community_engine 3.0.0 → 3.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (198) hide show
  1. checksums.yaml +5 -13
  2. data/.gitignore +4 -1
  3. data/.travis.yml +5 -2
  4. data/CHANGELOG.markdown +270 -0
  5. data/Gemfile +3 -0
  6. data/README.markdown +20 -21
  7. data/Rakefile +8 -6
  8. data/TODO.markdown +3 -0
  9. data/UPGRADING.markdown +46 -36
  10. data/app/assets/javascripts/active_admin.js.coffee +19 -0
  11. data/app/assets/javascripts/ckeditor/configs/ads.js.coffee +175 -0
  12. data/app/assets/javascripts/ckeditor/configs/comments.js.coffee +2 -0
  13. data/app/assets/javascripts/ckeditor/configs/posts.js.coffee +248 -0
  14. data/app/assets/javascripts/ckeditor/rte/rte.ads.js.coffee +7 -0
  15. data/app/assets/javascripts/ckeditor/rte/rte.comments.js.coffee +8 -0
  16. data/app/assets/javascripts/ckeditor/rte/rte.js.coffee +20 -0
  17. data/app/assets/javascripts/ckeditor/rte/rte.posts.js.coffee +14 -0
  18. data/app/assets/javascripts/community_engine.js +114 -123
  19. data/{vendor → app}/assets/javascripts/jcrop/jquery.Jcrop.js +0 -0
  20. data/{vendor → app}/assets/javascripts/jcrop/jquery.color.js +0 -0
  21. data/{vendor → app}/assets/javascripts/tag-it/tag-it.js +0 -0
  22. data/app/assets/stylesheets/active_admin.css.scss +27 -0
  23. data/{vendor → app}/assets/stylesheets/jcrop/Jcrop.gif +0 -0
  24. data/{vendor → app}/assets/stylesheets/jcrop/jquery.Jcrop.min.css +0 -0
  25. data/{vendor → app}/assets/stylesheets/tag-it/tag-it.css +0 -0
  26. data/{vendor → app}/assets/stylesheets/tag-it/tagit.ui-zendesk.css +0 -0
  27. data/app/controllers/activities_controller.rb +4 -4
  28. data/app/controllers/albums_controller.rb +13 -18
  29. data/app/controllers/authorizations_controller.rb +1 -1
  30. data/app/controllers/base_controller.rb +9 -32
  31. data/app/controllers/categories_controller.rb +1 -78
  32. data/app/controllers/clippings_controller.rb +3 -7
  33. data/app/controllers/comments_controller.rb +4 -24
  34. data/app/controllers/events_controller.rb +3 -12
  35. data/app/controllers/favorites_controller.rb +2 -2
  36. data/app/controllers/forums_controller.rb +5 -9
  37. data/app/controllers/invitations_controller.rb +1 -1
  38. data/app/controllers/messages_controller.rb +4 -8
  39. data/app/controllers/moderators_controller.rb +1 -1
  40. data/app/controllers/monitorships_controller.rb +1 -1
  41. data/app/controllers/pages_controller.rb +0 -62
  42. data/app/controllers/password_resets_controller.rb +2 -2
  43. data/app/controllers/photo_manager_controller.rb +3 -3
  44. data/app/controllers/photos_controller.rb +43 -14
  45. data/app/controllers/posts_controller.rb +7 -14
  46. data/app/controllers/rsvps_controller.rb +3 -3
  47. data/app/controllers/sb_posts_controller.rb +20 -20
  48. data/app/controllers/sessions_controller.rb +1 -1
  49. data/app/controllers/tags_controller.rb +4 -52
  50. data/app/controllers/topics_controller.rb +15 -10
  51. data/app/controllers/users_controller.rb +9 -16
  52. data/app/controllers/votes_controller.rb +2 -2
  53. data/app/helpers/base_helper.rb +4 -14
  54. data/app/models/acts_as_taggable_on/tag.rb +9 -41
  55. data/app/models/clipping.rb +1 -1
  56. data/app/models/forum.rb +2 -2
  57. data/app/models/photo.rb +1 -1
  58. data/app/models/post.rb +1 -1
  59. data/app/models/sb_post.rb +19 -15
  60. data/app/models/topic.rb +10 -10
  61. data/app/models/user.rb +1 -1
  62. data/app/policies/active_admin/page_policy.rb +11 -0
  63. data/app/policies/application_policy.rb +59 -0
  64. data/app/policies/post_policy.rb +13 -0
  65. data/app/policies/sb_post_policy.rb +15 -0
  66. data/app/policies/topic_policy.rb +23 -0
  67. data/app/views/ckeditor/pictures/index.html.haml +15 -0
  68. data/app/views/ckeditor/shared/_asset.html.haml +9 -0
  69. data/app/views/ckeditor/shared/_asset_tmpl.html.erb +14 -0
  70. data/app/views/comments/approve.js.haml +1 -1
