Lighthouse has a new layout. Prefer the old one? Return to the old layout, and switch back any time from the link at the top of each page.

Webroar has dependency on old, less secure, version of rails 2.3.2

#6

The webroar gem has an runtime dependency on Rails = 2.3.2 which is an outdated release.

Rails 2.3.4 includes security fixes and should be allowed to be used.

http://weblog.rubyonrails.org/2009/9/4/ruby-on-rails-2-3-4

Does webroar include a hard dependency on a specific version of rails? If so, it should not and the application being hosted should determine the version of rails it wants to use.

Different applications running under webroar, should be able to run under different versions of rails at the same time.

Webroar should be able to be installed, and run, with any modern rack aware version of rails and should specify a >= dependency on rails and not an '='.

Reported by Glenn Rempe · November 28th, 2009 @ 11:15 PM

State: resolved
Milestone: none
Assigned to: Dharmarth Shah Dharmarth Shah

Activity

  1. Aditya Babbar
    Aditya Babbar
    • Assigned user set to Aditya Babbar
    • State changed from new to open

    Couple of comments:

    1. WebROaR can run all versions of Rails Applications and doesn't force the deployed application to use any particular version of rails.

    2. The specific dependency of rails 2.3.2 is only for Admin Panel. Unfortunately, as of now Admin Panel + Rail 2.3.4 + Ruby 1.9 combination doesn't work. This issue is very much on our radar and we would be resolving it soon. Since Admin Panel is only meant to be used by the Server Administrator (and we recommend it being kept off when not in use to save memory), the security risk due to that XSS vulnerability is low at this point.

    November 29th, 2009 @ 12:04 AM

  2. Dharmarth Shah
    Dharmarth Shah
    • Assigned user changed from Aditya Babbar to Dharmarth Shah
    • State changed from open to resolved
    • Tag changed from bug, dependency, install to dependency, rails

    Rails dependency is changed to '>= 2.3.5'.

    Please find the change in latest version v0.2.5

    December 7th, 2009 @ 07:27 PM

Please Sign in or create a free account to add a new ticket.

With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.