wicked 0.3.4 → 0.4.0

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+## 0.4.0
+* User imputs no longer converted to symbol this mitigates risk of DoS
+via symbol table or RAM (symbols are not garbage collected).
+
 ## 0.3.4
 * Dynamic steps officially supported and tested
 
@@ -63,4 +67,4 @@
 
 ## 0.0.1
 
-* First Release
+* First Release

data/README.md

@@ -1,4 +1,6 @@
-# Wicked
+![](http://cl.ly/image/3O2i1P061o3y/content.png)
+
+# Step-By-Step Wizard Controllers
 
 [![Build Status](https://secure.travis-ci.org/schneems/wicked.png)](http://travis-ci.org/schneems/wicked) [![Code Climate](https://codeclimate.com/badge.png)](https://codeclimate.com/github/schneems/wicked)
 
@@ -13,7 +15,7 @@ Many times I'm left wanting a RESTful way to display a step by step process that
 Add this to your Gemfile
 
 ```ruby
-  gem 'wicked'
+gem 'wicked'
 ```
 
 Then run `bundle install` and you're ready to start
@@ -29,27 +31,29 @@ Then run `bundle install` and you're ready to start
 
 ## How
 
-We are going to build an 'after signup' wizard. First create a controller:
+We are going to build an 'after signup' wizard. If you don't have a `current_user` then check out how to [Build a step-by-step object with Wicked](https://github.com/schneems/wicked/wiki/Building-Partial-Objects-Step-by-Step).
+
+First create a controller:
 
 ```
-  rails g controller after_signup
+rails g controller after_signup
 ```
 
 Add Routes into `config/routes.rb`:
 
 ```ruby
-  resources :after_signup
+resources :after_signup
 ```
 
 Next include `Wicked::Wizard` in your controller
 
 ```ruby
 
-  class AfterSignupController < ApplicationController
-    include Wicked::Wizard
+class AfterSignupController < ApplicationController
+  include Wicked::Wizard
 
-    steps :confirm_password, :confirm_profile, :find_friends
-    # ...
+  steps :confirm_password, :confirm_profile, :find_friends
+  # ...
 
 ```
 
@@ -57,30 +61,30 @@ You can also use the old way of inheriting from `Wicked::WizardController`.
 
 ```ruby
 
-  class AfterSignupController < Wicked::WizardController
+class AfterSignupController < Wicked::WizardController
 
-    steps :confirm_password, :confirm_profile, :find_friends
-    # ...
+  steps :confirm_password, :confirm_profile, :find_friends
+  # ...
 
 ```
 
 The wizard is set to call steps in order in the show action, you can specify custom logic in your show using a case statement like below. To send someone to the first step in this wizard we can direct them to `after_signup_path(:confirm_password)`.
 
 ```ruby
-  class AfterSignupController < ApplicationController
-    include Wicked::Wizard
-
-    steps :confirm_password, :confirm_profile, :find_friends
-
-    def show
-      @user = current_user
-      case step
-      when :find_friends
-        @friends = @user.find_friends
-      end
-      render_wizard
+class AfterSignupController < ApplicationController
+  include Wicked::Wizard
+
+  steps :confirm_password, :confirm_profile, :find_friends
+
+  def show
+    @user = current_user
+    case step
+    when :find_friends
+      @friends = @user.find_friends
     end
+    render_wizard
   end
+end
 ```
 
 **Note:** Wicked uses the `:id` parameter to control the flow of steps, if you need to have an id parameter, please use nested routes see [building objects with wicked](https://github.com/schneems/wicked/wiki/Partial-Validation-of-Active-Record-Objects) for an example. It will need to be prefixed, for example a Product's `:id` would be `:product_id`
@@ -91,35 +95,35 @@ By default the wizard will render a view with the same name as the step. So for
 
 Then in your view you can use the helpers to get to the next step.
 
-```ruby
-   <%= link_to 'skip', next_wizard_path %>
+```erb
+<%= link_to 'skip', next_wizard_path %>
 ```
 
 You can manually specify which wizard action you want to link to by using the wizard_path helper.
 
-```ruby
-   <%= link_to 'skip', wizard_path(:find_friends) %>
+```erb
+<%= link_to 'skip', wizard_path(:find_friends) %>
 ```
 
 In addition to showing sequential views we can update elements in our controller.
 
