ramaze 0.3.9.1 → 2023.01.06

data/lib/ramaze/helper/cache.rb

@@ -1,143 +1,121 @@
-#          Copyright (c) 2008 Michael Fellinger m.fellinger@gmail.com
-# All files in this distribution are subject to the terms of the Ruby license.
+#          Copyright (c) 2009 Michael Fellinger m.fellinger@gmail.com
+# All files in this distribution are subject to the terms of the MIT license.
 
 module Ramaze
+  module Helper
+    ##
+    # Caching of simple objects and whole action responses.
+    #
+    module Cache
+      # Setup needed traits, add the singleton methods and add the caches used
+      # by this helper.
+      #
+      # @param [Class] into Class that this Module is included into
+      # @author manveru
+      #
+      def self.included(into)
+        into.extend(SingletonMethods)
+        into.add_action_wrapper(6.0, :cache_wrap)
+        into.trait[:cache_action] ||= Set.new
+        Ramaze::Cache.add(:action, :cache_helper_value)
+      end
 
-  # This helper is providing easy access to a couple of Caches to use for
-  # smaller amounts of data.
+      ##
+      # @param [Action] action The currently wrapped action
+      # @yield The next block in wrap_action_call
+      # @return [String] the response body
+      # @see Innate::Node#wrap_action_call
+      # @author manveru
+      #
+      def cache_wrap(action)
+        cache = Innate::Cache.action
 
-  module Helper::Cache
-    C = Ramaze::Cache
+        ancestral_trait[:cache_action].each do |cache_action|
+          temp  = cache_action.dup
+          block = temp.delete(:key)
+          ttl   = temp.delete(:ttl)
 
-    # Create the Cache.value_cache on inclusion if it doesn't exist yet.
-    def self.included(klass)
-      C.add(:value_cache) unless C::CACHES.has_key?(:value_cache)
-    end
+          if temp.all?{|key, value| action[key] == value }
+            cache_key = action.full_path
+            cache_key << "_#{action.instance.instance_eval(&block).to_s}" if block
 
-    # Example:
-    #
-    #   class FooController < Ramaze::Controller
-    #     helper :cache
-    #     cache :index, :map_of_the_internet
-    #   end
-    #
-    # cache supports these options
-    #   [+:ttl+]  time-to-live in seconds
-    #   [+:key+]  proc that returns a key to store cache with
-    #
-    # Example:
-    #
-    #   class CacheController < Ramaze::Controller
-    #     helper :cache
-    #
-    #     # for each distinct value of request['name']
-    #     # cache rendered output of name action for 60 seconds
-    #     cache :name, :key => lambda{ request['name'] }, :ttl => 60
-    #
-    #     def name
-    #       "hi #{request['name']}"
-    #     end
-    #   end
-    #
-    # cache acts as a wrapper for value_cache if no args are given
+            if cached = cache[cache_key]
+              action.options[:content_type] = cached[:type]
+            else
+              cached = {
+                :body => catch(:respond) { yield },
+                :type => response['Content-Type']
+              }
 
-    def cache *args
-      return value_cache if args.size == 0
+              if ttl
+                cache.store(cache_key, cached, :ttl => ttl)
+              else
+                cache.store(cache_key, cached)
+              end
+            end
 
-      if args.last.is_a? Hash
-        opts = args.pop
-      end
-      opts ||= {}
+            return cached[:body]
+          end
+        end
 
