Changeset 5766

Timestamp:

05/28/08 13:29:30 (2 years ago)

Author:

uta

Message:

2008/05/28 sync

Files:

• plugins/rails_protection/trunk/rails_protection/lib/custom_sanitizer_rules/tiny_mce.rb (modified) (8 diffs)
• plugins/rails_protection/trunk/rails_protection/lib/rails_protection_for_csrf.rb (modified) (4 diffs)

plugins/rails_protection/trunk/rails_protection/lib/custom_sanitizer_rules/tiny_mce.rb

@@ -3 +3 @@
-    :class          => /\A[-_a-zA-Z0-9]+\Z/mn,
-    :href           => %r(\A(?:http|https|ftp)://|\A/(?:images|javascripts|stylesheets))mn,
+    :id             => /\A[a-zA-Z][a-zA-Z0-9_:.-]*\Z/mn,
-    :name           => /\A[-_a-zA-Z0-9]+\Z/mn,
-    :target         => /\A_self|_blank\z/mn,
-    :title          => /.+/mn,
-    :type           => /.+/mn,
-    :id             => /.+/mn,
-  },
-  :b => {
@@ -28 +28 @@
-    :class          => /\A[-_a-zA-Z0-9]+\Z/mn,
-    :style          => {
+      :'border'             => /\A((dashed|dotted|double|groove|hidden|inset|none|outset|ridge|solid|[a-z]{3,20}|#[a-fA-F0-9]{3}|#[a-fA-F0-9]{6}|rgb\s*\(\s*[0-9]{3}\s*,\s*[0-9]{3}\s*,\s*[0-9]{3}\s*\)|[0-9]+px)\s*){1,3}\Z/mn,
-      :'border-style'       => /\Adashed|dotted|double|groove|hidden|inset|none|outset|ridge|solid\Z/mn,
-      :'border-width'       => /\A[0-9]+px\Z/mn,
@@ -37 +38 @@
-      :'overflow'           => /\Aauto|hidden|scroll|visible\Z/mn,
-      :'white-space'        => /\Anormal|nowrap|pre\Z/mn,
-      :'border'             => /\A((dashed|dotted|double|groove|hidden|inset|none|outset|ridge|solid|[a-z]{3,20}|#[a-fA-F0-9]{3}|#[a-fA-F0-9]{6}|rgb\s*\(\s*[0-9]{3}\s*,\s*[0-9]{3}\s*,\s*[0-9]{3}\s*\)|[0-9]+px)\s*){1,3}\Z/mn,
-    },
-  },
@@ -119 +119 @@
-    :height         => /\A[1-4]?[0-9]?[0-9]\Z/mn,
-    :hspace         => /\A[0-9]\Z/mn,
+    :id             => /\A[a-zA-Z][a-zA-Z0-9_:.-]*\Z/mn,
-    :src            => %r(/stream/[0-9]+\z|\.(?:gif|jpe?g|png)(?:\?[0-9]+)?\z)mn,
-    :title          => /.+/mn,
-    :vspace         => /\A[0-9]\Z/mn,
-    :width          => /\A[1-6]?[0-9]?[0-9]\Z/mn,
-    :id             => /.+/mn,
-  },
-  :li => {
@@ -203 +203 @@
-    :style          => {
-      :'background-color'   => /\A([a-z]{3,20}|#[a-fA-F0-9]{3}|#[a-fA-F0-9]{6}|rgb\s*\(\s*[0-9]{3}\s*,\s*[0-9]{3}\s*,\s*[0-9]{3}\s*\))\Z/mn,
-
-
-
+
+
+
+
+
-    },
-    :summary        => /.+/mn,
@@ -222 +224 @@
-    :style          => {
-      :'background-color'   => /\A([a-z]{3,20}|#[a-fA-F0-9]{3}|#[a-fA-F0-9]{6}|rgb\s*\(\s*[0-9]{3}\s*,\s*[0-9]{3}\s*,\s*[0-9]{3}\s*\))\Z/mn,
--color'       => /\A([a-z]{3,20}|#[a-fA-F0-9]{3}|#[a-fA-F0-9]{6}|rgb\s*\(\s*[0-9]{3}\s*,\s*[0-9]{3}\s*,\s*[0-9]{3}\s*\))
-width'       => /\A[0-9]px
-'             => /\A((dashed|dotted|double|groove|hidden|inset|none|outset|ridge|solid|[a-z]{3,20}|#[a-fA-F0-9]{3}|#[a-fA-F0-9]{6}|rgb\s*\(\s*[0-9]{3}\s*,\s*[0-9]{3}\s*,\s*[0-9]{3}\s*\)|[0-9]+px)\s*){1,3}
+'             => /\A((dashed|dotted|double|groove|hidden|inset|none|outset|ridge|solid|[a-z]{3,20}|#[a-fA-F0-9]{3}|#[a-fA-F0-9]{6}|rgb\s*\(\s*[0-9]{3}\s*,\s*[0-9]{3}\s*,\s*[0-9]{3}\s*\)|[0-9]+px)\s*){1,3}
+color'       => /\A([a-z]{3,20}|#[a-fA-F0-9]{3}|#[a-fA-F0-9]{6}|rgb\s*\(\s*[0-9]{3}\s*,\s*[0-9]{3}\s*,\s*[0-9]{3}\s*\))
+-width'       => /\A[0-9]px
-    },
-    :valign         => /\Atop|middle|bottom\Z/mn,
@@ -241 +243 @@
-    :style          => {
-      :'background-color'   => /\A([a-z]{3,20}|#[a-fA-F0-9]{3}|#[a-fA-F0-9]{6}|rgb\s*\(\s*[0-9]{3}\s*,\s*[0-9]{3}\s*,\s*[0-9]{3}\s*\))\Z/mn,
+      :'border'             => /\A((dashed|dotted|double|groove|hidden|inset|none|outset|ridge|solid|[a-z]{3,20}|#[a-fA-F0-9]{3}|#[a-fA-F0-9]{6}|rgb\s*\(\s*[0-9]{3}\s*,\s*[0-9]{3}\s*,\s*[0-9]{3}\s*\)|[0-9]+px)\s*){1,3}\Z/mn,
-      :'border-color'       => /\A([a-z]{3,20}|#[a-fA-F0-9]{3}|#[a-fA-F0-9]{6}|rgb\s*\(\s*[0-9]{3}\s*,\s*[0-9]{3}\s*,\s*[0-9]{3}\s*\))\Z/mn,
-      :'border-width'       => /\A[0-9]px\Z/mn,
@@ -257 +260 @@
-    :style          => {
-      :'background-color'   => /\A([a-z]{3,20}|#[a-fA-F0-9]{3}|#[a-fA-F0-9]{6}|rgb\s*\(\s*[0-9]{3}\s*,\s*[0-9]{3}\s*,\s*[0-9]{3}\s*\))\Z/mn,
+      :'border'             => /\A((dashed|dotted|double|groove|hidden|inset|none|outset|ridge|solid|[a-z]{3,20}|#[a-fA-F0-9]{3}|#[a-fA-F0-9]{6}|rgb\s*\(\s*[0-9]{3}\s*,\s*[0-9]{3}\s*,\s*[0-9]{3}\s*\)|[0-9]+px)\s*){1,3}\Z/mn,
-      :'border-color'       => /\A([a-z]{3,20}|#[a-fA-F0-9]{3}|#[a-fA-F0-9]{6}|rgb\s*\(\s*[0-9]{3}\s*,\s*[0-9]{3}\s*,\s*[0-9]{3}\s*\))\Z/mn,
-      :'border-width'       => /\A[0-9]px\Z/mn,

plugins/rails_protection/trunk/rails_protection/lib/rails_protection_for_csrf.rb

@@ -3 +3 @@
-    module ActionControllerMethods #:nodoc:
-      def protection_for_csrf
-
-
+
+
+
+
+
+
+
+
-        end
-      end
@@ -59 +65 @@
-    end
-
+    module ActiveRecordMethods #:nodoc:
+      def validate_for_csrf
+        raise RailsProtection::Csrf::SessionValidateException if Thread.current[:rails_protection_refuse_update] && self.ignore_csrf_validation.blank?
+      end
+    end
+
-    class SessionValidateException < ::ActionController::ActionControllerError
-    end
@@ -64 +76 @@
-end
-
+::ActionController::Base.class_eval do
+  alias :rails_protection_redirect_to_original :redirect_to unless method_defined?(:rails_protection_redirect_to_original)
+  def redirect_to(options = {}, *parameters_for_method_reference)
+    case request.method
+    when :post, :put, :delete
+      session[:rails_protection_ignore_csrf_validation] = true
+    end
+    rails_protection_redirect_to_original(options, *parameters_for_method_reference)
+  end
+end
-::ActionController::Base.send(:include, RailsProtection::Csrf::ActionControllerMethods)
-::ActionController::Base.class_eval do
@@ -73 +95 @@
-end
-::ActionView::Base.send(:include, RailsProtection::Csrf::ActionViewMethods)
+
+::ActiveRecord::Base.send(:include, RailsProtection::Csrf::ActiveRecordMethods)
+::ActiveRecord::Base.class_eval do
+  attr_accessor  :ignore_csrf_validation
+  before_destroy :validate_for_csrf
+  before_save    :validate_for_csrf
+end