 
 ```ruby
-  class AfterSignupController < ApplicationController
-    include Wicked::Wizard
-
-    steps :confirm_password, :confirm_profile, :find_friends
-
-    def update
-      @user = current_user
-      case step
-      when :confirm_password
-        @user.update_attributes(params[:user])
-      end
-      sign_in(@user, :bypass => true) # needed for devise
-      render_wizard @user
+class AfterSignupController < ApplicationController
+  include Wicked::Wizard
+
+  steps :confirm_password, :confirm_profile, :find_friends
+
+  def update
+    @user = current_user
+    case step
+    when :confirm_password
+      @user.update_attributes(params[:user])
     end
+    sign_in(@user, :bypass => true) # needed for devise
+    render_wizard @user
   end
+end
 ```
 
 We're passing `render_wizard` our `@user` object here. If you pass an object into `render_wizard` it will show the next step if the object saves or re-render the previous view if it does not save.
@@ -127,15 +131,13 @@ We're passing `render_wizard` our `@user` object here. If you pass an object int
 
 To get to this update action, you simply need to submit a form that PUT's to the same url
 
-```ruby
-
-    <%= form_for @user, :url => wizard_path, :method => :put do |f| %>
-      <%=  f.password_field :password  %>
-      <%=  f.password_field :password_confirmation  %>
-
-      <%= f.submit "Change Password" %>
-    <% end %>
+```erb
+<%= form_for @user, :url => wizard_path, :method => :put do |f| %>
+  <%=  f.password_field :password  %>
+  <%=  f.password_field :password_confirmation  %>
 
+  <%= f.submit "Change Password" %>
+<% end %>
 ```
 
 We explicitly tell the form to PUT above. If you forget this, you will get a warning about the create action not existing, or no route found for POST. Don't forget this.
@@ -144,20 +146,18 @@ We explicitly tell the form to PUT above. If you forget this, you will get a war
 In the controller if you find that you want to skip a step, you can do it simply by calling `skip_step`
 
 ```ruby
-
-  def show
-    @user = current_user
-    case step
-    when :find_friends
-      if @user.has_facebook_access_token?
-        @friends = @user.find_friends
-      else
-        skip_step
-      end
+def show
+  @user = current_user
+  case step
+  when :find_friends
+    if @user.has_facebook_access_token?
+      @friends = @user.find_friends
+    else
+      skip_step
     end
-    render_wizard
   end
-
+  render_wizard
+end
 ```
 
 Now you've got a fully functioning AfterSignup controller! If you have questions or if you struggled with something, let me know on [twitter](http://twitter.com/schneems), and i'll try to make it better or make the docs better.
@@ -167,26 +167,25 @@ Now you've got a fully functioning AfterSignup controller! If you have questions
 View/URL Helpers
 
 ```ruby
+wizard_path                  # Grabs the current path in the wizard
+wizard_path(:specific_step)  # Url of the :specific_step
+next_wizard_path             # Url of the next step
+previous_wizard_path         # Url of the previous step
 
-  wizard_path                  # Grabs the current path in the wizard
-  wizard_path(:specific_step)  # Url of the :specific_step
-  next_wizard_path             # Url of the next step
-  previous_wizard_path         # Url of the previous step
-
-  # These only work while in a Wizard, and are not absolute paths
-  # You can have multiple wizards in a project with multiple `wizard_path` calls
+# These only work while in a Wizard, and are not absolute paths
+# You can have multiple wizards in a project with multiple `wizard_path` calls
 ```
 
 
 Controller Tidbits:
 
 ```ruby
-  steps  :first, :second       # Sets the order of steps
-  step                         # Gets symbol of current step
-  next_step                    # Gets symbol of next step
-  skip_step                    # Tells render_wizard to skip to the next logical step
-  render_wizard                # Renders the current step
-  render_wizard(@user)         # Shows next_step if @user.save, otherwise renders current step
+steps  :first, :second       # Sets the order of steps
+step                         # Gets symbol of current step
+next_step                    # Gets symbol of next step
+skip_step                    # Tells render_wizard to skip to the next logical step
+render_wizard                # Renders the current step
+render_wizard(@user)         # Shows next_step if @user.save, otherwise renders current step
 ```
 
 
@@ -195,8 +194,8 @@ Finally:
 Don't forget to create your named views
 
 ```
-  app/
-   views/
+app/
+  views/
     controller_name/
       first.html.erb
       second.html.erb
@@ -209,21 +208,21 @@ Don't forget to create your named views
 You can specify the url that your user goes to by over-riding the `finish_wizard_path` in your wizard controller.
 
