if you run mod_php its quite simple to deactivate php for a directory tree. Just create a file .htaccess in the base directory of that tree and add one line to it:

php_flag engine off

Make sure the webserver can read that file.

this is perfect - just what i need to do but was putting off.

append the string "GIF89" to the upload file will bypassing the content_type filter,for example:

GIF89
<?php phpinfo(); ?>

It's so easy to forget these h methods. Looking forward to Rails 3, any one knows when it's ready?

Thanks Ryan! Just updated a couple of my apps. These are easy to forget and it's nice to have a solid checklist in place. One of your most important screen casts yet!
Brian

Ryan, about Rails 3 and the h() method: what's the function to unescape a string, i.e., the contrary of h()? :P

Thanks! Great cast today.

Even by the high standards one usually encounters on Railscasts, this is a fantastically concise description of major security flaws for all rails developers to be aware of.

@Josè: I think you can use <%= raw(text) %>

There is a plugin for h() issue.

http://code.google.com/p/xss-shield/

XSS Shield protects your views against cross-site scripting attacks without error-prone manual escaping with h().

Instead of:

  <h3><%= h(item.name) %></h3>
  <p><%= link_to "#{h(item.first_name)}'s stuff", :action => :view, :id => item %></p>
You will be able to write:

  <h3><%= item.name %></h3>
  <p><%= link_to "#{item.first_name}'s stuff", :action => :view, :id => item %></p>

Hi Ryan,

Thanks a lot....for all these tutorials.....you are doing a wonderful job.....you have been a major driving force for many like me making learning rails easier and motivational..........thanks once again:)

Paperclip also allows for users to view other users' uploads. What's best is simply not to store files in the public directory and then use send_file. send_file would not execute any scripts.

Hey man I hit you up on twitter the other day, wondering about all the attr_accessible's in nifty-scaffold, still didn't understand when you said security issues. Now I know, cheers mate!

godt damn, nice episode. I'm greatfull for all the time you save me with these short to the point videos. This one was very usefull!

Very nice and useful, I'm gonna use it

Hi,

Thanks for all your screencasts !

What did you do to have this console ? It's very nice !

Sephi-Chan

And people, don't forget to upgrade to 2.3.4 because of h() html escaping xss vulnerability

It's all the old song) But it's good to refresh knowledge.
One more thanks, Ryan!

Thank you for keep Rails alive, somehow I got all excited about the technology... got a couple books, watch the screencasts and develop some applications to play with it, even learn the basics of git ;-).

Lately feel like the momentum, and energy start to vanishing a bit... The brazilian podcast quit posting news, the envycast split also. Peepcode start posting some other topics to keep it profitable, which I understand and don't blame at all, but really hope you keep the rails momentum going. Its a great technology and really fun and cool way to develop applications. I'm just affraid the direction is not clear and everyday we see less and less people on the community.

Thank you Ryan for be our sensei in the Ruby on Rails development world, can't agree more thank you for all your hard work and your screencasts. Really enjoy your videos at pragmatic tv.

Best Regards Dinooz.

@Sephi-Chan Ryan mention on the previous railscast he used hirb gem something to give the output mysql like, yes I agree really cool.

Ryan, I have a bad feeling you have a bunch of rails developers fixing the flaws in their sites this week, especially now that you've shown all these flaws many people might not have known they had...

Thanks! Great Railscast again!

Hey Ryan,
thank you very much for this awesome screencast! I really enjoy your stuff! Keep up the good work :)
Kind regards
Bijan

Great screencast and information.

Rails abilitiy for scoping at the association level makes it excellent and easy to use and understand!

Love it

Also, anyone know how to get the console to display the model information like how Ryan has it in the screen cast? When he does a find, it shows a table with the attributes. Is that a plugin?

Please add captcha!

Great stuff Ryan. What do you suggest to give administrators the opportunity to do mass assignment (change ownership, etc.) without making the controllers bloated?

Jeffery, try the trusted-params plugin at http://github.com/ryanb/trusted-params/tree/master

great resource!!!

want to test your server date.

greets from germany (UTC + 1)

Thanks for sharing all the flaws that could put a programmer in trouble. Its easy to leave something opened, especially after leaving a project and coming back to complete it later.

Police Ready, it's hirb (http://github.com/cldwalker/hirb/tree/master). In console require 'hirb' and do Hirb.enable. Now the records should be showed in that table format.

A great resource presented in a very compact way, so thanks. Keep up the good work.

Very useful tips, I've used them and will use

A nice checklist to keep in mind while developing rails sites!

Thanks, Ryan

This seems to be a way to train consumers to a new model and expectation for "using" this content in a way that is perceived as "legal".
really

Ryan,

Great episode!

