The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
1answer
134 views

Checking if current user exists before executing code

In one of my controllers I have this method: def method_name if current_user @model = Model.find(params[:id]) if @model.destroy flash.alert = 'Model deleted successfully' ...
1
vote
1answer
82 views

What can I do to increase security of a small open source application

I've been developing a small CRUDish Ruby on Rails application on my free time for a non-profit organization. The app is already running in a small scale in Heroku. Lately I've been thinking about ...
1
vote
2answers
949 views

Possible attack on website

I am a developer and I therefor I have very little knowledge on security. So I need some help understanding the attack on website which we launched recently for one of our client. Website is built on ...
0
votes
1answer
106 views

Preventing body onload xss that is injected as a request parameter

I have a rails 4.0.1 app that allows locale as a request parameter. Here is what i saw when i tested my app on firefox; ...
1
vote
1answer
202 views

How should developers handle Form POST variables that conflict with route variables?

In ASP.NET MVC, when I perform a HTTP post to /controller/action/UserID ... and have a corresponding route /controller/action/{UserID} ... and if I do a Form POST, the POSTed data UserID ...
5
votes
3answers
323 views

How I can prove that SSH attacks are not from my application?

My ruby on rails web application is hosted on Linode. Linode opened a ticket and blamed my Linode server for attacking other servers. The logs revealed that it's a SSH brute force attack which ...
1
vote
2answers
865 views

How to test my website for the rails YAML vulnerability

I am quite puzzled by how to test my rails app for the YAML vulnerability first, I upgraded to the latest rails 3.2.11, and I tried this It gave me not likely to be vulnerable or URIPATH must be set ...
0
votes
1answer
137 views

How do I prevent my Rails application from attack? [closed]

My website is being nuked by new signups and new posts some of which don't even have user.id associated with. How do I solve this? What code should I add to the user#new page and/or post#new page. ...
1
vote
2answers
171 views

Do these mysql and ssh issues mean my rails server was hacked?

I'm running a rails application on an ubuntu server on slicehost. I got a pingdom alert that the server was unreachable, so I tried to load the website in my browser. It showed a Passenger error, ...
4
votes
2answers
282 views

Can anybody recommend any gems for checking security vulnerabilities?

I want to check one of my RoR projects for security vulnerabilities. So can anybody recommend any gems for my needs?
3
votes
2answers
1k views

Is my current method of handling session cookies insecure?

I'm writing a multi-tenant application where accounts are scoped by subdomains. This adds considerable complexity and I'm starting to worry about security. Each user can have several accounts. For ...
3
votes
1answer
157 views

Security of rails user access/permissions plugins

I was wondering if anyone knows what the most secure user access plugin for Rails is, and if any of them prevent session fixation?
17
votes
3answers
1k views

Rails - protection against code injection and XSS

I've started using Ruby on Rails, and I was wondering if there were any security gotchas to watch out for with Rails, particularly regarding code injection and XSS? I know Rails tries to prevent ...