vidibus-xss 0.1.6 → 0.1.7

data/.bundle/config

@@ -0,0 +1,2 @@
+--- 
+BUNDLE_DISABLE_SHARED_GEMS: "1"

data/.rspec

@@ -0,0 +1,2 @@
+--color
+--format nested

data/Gemfile

@@ -0,0 +1,13 @@
+source :rubygems
+
+gem "rails", "~> 3.0.0"
+gem "nokogiri"
+gem "vidibus-routing_error"
+gem "vidibus-uuid"
+
+# Development dependecies
+gem "jeweler"
+gem "rake"
+gem "rspec", "~> 2.0.0.beta.20"
+gem "rr"
+gem "relevance-rcov"

data/Gemfile.lock

@@ -0,0 +1,107 @@
+GEM
+  remote: http://rubygems.org/
+  specs:
+    abstract (1.0.0)
+    actionmailer (3.0.0)
+      actionpack (= 3.0.0)
+      mail (~> 2.2.5)
+    actionpack (3.0.0)
+      activemodel (= 3.0.0)
+      activesupport (= 3.0.0)
+      builder (~> 2.1.2)
+      erubis (~> 2.6.6)
+      i18n (~> 0.4.1)
+      rack (~> 1.2.1)
+      rack-mount (~> 0.6.12)
+      rack-test (~> 0.5.4)
+      tzinfo (~> 0.3.23)
+    activemodel (3.0.0)
+      activesupport (= 3.0.0)
+      builder (~> 2.1.2)
+      i18n (~> 0.4.1)
+    activerecord (3.0.0)
+      activemodel (= 3.0.0)
+      activesupport (= 3.0.0)
+      arel (~> 1.0.0)
+      tzinfo (~> 0.3.23)
+    activeresource (3.0.0)
+      activemodel (= 3.0.0)
+      activesupport (= 3.0.0)
+    activesupport (3.0.0)
+    arel (1.0.1)
+      activesupport (~> 3.0.0)
+    builder (2.1.2)
+    diff-lcs (1.1.2)
+    erubis (2.6.6)
+      abstract (>= 1.0.0)
+    gemcutter (0.6.1)
+    git (1.2.5)
+    i18n (0.4.1)
+    jeweler (1.4.0)
+      gemcutter (>= 0.1.0)
+      git (>= 1.2.5)
+      rubyforge (>= 2.0.0)
+    json_pure (1.4.6)
+    macaddr (1.0.0)
+    mail (2.2.5)
+      activesupport (>= 2.3.6)
+      mime-types
+      treetop (>= 1.4.5)
+    mime-types (1.16)
+    nokogiri (1.4.3.1)
+    polyglot (0.3.1)
+    rack (1.2.1)
+    rack-mount (0.6.13)
+      rack (>= 1.0.0)
+    rack-test (0.5.4)
+      rack (>= 1.0)
+    rails (3.0.0)
+      actionmailer (= 3.0.0)
+      actionpack (= 3.0.0)
+      activerecord (= 3.0.0)
+      activeresource (= 3.0.0)
+      activesupport (= 3.0.0)
+      bundler (~> 1.0.0)
+      railties (= 3.0.0)
+    railties (3.0.0)
+      actionpack (= 3.0.0)
+      activesupport (= 3.0.0)
+      rake (>= 0.8.4)
+      thor (~> 0.14.0)
+    rake (0.8.7)
+    relevance-rcov (0.9.2.1)
+    rr (1.0.0)
+    rspec (2.0.0.beta.20)
+      rspec-core (= 2.0.0.beta.20)
+      rspec-expectations (= 2.0.0.beta.20)
+      rspec-mocks (= 2.0.0.beta.20)
+    rspec-core (2.0.0.beta.20)
+    rspec-expectations (2.0.0.beta.20)
+      diff-lcs (>= 1.1.2)
+    rspec-mocks (2.0.0.beta.20)
+    rubyforge (2.0.4)
+      json_pure (>= 1.1.7)
+    thor (0.14.0)
+    treetop (1.4.8)
+      polyglot (>= 0.3.1)
+    tzinfo (0.3.23)
+    uuid (2.3.1)
+      macaddr (~> 1.0)
+    vidibus-routing_error (0.1.4)
+      rails (>= 3.0.0.rc)
+    vidibus-uuid (0.3.6)
+      uuid
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  jeweler
+  nokogiri
+  rails (~> 3.0.0)
+  rake
+  relevance-rcov
+  rr
+  rspec (~> 2.0.0.beta.20)
+  vidibus-routing_error
+  vidibus-uuid

