delayed_job_web 1.2.5 → 1.2.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: fd71bb47b1d7610aedae5d9bba05adb12fff3c3a
-  data.tar.gz: ab1cfb631599bd2d1c4522842a8e0b75b7837d04
+  metadata.gz: 74a545eb43b23219f3650c32fb4ec8946f27af4c
+  data.tar.gz: 05713de94d0c7aaf2a7e25a54d0f93f12e671cd6
 SHA512:
-  metadata.gz: 4734261d3b5dbdd57161388f5900686cd6f9a25df1caabfcb64c70ddd8c6a0ae8eb84ba05c02f8a03b8fd0ff10269f6f413f0e4b78103a1e4cf787b431be08dd
-  data.tar.gz: c15a29804f5bde65ff4849508aaa16aa11f7fc9e78eb0028aac3d586d2b975fa823fbd3150be7d9b993534c2337d457b495f2e4f2d9c2ead3cbf97823f9bb77a
+  metadata.gz: 8904284f071219871077d63c9c52dcd5993ba53e0a33358216f4586be950bf4d085823dc9b9e233c45f7dc9de12917b0229d327796831f6bd4d33556b0a71842
+  data.tar.gz: 9068d6b51e167cf0af75bd902544a3e5de7d18c588acad02481ccd69023f4e784521ce1c6dc74d74d262d769416e4b16df697d9ac7fa27090d39cca4e18b9fad

data/delayed_job_web.gemspec

@@ -2,7 +2,7 @@
 
 Gem::Specification.new do |s|
   s.name = "delayed_job_web"
-  s.version = "1.2.5"
+  s.version = "1.2.6"
 
   s.authors = ["Erick Schmitt"]
   s.date = "2014-01-29"
@@ -47,10 +47,9 @@ Gem::Specification.new do |s|
   s.require_paths = ["lib"]
   s.summary = "Web interface for delayed_job"
 
-  s.add_runtime_dependency(%q<sinatra>, [">= 0.9.2"])
+  s.add_runtime_dependency(%q<sinatra>, [">= 1.4.4"])
   s.add_runtime_dependency(%q<activerecord>, ["> 3.0.0"])
   s.add_runtime_dependency(%q<delayed_job>, ["> 2.0.3"])
   s.add_development_dependency(%q<shoulda>, [">= 0"])
   s.add_development_dependency(%q<rack-test>, [">= 0"])
 end
-

data/lib/delayed_job_web/application/app.rb

@@ -6,9 +6,27 @@ require 'delayed_job'
 class DelayedJobWeb < Sinatra::Base
   set :root, File.dirname(__FILE__)
   set :static, true
-  set :public_folder,  File.expand_path('../public', __FILE__)
-  set :views,  File.expand_path('../views', __FILE__)
-  
+  set :public_folder, File.expand_path('../public', __FILE__)
+  set :views, File.expand_path('../views', __FILE__)
+
+  # Enable sessions so we can use CSRF protection
+  set :sessions,
+    # Unique cookie key that won't clash with Rails etc
+    :key => "rack.delayed-job-web-session"
+
+  set :protection,
+    # Various session protections
+    :session => true,
+    # Various non-default Rack::Protection options
+    :use => [
+      # Prevent destructive actions without a valid CSRF auth token
+      :authenticity_token,
+      # Prevent destructive actions with remote referrers
+      :remote_referrer
+    ],
+    # Deny the request, don't clear the session
+    :reaction => :deny
+
   before do
     @queues = (params[:queues] || "").split(",").map{|queue| queue.strip}.uniq.compact
   end
@@ -24,13 +42,18 @@ class DelayedJobWeb < Sinatra::Base
   def per_page
     20
   end
-  
+
   def url_path(*path_parts)
     url = [ path_prefix, path_parts ].join("/").squeeze('/')
     url += "?queues=#{@queues.join(",")}" unless @queues.empty?
     url
   end
- alias_method :u, :url_path
+
+  alias_method :u, :url_path
+
+  def h(text)
+    Rack::Utils.escape_html(text)
+  end
 
   def path_prefix
     request.env['SCRIPT_NAME']
@@ -55,6 +78,15 @@ class DelayedJobWeb < Sinatra::Base
     end
   end
 
+  def csrf_token
+    # Set up by Rack::Protection
+    session[:csrf]
+  end
+
+  def csrf_token_tag
+    "<input type='hidden' name='authenticity_token' value='#{h csrf_token}'>"
+  end
+
   get '/overview' do
     if delayed_job
       erb :overview
@@ -76,25 +108,25 @@ class DelayedJobWeb < Sinatra::Base
     end
   end
 
-  get "/remove/:id" do
+  post "/remove/:id" do
     delayed_job.find(params[:id]).delete
     redirect back
   end
 
-  get "/requeue/:id" do
+  post "/requeue/:id" do
     job = delayed_job.find(params[:id])
     job.update_attributes(:run_at => Time.now, :failed_at => nil)
     redirect back
   end
 
-  get "/reload/:id" do
+  post "/reload/:id" do
     job = delayed_job.find(params[:id])
     job.update_attributes(:run_at => Time.now, :failed_at => nil, :locked_by => nil, :locked_at => nil, :last_error => nil, :attempts => 0)
     redirect back
   end
 
   post "/failed/clear" do
-    delayed_job.destroy_all(delayed_job_sql(:failed, @queues))
+    delayed_jobs(:failed, @queues).delete_all
     redirect u('failed')
   end
 
@@ -104,24 +136,23 @@ class DelayedJobWeb < Sinatra::Base
   end
 
   def delayed_jobs(type, queues = [])
-    delayed_job.where(delayed_job_sql(type, queues))
-  end
-
-  def delayed_job_sql(type, queues = [])
-    conditions = []
-    
-    conditions << case type
-    when :working
-      'locked_at is not null'
-    when :failed
-      'last_error is not null'
-    when :pending
-      'attempts = 0'
-    end
-    
-    conditions << "queue IN ('#{queues.join("','")}')" unless queues.empty?
-    
-    conditions.compact.join(" AND ")
+    rel = delayed_job
+
+    rel =
+      case type
+      when :working
+        rel.where('locked_at IS NOT NULL')
+      when :failed
+        rel.where('last_error IS NOT NULL')
+      when :pending
+        rel.where(:attempts => 0)
+      else
+        rel
+      end
+
+    rel = rel.where(:queue => queues) unless queues.empty?
+
+    rel
   end
 
   get "/?" do

data/lib/delayed_job_web/application/public/stylesheets/style.css

@@ -75,6 +75,7 @@ pre { font-family:Courier New; line-height:1.4em; }
 #main ul.job li dl dd .retried .remove { display:none; margin-top: 8px; }
 #main ul.job li.hover dl dd .retried .remove { display:block; }
 #main ul.job li dl dd .controls { display:none; float:right; }
+#main ul.job li dl dd .controls form { display: inline; }
 #main ul.job li.hover dl dd .controls { display:block; }
 #main ul.job li dl dd code, #main ul.failed li dl dd pre { font-family:Monaco, "Courier New", monospace; font-size:90%; white-space: pre-wrap;}
 #main ul.job li dl dd.error a {font-family:Monaco, "Courier New", monospace; font-size:90%; }
@@ -84,6 +85,6 @@ pre { font-family:Courier New; line-height:1.4em; }
 #main p.pagination a.less { float:left;}
 #main p.pagination a.more { float:right;}
 
-#main form {float:right; margin-top:-10px;margin-left:10px;}
+#main .header-queues {float:right; margin-top:-10px;margin-left:10px;}
 
 #main .time a.toggle_format {text-decoration:none;}

data/lib/delayed_job_web/application/views/error.erb

@@ -1,2 +1,2 @@
 <h1>Error</h1>
-<p><%= @message %></p>
+<p><%=h @message %></p>

data/lib/delayed_job_web/application/views/failed.erb

@@ -1,9 +1,11 @@
 <h1>Failed Jobs</h1>
 <% if @jobs.any? %>
   <form action="<%= u('failed/clear') %>" method="POST">
+    <%= csrf_token_tag %>
     <input type="submit" value="Clear Failed Jobs"></input>
   </form>
   <form action="<%= u('requeue/all') %>" method="POST">
+    <%= csrf_token_tag %>
     <input type="submit" value="Retry Failed Jobs"></input>
   </form>
 <% end %>