  71. data/app/views/comments/create.js.erb +1 -1
  72. data/app/views/comments/edit.js.erb +2 -1
  73. data/app/views/events/_subscribe.html.haml +1 -1
  74. data/app/views/forums/show.html.haml +8 -4
  75. data/app/views/posts/show.html.haml +4 -0
  76. data/app/views/sb_posts/_edit_script.js.erb +2 -3
  77. data/app/views/sb_posts/_reply_script.js.erb +2 -4
  78. data/app/views/sb_posts/_sb_post.html.haml +7 -6
  79. data/app/views/sb_posts/create.js.erb +4 -4
  80. data/app/views/sb_posts/edit.js.erb +2 -1
  81. data/app/views/sessions/_menu_item.html.haml +4 -4
  82. data/app/views/shared/_end_javascript.html.haml +1 -2
  83. data/app/views/shared/_login_sidebar.html.haml +2 -2
  84. data/app/views/tags/show.html.haml +3 -3
  85. data/app/views/topics/show.html.haml +1 -1
  86. data/app/views/users/_profile_user_info_sidebar.html.haml +2 -2
  87. data/app/views/users/destroy.js.erb +3 -0
  88. data/app/views/users/new.html.haml +1 -1
  89. data/app/views/users/show.html.haml +1 -1
  90. data/app/views/users/signup_completed.html.haml +1 -1
  91. data/community_engine.gemspec +14 -11
  92. data/config/initializers/active_admin.rb +239 -0
  93. data/config/initializers/ckeditor.rb +8 -0
  94. data/config/initializers/ransack_bootstrap_fix.rb +25 -0
  95. data/config/locales/de-DE.yml +1 -0
  96. data/config/locales/en.yml +3 -0
  97. data/config/routes.rb +14 -19
  98. data/config/spring.rb +1 -0
  99. data/db/migrate/083_create_active_admin_comments.rb +19 -0
  100. data/lib/community_engine.rb +7 -3
  101. data/lib/community_engine/admin/ads.rb +3 -0
  102. data/lib/community_engine/admin/categories.rb +20 -0
  103. data/lib/community_engine/admin/comments.rb +4 -0
  104. data/lib/community_engine/admin/dashboard.rb +38 -0
  105. data/lib/community_engine/admin/events.rb +3 -0
  106. data/lib/community_engine/admin/forums.rb +3 -0
  107. data/lib/community_engine/admin/homepage_features.rb +25 -0
  108. data/lib/community_engine/admin/metro_areas.rb +4 -0
  109. data/lib/community_engine/admin/pages.rb +26 -0
  110. data/lib/community_engine/admin/posts.rb +92 -0
  111. data/lib/community_engine/admin/tags.rb +21 -0
  112. data/lib/community_engine/admin/users.rb +54 -0
  113. data/lib/community_engine/authenticated_system.rb +5 -20
  114. data/lib/community_engine/engine.rb +5 -0
  115. data/lib/community_engine/version.rb +1 -1
  116. data/lib/resource_feeder/atom.rb +2 -0
  117. data/lib/resource_feeder/rss.rb +2 -0
  118. data/lib/white_list.rb +6 -11
  119. data/test/fixtures/events.yml +10 -0
  120. data/test/fixtures/tags.yml +6 -5
  121. data/test/functional/activities_controller_test.rb +19 -19
  122. data/test/functional/admin/posts_controller_test.rb +16 -0
  123. data/test/functional/admin_controller_test.rb +82 -82
  124. data/test/functional/categories_controller_test.rb +0 -39
  125. data/test/functional/comments_controller_test.rb +14 -7
  126. data/test/functional/favorites_controller_test.rb +15 -16
  127. data/test/functional/pages_controller_test.rb +0 -71
  128. data/test/functional/posts_controller_test.rb +21 -2
  129. data/test/functional/sb_posts_controller_test.rb +3 -3
  130. data/test/functional/sessions_controller_test.rb +2 -2
  131. data/test/functional/tags_controller_test.rb +9 -20
  132. data/test/functional/users_controller_test.rb +0 -8
  133. data/test/functional/votes_controller_test.rb +1 -1
  134. data/test/testapp/config/spring.rb +1 -0
  135. data/test/testapp/db/schema.rb +16 -1
  136. data/test/unit/event_test.rb +1 -1
  137. metadata +204 -170
  138. data/CHANGELOG +0 -144
  139. data/app/controllers/admin_controller.rb +0 -80
  140. data/app/controllers/ads_controller.rb +0 -90
  141. data/app/controllers/homepage_features_controller.rb +0 -74
  142. data/app/controllers/metro_areas_controller.rb +0 -74
  143. data/app/controllers/statistics_controller.rb +0 -35