 
-```
-  def finish_wizard_path
-    user_path(current_user)
-  end
+```ruby
+def finish_wizard_path
+  user_path(current_user)
+end
 ```
 
 
 ### Testing with RSpec
 
 ```ruby
-  # Test find_friends block of show action
-  get :show, :id => :find_friends
+# Test find_friends block of show action
+get :show, :id => :find_friends
 
-  # Test find_friends block of update action
-  put :update, {'id' => 'find_friends', "user" => { "id" => @user.id.to_s }}
+# Test find_friends block of update action
+put :update, {'id' => 'find_friends', "user" => { "id" => @user.id.to_s }}
 ```
 
 
@@ -231,11 +230,15 @@ You can specify the url that your user goes to by over-riding the `finish_wizard
 
 If your site works in multiple languages, or if you just want more control over how your URL's look you can now use I18n with wicked. To do so you need to replace this:
 
-    include Wicked::Wizard
+```ruby
+include Wicked::Wizard
+```
 
 With this:
 
-    include Wicked::Wizard::Translated
+```ruby
+include Wicked::Wizard::Translated
+```
 
 This will allow you to specify translation keys instead of literal step names. Let's say you've got steps that look like this:
 
@@ -245,26 +248,29 @@ So the urls would be `/after_signup/first` and `/after_signup/second`. But you w
 
 To internationalize first you need to create your locales files under `config/locales` such as `config/locales/es.yml` for Spanish. You then need to add a `first` and `second` key under a `wicked` key like this:
 
-    es:
-      hello: "hola mundo"
-      wicked:
-        first: "uno"
-        second: "dos"
+```yaml
+es:
+  hello: "hola mundo"
+  wicked:
+    first: "uno"
+    second: "dos"
+```
 
 It would also be a good idea to create a english version under `config/locales/en.yml` or your english speaking friends will get errors. If your app already uses I18n you don't need to do anything else, if not you will need to make sure that you set the `I18n.locale` on each request you could do this somewhere like a before filter in your application_controller.rb
 
+```ruby
+before_filter :set_locale
 
-    before_filter :set_locale
+private
 
-    private
+def set_locale
+  I18n.locale = params[:locale] if params[:locale].present?
+end
 
-    def set_locale
-      I18n.locale = params[:locale] if params[:locale].present?
-    end
-
-    def default_url_options(options = {})
-      {locale: I18n.locale}
-    end
+def default_url_options(options = {})
+  {locale: I18n.locale}
+end
+```
 
 For a screencast on setting up and using I18n check out [Railscasts](http://railscasts.com/episodes/138-i18n-revised). You can also read the [free I18n Rails Guide](http://guides.rubyonrails.org/i18n.html).
 
@@ -276,19 +282,25 @@ Wicked expects your files to be named the same as your keys, so when a user visi
 
 Very similar to using I18n from above but instead of making new files for different languages, you can stick with one language. Make sure you are using the right module:
 
-    include Wicked::Wizard::Translated
+```ruby
+include Wicked::Wizard::Translated
+```
 
 Then you'll need to specify translations in your language file. For me, the language I'm using is english so I can add translations to `config/locales/en.yml`
 
-    en:
-      hello: "hello world"
-      wicked:
-        first: "verify_email"
-        second: "if_you_are_popular_add_friends"
+```yaml
+en:
+  hello: "hello world"
+  wicked:
+    first: "verify_email"
+    second: "if_you_are_popular_add_friends"
+```
 
 Now you can change the values in the URL's to whatever you want without changing your controller or your files, just modify your `en.yml`. If you're not using English you can set your default_locale to something other than `en` in your `config/application.rb` file.
 
-    config.i18n.default_locale = :de
+```ruby
+config.i18n.default_locale = :de
+```
 
 Custom crafted wizard urls: just another way Wicked makes your app a little more saintly.
 
@@ -296,22 +308,23 @@ Custom crafted wizard urls: just another way Wicked makes your app a little more
 
 If you wish to set the order of your steps dynamically you can do this with a `prepend_before_filter` and `self.steps =` like this:
 
-```
-  include Wicked::Wizard
-  prepend_before_filter :set_steps
+```ruby
+include Wicked::Wizard
+prepend_before_filter :set_steps
 
-  # ...
+# ...
 
-  private
-  def set_steps
-    if params[:flow] == "twitter"
-      self.steps = [:ask_twitter, :ask_email]
-    elsif params[:flow] == "facebook"
-      self.steps = [:ask_facebook, :ask_email]
-    end
+private
+def set_steps
+  if params[:flow] == "twitter"
+    self.steps = [:ask_twitter, :ask_email]
+  elsif params[:flow] == "facebook"
+    self.steps = [:ask_facebook, :ask_email]
   end
+end
 ```
 