data/Rakefile

@@ -1,5 +1,8 @@
 require "rubygems"
 require "rake"
+require "rake/rdoctask"
+require "rspec"
+require "rspec/core/rake_task"
 
 begin
   require "jeweler"
@@ -10,40 +13,25 @@ begin
     gem.email = "andre@vidibus.com"
     gem.homepage = "http://github.com/vidibus/vidibus-xss"
     gem.authors = ["Andre Pankratz"]
-    gem.add_development_dependency "rspec", ">= 1.2.9"
-    gem.add_development_dependency "relevance-rcov"
-    gem.add_development_dependency "rr"
     gem.add_dependency "rails", ">= 3.0.0.rc"
     gem.add_dependency "nokogiri"
     gem.add_dependency "vidibus-routing_error"
-    
-    # gem is a Gem::Specification... see http://www.rubygems.org/read/chapter/20 for additional settings
   end
   Jeweler::GemcutterTasks.new
 rescue LoadError
   puts "Jeweler (or a dependency) not available. Install it with: gem install jeweler"
 end
 
-require "spec/rake/spectask"
-Spec::Rake::SpecTask.new(:spec) do |spec|
-  spec.libs << "lib" << "spec"
-  spec.spec_files = FileList["spec/**/*_spec.rb"]
-end
-
-Spec::Rake::SpecTask.new(:rcov) do |t|
-  t.spec_files = FileList["spec/vidibus/**/*_spec.rb"]
+Rspec::Core::RakeTask.new(:rcov) do |t|
+  t.pattern = "spec/**/*_spec.rb"
   t.rcov = true
   t.rcov_opts = ["--exclude", "^spec,/gems/"]
 end
 
-task :spec => :check_dependencies
-task :default => :spec
-
-require "rake/rdoctask"
 Rake::RDocTask.new do |rdoc|
   version = File.exist?("VERSION") ? File.read("VERSION") : ""
   rdoc.rdoc_dir = "rdoc"
-  rdoc.title = "vidibus-xss #{version}"
+  rdoc.title = "vidibus-inheritance #{version}"
   rdoc.rdoc_files.include("README*")
   rdoc.rdoc_files.include("lib/**/*.rb")
   rdoc.options << "--charset=utf-8"

data/VERSION

@@ -1 +1 @@
-0.1.6
+0.1.7

data/lib/vidibus/xss/extensions/controller.rb

@@ -4,52 +4,53 @@ module Vidibus
   module Xss
     module Extensions
       module Controller
+        
         extend ActiveSupport::Concern
         
         included do
-           helper_method :url_for, :xss_request?, :fullpath_url
-           #layout :get_layout
-
-           respond_to :html, :xss
-
-           rescue_from ActionController::RoutingError, :with => :rescue_404
-         end
-         
-         protected
-         
-         # Returns layout for current request format.
-         def get_layout(format = nil)
-           (xss_request? or format == :xss) ? 'xss.haml' : 'application'
-         end
-         
-         # 
-         # IMPORTANT: restart server to apply modifications.
-         def rescue_404
-           return if respond_to_options_request
-           super
-           #render :template => "shared/404", :status => 404
-         end
+          helper_method :url_for, :xss_request?, :fullpath_url
+          respond_to :html, :xss
+          rescue_from ActionController::RoutingError, :with => :rescue_404
+        end
+        
+        # Set hostname of clients that are allowed to access this resource.
+        def xss_clients
+          raise %(Define #xss_clients in your ApplicationController that returns all hosts that are allowed to access your service.\nExample: %w[http://myconsumer.local])
+        end
+        
+        protected
+        
+        # Returns layout for current request format.
+        def get_layout(format = nil)
+          (xss_request? or format == :xss) ? 'xss.haml' : 'application'
+        end
+        
+        # IMPORTANT: restart server to apply modifications.
+        def rescue_404
+          return if respond_to_options_request
+          super
+        end
 
-         # Responds to OPTIONS request.
-         # When sending data to foreign domain by AJAX, Firefox will send an OPTIONS request first.
-         # 
-         # == Usage:
-         #
-         #  Set up a catch-all route for handling 404s like this, if you haven't done it already:
-         #
-         #    match "*path" => "application#rescue_404"
-         #
-         #  In ApplicationController, define a method that will be called by this catch-all route:
-         #
-         #    def rescue_404
-         #      respond_to_options_request
-         #    end
-         #
-         def respond_to_options_request
-           return unless options_request?
-           xss_access_control_headers
-           render(:text => "OK", :status => 200) and return true
-         end
+        # Responds to OPTIONS request.
+        # When sending data to foreign domain by AJAX, Firefox will send an OPTIONS request first.
+        # 
+        # == Usage:
+        #
+        #  Set up a catch-all route for handling 404s like this, if you haven't done it already:
+        #
+        #    match "*path" => "application#rescue_404"
+        #
+        #  In ApplicationController, define a method that will be called by this catch-all route:
+        #
+        #    def rescue_404
+        #      respond_to_options_request
+        #    end
+        #
+        def respond_to_options_request
+          return unless options_request?
+          xss_access_control_headers
+          render(:text => "OK", :status => 200) and return true
+        end
       
         # Returns true if current request is in XSS format.
         def xss_request?
@@ -72,9 +73,11 @@ module Vidibus
         # Set access control headers to allow cross-domain XMLHttpRequest calls.
         # For more information, see: https://developer.mozilla.org/En/HTTP_access_control
         def xss_access_control_headers
-          headers["Access-Control-Allow-Origin"] = "*"
-          headers["Access-Control-Allow-Methods"] = "GET, PUT, POST, OPTIONS"
-          headers["Access-Control-Allow-Headers"] = "Content-Type"
+          headers["Access-Control-Allow-Origin"] = xss_clients.join(",")
+          headers["Access-Control-Allow-Methods"] = "GET,PUT,POST,OPTIONS"
+          headers["Access-Control-Allow-Headers"] = "Content-Type,Depth,User-Agent,X-File-Size,X-Requested-With,If-Modified-Since,X-File-Name,Cache-Control"
+          headers["Access-Control-Allow-Credentials"] = "true"
+          headers["Access-Control-Max-Age"] = "1728000" # Cache this response for 20 days.
         end
         
         def extract_xss_html(dom)
@@ -167,12 +170,12 @@ module Vidibus
           path = options.delete(:get)
           redirect = options.delete(:redirect)
           callback = options.delete(:callback)
-
+          
           raise "Please provide :content, :get, :redirect or :callback." unless content or path or redirect or callback
           raise "Please provide either :content to render or :get location to load. Not both." if content and path
-
+          
           xss = ""
-
+          
           # determine scope
           if !(scope = params[:scope]).blank?
             scope = "$('##{scope}')"
@@ -180,7 +183,7 @@ module Vidibus
             scope = "$s#{xss_random_string}"
             xss << %(var #{scope}=vidibus.xss.detectScope();)
           end
-
+          
           # set host for current scope
           xss << %(vidibus.xss.setHost('#{request.protocol}#{request.host_with_port}',#{scope});)
 
@@ -202,7 +205,9 @@ module Vidibus
               %(vidibus.xss.callback(#{callback.to_json},#{scope});)
             end
           end
-
+          
+          xss_content << xss_csrf_vars
+          
           # wait until resources have been loaded, before rendering XSS content
           if defer
             function_name = "rx#{xss_random_string}"
@@ -222,16 +227,19 @@ module Vidibus
             random
           end
         end
-        
 
-        ### Override core extensions
+        # Sets vars for CSRF protection.
+        def xss_csrf_vars
+          %(vidibus.csrf.param='#{request_forgery_protection_token}', vidibus.csrf.token='#{form_authenticity_token}';)
+        end
 
