blazer 2.0.2 → 2.1.0

Sign up to get free protection for your applications and to get access to all the features.

Potentially problematic release.


This version of blazer might be problematic. Click here for more details.

checksums.yaml CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  SHA256:
3
- metadata.gz: 4a6731164b551f139951303884ca6531d336249299f5ff6e295160348540a687
4
- data.tar.gz: 784d957116c412f9ac526661e0ca7252d62c43ffd51a67bb106d1a401da44f25
3
+ metadata.gz: d30135b6a6bfd6aa1bc940afff2c6e58ba3a4fec00a5e6cf4c34573acadc08ef
4
+ data.tar.gz: 925787073e4b0f161ab974875ba7df666c3bc6cd99d87f93052a0a54e4b94663
5
5
  SHA512:
6
- metadata.gz: be8f6f7713953e505d76170f1e0e81284f0dd99b35ed28d42932542de702fd0e541e1a8b86e6428c47324d66f58ae98df2732221ad49ac512db221d0c664de07
7
- data.tar.gz: 0e3c7202af0c73b9070e81c922167d46f387aea34d47797333aa3a1d89f8f6a7710a47f1a1eb61fe7d20e880d7183e2e7019263547b78d01124ebd80cd849d13
6
+ metadata.gz: 245b6001c927c3c592afd6aaed930e11a35bdb56c39c165c5f4b318ce095b17937c25dc71efcf0b0cdca5a1a2c7139ad0f917903d429a228cafd9ab86d24c1d2
7
+ data.tar.gz: afc5184b13e8ee2537b16b81f75a3ba703d357999dea851c887596b3daaf92a1bd486c1825129f15c93a72e6f23c16f5cc4d306c11346344ba560085e6ec5861
@@ -1,3 +1,7 @@
1
+ ## 2.1.0
2
+
3
+ - Fixed XSS vulnerability due to Chartkick - see [#245](https://github.com/ankane/blazer/issues/245)
4
+
1
5
  ## 2.0.2
2
6
 
3
7
  - Added support for variable transformation for blind indexing
@@ -29,25 +29,11 @@ module Blazer
29
29
  end
30
30
 
31
31
  def blazer_maps?
32
- ENV["MAPBOX_ACCESS_TOKEN"].present?
32
+ Blazer.mapbox_access_token.present?
33
33
  end
34
34
 
35
35
  def blazer_js_var(name, value)
36
- "var #{name} = #{blazer_json_escape(value.to_json(root: false))};".html_safe
37
- end
38
-
39
- JSON_ESCAPE = { '&' => '\u0026', '>' => '\u003e', '<' => '\u003c', "\u2028" => '\u2028', "\u2029" => '\u2029' }
40
- JSON_ESCAPE_REGEXP = /[\u2028\u2029&><]/u
41
-
42
- # Prior to version 4.1 of rails double quotes were inadventently removed in json_escape.
43
- # This adds the correct json_escape functionality to rails versions < 4.1
44
- def blazer_json_escape(s)
45
- if Rails::VERSION::STRING < "4.1"
46
- result = s.to_s.gsub(JSON_ESCAPE_REGEXP, JSON_ESCAPE)
47
- s.html_safe? ? result.html_safe : result
48
- else
49
- json_escape(s)
50
- end
36
+ "var #{name} = #{json_escape(value.to_json(root: false))};".html_safe
51
37
  end
52
38
 
