rails_admin 1.1.0 → 1.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: d27a09f1e2cf25bfca10937bcd279281e982f14b
-  data.tar.gz: 51952b4144d0ad13b3e7e5790b63cff53480502c
+  metadata.gz: d80a5575faa7784d6f5d17ddebb05038a5416969
+  data.tar.gz: c30c5b1ffb5839b5b387b7935e7ed201966efdbb
 SHA512:
-  metadata.gz: fa0d0657963371052c1851983b8b371ce44171d215fce5f0d50ddd6d638bc543329930918b46172ff555fe558ff179d2b9fe45ab8326035ea031be61db4ebf93
-  data.tar.gz: 75e8e10ba79d3b1bec8515a9277ee2e613e70307d549f38136763c65c6d301f22348ef803e9d09fedbbffc4e01ad598eb48c847857cbc34e6503d572319ca8e5
+  metadata.gz: ee5a0326bd91f3b04e1b7711cddb648772bbc29f47f76784a69508fcfa3bf590528321b86faddace87c3bd1d6334100e0fea04cf18dbd04ecf6bd3e3ed2c85e9
+  data.tar.gz: 4565950fa8e26c5c5b7a0d79cb522e91d1256575287e7b637165c2c03b82053461aa3e6317479c5ca2340439b5a9d8e4e5768efe52939b7d32b1bb1cfd443919

data/Gemfile

@@ -18,8 +18,6 @@ group :active_record do
     gem 'pg', '>= 0.14'
     gem 'sqlite3', '>= 1.3'
   end
-
-  gem 'paper_trail', '>= 5.0'
 end
 
 group :development, :test do

data/README.md

@@ -16,6 +16,15 @@
 
 RailsAdmin is a Rails engine that provides an easy-to-use interface for managing your data.
 
+## Announcements
+
+### [Action required] Security issue
+
+**RailsAdmin 1.0.0 and 1.1.0 have been reported to have CSRF vulnerability with default setup.** We strongly recommend that you upgrade RailsAdmin to 1.1.1 or later as soon as possible, if you are on these versions. See [b13e879e](https://github.com/sferik/rails_admin/commit/b13e879eb93b661204e9fb5e55f7afa4f397537a) for the detail.
+
+This problem was reported by SourceClear, Inc.
+
+
 ## Features
 * CRUD any data with ease
 * Custom actions

data/app/controllers/rails_admin/application_controller.rb

@@ -11,6 +11,8 @@ module RailsAdmin
   end
 
   class ApplicationController < Config.parent_controller.constantize
+    protect_from_forgery with: :exception
+
     before_action :_authenticate!
     before_action :_authorize!
     before_action :_audit!
@@ -63,12 +65,14 @@ module RailsAdmin
     rescue_from RailsAdmin::ObjectNotFound do
       flash[:error] = I18n.t('admin.flash.object_not_found', model: @model_name, id: params[:id])
       params[:action] = 'index'
+      @status_code = :not_found
       index
     end
 
     rescue_from RailsAdmin::ModelNotFound do
       flash[:error] = I18n.t('admin.flash.model_not_found', model: @model_name)
       params[:action] = 'dashboard'
+      @status_code = :not_found
       dashboard
     end
   end

data/config/initializers/active_record_extensions.rb

@@ -1,4 +1,4 @@
-if defined?(::ActiveRecord)
+ActiveSupport.on_load(:active_record) do
   module ActiveRecord
     class Base
       def self.rails_admin(&block)

data/lib/rails_admin/adapters/active_record.rb

@@ -72,6 +72,8 @@ module RailsAdmin
           ::ActiveRecord::Base.connection.select_one("SELECT ''::text AS str;").values.first.encoding
         when 'mysql2'
           ::ActiveRecord::Base.connection.instance_variable_get(:@connection).encoding
+        when 'oracle_enhanced'
+          ::ActiveRecord::Base.connection.select_one("SELECT dummy FROM DUAL").values.first.encoding
         else
           ::ActiveRecord::Base.connection.select_one("SELECT '' AS str;").values.first.encoding
         end

data/lib/rails_admin/config/actions/dashboard.rb

@@ -30,7 +30,7 @@ module RailsAdmin
                 @most_recent_created[t.model.name] = t.model.last.try(:created_at)
               end
             end
-            render @action.template_name, status: (flash[:error].present? ? :not_found : 200)
+            render @action.template_name, status: @status_code || :ok
           end
         end
 

data/lib/rails_admin/config/actions/index.rb

@@ -41,7 +41,7 @@ module RailsAdmin
 
             respond_to do |format|
               format.html do
-                render @action.template_name, status: (flash[:error].present? ? :not_found : 200)
+                render @action.template_name, status: @status_code || :ok
               end
 
               format.json do

data/lib/rails_admin/support/csv_converter.rb

@@ -4,6 +4,9 @@ require 'csv'
 module RailsAdmin
   class CSVConverter
     def initialize(objects = [], schema = {})
+      @fields = []
+      @associations = []
+
       return self if (@objects = objects).blank?
 
       @model = objects.dup.first.class
@@ -32,6 +35,7 @@ module RailsAdmin
     end
 
     def to_csv(options = {})
+      options = HashWithIndifferentAccess.new(options)
       encoding_to = Encoding.find(options[:encoding_to]) if options[:encoding_to].present?
 
       csv_string = generate_csv_string(options)

data/lib/rails_admin/version.rb

@@ -2,7 +2,7 @@ module RailsAdmin
   class Version
     MAJOR = 1
     MINOR = 1
-    PATCH = 0
+    PATCH = 1
     PRE = nil
 
     class << self

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rails_admin
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 1.1.1
 platform: ruby
 authors:
 - Erik Michaels-Ober
@@ -12,7 +12,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-10-30 00:00:00.000000000 Z
+date: 2016-12-25 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: builder