-      args.each do |arg|
-        actions_cached[arg.to_sym] = opts unless arg.nil?
+        yield
       end
-    end
-
-    private
-
-    # use this to cache values in your controller and templates,
-    # for example heavy calculations or time-consuming queries.
-
-    def value_cache
-      C.value_cache
-    end
-
-    # action_cache holds rendered output of actions for which caching is enabled.
-    #
-    # For simple cases:
-    #
-    #   class Controller < Ramaze::Controller
-    #     map '/path/to'
-    #     helper :cache
-    #     cache :action
-    #
-    #     def action with, params
-    #       'rendered output'
-    #     end
-    #   end
-    #
-    #   { '/path/to/action/with/params' => {
-    #       :time => Time.at(rendering),
-    #       :type => 'content/type',
-    #       :content => 'rendered output'
-    #     }
-    #   }
-    #
-    # If an additional key is provided:
-    #
-    #   class Controller < Ramaze::Controller
-    #     map '/path/to'
-    #     helper :cache
-    #     cache :action, :key => lambda{ 'value of key proc' }
-    #
-    #     def action
-    #       'output'
-    #     end
-    #   end
-    #
-    #   { '/path/to/action' => {
-    #       'value of key proc' => {
-    #         :time => Time.at(rendering),
-    #         :type => 'content/type',
-    #         :content => 'output'
-    #       }
-    #     }
-    #   }
-    #
-    # Caches can be invalidated after a certain amount of time
-    # by supplying a :ttl option (in seconds)
-    #
-    #   class Controller < Ramaze::Controller
-    #     helper :cache
-    #     cache :index, :ttl => 60
-    #
-    #     def index
-    #       Time.now.to_s
-    #     end
-    #   end
-    #
-    # or by deleting values from action_cache directly
-    #
-    #   action_cache.clear
-    #   action_cache.delete '/index'
-    #   action_cache.delete '/path/to/action'
 
-    def action_cache
-      C.actions
-    end
+      ##
+      # This method is used to access Ramaze::Cache.cache_helper_value.
+      # It provides an easy way to cache long-running computations, gathering
+      # external resources like RSS feeds or DB queries that are the same for
+      # every user of an application.
+      # This method changes behaviour if a block is passed, which can be used
+      # to do lazy computation of the cached value conveniently when using a
+      # custom TTL or longer expressions that don't fit on one line with ||=.
+      #
+      # @example to get the cache object directly
+      #
+      #   count = cache_value[:count] ||= Article.count
+      #
+      # @example with block
+      #
+      #   count = cache_value(:count){ Article.count }
+      #   count = cache_value(:count, :ttl => 60){ Article.count }
+      #
+      # @return [Object] The cache wrapper assigned for :cache_helper_value
+      # @see Innate::Cache
+      # @author manveru
+      #
+      def cache_value(key = nil, options = {})
+        cache = Ramaze::Cache.cache_helper_value
 
-    # This refers to the class-trait of cached actions, you can
-    # add/remove actions to be cached.
-    #
-    # Example:
-    #
-    #   class FooController < Ramaze::Controller
-    #     trait :actions_cached => [:index, :map_of_the_internet]
-    #   end
+        if key and block_given?
+          if found = cache[key]
+            found
+          else
+            cache.store(key, yield, options)
+          end
+        else
+          cache
+        end
+      end
 
-    def actions_cached
-      ancestral_trait[:actions_cached]
-    end
-  end
-end
+      module SingletonMethods
+        # This method allows you to cache whole actions.
+        #
+        # @example Basic usage
+        #   class Foo < Ramaze::Controller
+        #     helper :cache
+        #     cache_action :method => :bar
+        #
+        #     def bar
+        #       rand
+        #     end
+        #   end
+        #
+        def cache_action(hash, &block)
+          hash[:key] = block if block_given?
+          hash[:method] = hash[:method].to_s
+          trait[:cache_action] << hash
+        end
+      end
+    end # Cache
+  end # Helper
+end # Ramaze

