netzke-core 0.4.2 → 0.4.3

data/.gitignore

@@ -1,4 +1,5 @@
 *.log
 pkg
 doc
+Manifest
 .DS_Store

data/CHANGELOG

@@ -1,3 +1,6 @@
+v0.4.3
+Fix: reworking loadAggregatee()-related code, closing a security flaw when a malicious browser could send any configuration options to instantiate the widget being loaded.
+
 v0.4.2
 2009-09-11
 Fix: the API call (at the JavaScript side) was ignoring the callback parameter.

data/README.rdoc

@@ -1,12 +1,30 @@
 = netzke-core
 Create Ext JS + Rails reusable components (widgets) with minimum effort.
 
+This is the bare bones of the Netzke framework. Use it to build your own widgets from scratch. For pre-built widgets (like panels, grids, forms, trees, applications), see the netzke-basepack project.
+
+The idea behind the Netzke framework is that it allows you write reusable client/server code. Create a widget, and then embed it (or load it dynamically) into your Ext-based applications or HTML pages. For more info, see the links below.
+
+== Instalation
+From RubyForge:
+  
+    sudo gem install netzke-core
+    
+From github:
+
+    sudo gem install skozlov-netzke-core
+    
+If you want the most recent changes, install this as a plugin:
+
+    script/plugin install git://github.com/skozlov/netzke-core.git
+    
+== Usage
 Introduction to Netzke framework: http://github.com/skozlov/netzke/tree/master
 
 Tutorials: http://blog.writelesscode.com
 
 Live-demo: http://netzke-demo.writelesscode.com
 
-Also see netzke-basepack (pre-programmed widgets) project: http://github.com/skozlov/netzke-basepack/tree/master
+The netzke-basepack project (pre-built full-featured widgets): http://github.com/skozlov/netzke-basepack/tree/master
 
 Copyright (c) 2009 Sergei Kozlov, released under the MIT license

data/Rakefile

@@ -12,7 +12,28 @@ begin
   Jeweler::RubyforgeTasks.new do |rubyforge|
     rubyforge.doc_task = "rdoc"
   end
-  
+    
 rescue LoadError
   puts "Jeweler not available. Install it with: sudo gem install technicalpickles-jeweler -s http://gems.github.com"
-end
+end
+
+require 'rake/rdoctask'
+Rake::RDocTask.new do |rdoc|
+  if File.exist?('VERSION')
+    version = File.read('VERSION')
+  else
+    version = ""
+  end
+
+  rdoc.rdoc_dir = 'rdoc'
+  rdoc.title = "netzke-core #{version}"
+  rdoc.rdoc_files.include('README*')
+  rdoc.rdoc_files.include('lib/**/*.rb')
+end
+
+require 'rake/testtask'
+Rake::TestTask.new(:test) do |test|
+  test.libs << 'lib' << 'test'
+  test.pattern = 'test/**/*_test.rb'
+  test.verbose = true
+end

data/VERSION

@@ -1 +1 @@
-0.4.2
+0.4.3

data/javascripts/core.js

@@ -91,30 +91,31 @@ Ext.widgetMixIn = {
   is_netzke: true, // to distinguish Netzke components from regular Ext components
   
   /*
-  Loads aggregatee into a container. Sends the widgets cache info to the server.
+  Loads aggregatee into a container.
   */
   loadAggregatee: function(params){
-    // build the cached widget list
+    // params that will be provided for the server API call (load_aggregatee_with_cache); all what's passed in params.params is merged in
+    var apiParams = Ext.apply({id: params.id, container: params.container}, params.params); 
+    
+    // build the cached widgets list to send it to the server
     var cachedWidgetNames = [];
     for (name in Ext.netzke.cache) {
       cachedWidgetNames.push(name);
     }
+    apiParams.cache = Ext.encode(cachedWidgetNames);
     
-    params.cache = Ext.encode(cachedWidgetNames);
-    
-    // remember the passed callback
+    // remember the passed callback for the future
     if (params.callback) {
-      this.callbackHash[params.id] = params.callback;
-      delete params.callback;
-      delete params.scope;
+      this.callbackHash[params.id] = params.callback; // per loaded widget, as there may be simultaneous calls
     }
     
     // visually disable the container while the widget is being loaded
     // Ext.getCmp(params.container).disable();
-    Ext.getCmp(params.container).removeChild(); // simply cleanup the area, which speaks for itself
+
+    Ext.getCmp(params.container).removeChild(); // remove the old widget
     
