"), :class => 'mtm_add_associations', 'data-remove' => "##{assoc}_remove_list")
-        t << Forme.form(obj, form_attr, form_opts) do |f|
+        t << Forme.form(obj, form_attr, form_opts(form_attr[:action])) do |f|
           opts = model.column_options_for(:mtm_edit, request, assoc)
           add_opts = opts[:add] ? opts.merge(opts.delete(:add)) : opts.dup
           add_opts = {:name=>'add[]', :id=>"add_#{assoc}"}.merge(add_opts)
@@ -674,7 +678,7 @@ module AutoForme
       t << "<li>"
       t << association_link(mc, assoc_obj)
       form_attr = form_attributes(:action=>url_for("mtm_update/#{model.primary_key_value(obj)}?association=#{assoc}&remove%5b%5d=#{model.primary_key_value(assoc_obj)}&redir=edit"), :method=>'post', :class => 'mtm_remove_associations', 'data-add'=>"#add_#{assoc}")
-      t << Forme.form(form_attr, form_opts) do |f|
+      t << Forme.form(form_attr, form_opts(form_attr[:action])) do |f|
         f.button(:value=>'Remove', :class=>'btn btn-xs btn-danger')
       end.to_s
       t << "</li>"

data/lib/autoforme/frameworks/rails.rb

@@ -29,7 +29,7 @@ module AutoForme
         end
         
         # Use Rails's form_authenticity_token for CSRF protection.
-        def csrf_token_hash
+        def csrf_token_hash(action=nil)
           vc = @controller.view_context
           {vc.request_forgery_protection_token.to_s=>vc.form_authenticity_token} if vc.protect_against_forgery?
         end

data/lib/autoforme/frameworks/roda.rb

@@ -38,8 +38,20 @@ module AutoForme
         end
         
         # Use Rack::Csrf for csrf protection if it is defined.
-        def csrf_token_hash
-          {::Rack::Csrf.field=>::Rack::Csrf.token(@env)} if defined?(::Rack::Csrf)
+        def csrf_token_hash(action=nil)
+          if @controller.respond_to?(:check_csrf!)
+            # Using route_csrf plugin
+            # :nocov:
+            token = if @controller.use_request_specific_csrf_tokens?
+              @controller.csrf_token(@controller.csrf_path(action))
+            else
+              @controller.csrf_token
+            end
+            {@controller.csrf_field=>token}
+            # :nocov:
+          elsif defined?(::Rack::Csrf)
+            {::Rack::Csrf.field=>::Rack::Csrf.token(@env)}
+          end
         end
       end
 

data/lib/autoforme/frameworks/sinatra.rb

@@ -29,7 +29,7 @@ module AutoForme
         end
         
         # Use Rack::Csrf for csrf protection if it is defined.
-        def csrf_token_hash
+        def csrf_token_hash(action=nil)
           {::Rack::Csrf.field=>::Rack::Csrf.token(@env)} if defined?(::Rack::Csrf)
         end
       end

data/lib/autoforme/version.rb

@@ -1,8 +1,22 @@
 # frozen-string-literal: true
 
 module AutoForme
+  # The major version of AutoForme, updated only for major changes that are
+  # likely to require modification to apps using AutoForme.
+  MAJOR = 1
+
+  # The minor version of AutoForme, updated for new feature releases of AutoForme.
+  MINOR = 8
+
+  # The patch version of AutoForme, updated only for bug fixes from the last
+  # feature release.
+  TINY = 0
+
   # Version constant, use <tt>AutoForme.version</tt> instead.
-  VERSION = '1.7.0'.freeze
+  VERSION = "#{MAJOR}.#{MINOR}.#{TINY}".freeze
+
+  # The full version of AutoForme as a number (1.8.0 => 10800)
+  VERSION_NUMBER = MAJOR*10000 + MINOR*100 + TINY
 
   # Returns the version as a frozen string (e.g. '0.1.0')
   def self.version

data/spec/rails_spec_helper.rb

@@ -5,6 +5,9 @@ require 'autoforme'
 class AutoFormeSpec::App
   def self.autoforme(klass=nil, opts={}, &block)
     sc = Class.new(Rails::Application)
+    def sc.name
+      "AutoForme Test"
+    end
     framework = nil
     sc.class_eval do
       controller = Class.new(ActionController::Base)
@@ -50,13 +53,14 @@ HTML
         end
       end
 
-      config.secret_token = routes.append do
+      st = routes.append do
         get 'session/set', :controller=>'autoforme', :action=>'session_set'
       end.inspect
+      config.secret_token = st if Rails.respond_to?(:version) && Rails.version < '5.2'
       config.active_support.deprecation = :stderr
       config.middleware.delete(ActionDispatch::ShowExceptions)
       config.middleware.delete(Rack::Lock)
-      config.secret_key_base = 'foo'
+      config.secret_key_base = st*15
       config.eager_load = true
       if Rails.version > '4.2'
         config.action_dispatch.cookies_serializer = :json

data/spec/roda_spec_helper.rb

@@ -31,7 +31,11 @@ class AutoFormeSpec::App < Roda
 HTML
 
   use Rack::Session::Cookie, :secret => '1'
-  use Rack::Csrf
+  if ENV['RODA_ROUTE_CSRF'].to_i > 0
+    plugin :route_csrf, :require_request_specific_tokens=>ENV['RODA_ROUTE_CSRF'] == '1'
+  else
+    use Rack::Csrf
+  end
 
   template_opts = {:default_encoding=>nil}
   plugin :render, :layout=>{:inline=>LAYOUT}, :template_opts=>template_opts, :opts=>template_opts
@@ -54,6 +58,8 @@ HTML
       end
 
       route do |r|
+        check_csrf! if ENV['RODA_ROUTE_CSRF'].to_i > 0
+
         r.get 'session/set' do
           session.merge!(r.params)
           ''

data/spec/spec_helper.rb

@@ -24,13 +24,15 @@ require "./spec/#{ENV['FRAMEWORK']}_spec_helper"
 require 'capybara'
 require 'capybara/dsl'
 require 'rack/test'
+
+ENV['MT_NO_PLUGINS'] = '1' # Work around stupid autoloading of plugins
 gem 'minitest'
 require 'minitest/autorun'
 require 'minitest/hooks/default'
 
 if ENV['WARNING']
   require 'warning'
-  Warning.ignore([:missing_ivar, :fixnum])
+  Warning.ignore([:missing_ivar, :fixnum, :not_reached])
 end
 
 require './spec/sequel_spec_helper'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: autoforme
 version: !ruby/object:Gem::Version
-  version: 1.7.0
+  version: 1.8.0
 platform: ruby
 authors:
 - Jeremy Evans
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-10-27 00:00:00.000000000 Z
+date: 2018-06-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: forme
@@ -267,7 +267,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.6.13
+rubygems_version: 2.7.6
 signing_key: 
 specification_version: 4
 summary: Web Administrative Console for Roda/Sinatra/Rails and Sequel::Model