conc-at / clueshed Goto Github PK

Security issue from Hakiri: Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.20, 4.0.x before 4.0.11, 4.1.x before 4.1.7, and 4.2.x before 4.2.0.beta3, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via a /../ sequence.

Appears in the UI in production.

For the form expansion on root.

Add one. (From conc.at)
Might this be customizable, too?

These are currently in public but it should be possible to use the default layout and add the messages there.

A user wants to attend a node.js developer unconference in Tokyo and submits their proposal “How to reverse engineer APIs” so they can decide on their attendance based on the feedback. After signing up all they has to do is fill out one form and the proposal is visible to everyone attending the event.

Pretty much the same as #3

We have to decide whether/how it should be possible to post a contribution without replying to an interest. For example we could render a list of Interest/Contribs that match keywords in the title, so that they can reply/upvote others.

Security issue from Hakiri: Directory traversal vulnerability in actionpack/lib/action_dispatch/middleware/static.rb in Action Pack in Ruby on Rails 3.x before 3.2.21, 4.0.x before 4.0.12, 4.1.x before 4.1.8, and 4.2.x before 4.2.0.beta4, when serve_static_assets is enabled, allows remote attackers to determine the existence of files outside the application root via vectors involving a \ (backslash) character, a similar issue to CVE-2014-7818.

There should be something like "No Contrib yet" on the root site:

Custom/ENV SCSS variables only work in development not in production.

NoMethodError (undefined method get_user' for #Class:0x007f30573c6048):
2015-01-05T16:53:34.699715+00:00 app[web.1]: app/models/user.rb:58:in find_for_oauth'

• blacklist usernames like sign_in, cancel, sign_up, edit for route conflicts
• resolve no initial password dilemma