-    // remote api call
-    this.loadAggregateeWithCache(params);
+    // do the remote API call
+    this.loadAggregateeWithCache(apiParams);
   },
   
   /*

data/lib/netzke/base.rb

@@ -429,35 +429,6 @@ module Netzke
       "#{@id_name}__#{action_name}"
     end
 
-    # permissions
-    # def available_permissions
-    #   []
-    # end
-
-    # def process_permissions_config
-    #   if !available_permissions.empty?
-    #     # First, process permissions from the config
-    #     @permissions = available_permissions.inject({}){|h,p| h.merge(p.to_sym => true)} # by default anything is allowed
-    # 
-    #     config[:prohibit] = available_permissions if config[:prohibit] == :all # short-cut for all permissions
-    #     config[:prohibit] = [config[:prohibit]] if config[:prohibit].is_a?(Symbol) # so that config[:prohibit] => :write works
-    #     config[:prohibit] && config[:prohibit].each{|p| @permissions.merge!(p.to_sym => false)} # prohibit
-    # 
-    #     config[:allow] = [config[:allow]] if config[:allow].is_a?(Symbol) # so that config[:allow] => :write works
-    #     config[:allow] && config[:allow].each{|p| @permissions.merge!(p.to_sym => true)} # allow
-    #     
-    #     # ... and then merge it with NetzkePreferences
-    #     available_permissions.each do |p|
-    #       # if nothing is stored in persistent_config, store the permission from the config; otherwise leave what's there
-    #       persistent_config["permissions/#{p}"].nil? && persistent_config["permissions/#{p}"] = @permissions[p.to_sym]
-    # 
-    #       # what's stored in persistent_config has higher priority, so, if there's something there, use that
-    #       persistent_permisson = persistent_config["permissions/#{p}"]
-    #       @permissions[p.to_sym] = persistent_permisson unless persistent_permisson.nil?
-    #     end
-    #   end
-    # end
-
     # called when the method_missing tries to processes a non-existing aggregatee
     def aggregatee_missing(aggr)
       flash :error => "Unknown aggregatee #{aggr} for widget #{name}"
@@ -486,9 +457,7 @@ module Netzke
     def load_aggregatee_with_cache(params)
       cache = ActiveSupport::JSON.decode(params.delete(:cache))
       relative_widget_id = params.delete(:id).underscore
-      passed_config = params[:config] && ActiveSupport::JSON.decode(params[:config]) || {}
-      passed_config = passed_config.symbolize_keys
-      widget = aggregatee_instance(relative_widget_id, passed_config)
+      widget = aggregatee_instance(relative_widget_id)
       
       # inform the widget that it's being loaded
       widget.before_load

data/netzke-core.gemspec

@@ -5,11 +5,11 @@
 
 Gem::Specification.new do |s|
   s.name = %q{netzke-core}
-  s.version = "0.4.2"
+  s.version = "0.4.3"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["Sergei Kozlov"]
-  s.date = %q{2009-09-11}
+  s.date = %q{2009-09-24}
   s.description = %q{Build ExtJS/Rails widgets with minimum effort}
   s.email = %q{sergei@playcode.nl}
   s.extra_rdoc_files = [
@@ -75,7 +75,7 @@ Gem::Specification.new do |s|
   s.rdoc_options = ["--charset=UTF-8"]
   s.require_paths = ["lib"]
   s.rubyforge_project = %q{netzke-core}
-  s.rubygems_version = %q{1.3.4}
+  s.rubygems_version = %q{1.3.5}
   s.summary = %q{Build ExtJS/Rails widgets with minimum effort}
   s.test_files = [
     "test/app_root/app/controllers/application_controller.rb",

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: netzke-core
 version: !ruby/object:Gem::Version 
-  version: 0.4.2
+  version: 0.4.3
 platform: ruby
 authors: 
 - Sergei Kozlov
@@ -9,7 +9,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2009-09-11 00:00:00 -05:00
+date: 2009-09-24 00:00:00 -05:00
 default_executable: 
 dependencies: []
 
@@ -100,7 +100,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 
 rubyforge_project: netzke-core
-rubygems_version: 1.3.4
+rubygems_version: 1.3.5
 signing_key: 
 specification_version: 3
 summary: Build ExtJS/Rails widgets with minimum effort