Commit graph

6 commits

Author SHA1 Message Date
Jacques Distler 9e909d5be3 Update Rails, rails_xss and Bundler
Update Bundler to 1.0.15.
Update Rails to 2.3.12.
Update rails_xss plugin.

The latter two were the
source of a considerable
amount of grief, as rails_xss
is now MUCH stricter about what
string methods can be used.

Also made it possible to use
rake 0.9.x with Instiki. But
you probably REALLY want to use

 ruby bundle exec rake ...

instead of just saying

 rake ....
2011-06-15 00:43:38 -05:00
Jacques Distler 1da034e2be Fix some to-be-deprecated stuff 2010-05-26 14:16:34 -05:00
Jacques Distler 97a35e280b DB Migration
% rake upgrade_instiki

fixes some potential problems in the database column types.

Revision content can now be up to 16MB.
Under MySQL, the previous limit was 64KB.

Page names can now be up to 255 bytes.
Under MySQL, the previous limit was 60 bytes.

Additional CSS styles can now be up to 64KB.
Under MySQL, the previous limit was 255 bytes.

Thanks to Andrew Stacey for reporting these.
2009-10-21 00:42:48 -05:00
Jacques Distler 888e93a7fd Streamline Rake Task
Refactor the upgrade_instiki rake task.
Based on the (very nice) JHerdman's
  64d305f2a8
but defaults to 'production' environment, instead.
Instiki users don't know about production/development/test.
Instiki defaults to 'production'. So should its associated rake tasks.
2009-08-29 23:31:39 -05:00
Jacques Distler c05d69bcff Make upgrade_instiki Rake Task Database-Agnostic
Reported by James Herdman.
2009-08-27 16:57:37 -05:00
Jacques Distler 5d15e3f39d Security: Instiki 0.16.2
On Webs with file uploads enabled, uploaded files were stored
(in version 0.16.1 and earlier) in the public/ directory.

This was a security threat. A miscreant could upload a .html file.
When a user clicked on the link to the file, it was opened (unsanitized)
in the browser.

As of version 0.16.2, uploaded files are stored in the webs/
directory. Now, when the user clicks on the link, the file is sent
with the

    Content-Disposition: attachment

header set, which causes the file to be downloaded, rather than opened
in the browser. As always, files downloaded from the internets should be
treated with caution. At least, this way, they are not aoutomatically 
opened in the browser.

To move your existing uploaded files to the new location, do a

     rake upgrade_instiki
2009-01-26 00:21:30 -06:00