data/lib/delayed_job_web/application/views/job.erb

@@ -3,59 +3,62 @@
     <dt>ID</dt>
     <dd>
       <a name="<%= job.id %>"></a>
-      <a href="#<%= job.id %>"><%= job.id %></a>
+      <a href="#<%= job.id %>"><%=h job.id %></a>
       <div class="controls">
-        <a href="<%= u("requeue/#{job.id}") %>" rel="retry">Retry</a>
+        <form action="<%= u("requeue/#{job.id}") %>" method="post"><%= csrf_token_tag %><input type="submit" value="Retry"></input></form>
         or
-        <a href="<%= u("remove/#{job.id}") %>" rel="remove">Remove</a>
+        <form action="<%= u("remove/#{job.id}") %>" method="post"><%= csrf_token_tag %><input type="submit" value="Remove"></input></form>
         or
-        <a href="<%= u("reload/#{job.id}") %>" rel="reload_job">Reload Job</a>
+        <form action="<%= u("reload/#{job.id}") %>" method="post"><%= csrf_token_tag %><input type="submit" value="Reload"></input></form>
       </div>
     </dd>
     <dt>Priority</dt>
-    <dd><%= job.priority %></dd>
+    <dd><%=h job.priority %></dd>
     <dt>Attempts</dt>
-    <dd><%= job.attempts %></dd>
+    <dd><%=h job.attempts %></dd>
     <% if job.respond_to?(:queue) && job.queue %>
       <dt>Queue</dt>
-      <dd><%= job.queue %></dd>
+      <dd><%=h job.queue %></dd>
     <% end %>
     <dt>Handler</dt>
     <dd>
-    <pre><%= job.handler %></pre>
+    <pre><%=h job.handler %></pre>
     </dd>
     <% if job.last_error %>
       <dt>Last Error</dt>
       <dd>
         <div class="backtrace">
-          <pre><%= job.last_error[0..100] + '...' %></pre>
+          <pre><%=h job.last_error[0..100] + '...' %></pre>
         </div>
         <a class="backtrace" href="#">Toggle full message</a>
         <div class="backtrace full hide">
-          <pre><%= job.last_error %></pre>
+          <pre><%=h job.last_error %></pre>
         </div>
       </dd>
     <% end %>
     <% if job.run_at %>
       <dt>Run At</dt>
       <dd class="time">
-        <%= job.run_at.rfc822 %>
+        <%=h job.run_at.rfc822 %>
       </dd>
     <% end %>
     <% if job.locked_at %>
       <dt>Locked At</dt>
       <dd class="time">
-        <%= job.locked_at.rfc822 %>
+        <%=h job.locked_at.rfc822 %>
       </dd>
     <% end %>
     <% if job.locked_by %>
       <dt>Locked By</dt>
       <dd>
-        <%= job.locked_by %>
+        <%=h job.locked_by %>
       </dd>
     <% end %>
     <% if job.failed_at %>
       <dt>Failed At</dt>
+      <dd>
+        <%=h job.failed_at %>
+      </dd>
     <% end %>
   </dl>
 </li>

data/lib/delayed_job_web/application/views/layout.erb

@@ -11,13 +11,13 @@
         <% tabs.each do |tab| %>
           <li class="<%= request.path_info == tab[:path] ? 'current' : '' %>">
             <a class="tab" href="<%= u(tab[:path]) %>">
-              <%= tab[:name] %>
+              <%=h tab[:name] %>
             </a>
           </li>
         <% end %>
         <li>
-          <form method="get" action="" style="display:inline; width: 100%;">
-            <input name="queues" type="text" value="<%= @queues.join(", ") %>" style="width: 300px;" placeholder="Filter jobs by queue name (e.g. queue1, queue2)" />
+          <form method="get" class="header-queues" action="" style="display:inline; width: 100%;">
+            <input name="queues" type="text" value="<%=h @queues.join(", ") %>" style="width: 300px;" placeholder="Filter jobs by queue name (e.g. queue1, queue2)" />
             <input type="submit" value="Filter" />
           </form>
         </li>
@@ -30,7 +30,7 @@
       <p>
         Powered by
         <a href="https://github.com/collectiveidea/delayed_job">delayed_job</a>
-        &
+        &amp;
         <a href="https://github.com/ejschmitt/delayed_job_web">delayed_job_web</a>
       </p>
     </div>

data/lib/delayed_job_web/application/views/pending.erb

@@ -1,6 +1,7 @@
 <h1>Pending</h1>
 <% if @jobs.any? %>
   <form action="<%= u('requeue/all') %>" method="POST">
+    <%= csrf_token_tag %>
     <input type="submit" value="Enqueue All Immediately"></input>
   </form>
 <% end %>

data/lib/delayed_job_web/application/views/stats.erb

@@ -5,7 +5,7 @@
       environment
     </th>
     <th>
-      <%= Sinatra::Application.environment.to_s %>
+      <%=h Sinatra::Application.environment.to_s %>
     </th>
   </tr>
   <tr>

data/test/test_delayed_job_web.rb

@@ -26,6 +26,10 @@ class Delayed::Job
   def self.count(*args)
     0
   end
+
+  def self.order(*args)
+    DelayedJobFake.new
+  end
 end
 
 class TestDelayedJobWeb < Test::Unit::TestCase

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: delayed_job_web
 version: !ruby/object:Gem::Version
-  version: 1.2.5
+  version: 1.2.6
 platform: ruby
 authors:
 - Erick Schmitt
@@ -16,14 +16,14 @@ dependencies:
     requirements:
     - - '>='
       - !ruby/object:Gem::Version
-        version: 0.9.2
+        version: 1.4.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '>='
       - !ruby/object:Gem::Version
-        version: 0.9.2
+        version: 1.4.4
 - !ruby/object:Gem::Dependency
   name: activerecord
   requirement: !ruby/object:Gem::Requirement