+Note: Do not pass user submitted params directly into `self.steps` while using the custom or translated urls. The translator calls `to_sym` on steps provided, and if a user is allowed to submit arbitrary symbols, they could flood the take down your production app by filling up the symbol table. So just don't do it.
 
 ## About
 
@@ -319,4 +332,4 @@ Please poke around the source code, if you see easier ways to get a Rails contro
 
 If you have a question file an issue or, find me on the Twitters [@schneems](http://twitter.com/schneems).
 
-This project rocks and uses MIT-LICENSE.
+This project rocks and uses MIT-LICENSE.

data/VERSION

@@ -1 +1 @@
-0.3.4
+0.4.0

data/lib/wicked/controller/concerns/render_redirect.rb

@@ -23,7 +23,7 @@ module Wicked::Controller::Concerns::RenderRedirect
   end
 
   def render_step(the_step, options = {})
-    if the_step.nil? || the_step == :finish
+    if the_step.nil? || the_step.to_s == 'finish'
       redirect_to_finish_wizard options
     else
       render the_step, options

data/lib/wicked/controller/concerns/steps.rb

@@ -25,7 +25,7 @@ module Wicked::Controller::Concerns::Steps
     current_step_index > step_index_for(step_name)
   end
 
-  # will return true if the step passed in has already been executed by the wizard
+  # will return true if the step passed in has not been executed by the wizard
   def future_step?(step_name)
     return false unless current_and_given_step_exists?(step_name)
     current_step_index < step_index_for(step_name)

data/lib/wicked/wizard.rb

@@ -29,14 +29,15 @@ module Wicked
     end
 
     def check_redirect_to_first_last!(step)
-      redirect_to wizard_path(steps.first) if step == :wizard_first
-      redirect_to wizard_path(steps.last)  if step == :wizard_last
+      redirect_to wizard_path(steps.first) if step.to_s == 'wizard_first'
+      redirect_to wizard_path(steps.last)  if step.to_s == 'wizard_last'
     end
 
     def setup_step_from(the_step)
-      the_step = the_step.try(:to_sym) || steps.try(:first)
+      the_step = the_step || steps.try(:first)
       check_redirect_to_first_last!(the_step)
-      return the_step
+      step = steps.detect {|stp| stp.to_s == the_step } if steps.present? && the_step.present?
+      return step || the_step
     end
 
     def check_steps!(the_step)
@@ -52,4 +53,5 @@ module Wicked
     end
     public
   end
-end
+end
+

data/lib/wicked/wizard/translated.rb

@@ -10,8 +10,8 @@ module Wicked
       end
 
       # creates a hash where keys are translated steps, values are the name of the view file
-      # {:first=>"first", :second=>"second"}
-      # {:uno=>"first", :dos=>"second"}
+      # {:first => "first", :second => "second"}
+      # {:uno   => "first",   :dos  => "second"}
       #
       def wizard_translations
         @wizard_translations ||= steps.inject(ActiveSupport::OrderedHash.new) do |hash, step|
@@ -41,9 +41,9 @@ module Wicked
       #     steps "wicked.first", "wicked.second"
       #
       def setup_wizard_translated
+        self.steps     = wizard_translations.keys     # must come before setting previous/next steps
         step_name      = setup_step_from(params[:id])
         check_steps!(step_name)
-        self.steps     = wizard_translations.keys        # must come before setting previous/next steps
         @previous_step = previous_step(step_name)
         @next_step     = next_step(step_name)
         @step          = wizard_translations[step_name]  # translates step name to url
@@ -51,4 +51,4 @@ module Wicked
       public
     end
   end
-end
+end

data/test/dummy/app/controllers/dynamic_steps_controller.rb

@@ -10,7 +10,7 @@ class DynamicStepsController < ApplicationController
   private
   def set_steps
     self.steps = if params[:steps]
-      params[:steps].map(&:to_sym)
+      params[:steps]
     end
   end
 end