  144. data/app/views/admin/comments.html.haml +0 -53
  145. data/app/views/admin/events.html.haml +0 -26
  146. data/app/views/admin/messages.html.haml +0 -3
  147. data/app/views/admin/update.js.erb +0 -1
  148. data/app/views/admin/users.html.haml +0 -57
  149. data/app/views/ads/_form.html.haml +0 -21
  150. data/app/views/ads/edit.html.haml +0 -7
  151. data/app/views/ads/index.html.haml +0 -29
  152. data/app/views/ads/new.html.haml +0 -6
  153. data/app/views/ads/show.html.haml +0 -19
  154. data/app/views/categories/_form.html.haml +0 -8
  155. data/app/views/categories/edit.html.haml +0 -4
  156. data/app/views/categories/index.html.haml +0 -20
  157. data/app/views/categories/new.html.haml +0 -4
  158. data/app/views/homepage_features/_form.html.haml +0 -6
  159. data/app/views/homepage_features/edit.html.haml +0 -6
  160. data/app/views/homepage_features/index.html.haml +0 -24
  161. data/app/views/homepage_features/new.html.haml +0 -2
  162. data/app/views/homepage_features/show.html.haml +0 -27
  163. data/app/views/metro_areas/_form.html.haml +0 -6
  164. data/app/views/metro_areas/edit.html.haml +0 -8
  165. data/app/views/metro_areas/index.html.haml +0 -21
  166. data/app/views/metro_areas/new.html.haml +0 -6
  167. data/app/views/metro_areas/show.html.haml +0 -14
  168. data/app/views/pages/_form.html.haml +0 -18
  169. data/app/views/pages/edit.html.haml +0 -4
  170. data/app/views/pages/index.html.haml +0 -34
  171. data/app/views/pages/new.html.haml +0 -7
  172. data/app/views/shared/_admin_nav.html.haml +0 -17
  173. data/app/views/shared/_load_tinymce.js.erb +0 -15
  174. data/app/views/statistics/activities.xml.builder +0 -33
  175. data/app/views/statistics/index.html.haml +0 -48
  176. data/app/views/tags/edit.html.haml +0 -12
  177. data/app/views/tags/manage.html.haml +0 -30
  178. data/app/views/users/update.js.erb +0 -1
  179. data/test/functional/ads_controller_test.rb +0 -51
  180. data/test/functional/homepage_features_controller_test.rb +0 -69
  181. data/test/functional/metro_areas_controller_test.rb +0 -63
  182. data/test/functional/statistics_controller_test.rb +0 -18
  183. data/test/unit/acts_as_taggable_on/tag_test.rb +0 -22
  184. data/vendor/converted2.3plugins_to_lib_leftovers/acts_as_publishable/README +0 -3
  185. data/vendor/converted2.3plugins_to_lib_leftovers/acts_as_publishable/Rakefile +0 -22
  186. data/vendor/converted2.3plugins_to_lib_leftovers/acts_as_publishable/generators/publishing/publishing_generator.rb +0 -34
  187. data/vendor/converted2.3plugins_to_lib_leftovers/acts_as_publishable/generators/publishing/templates/migration.rb +0 -13
  188. data/vendor/converted2.3plugins_to_lib_leftovers/acts_as_publishable/install.rb +0 -3
  189. data/vendor/converted2.3plugins_to_lib_leftovers/acts_as_publishable/test/acts_as_publishable_test.rb +0 -8
  190. data/vendor/converted2.3plugins_to_lib_leftovers/acts_as_publishable/uninstall.rb +0 -1
  191. data/vendor/converted2.3plugins_to_lib_leftovers/resource_feeder/README +0 -4
  192. data/vendor/converted2.3plugins_to_lib_leftovers/resource_feeder/Rakefile +0 -22
  193. data/vendor/converted2.3plugins_to_lib_leftovers/resource_feeder/test/atom_feed_test.rb +0 -85
  194. data/vendor/converted2.3plugins_to_lib_leftovers/resource_feeder/test/rss_feed_test.rb +0 -61
  195. data/vendor/converted2.3plugins_to_lib_leftovers/resource_feeder/test/test_helper.rb +0 -60
  196. data/vendor/converted2.3plugins_to_lib_leftovers/white_list/README +0 -35
  197. data/vendor/converted2.3plugins_to_lib_leftovers/white_list/Rakefile +0 -22
  198. data/vendor/converted2.3plugins_to_lib_leftovers/white_list/test/white_list_test.rb +0 -120
@@ -1,3 +0,0 @@
1
- ActsAsPublishable
2
- =================
3
-
@@ -1,22 +0,0 @@
1
- require 'rake'
2
- require 'rake/testtask'
3
- require 'rake/rdoctask'
4
-
5
- desc 'Default: run unit tests.'