+        ### Override core extensions
 
-        # Bypasses authenticity verification for XSS requests.
-        # TODO: Verify authenticity in other ways (Single Sign-on).
-        def verify_authenticity_token
-          xss_request? || super
-        end
+        # # Bypasses authenticity verification for XSS requests.
+        # # TODO: Verify authenticity in other ways (Single Sign-on).
+        # def verify_authenticity_token
+        #   xss_request? || super
+        # end
         
         # Extension of url_for:
         # Transform given relative paths into absolute urls.
@@ -267,7 +275,8 @@ module Vidibus
         end
 
         # Extensions of render method:
-        # Renders XSS response if requested
+        # Renders XSS response if requested.
+        # If Origin is withing allowed xss_clients, xss heades will be sent to allow authorization.
         def render(*args, &block)
           args << options = args.extract_options!
           if xss_request? or options[:format] == :xss
@@ -287,6 +296,9 @@ module Vidibus
 
             render_xss(xss)
           else
+            if xss_clients.include?(request.headers["Origin"])
+              xss_access_control_headers
+            end
             super(*args, &block)
           end
         end

data/public/javascripts/vidibus.js

@@ -5,189 +5,27 @@
 
 var vidibus = {};
 
-// Basic loader for stylesheets and javascripts.
-vidibus.loader = {
-  
-  complete: true,       // indicates that loading has been finished
-  queue: [],            // holds resources that are queued to load
-  loading: undefined,   // holds resource that is currently being loaded
-  preloaded: undefined, // holds resources that are included in consumer base file
-  loaded: {},           // holds resources that are currently loaded
-  unused: {},           // holds resources that are loaded, but not required anymore
-  
-  /**
-   * Load resources.
-   */
-  load: function(resources, scope) {
-    this.initStaticResources();
-    this.complete = false;
-    this.unused = jQuery.extend({}, this.loaded); // clone
-
-    $(resources).each(function() {
-      var resource = this,
-          src = resource.src,
-          name = vidibus.loader.resourceName(src);
-      
-      resource.name = name;
-      resource.scopes = {}
-      resource.scopes[scope] = true;
-      
-      // remove current file, because it is used
-      delete vidibus.loader.unused[name];
-
-      // skip files that have already been loaded
-      if (vidibus.loader.loaded[name]) {
-        vidibus.loader.loaded[name].scopes[scope] = true; // add current scope
-        return; // continue
-      } else if (vidibus.loader.preloaded[name]) {
-        return; // continue
-      }
-      
-      vidibus.loader.loaded[name] = resource;
-      switch (resource.type) {
-        
-        // load css file directly
-        case 'text/css':
-          var element = document.createElement("link"); 
-          element.rel = 'stylesheet'; 
-          element.href = src; 
-          element.media = resource.media || 'all';
-          element.type = 'text/css';
-          vidibus.loader.appendToHead(element);
-          break;
-          
-        // push script file to loading queue
-        case 'text/javascript':
-          vidibus.loader.queue.push(resource);
-          break;
-          
-        default: console.log('vidibus.loader.load: unsupported resource type: '+resource.type);
-      }
-    });
-    
-    this.loadQueue(true);
-    this.unloadUnused(scope);
-  },
+jQuery(function ($) {
   
   /**
-   * Returns file name of resource.
+   * Assign global cross-site request forgery protection variables.
+   * To use vidibus.csrf, simply append it to your options object:
+   *   jQuery.extend(yourSettings, vidibus.csrf.data)
    */
-  resourceName: function(url) {
-    return url.match(/\/([^\/\?]+)(\?.*)*$/)[1];
-  },
-  
-  /**
-   * Returns list of static resources.
-   */
-  initStaticResources: function() {
-    if (vidibus.loader.preloaded == undefined) {
-      vidibus.loader.preloaded = {};
-      var $resource, src, name;
-      $('script[src],link[href]',$('head')).each(function() {
-        $resource = $(this);
-        src = $resource.attr('src') || $resource.attr('href');
-        name = vidibus.loader.resourceName(src);
-        vidibus.loader.preloaded[name] = src;
-      });
-    }
-  },
-  
-  /**
-   * Loads resources in queue.
-   */
-  loadQueue: function(start) {
-    
-    // Reduce queue if this method is called as callback.
-    if(start != true) {
-      vidibus.loader.queue.shift();
-    }
-    
-    var resource = vidibus.loader.queue[0];
+  vidibus.csrf = {
+    param: $('meta[name=csrf-param]').attr('content'),
+    token: $('meta[name=csrf-token]').attr('content'),
     