53
39
  def blazer_series_name(k)
@@ -32,7 +32,9 @@
32
32
  <thead>
33
33
  <tr>
34
34
  <th>Name</th>
35
- <th style="width: 20%; text-align: right;">Mastermind</th>
35
+ <% if Blazer.user_class %>
36
+ <th style="width: 20%; text-align: right;">Mastermind</th>
37
+ <% end%>
36
38
  </tr>
37
39
  </thead>
38
40
  <tbody class="list" v-cloak>
@@ -41,7 +43,9 @@
41
43
  <a :href="itemPath(query)" :class="{ dashboard: query.dashboard }">{{ query.name }}</a>
42
44
  <span class="vars">{{ query.vars }}</span>
43
45
  </td>
44
- <td class="creator">{{ query.creator }}</td>
46
+ <% if Blazer.user_class %>
47
+ <td class="creator">{{ query.creator }}</td>
48
+ <% end %>
45
49
  </tr>
46
50
  </tbody>
47
51
  </table>
@@ -76,9 +76,10 @@
76
76
  <% if blazer_maps? && @markers.any? %>
77
77
  <div id="map" style="height: <%= @only_chart ? 300 : 500 %>px;"></div>
78
78
  <script>
79
- L.mapbox.accessToken = '<%= ENV["MAPBOX_ACCESS_TOKEN"] %>';
80
- var map = L.mapbox.map('map', 'ankane.ioo8nki0');
79
+ <%= blazer_js_var "mapboxAccessToken", Blazer.mapbox_access_token %>
81
80
  <%= blazer_js_var "markers", @markers %>
81
+ L.mapbox.accessToken = mapboxAccessToken;
82
+ var map = L.mapbox.map('map', 'ankane.ioo8nki0');
82
83
  var featureLayer = L.mapbox.featureLayer().addTo(map);
83
84
  var geojson = [];
84
85
  for (var i = 0; i < markers.length; i++) {
@@ -52,6 +52,7 @@ module Blazer
52
52
  attr_accessor :query_editable
53
53
  attr_accessor :override_csp
54
54
  attr_accessor :slack_webhook_url
55
+ attr_accessor :mapbox_access_token
55
56
  end
56
57
  self.audit = true
57
58
  self.user_name = :name
@@ -26,6 +26,7 @@ module Blazer
26
26
  Blazer.images = Blazer.settings["images"] || false
27
27
  Blazer.override_csp = Blazer.settings["override_csp"] || false
28
28
  Blazer.slack_webhook_url = Blazer.settings["slack_webhook_url"] || ENV["BLAZER_SLACK_WEBHOOK_URL"]
29
+ Blazer.mapbox_access_token = Blazer.settings["mapbox_access_token"] || ENV["MAPBOX_ACCESS_TOKEN"]
29
30
  end
30
31
  end
31
32
  end
@@ -1,3 +1,3 @@
1
1
  module Blazer
2
- VERSION = "2.0.2"
2
+ VERSION = "2.1.0"
3
3
  end
@@ -68,3 +68,6 @@ check_schedules:
68
68
  # enable forecasting
69
69
  # note: with trend, time series are sent to https://trendapi.org
70
70
  # forecasting: trend
71
+
72
+ # enable map
73
+ # mapbox_access_token: <%%= ENV["MAPBOX_ACCESS_TOKEN"] %>
metadata CHANGED
@@ -1,14 +1,14 @@
1
1
  --- !ruby/object:Gem::Specification
2
2
  name: blazer
3
3
  version: !ruby/object:Gem::Version
4
- version: 2.0.2
4
+ version: 2.1.0
5
5
  platform: ruby
6
6
  authors:
7
7
  - Andrew Kane
8
8
  autorequire:
9
9
  bindir: bin
10
10
  cert_chain: []
11
- date: 2019-05-27 00:00:00.000000000 Z
11
+ date: 2019-06-04 00:00:00.000000000 Z
12
12
  dependencies:
13
13
  - !ruby/object:Gem::Dependency
14
14
  name: railties
@@ -44,14 +44,14 @@ dependencies:
44
44
  requirements:
45
45
  - - ">="
46
46
  - !ruby/object:Gem::Version
47
- version: '0'
47
+ version: '3.2'
48
48
  type: :runtime
49
49
  prerelease: false
50
50
  version_requirements: !ruby/object:Gem::Requirement
51
51
  requirements:
52
52
  - - ">="
53
53
  - !ruby/object:Gem::Version
54
- version: '0'
54
+ version: '3.2'
55
55
  - !ruby/object:Gem::Dependency
56
56
  name: safely_block
57
57
  requirement: !ruby/object:Gem::Requirement