data/lib/ramaze/helper/csrf.rb

@@ -0,0 +1,191 @@
+require 'securerandom'
+require 'digest'
+
+module Ramaze
+  module Helper
+    ##
+    # A relatively basic yet useful helper that can be used to protect your
+    # application from CSRF attacks/exploits. Note that this helper merely
+    # generates the required data, and provides several methods. You still need
+    # to manually add the token to each form.
+    #
+    # The reason for this is because this is quite simple. Ramaze is meant as a
+    # framework that works with any given helper, ORM, template engine and so
+    # on. If we were to automatically load this helper and include (a perhaps
+    # more advanced) CSRF system that would mean that every form helper,
+    # official or third-party, would have to support that specific system.
+    # However, there's no need to panic as it's very easy to setup a basic anti
+    # CSRF system.
+    #
+    # ## Usage
+    #
+    # In order to enable CSRF protection we need to do two things. Load the
+    # helper and create a before_all block in a controller. Take a look at the
+    # following code:
+    #
+    #     class BaseController < Ramaze::Controller
+    #       before_all do
+    #         puts "Hello, before_all!"
+    #       end
+    #     end
+    #
+    # This would output "Hello, before_all!" to the console upon each request.
+    # Not very useful but it does show what the before_all block can do. On to
+    # actual CSRF related code!
+    #
+    #     class BaseController < Ramaze::Controller
+    #       before_all do
+    #         csrf_protection :save do
+    #           # ....
+    #         end
+    #       end
+    #     end
+    #
+    # This example introduces an extra block that validates the current
+    # request. Whenever a user requests a controller that either extends
+    # BaseController or has it's own before_all block Ramaze will check if the
+    # current request data contains a CSRF token. Of course an if/end isn't
+    # very useful if it doesn't do anything, let's add some code.
+    #
+    #     class BaseController < Ramaze::Controller
+    #       before_all do
+    #         csrf_protection :save do
+    #           puts "Hello, unsafe data!"
+    #         end
+    #       end
+    #     end
+    #
+    # The code above checks if the current method is "save" (or any other of
+    # the provided methods) and checks if an CSRF token is supplied if the
+    # method matches. Protected methods require a token in ALL HTTP requests
+    # (GET, POST, etc). While this may seem weird since GET is generally used
+    # for safe actions it actually makes sense. Ramaze stores both the POST and
+    # GET parameters in the request.params hash. While this makes it easy to
+    # work with POST/GET data this also makes it easier to spoof POST requests
+    # using a GET request, thus this helper protects ALL request methods.
+    #
+    # If you're a lazy person you can copy-paste the example below and adapt it
+    # to your needs.
+    #
+    #     class BaseController < Ramaze::Controller
+    #       before_all do
+    #         csrf_protection :save do
+    #           respond("The supplied CSRF token is invalid.", 401)
+    #         end
+    #       end
+    #     end
+    #
+    module CSRF
+      include Innate::Optioned
+
+      options.dsl do
+        o 'The name of the token field', :field_name, 'csrf_token'
+      end
+
+      ##
+      # Method that can be used to protect the specified methods against CSRF
+      # exploits. Each protected method will require the token to be stored in
+      # a field called "csrf_token". This method will then validate that token
+      # against the current token in the session.
+      #
+      # @param [Array] methods Array of method names that should be checked.
+      # @param [Proc] block Block that will be executed if the token is
+      #  invalid.
+      # @example
+      #  # Protect "create" and "save" against CSRF exploits
+      #  before_all do
+      #    csrf_protection :create, :save do
+      #      respond("GET TO DA CHOPPA!", 401)
+      #    end
+      #  end
+      #
+      def csrf_protection(*methods, &block)
+        if methods.include?(action.name) \
+        or methods.include?(action.name.to_sym)
+          unless validate_csrf_token(request.params[CSRF.options.field_name])
+            yield
+          end
+        end
+      end
+
+      ##
+      # Generate a new token and create the session array that will be used to
+      # validate the client.
+      #
+      # Note that this method will be automatically called if no CSRF token
+      # exists.
+      #
+      # @param [Hash] args Additional arguments that can be set such as the
+      #  TTL.
+      #
+      def generate_csrf_token(args = {})
+        random = SecureRandom.random_bytes(512)
+        time   = Time.now.to_f
+        token  = Digest::SHA512.hexdigest(random + time.to_s)
+
+        # Time to store all the data we want to check later.
+        session[:_csrf] = {
+          :token => token,
+          :ip    => request.ip,
+          :agent => request.env['HTTP_USER_AGENT'],
+          :host  => request.host
+        }
+
+        return
+      end
+
+      ##
+      # Retrieves the current value of the CSRF token.
+      #
+      # @return [String] The current CSRF token.
+      # @example
+      #  form(@data, :method => :post) do |f|
+      #    f.input_hidden :csrf_token, get_csrf_token()
+      #  end
+      #
+      def get_csrf_token
+        if !session[:_csrf] || !self.validate_csrf_token(session[:_csrf][:token])
+          self.generate_csrf_token
+        end
+
+        return session[:_csrf][:token]
+      end
+
+      ##
+      # Validates the request based on the current session date stored in
+      # _csrf.
+      #
+      # @param  [String] input_token The CSRF token to validate.
+      # @return [TrueClass|FalseClass]
+      # @example
+      #  before_all do
+      #    if validate_csrf_token(request.params['csrf_token']) != true
+      #      respond("Invalid CSRF token", 401)
+      #    end
+      #  end
+      #
+      def validate_csrf_token(input_token)
+        # Check if the CSRF data has been generated and generate it if this
+        # hasn't been done already (usually on the first request).
+        if !session[:_csrf] or session[:_csrf].empty?
+          self.generate_csrf_token
+        end
+
+        _csrf = session[:_csrf]
+
+        valid = session[:_csrf][:token] == input_token &&
+          _csrf[:host]  == request.host &&
+          _csrf[:ip]    == request.ip &&
+          _csrf[:agent] == request.env['HTTP_USER_AGENT']
+
+        if valid
+          generate_csrf_token
+
+          return true
+        else
+          return false
+        end
+      end
+    end # CSRF
+  end # Helper
+end # Ramaze

data/lib/ramaze/helper/email.rb

@@ -0,0 +1,116 @@
+require 'net/smtp'
+
+module Ramaze
+  module Helper
+    ##
+    # The Email helper can be used as a simple way of sending Emails from your
+    # application. In order to use this helper you first need to load it:
+    #
+    #     class Comments < Ramaze::Controller
+    #       helper :email
+    #     end
+    #
+    # Sending an Email can be done by calling the method send_email():
+    #
+    #     send_email(
+    #       'user@domain.tld',
+    #       'Hello, world!',
+    #       'Hello, this is an Email'
+    #     )
+    #
+    # Ramaze will log any errors in case the Email could not be sent so you
+    # don't have to worry about this.
+    #
+    # ## Options
+    #
+    # This module can be configured using Innate::Optioned. Say you want to
+    # change the SMTP host you simply need to do the following:
+    #
+    #     Ramaze::Helper::Email.options.host = 'mail.google.com'
+    #
+    # Various other options are available, for a full list of these options run
+    # the following in an IRB session:
+    #
+    #     puts Ramaze::Helper::Email.options
+    #
+    # By default this helper uses ``\r\n`` for newlines, this can be changed as
+    # following:
+    #
+    #     Ramaze::Helper::Email.options.newline = "\n"
+    #
+    # @author Yorick Peterse
+    # @author Michael Fellinger
+    # @since  16-06-2011
+    #
+    module Email
+      include Innate::Optioned
+
+      options.dsl do
+        o 'The SMTP server to use for sending Emails'     , :host          , ''
+        o 'The SMTP helo domain'                          , :helo_domain   , ''
+        o 'The username for the SMTP server'              , :username      , ''
+        o 'The password for the SMTP server'              , :password      , ''
+        o 'The sender\'s Email address'                   , :sender        , ''
+        o 'The port of the SMTP server'                   , :port          , 25
+        o 'The authentication type of the SMTP server'    , :auth_type     , :login
+        o 'An array of addresses to forward the Emails to', :bcc           , []
+        o 'The name (including the Email) of the sender'  , :sender_full   , nil
+        o 'A prefix to use for the subjects of the Emails', :subject_prefix, ''
+        o 'The type of newlines to use for the Email'     , :newline       , "\r\n"
+        o 'The generator to use for Email IDs'            , :generator     , lambda {
+          "<" + Time.now.to_i.to_s + "@" + Ramaze::Helper::Email.options.helo_domain + ">"
+        }
+      end
+
+      ##
+      # Sends an Email over SMTP.
+      #
+      # @example
+      #  send_email('user@domain.tld', 'Hello, world!', 'Hello, this is an Email')
+      #
+      # @author Yorick Peterse
+      # @author Michael Fellinger
+      # @since  16-06-2011
+      # @param  [String] recipient The Email address to send the Email to.
+      # @param  [String] subject The subject of the Email.
+      # @param  [String] message The body of the Email
+      #
+      def send_email(recipient, subject, message)
+        sender  = Email.options.sender_full || "#{Email.options.sender} <#{Email.options.sender}>"
+        subject = [Email.options.subject_prefix, subject].join(' ').strip
+        id      = Email.options.generator.call
+
+        # Generate the body of the Email
+        email = [
+          "From: #{sender}", "To: <#{recipient}>", "Date: #{Time.now.rfc2822}",
+          "Subject: #{subject}", "Message-Id: #{id}", '', message
+        ].join(Email.options.newline)
+
+        # Send the Email
+        email_options = []
+
+        [:host, :port, :helo_domain, :username, :password, :auth_type].each do |k|
+          email_options.push(Email.options[k])
+        end
+
+        begin
+          Net::SMTP.start(*email_options) do |smtp|
+            smtp.send_message(
+              email,
+              Email.options.sender,
+              [recipient, *Email.options.bcc]
+            )
+
+            Ramaze::Log.info(
+              "Email sent to #{recipient} with subject \"#{subject}\""
+            )
+          end
+        rescue => e
+          Ramaze::Log.error(
+            "Failed to send an Email to #{recipient}: #{e.inspect}"
+          )
+        end
+      end
+    end # Email
+  end # Helper
+end # Ramaze