data/test/dummy/app/controllers/steps_controller.rb

@@ -5,6 +5,13 @@ class StepPositionsController < ApplicationController
   steps :first, :second, :last_step
 
   def show
+    case step
+    when :first
+    when :second
+    when :last_step
+    else
+      raise "error #{step.inspect}"
+    end
     render_wizard
   end
 

data/test/integration/dynamic_steps_test.rb

@@ -2,7 +2,7 @@ require 'test_helper'
 
 class DynamicStepsTest < ActiveSupport::IntegrationCase
   test 'set dynamic steps from params' do
-    steps = [:first, :second]
+    steps = ['first', 'second']
     visit dynamic_steps_path(:steps => steps)
     assert has_content?(steps.first.inspect)
     assert has_content?(steps.inspect)

data/wicked.gemspec

@@ -5,11 +5,11 @@
 
 Gem::Specification.new do |s|
   s.name = "wicked"
-  s.version = "0.3.4"
+  s.version = "0.4.0"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["schneems"]
-  s.date = "2012-12-22"
+  s.date = "2013-01-16"
   s.description = "Wicked is a Rails engine for producing easy wizard controllers"
   s.email = "richard.schneeman@gmail.com"
   s.extra_rdoc_files = [

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: wicked
 version: !ruby/object:Gem::Version
-  version: 0.3.4
+  version: 0.4.0
   prerelease: 
 platform: ruby
 authors:
@@ -9,11 +9,11 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-12-22 00:00:00.000000000Z
+date: 2013-01-16 00:00:00.000000000Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
-  requirement: &70241592223140 !ruby/object:Gem::Requirement
+  requirement: &70204702345240 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -21,10 +21,10 @@ dependencies:
         version: 3.0.7
   type: :runtime
   prerelease: false
-  version_requirements: *70241592223140
+  version_requirements: *70204702345240
 - !ruby/object:Gem::Dependency
   name: rails
-  requirement: &70241592222660 !ruby/object:Gem::Requirement
+  requirement: &70204702344580 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -32,10 +32,10 @@ dependencies:
         version: 3.0.7
   type: :runtime
   prerelease: false
-  version_requirements: *70241592222660
+  version_requirements: *70204702344580
 - !ruby/object:Gem::Dependency
   name: rake
-  requirement: &70241592222140 !ruby/object:Gem::Requirement
+  requirement: &70204702343980 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -43,10 +43,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70241592222140
+  version_requirements: *70204702343980
 - !ruby/object:Gem::Dependency
   name: jeweler
-  requirement: &70241592221620 !ruby/object:Gem::Requirement
+  requirement: &70204702341060 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -54,10 +54,10 @@ dependencies:
         version: 1.6.4
   type: :development
   prerelease: false
-  version_requirements: *70241592221620
+  version_requirements: *70204702341060
 - !ruby/object:Gem::Dependency
   name: rcov
-  requirement: &70241592221140 !ruby/object:Gem::Requirement
+  requirement: &70204702340560 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -65,10 +65,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70241592221140
+  version_requirements: *70204702340560
 - !ruby/object:Gem::Dependency
   name: capybara
-  requirement: &70241592220640 !ruby/object:Gem::Requirement
+  requirement: &70204702340040 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -76,10 +76,10 @@ dependencies:
         version: 0.4.0
   type: :development
   prerelease: false
-  version_requirements: *70241592220640
+  version_requirements: *70204702340040
 - !ruby/object:Gem::Dependency
   name: launchy
-  requirement: &70241592220080 !ruby/object:Gem::Requirement
+  requirement: &70204702339560 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -87,10 +87,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70241592220080
+  version_requirements: *70204702339560
 - !ruby/object:Gem::Dependency
   name: sqlite3
-  requirement: &70241592219520 !ruby/object:Gem::Requirement
+  requirement: &70204702339020 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -98,10 +98,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70241592219520
+  version_requirements: *70204702339020
 - !ruby/object:Gem::Dependency
   name: activerecord-jdbcsqlite3-adapter
-  requirement: &70241592218960 !ruby/object:Gem::Requirement
+  requirement: &70204702338540 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -109,7 +109,7 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *70241592218960
+  version_requirements: *70204702338540
 description: Wicked is a Rails engine for producing easy wizard controllers
 email: richard.schneeman@gmail.com
 executables: []
@@ -217,7 +217,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: 3202762565792531616
+      hash: -2935823026133279485
 required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
   requirements: