merb_param_protection 0.9.2 → 0.9.3

data/README

@@ -1,7 +1,7 @@
 merb_param_protection
 =================
 
-This plugin exposes two new controller methods which allow us to simply and flexibly filter the parameters available within the controller.
+This plugin exposes three new controller methods which allow us to simply and flexibly filter the parameters available within the controller.
 
 Setup:
 The request sets: 
@@ -25,3 +25,13 @@ So we see that params_accessible removes everything except what is explictly spe
   params.inspect # => { :post => { :title => "ello", :body => "Want it", :rank => 4 } }
 
 We also see that params_protected removes ONLY those parameters explicitly specified.
+
+Sometimes you have certain post parameters that are best left unlogged, we support that too.  Your
+actions continue to receive the variable correctly, but the requested parameters are scrubbed
+at log time.
+
+  MySuperDuperController < Application
+    log_params_filtered :password
+  end
+  
+  params.inspect # => { :username => 'atmos', :password => '[FILTERED]' }

data/Rakefile

@@ -4,7 +4,7 @@ require 'spec/rake/spectask'
 
 PLUGIN = "merb_param_protection"
 NAME = "merb_param_protection"
-VERSION = "0.9.2"
+VERSION = "0.9.3"
 AUTHOR = "Lance Carlson"
 EMAIL = "lancecarlson@gmail.com"
 HOMEPAGE = "http://merb.devjavu.com"
@@ -21,7 +21,7 @@ spec = Gem::Specification.new do |s|
   s.author = AUTHOR
   s.email = EMAIL
   #s.homepage = HOMEPAGE
-  s.add_dependency('merb', '>= 0.9.2')
+  s.add_dependency('merb-core', '>= 0.9.3')
   s.require_path = 'lib'
   s.autorequire = PLUGIN
   s.files = %w(LICENSE README Rakefile TODO) + Dir.glob("{lib,specs}/**/*")

data/lib/merb_param_protection.rb

@@ -39,10 +39,12 @@ if defined?(Merb::Plugins)
           base.send(:include, InstanceMethods)
           base.send(:class_inheritable_accessor, :accessible_params_args)
           base.send(:class_inheritable_accessor, :protected_params_args)
+          base.send(:class_inheritable_accessor, :log_params_args)
+          
           base.send(:before, :initialize_params_filter)
         end
 
-        module ClassMethods          
+        module ClassMethods
           # Ensures these parameters are sent for the object
           # 
           #   params_accessible :post => [:title, :body]
@@ -58,6 +60,16 @@ if defined?(Merb::Plugins)
           def params_protected(args = {})
             assign_filtered_params(:protected_params_args, args)
           end
+
+          # Filters parameters out from the default log string
+          #  Params will still be passed to the controller properly, they will
+          #  show up as [FILTERED] in the merb logs.
+          #
+          # log_params_filtered :password, 'token'
+          # 
+          def log_params_filtered(*args)
+            self.log_params_args = args.collect { |arg| arg.to_sym }
+          end
           
           private
           
@@ -113,7 +125,7 @@ if defined?(Merb::Plugins)
 
         # Removes specified parameters of an object
         # 
-        #   params_filter_from_object(:post, [:status, :author_id])
+        #   remove_params_from_object(:post, [:status, :author_id])
         # 
         def remove_params_from_object(obj, attrs = [])
           unless params[obj].nil?
@@ -141,4 +153,15 @@ if defined?(Merb::Plugins)
   
   Merb::Controller.send(:include, Merb::ParamsFilter::ControllerMixin)
   Merb::Request.send(:include, Merb::ParamsFilter::RequestMixin)
+  
+  class Merb::Controller
+    def self._filter_params(params)
+      return params if self.log_params_args.nil?
+      result = { }
+      params.each do |k,v|
+        result[k] = (self.log_params_args.include?(k.to_sym) ? '[FILTERED]' : v)
+      end
+      result
+    end
+  end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: merb_param_protection
 version: !ruby/object:Gem::Version 
-  version: 0.9.2
+  version: 0.9.3
 platform: ruby
 authors: 
 - Lance Carlson
@@ -9,17 +9,17 @@ autorequire: merb_param_protection
 bindir: bin
 cert_chain: []
 
-date: 2008-03-24 00:00:00 -05:00
+date: 2008-05-04 00:00:00 -05:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency 
-  name: merb
+  name: merb-core
   version_requirement: 
   version_requirements: !ruby/object:Gem::Requirement 
     requirements: 
     - - ">="
       - !ruby/object:Gem::Version 
-        version: 0.9.2
+        version: 0.9.3
     version: 
 description: Merb plugin that provides params_accessible and params_protected class methods
 email: lancecarlson@gmail.com