6
- task :default => :test
7
-
8
- desc 'Test the acts_as_publishable plugin.'
9
- Rake::TestTask.new(:test) do |t|
10
- t.libs << 'lib'
11
- t.pattern = 'test/**/*_test.rb'
12
- t.verbose = true
13
- end
14
-
15
- desc 'Generate documentation for the acts_as_publishable plugin.'
16
- Rake::RDocTask.new(:rdoc) do |rdoc|
17
- rdoc.rdoc_dir = 'rdoc'
18
- rdoc.title = 'ActsAsPublishable'
19
- rdoc.options << '--line-numbers' << '--inline-source'
20
- rdoc.rdoc_files.include('README')
21
- rdoc.rdoc_files.include('lib/**/*.rb')
22
- end
@@ -1,34 +0,0 @@
1
- class PublishingGenerator < Rails::Generator::Base
2
-
3
- attr_reader :publishing_class
4
- attr_reader :publishing_table_name
5
-
6
- def initialize(args, options = {})
7
- klass = args.last
8
-
9
- begin; valid_klass = klass.camelcase.constantize; rescue; end
10
-
11
- if valid_klass
12
- @publishing_table_name = klass.to_s.downcase.pluralize
13
- @publishing_class = klass.to_s.capitalize
14
- else
15
- raise "#{klass} is not a valid class in this application."
16
- end
17
-
18
- super
19
- end
20
-
21
- def manifest
22
- record do |m|
23
- unless options[:skip_migration]
24
- m.migration_template 'migration.rb', 'db/migrate',
25
- :migration_file_name => "add_published_as_to_#{@publishing_table_name}"
26
- end
27
- end
28
- end
29
-
30
- protected
31
- def usage
32
- puts "Usage: #{$0} publishing [ModelName]"
33
- end
34
- end
@@ -1,13 +0,0 @@
1
- class AddPublishedAsTo<%= publishing_class.pluralize %> < ActiveRecord::Migration
2
-
3
- # Add the new tables.
4
- def self.up
5
- add_column :<%= publishing_table_name %>, :published_as, :string, :limit => 16, :default => 'draft'
6
- end
7
-
8
- # Remove the tables.
9
- def self.down
10
- remove_column :<%= publishing_table_name %>, :published_as
11
- end
12
-
13
- end
@@ -1,8 +0,0 @@
1
- require 'test/unit'
2
-
3
- class ActsAsPublishableTest < Test::Unit::TestCase
4
- # Replace this with your real tests.
5
- def test_this_plugin
6
- flunk
7
- end
8
- end
@@ -1,4 +0,0 @@
1
- ResourceFeeder
2
- ==============
3
-
4
- Simple feeds for resources
@@ -1,22 +0,0 @@
1
- require 'rake'
2
- require 'rake/testtask'
3
- require 'rake/rdoctask'
4
-
5
- desc 'Default: run unit tests.'
6
- task :default => :test
7
-
8
- desc 'Test the resource_feed plugin.'
9
- Rake::TestTask.new(:test) do |t|
10
- t.libs << 'lib'
11
- t.pattern = 'test/**/*_test.rb'
12
- t.verbose = true
13
- end
14
-
15
- desc 'Generate documentation for the resource_feed plugin.'