-    // return if file is currently loading
-    if (resource) {
-      if (resource == vidibus.loader.loading) {
-        // console.log('CURRENTLY LOADING: '+resource.src);
-        return;
+    data: function() {
+      obj = {};
+      if(this.param && this.token) {
+        obj[this.param] = this.token;
       }
-      vidibus.loader.loading = resource;
-      vidibus.loader.loadScript(resource.src, vidibus.loader.loadQueue);
-    } else {
-      vidibus.loader.loading = undefined;
-      vidibus.loader.complete = true;
+      return obj;
     }
-  },
+  };
   
-  /**
-   * Loads script src.
-   */
-  loadScript: function(src, callback) {
-    var element = document.createElement("script");
-    if (element.addEventListener) {
-      element.addEventListener("load", callback, false);
-    } else {
-      // IE
-      element.onreadystatechange = function() {
-        if (this.readyState == 'loaded') callback.call(this);
-      }
-    }
-    element.type = 'text/javascript';
-    element.src = src;
-    vidibus.loader.appendToHead(element);
-    element = null;
-  },
-  
-  /**
-   * Detects unused resources and removes them.
-   */
-  unloadUnused: function(scope) {
-    var name, resources = [];
-    for(name in vidibus.loader.unused) {
-
-      // Remove dependency for given scope.
-      if (vidibus.loader.unused[name].scopes[scope]) {
-        delete vidibus.loader.unused[name].scopes[scope];
-      }
-      
-      // Unload resource if it has no dependencies left.
-      if ($.isEmptyObject(vidibus.loader.unused[name].scopes)) {
-        resources.push(vidibus.loader.unused[name]);
-      }
-    }
-    vidibus.loader.unload(resources);
-    vidibus.loader.unused = {}
-  },
-  
-  /**
-   * Removes resources given in list.
-   */
-  unload: function(resources) {
-    var src, data, resource;
-    $(resources).each(function() {
-      resource = this;
-      src = resource.src;
-
-      // console.log('REMOVE UNUSED RESOURCE: '+src);
-      
-      switch (resource.type) {
-        case "text/css": 
-          $('link[href="'+src+'"]').remove();
-          break;
-          
-        case "text/javascript": 
-          $('script[src="'+src+'"]').remove();
-          break;
-          
-        default: console.log('vidibus.loader.unload: unsupported resource type: '+resource.type);
-      }
-      delete vidibus.loader.loaded[resource.name];
-    });
-  },
-  
-  /**
-   * Appends given element to document head.
-   */
-  appendToHead: function(element) {
-    document.getElementsByTagName("head")[0].appendChild(element);
+  if(vidibus.csrf.param && vidibus.csrf.token) {
+    vidibus.csrf.data[vidibus.csrf.param] = encodeURIComponent(vidibus.csrf.token);
   }
-};
+});

data/public/javascripts/vidibus.loader.js

@@ -0,0 +1,186 @@
+// Basic loader for stylesheets and javascripts.
+vidibus.loader = {
+  
+  complete: true,       // indicates that loading has been finished
+  queue: [],            // holds resources that are queued to load
+  loading: undefined,   // holds resource that is currently being loaded
+  preloaded: undefined, // holds resources that are included in consumer base file
+  loaded: {},           // holds resources that are currently loaded
+  unused: {},           // holds resources that are loaded, but not required anymore
+  
+  /**
+   * Load resources.
+   */
+  load: function(resources, scope) {
+    this.initStaticResources();
+    this.complete = false;
+    this.unused = jQuery.extend({}, this.loaded); // clone
+
+    $(resources).each(function() {
+      var resource = this,
+          src = resource.src,
+          name = vidibus.loader.resourceName(src);
+      
+      resource.name = name;
+      resource.scopes = {}
+      resource.scopes[scope] = true;
+      
+      // remove current file, because it is used
+      delete vidibus.loader.unused[name];
+
+      // skip files that have already been loaded
+      if (vidibus.loader.loaded[name]) {
+        vidibus.loader.loaded[name].scopes[scope] = true; // add current scope
+        return; // continue
+      } else if (vidibus.loader.preloaded[name]) {
+        return; // continue
+      }
+      
+      vidibus.loader.loaded[name] = resource;
+      switch (resource.type) {
+        
+        // load css file directly
+        case 'text/css':
+          var element = document.createElement("link"); 
+          element.rel = 'stylesheet'; 
+          element.href = src; 
+          element.media = resource.media || 'all';
+          element.type = 'text/css';
+          vidibus.loader.appendToHead(element);
+          break;
+          
+        // push script file to loading queue
+        case 'text/javascript':
+          vidibus.loader.queue.push(resource);
+          break;
+          
+        default: console.log('vidibus.loader.load: unsupported resource type: '+resource.type);
+      }
+    });
+    
+    this.loadQueue(true);
+    this.unloadUnused(scope);
+  },
+  
+  /**
+   * Returns file name of resource.
+   */
+  resourceName: function(url) {
+    return url.match(/\/([^\/\?]+)(\?.*)*$/)[1];
+  },
+  
+  /**
+   * Returns list of static resources.
+   */
+  initStaticResources: function() {
+    if (vidibus.loader.preloaded == undefined) {
+      vidibus.loader.preloaded = {};
+      var $resource, src, name;
+      $('script[src],link[href]',$('head')).each(function() {
+        $resource = $(this);
+        src = $resource.attr('src') || $resource.attr('href');
+        name = vidibus.loader.resourceName(src);
+        vidibus.loader.preloaded[name] = src;
+      });
+    }
+  },
+  
+  /**
+   * Loads resources in queue.
+   */
+  loadQueue: function(start) {
+    
+    // Reduce queue if this method is called as callback.
+    if(start != true) {
+      vidibus.loader.queue.shift();
+    }
+    
+    var resource = vidibus.loader.queue[0];
+    
+    // return if file is currently loading
+    if (resource) {
+      if (resource == vidibus.loader.loading) {
+        // console.log('CURRENTLY LOADING: '+resource.src);
+        return;
+      }
+      vidibus.loader.loading = resource;
+      vidibus.loader.loadScript(resource.src, vidibus.loader.loadQueue);
+    } else {
+      vidibus.loader.loading = undefined;
+      vidibus.loader.complete = true;
+    }
+  },
+  
+  /**
+   * Loads script src.
+   */
+  loadScript: function(src, callback) {
+    var element = document.createElement("script");
+    if (element.addEventListener) {
+      element.addEventListener("load", callback, false);
+    } else {
+      // IE
+      element.onreadystatechange = function() {
+        if (this.readyState == 'loaded') callback.call(this);
+      }
+    }
+    element.type = 'text/javascript';
+    element.src = src;
+    vidibus.loader.appendToHead(element);
+    element = null;
+  },
+  
+  /**
+   * Detects unused resources and removes them.
+   */
+  unloadUnused: function(scope) {
+    var name, resources = [];
+    for(name in vidibus.loader.unused) {
+
+      // Remove dependency for given scope.
+      if (vidibus.loader.unused[name].scopes[scope]) {
+        delete vidibus.loader.unused[name].scopes[scope];
+      }
+      
+      // Unload resource if it has no dependencies left.
+      if ($.isEmptyObject(vidibus.loader.unused[name].scopes)) {
+        resources.push(vidibus.loader.unused[name]);
+      }
+    }
+    vidibus.loader.unload(resources);
+    vidibus.loader.unused = {}
+  },
+  
+  /**
+   * Removes resources given in list.
+   */
+  unload: function(resources) {
+    var src, data, resource;
+    $(resources).each(function() {
+      resource = this;
+      src = resource.src;
+
+      // console.log('REMOVE UNUSED RESOURCE: '+src);
+      
+      switch (resource.type) {
+        case "text/css": 
+          $('link[href="'+src+'"]').remove();
+          break;
+          
+        case "text/javascript": 
+          $('script[src="'+src+'"]').remove();
+          break;
+          
+        default: console.log('vidibus.loader.unload: unsupported resource type: '+resource.type);
+      }
+      delete vidibus.loader.loaded[resource.name];
+    });
+  },
+  
+  /**
+   * Appends given element to document head.
+   */
+  appendToHead: function(element) {
+    document.getElementsByTagName("head")[0].appendChild(element);
+  }
+};

data/public/javascripts/vidibus.xss.js

@@ -14,7 +14,6 @@
 //     $.ajax({...});
 // }
 
-
 vidibus.xss = {
   initialized: {},      // holds true for every scope that has been initialized
   fileExtension: 'xss', // use 'xss' as file extension
@@ -309,6 +308,7 @@ $(function($) {
             data['_method'] = method;
             method = 'POST';
           }
+          $.extend(data, vidibus.csrf.data());
           $.ajax({
             url: url,
             data: data,
@@ -316,6 +316,7 @@ $(function($) {
             type: method.toUpperCase(),
             beforeSend: function(xhr) {
               el.trigger('ajax:loading', xhr);
+              xhr.withCredentials = "true";
             },
             success: function(data, status, xhr) {
               el.trigger('ajax:success', [data, status, xhr]);
@@ -332,4 +333,17 @@ $(function($) {
       }
     }
   });
-});
+});
+
+/**
+ * Try to send xhr request withCredentials.
+ * Unfortunately, this has to be set after the connection has been opened.
+ * If you set a beforeSend handler yourself, you have to set withCredentials by yourself.
+ */
+$.ajaxSettings.beforeSend = function(xhr) {
+  try {
+    xhr.withCredentials = "true";
+  } catch(e) {
+    alert('Cannot set xhr with credentials:\n'+e)
+  }
+};

data/vidibus-xss.gemspec

@@ -5,18 +5,22 @@
 
 Gem::Specification.new do |s|
   s.name = %q{vidibus-xss}
-  s.version = "0.1.6"
+  s.version = "0.1.7"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["Andre Pankratz"]
-  s.date = %q{2010-08-17}
+  s.date = %q{2010-09-03}
   s.description = %q{Drop-in XSS support for remote applications.}
   s.email = %q{andre@vidibus.com}
   s.extra_rdoc_files = [
     "README.rdoc"
   ]
   s.files = [
-    ".gitignore",
+    ".bundle/config",
+     ".gitignore",
+     ".rspec",
+     "Gemfile",
+     "Gemfile.lock",
      "MIT-LICENSE",
      "README.rdoc",
      "Rakefile",
@@ -32,8 +36,8 @@ Gem::Specification.new do |s|
      "lib/vidibus/xss/mime_type.rb",
      "public/javascripts/jquery.ba-bbq.js",
      "public/javascripts/vidibus.js",
+     "public/javascripts/vidibus.loader.js",
      "public/javascripts/vidibus.xss.js",
-     "spec/spec.opts",
      "spec/spec_helper.rb",
      "vidibus-xss.gemspec"
   ]
@@ -51,24 +55,15 @@ Gem::Specification.new do |s|
     s.specification_version = 3
 
     if Gem::Version.new(Gem::VERSION) >= Gem::Version.new('1.2.0') then
-      s.add_development_dependency(%q<rspec>, [">= 1.2.9"])
-      s.add_development_dependency(%q<relevance-rcov>, [">= 0"])
-      s.add_development_dependency(%q<rr>, [">= 0"])
       s.add_runtime_dependency(%q<rails>, [">= 3.0.0.rc"])
       s.add_runtime_dependency(%q<nokogiri>, [">= 0"])
       s.add_runtime_dependency(%q<vidibus-routing_error>, [">= 0"])
     else
-      s.add_dependency(%q<rspec>, [">= 1.2.9"])
-      s.add_dependency(%q<relevance-rcov>, [">= 0"])
-      s.add_dependency(%q<rr>, [">= 0"])
       s.add_dependency(%q<rails>, [">= 3.0.0.rc"])
       s.add_dependency(%q<nokogiri>, [">= 0"])
       s.add_dependency(%q<vidibus-routing_error>, [">= 0"])
     end
   else
-    s.add_dependency(%q<rspec>, [">= 1.2.9"])
-    s.add_dependency(%q<relevance-rcov>, [">= 0"])
-    s.add_dependency(%q<rr>, [">= 0"])
     s.add_dependency(%q<rails>, [">= 3.0.0.rc"])
     s.add_dependency(%q<nokogiri>, [">= 0"])
     s.add_dependency(%q<vidibus-routing_error>, [">= 0"])

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification 
 name: vidibus-xss
 version: !ruby/object:Gem::Version 
-  hash: 23
+  hash: 21
   prerelease: false
   segments: 
   - 0
   - 1
-  - 6
-  version: 0.1.6
+  - 7
+  version: 0.1.7
 platform: ruby
 authors: 
 - Andre Pankratz
@@ -15,57 +15,13 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2010-08-17 00:00:00 +02:00
+date: 2010-09-03 00:00:00 +02:00
 default_executable: 
 dependencies: 
-- !ruby/object:Gem::Dependency 
-  name: rspec
-  prerelease: false
-  requirement: &id001 !ruby/object:Gem::Requirement 
-    none: false
-    requirements: 
-    - - ">="
-      - !ruby/object:Gem::Version 
-        hash: 13
-        segments: 
-        - 1
-        - 2
-        - 9
-        version: 1.2.9
-  type: :development
-  version_requirements: *id001
-- !ruby/object:Gem::Dependency 
-  name: relevance-rcov
-  prerelease: false
-  requirement: &id002 !ruby/object:Gem::Requirement 
-    none: false
-    requirements: 
-    - - ">="
-      - !ruby/object:Gem::Version 
-        hash: 3
-        segments: 
-        - 0
-        version: "0"
-  type: :development
-  version_requirements: *id002
-- !ruby/object:Gem::Dependency 
-  name: rr
-  prerelease: false
-  requirement: &id003 !ruby/object:Gem::Requirement 
-    none: false
-    requirements: 
-    - - ">="
-      - !ruby/object:Gem::Version 
-        hash: 3
-        segments: 
-        - 0
-        version: "0"
-  type: :development
-  version_requirements: *id003
 - !ruby/object:Gem::Dependency 
   name: rails
   prerelease: false
-  requirement: &id004 !ruby/object:Gem::Requirement 
+  requirement: &id001 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
     - - ">="
@@ -78,11 +34,11 @@ dependencies:
         - rc
         version: 3.0.0.rc
   type: :runtime
-  version_requirements: *id004
+  version_requirements: *id001
 - !ruby/object:Gem::Dependency 
   name: nokogiri
   prerelease: false
-  requirement: &id005 !ruby/object:Gem::Requirement 
+  requirement: &id002 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
     - - ">="
@@ -92,11 +48,11 @@ dependencies:
         - 0
         version: "0"
   type: :runtime
-  version_requirements: *id005
+  version_requirements: *id002
 - !ruby/object:Gem::Dependency 
   name: vidibus-routing_error
   prerelease: false
-  requirement: &id006 !ruby/object:Gem::Requirement 
+  requirement: &id003 !ruby/object:Gem::Requirement 
     none: false
     requirements: 
     - - ">="
@@ -106,7 +62,7 @@ dependencies:
         - 0
         version: "0"
   type: :runtime
-  version_requirements: *id006
+  version_requirements: *id003
 description: Drop-in XSS support for remote applications.
 email: andre@vidibus.com
 executables: []
@@ -116,7 +72,11 @@ extensions: []
 extra_rdoc_files: 
 - README.rdoc
 files: 
+- .bundle/config
 - .gitignore
+- .rspec
+- Gemfile
+- Gemfile.lock
 - MIT-LICENSE
 - README.rdoc
 - Rakefile
@@ -132,8 +92,8 @@ files:
 - lib/vidibus/xss/mime_type.rb
 - public/javascripts/jquery.ba-bbq.js
 - public/javascripts/vidibus.js
+- public/javascripts/vidibus.loader.js
 - public/javascripts/vidibus.xss.js
-- spec/spec.opts
 - spec/spec_helper.rb
 - vidibus-xss.gemspec
 has_rdoc: true

data/spec/spec.opts

@@ -1,2 +0,0 @@
---color
---format nested