From 1ef9ddde90a6a10099faecc93542335c437cfb09 Mon Sep 17 00:00:00 2001
From: Jared Crapo <jared@kotfu.net>
Date: Thu, 21 Oct 2010 11:56:36 -0700
Subject: Fixed typo in code for Session Expiry

---
 railties/guides/source/security.textile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'railties/guides/source/security.textile')

diff --git a/railties/guides/source/security.textile b/railties/guides/source/security.textile
index 4656cf4e40..e2103959ac 100644
--- a/railties/guides/source/security.textile
+++ b/railties/guides/source/security.textile
@@ -166,7 +166,7 @@ end
 The section about session fixation introduced the problem of maintained sessions. An attacker maintaining a session every five minutes can keep the session alive forever, although you are expiring sessions. A simple solution for this would be to add a created_at column to the sessions table. Now you can delete sessions that were created a long time ago. Use this line in the sweep method above:
 
 <ruby>
-delete_all "updated_at < '#{time.to_s(:db)}' OR
+delete_all "updated_at < '#{time.ago.to_s(:db)}' OR
   created_at < '#{2.days.ago.to_s(:db)}'"
 </ruby>
 
-- 
cgit v1.2.3


From 3d377454dbeb9ab9fc0a4d491498c237e33e8d4b Mon Sep 17 00:00:00 2001
From: eparreno <emili@eparreno.com>
Date: Mon, 15 Nov 2010 19:21:40 +0100
Subject: remove old school validations and replaced with new validates method.
 Pending: fix active_record guide

---
 railties/guides/source/security.textile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'railties/guides/source/security.textile')

diff --git a/railties/guides/source/security.textile b/railties/guides/source/security.textile
index 693645b202..6f766430c1 100644
--- a/railties/guides/source/security.textile
+++ b/railties/guides/source/security.textile
@@ -550,7 +550,7 @@ Ruby uses a slightly different approach than many other languages to match the e
 
 <ruby>
 class File < ActiveRecord::Base
-  validates_format_of :name, :with => /^[\w\.\-\+]+$/
+  validates :name, format => /^[\w\.\-\+]+$/
 end
 </ruby>
 
-- 
cgit v1.2.3


From 2515ad8a3e03402c1d5a5f9b46c48a3a9bf75081 Mon Sep 17 00:00:00 2001
From: Pavel Gorbokon <pahanix@gmail.com>
Date: Mon, 22 Nov 2010 16:37:33 +0200
Subject: Fix ruby syntax errors in railties/guides docs

---
 railties/guides/source/security.textile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'railties/guides/source/security.textile')

diff --git a/railties/guides/source/security.textile b/railties/guides/source/security.textile
index 6f766430c1..5b24d8c8e3 100644
--- a/railties/guides/source/security.textile
+++ b/railties/guides/source/security.textile
@@ -550,7 +550,7 @@ Ruby uses a slightly different approach than many other languages to match the e
 
 <ruby>
 class File < ActiveRecord::Base
-  validates :name, format => /^[\w\.\-\+]+$/
+  validates :name, :format => /^[\w\.\-\+]+$/
 end
 </ruby>
 
-- 
cgit v1.2.3


From e15a55c862c98d05ff95e7fa3162ed1298ba8be7 Mon Sep 17 00:00:00 2001
From: Vijay Dev <vijaydev.cse@gmail.com>
Date: Wed, 15 Dec 2010 22:35:09 +0530
Subject: filter_parameter_logging is deprecated in Rails 3. Changed it to
 config.filter_parameters

---
 railties/guides/source/security.textile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'railties/guides/source/security.textile')

diff --git a/railties/guides/source/security.textile b/railties/guides/source/security.textile
index 528c8861d4..9963106ff3 100644
--- a/railties/guides/source/security.textile
+++ b/railties/guides/source/security.textile
@@ -524,10 +524,10 @@ h4. Logging
 
 -- _Tell Rails not to put passwords in the log files._
 
-By default, Rails logs all requests being made to the web application. But log files can be a huge security issue, as they may contain login credentials, credit card numbers et cetera. When designing a web application security concept, you should also think about what will happen if an attacker got (full) access to the web server. Encrypting secrets and passwords in the database will be quite useless, if the log files list them in clear text. You can _(highlight)filter certain request parameters from your log files_ by the filter_parameter_logging method in a controller. These parameters will be marked [FILTERED] in the log.
+By default, Rails logs all requests being made to the web application. But log files can be a huge security issue, as they may contain login credentials, credit card numbers et cetera. When designing a web application security concept, you should also think about what will happen if an attacker got (full) access to the web server. Encrypting secrets and passwords in the database will be quite useless, if the log files list them in clear text. You can _(highlight)filter certain request parameters from your log files_ by appending them to config.filter_parameters in the application configuration. These parameters will be marked [FILTERED] in the log.
 
 <ruby>
-filter_parameter_logging :password
+config.filter_parameters << :password
 </ruby>
 
 h4. Good Passwords
-- 
cgit v1.2.3


From 7a028eae7914f8099b4369b51c2d06a47ecdab9e Mon Sep 17 00:00:00 2001
From: Vijay Dev <vijaydev.cse@gmail.com>
Date: Wed, 15 Dec 2010 23:13:22 +0530
Subject: fixed font

---
 railties/guides/source/security.textile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'railties/guides/source/security.textile')

diff --git a/railties/guides/source/security.textile b/railties/guides/source/security.textile
index 9963106ff3..fbafc40d93 100644
--- a/railties/guides/source/security.textile
+++ b/railties/guides/source/security.textile
@@ -524,7 +524,7 @@ h4. Logging
 
 -- _Tell Rails not to put passwords in the log files._
 
-By default, Rails logs all requests being made to the web application. But log files can be a huge security issue, as they may contain login credentials, credit card numbers et cetera. When designing a web application security concept, you should also think about what will happen if an attacker got (full) access to the web server. Encrypting secrets and passwords in the database will be quite useless, if the log files list them in clear text. You can _(highlight)filter certain request parameters from your log files_ by appending them to config.filter_parameters in the application configuration. These parameters will be marked [FILTERED] in the log.
+By default, Rails logs all requests being made to the web application. But log files can be a huge security issue, as they may contain login credentials, credit card numbers et cetera. When designing a web application security concept, you should also think about what will happen if an attacker got (full) access to the web server. Encrypting secrets and passwords in the database will be quite useless, if the log files list them in clear text. You can _(highlight)filter certain request parameters from your log files_ by appending them to <tt>config.filter_parameters</tt> in the application configuration. These parameters will be marked [FILTERED] in the log.
 
 <ruby>
 config.filter_parameters << :password
-- 
cgit v1.2.3