data/lib/ramaze/helper/erector.rb

@@ -0,0 +1,113 @@
+#          Copyright (c) 2008 Michael Fellinger m.fellinger@gmail.com
+# All files in this distribution are subject to the terms of the MIT license.
+
+require 'erector'
+
+module Ramaze
+  module Helper
+    ##
+    # Allows you to use some shortcuts for Erector in your Controller.
+    #
+    # use this inside your controller to directly build Erector
+    # Refer to the Erector-documentation and testsuite for more examples.
+    #
+    # @example
+    #   erector { h1 "Apples & Oranges" } #=> "<h1>Apples &amp; Oranges</h1>"
+    #   erector { h1(:class => 'fruits&floots'){ text 'Apples' } }
+    #
+    module Erector
+      include ::Erector::Mixin
+
+      class ::Erector::Widget
+        alias :raw! :rawtext
+        alias :old_css :css
+
+        ##
+        # Method that generates a XHTML 1.0 Strict doctype.
+        #
+        # @example
+        #   strict_html do
+        #     head do
+        #       title "Ramaze Rocks!"
+        #     end
+        #     body
+        #       div do
+        #
+        #       end
+        #     end
+        #   end
+        #
+        # @param [Hash] args Hash containing extra options such as the xml:lang
+        #  and xmlns attribute.
+        # @param [Block] block Block that contains the inner data of the <html>
+        #  element.
+        #
+        def strict_xhtml(*args, &block)
+          raw! '<?xml version="1.0" encoding="UTF-8"?>'
+          raw! '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "DTD/xhtml1-strict.dtd">'
+          html(:xmlns => "http://www.w3.org/1999/xhtml", :"xml:lang" => "en", :lang => "en", &block)
+        end
+
+        ##
+        # Generate a Javascript tag.
+        #
+        # @example
+        #   js 'javascript/jquery.js'
+        #
+        # @param [String] src The full or relative path to the Javascript file.
+        #
+        def js(src)
+          script :src => src
+        end
+
+        ##
+        # Generate a pair of conditional tags for a specific browser.
+        #
+        # @example
+        #   ie_if 'IE' do
+        #     ......
+        #   end
+        #
+        # @param [String] expr The if expression, such as 'IE' or 'lte IE7'.
+        # @param [block] block Block that contains the data that needs to be
+        #  loaded for the specified browser.
+        #
+        def ie_if(expr, &block)
+          raw! "<!--[if #{expr}]>"
+          yield
+          raw! "<![endif]-->"
+        end
+
+        ##
+        # Inspect the specified element.
+        #
+        # @param [String] elem The element to inspect.
+        #
+        def inspect(elem)
+          text elem.inspect
+        end
+
+        ##
+        # Generate a stylesheet tag.
+        #
+        # @example
+        #   css 'css/reset.css', :media => 'print'
+        #
+        # @param [String] href The path (either absolute or relative) to the CSS
+        #  file.
+        # @param [Hash] args A hash containing additional arguments to add to
+        #  the CSS tag.
+        #
+        def css(href, args = {})
+          attrs = {
+            :rel => "stylesheet",
+            :href => href,
+            :type => "text/css"
+          }.merge(args)
+
+          link attrs
+        end
+      end # Erector::Widget
+    end # Erector
+  end # Helper
+end # Ramaze