ruby-satisfaction 0.6.3 → 0.6.4

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    ruby-satisfaction (0.6.1)
+    ruby-satisfaction (0.6.3)
       activesupport (~> 2.3)
       json (>= 1.4.6)
       memcache-client (>= 1.5.0)

data/README.markdown

@@ -11,8 +11,12 @@ For questions, please visit the [Get Satisfaction API community][3]
 
 Changelog
 =========
+0.6.4
 
-0.6.2
+* Fixed a security issue with the resource associations and attributes.
+* Provide a more descriptive error message when the client tries to access a community that has restricted its identity provider.
+
+0.6.3
 
 * Fixed known issue with scoping. Calling resource methods could potentially change scope for
   other objects. For example:

data/lib/satisfaction/associations.rb

@@ -1,20 +1,25 @@
 module Associations
+  
   def has_many(resource, options={})
     class_name = options[:class_name] || "Sfn::#{resource.to_s.classify}"
-    eval <<-EOS
-      def self.#{resource}
-        @#{resource} ||= Sfn::ResourceCollection.new(#{class_name}, self.satisfaction, '#{options[:url]}')
+
+    class_eval do
+      define_method resource do
+        instance_variable_get("@#{resource}") || 
+          instance_variable_set("@#{resource}", Sfn::ResourceCollection.new(class_name.constantize, self.satisfaction, options[:url]))
       end
-    EOS
+    end   
   end
   
   def belongs_to(resource, options={})
     class_name = options[:class_name] || "Sfn::#{resource.to_s.classify}"
     parent_id = options[:parent_attribute] || "#{resource}_id"
-    eval <<-EOS
-      def self.#{resource}
-        @#{resource} ||= #{class_name}.new(#{parent_id}, self.satisfaction)
+    
+    class_eval do
+      define_method resource do
+        instance_variable_get("@#{resource}") ||
+          instance_variable_set("@#{resource}", class_name.constantize.new(parent_id, self.satisfaction))
       end
-    EOS
+    end  
   end
 end

data/lib/satisfaction/loader.rb

@@ -48,7 +48,14 @@ class Sfn::Loader
     when Net::HTTPBadRequest
       raise Sfn::BadRequest, "Bad request. Response body:\n" + response.body
     when Net::HTTPForbidden, Net::HTTPUnauthorized
-      raise Sfn::AuthorizationError, "Not authorized"
+      message = "Not authorized"
+      if restricted_provider = response['X-Sfn-Restricted-Identity-Provider']
+        message += " - Restricted to login provider"
+        if restricted_provider != 'yes'
+          message += " #{restricted_provider.capitalize}"
+        end
+      end
+      raise Sfn::AuthorizationError, message
     when Net::HTTPNotFound
       raise Sfn::NotFound, "Not found"
     when Net::HTTPServiceUnavailable
@@ -75,10 +82,17 @@ class Sfn::Loader
     http = Net::HTTP.new(uri.host, uri.port)
     add_authentication(request, http, options)
     response = execute(http, request)
-    
+
     case response
     when Net::HTTPForbidden, Net::HTTPUnauthorized
-      raise Sfn::AuthorizationError, "Not authorized"
+      message = "Not authorized"
+      if restricted_provider = response['X-Sfn-Restricted-Identity-Provider']
+        message += " - Restricted to login provider"
+        if restricted_provider != 'yes'
+          message += " #{restricted_provider.capitalize}"
+        end
+      end
+      raise Sfn::AuthorizationError, message
     when Net::HTTPNotFound
       raise Sfn::NotFound, "Not found"
     when Net::HTTPBadRequest

data/lib/satisfaction/resource/attributes.rb

@@ -21,12 +21,14 @@ module Sfn::Resource::Attributes
       options.reverse_merge!(:type => 'nil')
       raise "Name can't be empty" if name.blank?
       
-      class_eval <<-EOS
-        def #{name}
+      class_eval do
+        define_method name do
           self.load unless self.loaded?
-          @#{name} ||= decode_raw_attribute(@attributes['#{name}'], #{options[:type]}) if @attributes
+
+          instance_variable_get("@#{name}") ||
+            (@attributes && instance_variable_set("@#{name}", decode_raw_attribute(@attributes[name], options[:type])))
         end
-      EOS
+      end
     end
   
   end
@@ -64,4 +66,4 @@ class Sfn::Resource
       new(value, satisfaction)
     end
   end
-end
+end

data/lib/satisfaction/version.rb

@@ -2,7 +2,7 @@ module Satisfaction
   module VERSION
     MAJOR = 0
     MINOR = 6
-    PATCH  = 3
+    PATCH = 4
     PRE   = nil
 
     STRING = [MAJOR, MINOR, PATCH, PRE].compact.join('.')

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification 
 name: ruby-satisfaction
 version: !ruby/object:Gem::Version 
-  hash: 1
+  hash: 15
   prerelease: false
   segments: 
   - 0
   - 6
-  - 3
-  version: 0.6.3
+  - 4
+  version: 0.6.4
 platform: ruby
 authors: 
 - Get Satisfaction
@@ -15,7 +15,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2010-12-14 00:00:00 -08:00
+date: 2011-04-08 00:00:00 -07:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency