field_test 0.3.2 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2a60826c451cf3807f5e111f2b4a619f4c07db0011ff27e7f2ceb0dd03bd1807
-  data.tar.gz: 1150b7a05035bf91193dcdaca20a7075b1350d50ef037afebe6a1866baea5fb9
+  metadata.gz: 96def1c6805d880a03c141a421570a3e4b9f912e9427c385b132ffae646bc74b
+  data.tar.gz: b6eb3262d522544a40db7169364ebef0f6d9f4d2f1f4c82712c91fec5a617a4f
 SHA512:
-  metadata.gz: 9a2644d12172b876b33ddc7faec2c4490623fed35aa7ae1848f0486a9ff176a80c2bdc2db66ec9196b93034f8566dbfc11c2027f524177a946427b6c4b10d71b
-  data.tar.gz: 1dc282f0f054e7a95bdc4dfccd1361c11f28b53d70a2b5083ba73e40d3af13230246ad85e38990f74e7dab01a48fb5be9fefc5b2e6e1d8dff8cf066bb1dc525a
+  metadata.gz: 35765af19297887bae1e807aeff9f4f741687b4c3fc961b6b91a6aa9c3060098f42bb677d1055309b2698377dd6694c24770e8ab0418fa4c675146c1661559c0
+  data.tar.gz: 786390b24efece6a99b5db602b6b0162a2b398b319f42e61c8b0db4aca021fb4b80fba65ecfa5c5d94ebb451b7b1c852c25983e72246a3aa4640dc41613963a1

data/CHANGELOG.md

@@ -1,3 +1,8 @@
+## 0.4.0 (2020-08-04)
+
+- Fixed CSRF vulnerability with non-session based authentication
+- Fixed cache key for requests
+
 ## 0.3.2 (2020-04-16)
 
 - Added support for excluding IP addresses

data/app/controllers/field_test/base_controller.rb

@@ -2,7 +2,7 @@ module FieldTest
   class BaseController < ActionController::Base
     layout "field_test/application"
 
-    protect_from_forgery
+    protect_from_forgery with: :exception
 
     http_basic_authenticate_with name: ENV["FIELD_TEST_USERNAME"], password: ENV["FIELD_TEST_PASSWORD"] if ENV["FIELD_TEST_PASSWORD"]
   end

data/lib/field_test/helpers.rb

@@ -22,11 +22,16 @@ module FieldTest
         options[:user_agent] = request.user_agent
       end
 
-      # cache results for request
-      @field_test_cache ||= {}
-
       # don't update variant when passed via params
-      @field_test_cache[experiment] ||= params_variant || exp.variant(participants, options)
+      if params_variant
+        params_variant
+      else
+        # cache results for request
+        # TODO possibly remove in 0.4.0
+        cache_key = [exp.id, participants.map(&:where_values), options.slice(:variant, :exclude)]
+        @field_test_cache ||= {}
+        @field_test_cache[cache_key] ||= exp.variant(participants, options)
+      end
     end
 
     def field_test_converted(experiment, **options)

data/lib/field_test/version.rb

@@ -1,3 +1,3 @@
 module FieldTest
-  VERSION = "0.3.2"
+  VERSION = "0.4.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: field_test
 version: !ruby/object:Gem::Version
-  version: 0.3.2
+  version: 0.4.0
 platform: ruby
 authors:
 - Andrew Kane
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-04-16 00:00:00.000000000 Z
+date: 2020-08-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: railties