I tried to reproduce the issue you mentioned about uploading files with an incorrect content-type, while using the validates_attachment_content_type validation:

http://gist.github.com/192625

However, Paperclip seems to handle these properly. It seems that this validation does more than its name implies ;-).

As for the "#1 Mass Assignment" security issue, I largely prefer Merb's approach: filtering sensitive attributes should be done in the controller.

Look the 'param_protected' plugin for Rails.

Talking about the mass assignment, there is an interesting topic in Rails Core ML: http://bit.ly/4jfGa

Another security hole: filtering fields from serialized objects.

If you set up your users using default RESTful routes, then
  /users/:id.xml
will show all fields by default, including (if they exist) the persistence-token, crypted password, salt, email address and openid.

You can disable the formatted routes, or you can sanitize these fields by overriding to_xml, to_json, etc to always use the
     :only => [...whitelisted fields...]
flag.

I have a plugin at http://github.com/mrflip/attr_visible that helps set defaults for the serialization methods.

----------

Also be thoughtful about fields that should be writeable on create but not on update: for example, username, or an "I agree to these terms" flag. Remember, even if they're not present in the form they can be submitted as params.

actually useful information, thanks to the author

Thanks for the great screencast. You are my Ruby Hero!

Thanks for the great screencast.

Thanks for the great screencast.

Thanks for the great screencast.

 it's a bit like giving tax breaks to big businesses like wallmart but ignoring the mom and pop shops. now that is squashing the middle class. because the employees at wallmart don't make enough to be middle class

thx ryan,

great cast - as usual!

lots of your security issues might easily solved via rack-apps.

just have a look at http://coderack.org/

e.g. http://coderack.org/users/J-_-L/entries/80-racknotags is deleting all "<" and ">" tag elements - and you can use it for every app/framework you use!!

Excellent article! author deserves respect

thanks admin
information is the most beautiful treasures
 

thanks for all

thanks for your information, it is very helpful.

I am a carpenter, and have put in many lock in my career. Kwik set locks are cheap, they are not very good for security. So I would change all the entry locks to a better quality if you are worried. Start with the Schlage brand or better, and go for the heavy duty dead bolt.

Thanks for sharing this.

<?
/* oo very good/*
echo "Thank you admin :)";
?>

I haven't quite figured out why the sexual urge of men and women differ so much. And I never really figured out the whole Venus and Mars thing. I have never figured out why men think with their head and women with their heart.

web tasarımı, kurumsal site tasarımı, profesyonel web sitesi tasarımı, profesyonel web tasarımı

<a href="http://www.webtasarimturk.net" title="web tasarımı">web tasarımı</a>

this is a best ,thank you for sharing the bes

looks absolutely amazing!!!!!!!!!! I wish I had a piece right now.

I agree that security is very important! I've been practicing the 7 tips above. Thank you.

we provide our buyers with an efficient and manageable procurement process covering every phase of the international supply chain and

streamlining trade channels. Also welcome wholesaling, feedback now!

I have been following you blog for quite some time now…..I just wanted to say how excited and happy I am for you. I can’t wait to see what you come up with.

Great post how you know about this in very details, it is really very interesting and knowledgeable things.

If God would exists it will be you... very thanks for this screencast.

Very thanks for this screencast. Great post how you know about this in very details, it is really very interesting and knowledgeable things.

What's best is simply not to store files in the public directory and then use send_file. send_file would not execute any scripts.

I really liked your article and I shared with my friends in my facebook account ..
I gave my site a few examples below. If you appreciate my comments in you enter.

I think type of site that is useful in sharing information and it is important to shar.Web proliferation of new developments in the field of design and entrepreneurial spirit of people who have very beautiful and pleasing to be professional

These are easy to forget and it's nice to have a solid checklist in place. One of your most important screen casts yet!

It works really well with my win7 ultimate..you don't even notice it running in the background.

possibility of sharing and social solidarity at a level just fine

I think type of site that is useful in sharing information and it is important to shar.How to speed up internet technology? Thank you.

Some times, to a certain need, we have to convert PDF to image for enjoyment.

Your site is very useful in terms of cultural exchange.Thank you.

Discount Wholesale Electronics, Wholesale Cell Phones, Electronic Gadgets and More from the Best Dropship Wholesaler

But if yer talking about windows messenger, it comes with xp and vista, doesn't need installing.

a significant share of your site as people think.Thanks you

Thanks for sharing your article. I really enjoyed it. I put a link to my site to here so other people can read it. My readers have about the same interets

Very useful in terms of sharing people. Thank you.

thanks for your sharing, it is a nice post and like it very much.

append the string "GIF89" to the upload file will bypassing the content_type filter,for example:

GIF89
<?php phpinfo(); ?>

I feel like I’m often looking for interesting things to read about a variety of subjects, but I manage to include your blog among my reads every day because you have interesting entries that I look forward to. Here’s hoping there’s a lot more great material coming!