16
- Rake::RDocTask.new(:rdoc) do |rdoc|
17
- rdoc.rdoc_dir = 'rdoc'
18
- rdoc.title = 'ResourceFeed'
19
- rdoc.options << '--line-numbers' << '--inline-source'
20
- rdoc.rdoc_files.include('README')
21
- rdoc.rdoc_files.include('lib/**/*.rb')
22
- end
@@ -1,85 +0,0 @@
1
- require File.dirname(__FILE__) + '/test_helper'
2
- class AtomFeedTest < Test::Unit::TestCase
3
- attr_reader :request
4
-
5
- def setup
6
- @request = OpenStruct.new
7
- @request.host_with_port = 'example.com'
8
- @records = Array.new(5).fill(Post.new)
9
- @records.each &:save
10
- end
11
-
12
- def test_default_atom_feed
13
- atom_feed_for @records
14
-
15
- assert_select 'feed' do
16
- assert_select '>title', 'Posts'
17
- assert_select '>id', "tag:#{request.host_with_port}:Posts"
18
- assert_select '>link' do
19
- assert_select "[rel='alternate']"
20
- assert_select "[type='text/html']"
21
- assert_select "[href='http://example.com/posts']"
22
- end
23
- assert_select 'entry', 5 do
24
- assert_select 'title', :text => 'feed title (title)'
25
- assert_select "content[type='html']", '&lt;p&gt;feed description (description)&lt;/p&gt;'
26
- assert_select 'id', "tag:#{request.host_with_port},#{@records.first.created_at.xmlschema}:#{'http://example.com/posts/1'}"
27
- assert_select 'published', @records.first.created_at.xmlschema
28
- assert_select 'updated', @records.first.created_at.xmlschema
29
- assert_select 'link' do
30
- assert_select "[rel='alternate']"
31
- assert_select "[type='text/html']"
32
- assert_select "[href='http://example.com/posts/1']"
33
- end
34
- end
35
- end
36
- end
37
-
38
- def test_should_allow_custom_feed_options
39
- atom_feed_for @records, :feed => { :title => 'Custom Posts', :link => '/posts', :description => 'stuff', :self => '/posts.atom' }
40
-
41
- assert_select 'feed>title', 'Custom Posts'
42
- assert_select "feed>link[href='/posts']"
43
- assert_select 'feed>subtitle', 'stuff'
44
- assert_select 'feed>link' do
45
- assert_select "[rel='self']"
46
- assert_select "[type='application/atom+xml']"
47
- assert_select "[href='/posts.atom']"
48
- end
49
- end
50
-
51
- def test_should_allow_custom_item_attributes
52
- atom_feed_for @records, :item => { :title => :name, :description => :body, :pub_date => :create_date, :link => :id }
53
-
54
- assert_select 'entry', 5 do
55
- assert_select 'title', :text => 'feed title (name)'
56
- assert_select "content[type='html']", '&lt;p&gt;feed description (body)&lt;/p&gt;'
57
- assert_select 'published', (@records.first.created_at - 5.minutes).xmlschema
58
- assert_select 'updated', (@records.first.created_at - 5.minutes).xmlschema
59
- assert_select 'id', "tag:#{request.host_with_port},#{(@records.first.created_at - 5.minutes).xmlschema}:1"
60
- assert_select 'link' do
61
- assert_select "[rel='alternate']"
62
- assert_select "[type='text/html']"
63
- assert_select "[href='1']"
64
- end
65
- end
66
- end
67
-
68
- def test_should_allow_custom_item_attribute_blocks
69
- atom_feed_for @records, :item => { :title => lambda { |r| r.name }, :description => lambda { |r| r.body }, :pub_date => lambda { |r| r.create_date },
70
- :link => lambda { |r| "/#{r.created_at.to_i}" }, :guid => lambda { |r| r.created_at.to_i } }
71
-
72
- assert_select 'entry', 5 do
73
- assert_select 'title', :text => 'feed title (name)'
74
- assert_select "content[type='html']", '&lt;p&gt;feed description (body)&lt;/p&gt;'
75
- assert_select 'published', (@records.first.created_at - 5.minutes).xmlschema
76
- assert_select 'updated', (@records.first.created_at - 5.minutes).xmlschema
77
- assert_select 'id', /:\d+$/
78
- assert_select 'link' do
79
- assert_select "[rel='alternate']"
80
- assert_select "[type='text/html']"
81
- assert_select "[href=?]", /^\/\d+$/
82
- end
83
- end
84
- end
85
- end
@@ -1,61 +0,0 @@
1
- require File.dirname(__FILE__) + '/test_helper'
2
- class RssFeedTest < Test::Unit::TestCase
3
- def setup
4
- @records = Array.new(5).fill(Post.new)
5
- @records.each &:save
6
- end
7
-
8
- def test_default_rss_feed
9
- rss_feed_for @records
10
-
11
- assert_select 'rss[version="2.0"]' do
12
- assert_select 'channel' do
13
- assert_select '>title', 'Posts'
14
- assert_select '>link', 'http://example.com/posts'
15
- assert_select 'language', 'en-us'
16
- assert_select 'ttl', '40'
17
- end
18
- assert_select 'item', 5 do
19
- assert_select 'title', :text => 'feed title (title)'
20
- assert_select 'description', '&lt;p&gt;feed description (description)&lt;/p&gt;'
21
- %w(guid link).each do |node|
22
- assert_select node, 'http://example.com/posts/1'
23
- end
24
- assert_select 'pubDate', @records.first.created_at.to_s(:rfc822)
25
- end
26
- end
27
- end
28
-
29
- def test_should_allow_custom_feed_options
30
- rss_feed_for @records, :feed => { :title => 'Custom Posts', :link => '/posts', :description => 'stuff', :language => 'en-gb', :ttl => '80' }
31
-
32
- assert_select 'channel>title', 'Custom Posts'
33
- assert_select 'channel>link', '/posts'
34
- assert_select 'channel>description', 'stuff'
35
- assert_select 'channel>language', 'en-gb'
36
- assert_select 'channel>ttl', '80'
37
- end
38
-
39
- def test_should_allow_custom_item_attributes
40
- rss_feed_for @records, :item => { :title => :name, :description => :body, :pub_date => :create_date, :link => :id }
41
-
42
- assert_select 'item', 5 do
43
- assert_select 'title', :text => 'feed title (name)'
44
- assert_select 'description', '&lt;p&gt;feed description (body)&lt;/p&gt;'
45
- assert_select 'pubDate', (@records.first.created_at - 5.minutes).to_s(:rfc822)
46
- assert_select 'link', '1'
47
- assert_select 'guid', '1'
48
- end
49
- end
50
-
51
- def test_should_allow_custom_item_attribute_blocks
52
- rss_feed_for @records, :item => { :title => lambda { |r| r.name }, :description => lambda { |r| r.body }, :pub_date => lambda { |r| r.create_date },
53
- :link => lambda { |r| "/#{r.created_at.to_i}" }, :guid => lambda { |r| r.created_at.to_i } }
54
-
55
- assert_select 'item', 5 do
56
- assert_select 'title', :text => 'feed title (name)'
57
- assert_select 'description', '&lt;p&gt;feed description (body)&lt;/p&gt;'
58
- assert_select 'pubDate', (@records.first.created_at - 5.minutes).to_s(:rfc822)
59
- end
60
- end
61
- end
@@ -1,60 +0,0 @@
1
- Rails.env = 'test'
2
- require File.expand_path(File.join(File.dirname(__FILE__), '../../../../config/environment.rb'))
3
- require 'action_controller/test_process'
4
- require 'breakpoint'
5
- require 'ostruct'
6
-
7
- class Post
8
- attr_reader :id, :created_at
9
- def save; @id = 1; @created_at = Time.now.utc end
10
- def new_record?; @id.nil? end
11
-
12
- [:title, :name].each do |attr_name|
13
- define_method attr_name do
14
- "feed title (#{attr_name})"
15
- end
16
- end
17
-
18
- [:description, :body].each do |attr_name|
19
- define_method attr_name do
20
- "<p>feed description (#{attr_name})</p>"
21
- end
22
- end
23
-
24
- def create_date
25
- @created_at - 5.minutes
26
- end
27
- end
28
-
29
- class Test::Unit::TestCase
30
- include ResourceFeeder::Rss, ResourceFeeder::Atom
31
-
32
- def render_feed(xml)
33
- @response = OpenStruct.new
34
- @response.headers = {'Content-Type' => 'text/xml'}
35
- @response.body = xml
36
- end
37
-
38
- def rss_feed_for_with_ostruct(resources, options = {})
39
- render_feed rss_feed_for_without_ostruct(resources, options)
40
- end
41
-
42
- def atom_feed_for_with_ostruct(resources, options = {})
43
- render_feed atom_feed_for_without_ostruct(resources, options)
44
- end
45
-
46
- alias_method_chain :rss_feed_for, :ostruct
47
- alias_method_chain :atom_feed_for, :ostruct
48
-
49
- def html_document
50
- @html_document ||= HTML::Document.new(@response.body, false, true)
51
- end
52
-
53
- def user_posts_url
54
- "http://example.com/posts"
55
- end
56
-
57
- def user_post_url(post)
58
- "http://example.com/posts/#{post.id}"
59
- end
60
- end
@@ -1,35 +0,0 @@
1
- WhiteList
2
- =========
3
-
4
- This White Listing helper will html encode all tags and strip all attributes that aren't specifically allowed.
5
- It also strips href/src tags with invalid protocols, like javascript: especially. It does its best to counter any
6
- tricks that hackers may use, like throwing in unicode/ascii/hex values to get past the javascript: filters. Check out
7
- the extensive test suite.
8
-
9
- <%= white_list @article.body %>
10
-
11
- You can add or remove tags/attributes if you want to customize it a bit.
12
-
13
- add table tags
14
-
15
- WhiteListHelper.tags += %w(table td th)
16
-
17
- remove tags
18
-
19
- WhiteListHelper.tags -= %w(div span)
20
-
21
- clear any attributes that are allowed for <a> tags
22
-
23
- WhiteListHelper.attributes['a'] = []
24
-
25
- allow a new attribute for the <img> tag
26
-
27
- WhiteListHelper.attributes['img'] += %w(style)
28
-
29
- add new tag with attributes
30
-
31
- WhiteListHelper.attributes['table'] = %w(cellpadding cellspacing)
32
-
33
- change allowed attributes for all tags
34
-
35
- WhiteListHelper.attributes[nil] = %w(id class style)
@@ -1,22 +0,0 @@
1
- require 'rake'
2
- require 'rake/testtask'
3
- require 'rake/rdoctask'
4
-
5
- desc 'Default: run unit tests.'
6
- task :default => :test
7
-
8
- desc 'Test the white_list plugin.'
9
- Rake::TestTask.new(:test) do |t|
10
- t.libs << 'lib'
11
- t.pattern = 'test/**/*_test.rb'
12
- t.verbose = true
13
- end
14
-
15
- desc 'Generate documentation for the white_list plugin.'
16
- Rake::RDocTask.new(:rdoc) do |rdoc|
17
- rdoc.rdoc_dir = 'rdoc'
18
- rdoc.title = 'WhiteList'
19
- rdoc.options << '--line-numbers' << '--inline-source'
20
- rdoc.rdoc_files.include('README')
21
- rdoc.rdoc_files.include('lib/**/*.rb')
22
- end
@@ -1,120 +0,0 @@
1
- require 'test/unit'
2
- require File.expand_path(File.join(File.dirname(__FILE__), '../../../../config/environment.rb'))
3
-
4
- class WhiteListTest < Test::Unit::TestCase
5
- include WhiteListHelper
6
- public :contains_bad_protocols?
7
-
8
- (WhiteListHelper.tags + WhiteListHelper.attributes.keys).compact.each do |tag_name|
9
- define_method "test_should_allow_#{tag_name}_tag" do
10
- assert_white_listed "start <#{tag_name} id=\"1\" name=\"foo\">foo <bad>bar</bad> baz</#{tag_name}> end", "start <#{tag_name} id='1'>foo &lt;bad>bar&lt;/bad> baz</#{tag_name}> end"
11
- end
12
- end
13
-
14
- def test_should_allow_anchors
15
- assert_white_listed %(<a href="foo" onclick="bar"><script>baz</script></a>), "<a href='foo'>&lt;script>baz&lt;/script></a>"
16
- end
17
-
18
- WhiteListHelper.attributes['img'].each do |img_attr|
19
- define_method "test_should_allow_image_#{img_attr}_attribute" do
20
- assert_white_listed %(<img #{img_attr}="foo" onclick="bar" />), "<img #{img_attr}='foo' />"
21
- end
22
- end
23
-
24
- def test_should_handle_non_html
25
- assert_white_listed 'abc'
26
- end
27
-
28
- def test_should_handle_blank_text
29
- assert_white_listed nil
30
- assert_white_listed ''
31
- end
32
-
33
- def test_should_allow_custom_tags
34
- text = "<u>foo</u>"
35
- assert_equal(text, white_list(text, :tags => %w(u)))
36
- end
37
-
38
- def test_should_allow_custom_tags_with_attributes
39
- text = "<fieldset foo='bar'>foo</fieldset>"
40
- assert_equal(text, white_list(text, :attributes => {'fieldset' => %w(foo)}))
41
- end
42
-
43
- [%w(img src), %w(a href)].each do |(tag, attr)|
44
- define_method "test_should_strip_#{attr}_attribute_in_#{tag}_with_bad_protocols" do
45
- assert_white_listed %(<#{tag} #{attr}="javascript:bang" id="1">boo</#{tag}>), %(<#{tag} id='1'>boo</#{tag}>)
46
- end
47
- end
48
-
49
- def test_should_flag_bad_protocols
50
- %w(about chrome data disk hcp help javascript livescript lynxcgi lynxexec ms-help ms-its mhtml mocha opera res resource shell vbscript view-source vnd.ms.radio wysiwyg).each do |proto|
51
- assert contains_bad_protocols?("#{proto}://bad")
52
- end
53
- end
54
-
55
- def test_should_accept_good_protocols
56
- WhiteListHelper.protocols.each do |proto|
57
- assert !contains_bad_protocols?("#{proto}://good")
58
- end
59
- end
60
-
61
- def test_should_reject_hex_codes_in_protocol
62
- assert contains_bad_protocols?("%6A%61%76%61%73%63%72%69%70%74%3A%61%6C%65%72%74%28%22%58%53%53%22%29")
63
- assert_white_listed %(<a href="&#37;6A&#37;61&#37;76&#37;61&#37;73&#37;63&#37;72&#37;69&#37;70&#37;74&#37;3A&#37;61&#37;6C&#37;65&#37;72&#37;74&#37;28&#37;22&#37;58&#37;53&#37;53&#37;22&#37;29">1</a>), "<a>1</a>"
64
- end
65
-
66
- def test_should_block_script_tag
67
- assert_white_listed %(<SCRIPT\nSRC=http://ha.ckers.org/xss.js></SCRIPT>), "&lt;script src='http:' />&lt;/script>"
68
- end
69
-
70
- [%(<IMG SRC="javascript:alert('XSS');">),
71
- %(<IMG SRC=javascript:alert('XSS')>),
72
- %(<IMG SRC=JaVaScRiPt:alert('XSS')>),
73
- %(<IMG """><SCRIPT>alert("XSS")</SCRIPT>">),
74
- %(<IMG SRC=javascript:alert(&quot;XSS&quot;)>),
75
- %(<IMG SRC=javascript:alert(String.fromCharCode(88,83,83))>),
76
- %(<IMG SRC=&#106;&#97;&#118;&#97;&#115;&#99;&#114;&#105;&#112;&#116;&#58;&#97;&#108;&#101;&#114;&#116;&#40;&#39;&#88;&#83;&#83;&#39;&#41;>),
77
- %(<IMG SRC=&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041>),
78
- %(<IMG SRC=&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29>),
79
- %(<IMG SRC="jav\tascript:alert('XSS');">),
80
- %(<IMG SRC="jav&#x09;ascript:alert('XSS');">),
81
- %(<IMG SRC="jav&#x0A;ascript:alert('XSS');">),
82
- %(<IMG SRC="jav&#x0D;ascript:alert('XSS');">),
83
- %(<IMG SRC=" &#14; javascript:alert('XSS');">),
84
- %(<IMG SRC=`javascript:alert("RSnake says, 'XSS'")`>)].each_with_index do |img_hack, i|
85
- define_method "test_should_not_fall_for_xss_image_hack_#{i}" do
86
- assert_white_listed img_hack, "<img>"
87
- end
88
- end
89
-
90
- def test_should_sanitize_tag_broken_up_by_null
91
- assert_white_listed %(<SCR\0IPT>alert(\"XSS\")</SCR\0IPT>), "&lt;scr>alert(\"XSS\")&lt;/scr>"
92
- end
93
-
94
- def test_should_sanitize_invalid_script_tag
95
- assert_white_listed %(<SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT>), "&lt;script />&lt;/script>"
96
- end
97
-
98
- def test_should_sanitize_script_tag_with_multiple_open_brackets
99
- assert_white_listed %(<<SCRIPT>alert("XSS");//<</SCRIPT>), "&lt;&lt;script>alert(\"XSS\");//&lt;&lt;/script>"
100
- assert_white_listed %(<iframe src=http://ha.ckers.org/scriptlet.html\n<), "&lt;iframe src='http:' />&lt;"
101
- end
102
-
103
- def test_should_sanitize_unclosed_script
104
- assert_white_listed %(<SCRIPT SRC=http://ha.ckers.org/xss.js?<B>), "&lt;script src='http:' /><b>"
105
- end
106
-
107
- def test_should_sanitize_half_open_scripts
108
- assert_white_listed %(<IMG SRC="javascript:alert('XSS')"), "<img>"
109
- end
110
-
111
- def test_should_not_fall_for_ridiculous_hack
112
- img_hack = %(<IMG\nSRC\n=\n"\nj\na\nv\na\ns\nc\nr\ni\np\nt\n:\na\nl\ne\nr\nt\n(\n'\nX\nS\nS\n'\n)\n"\n>)
113
- assert_white_listed img_hack, "<img>"
114
- end
115
-
116
- protected
117
- def assert_white_listed(text, expected = nil)
118
- assert_equal((expected || text), white_list(text))
119
- end
120
- end