Hello community,
here is the log from the commit of package rubygem-rack-protection for
openSUSE:Factory checked in at 2018-07-18 22:50:56
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/rubygem-rack-protection (Old)
and /work/SRC/openSUSE:Factory/.rubygem-rack-protection.new (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "rubygem-rack-protection"
Wed Jul 18 22:50:56 2018 rev:4 rq:621027 version:2.0.3
Changes:
--------
---
/work/SRC/openSUSE:Factory/rubygem-rack-protection/rubygem-rack-protection.changes
2018-02-19 13:04:18.082863967 +0100
+++
/work/SRC/openSUSE:Factory/.rubygem-rack-protection.new/rubygem-rack-protection.changes
2018-07-18 22:52:12.235306299 +0200
@@ -1,0 +2,12 @@
+Fri Jun 8 17:27:24 UTC 2018 - [email protected]
+
+- updated to version 2.0.3
+ no changelog found
+
+-------------------------------------------------------------------
+Tue Jun 5 17:21:10 UTC 2018 - [email protected]
+
+- updated to version 2.0.2
+ no changelog found
+
+-------------------------------------------------------------------
Old:
----
rack-protection-2.0.1.gem
New:
----
rack-protection-2.0.3.gem
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ rubygem-rack-protection.spec ++++++
--- /var/tmp/diff_new_pack.XSRUCB/_old 2018-07-18 22:52:12.839304295 +0200
+++ /var/tmp/diff_new_pack.XSRUCB/_new 2018-07-18 22:52:12.839304295 +0200
@@ -24,7 +24,7 @@
#
Name: rubygem-rack-protection
-Version: 2.0.1
+Version: 2.0.3
Release: 0
%define mod_name rack-protection
%define mod_full_name %{mod_name}-%{version}
++++++ rack-protection-2.0.1.gem -> rack-protection-2.0.3.gem ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/Gemfile new/Gemfile
--- old/Gemfile 2018-02-16 16:43:47.000000000 +0100
+++ new/Gemfile 2018-06-08 18:04:25.000000000 +0200
@@ -1,4 +1,4 @@
-source "http://rubygems.org";
+source "https://rubygems.org";
# encoding: utf-8
gem 'rake'
Binary files old/checksums.yaml.gz and new/checksums.yaml.gz differ
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/lib/rack/protection/authenticity_token.rb
new/lib/rack/protection/authenticity_token.rb
--- old/lib/rack/protection/authenticity_token.rb 2018-02-16
16:43:47.000000000 +0100
+++ new/lib/rack/protection/authenticity_token.rb 2018-06-08
18:04:25.000000000 +0200
@@ -9,14 +9,78 @@
# Supported browsers:: all
# More infos::
http://en.wikipedia.org/wiki/Cross-site_request_forgery
#
- # Only accepts unsafe HTTP requests if a given access token matches the
token
- # included in the session.
+ # This middleware only accepts requests other than <tt>GET</tt>,
+ # <tt>HEAD</tt>, <tt>OPTIONS</tt>, <tt>TRACE</tt> if their given access
+ # token matches the token included in the session.
#
- # Compatible with rack-csrf.
+ # It checks the <tt>X-CSRF-Token</tt> header and the <tt>POST</tt> form
+ # data.
#
- # Options:
+ # Compatible with the {rack-csrf}[https://rubygems.org/gems/rack_csrf] gem.
#
- # authenticity_param: Defines the param's name that should contain the
token on a request.
+ # == Options
+ #
+ # [<tt>:authenticity_param</tt>] the name of the param that should contain
+ # the token on a request. Default value:
+ # <tt>"authenticity_token"</tt>
+ #
+ # == Example: Forms application
+ #
+ # To show what the AuthenticityToken does, this section includes a sample
+ # program which shows two forms. One with, and one without a CSRF token
+ # The one without CSRF token field will get a 403 Forbidden response.
+ #
+ # Install the gem, then run the program:
+ #
+ # gem install 'rack-protection'
+ # ruby server.rb
+ #
+ # Here is <tt>server.rb</tt>:
+ #
+ # require 'rack/protection'
+ #
+ # app = Rack::Builder.app do
+ # use Rack::Session::Cookie, secret: 'secret'
+ # use Rack::Protection::AuthenticityToken
+ #
+ # run -> (env) do
+ # [200, {}, [
+ # <<~EOS
+ # <!DOCTYPE html>
+ # <html lang="en">
+ # <head>
+ # <meta charset="UTF-8" />
+ # <title>rack-protection minimal example</title>
+ # </head>
+ # <body>
+ # <h1>Without Authenticity Token</h1>
+ # <p>This takes you to <tt>Forbidden</tt></p>
+ # <form action="" method="post">
+ # <input type="text" name="foo" />
+ # <input type="submit" />
+ # </form>
+ #
+ # <h1>With Authenticity Token</h1>
+ # <p>This successfully takes you to back to this form.</p>
+ # <form action="" method="post">
+ # <input type="hidden" name="authenticity_token"
value="#{env['rack.session'][:csrf]}" />
+ # <input type="text" name="foo" />
+ # <input type="submit" />
+ # </form>
+ # </body>
+ # </html>
+ # EOS
+ # ]]
+ # end
+ # end
+ #
+ # Rack::Handler::WEBrick.run app
+ #
+ # == Example: Customize which POST parameter holds the token
+ #
+ # To customize the authenticity parameter for form data, use the
+ # <tt>:authenticity_param</tt> option:
+ # use Rack::Protection::AuthenticityToken, authenticity_param:
'your_token_param_name'
class AuthenticityToken < Base
TOKEN_LENGTH = 32
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/lib/rack/protection/base.rb
new/lib/rack/protection/base.rb
--- old/lib/rack/protection/base.rb 2018-02-16 16:43:47.000000000 +0100
+++ new/lib/rack/protection/base.rb 2018-06-08 18:04:25.000000000 +0200
@@ -13,7 +13,7 @@
:session_key => 'rack.session', :status => 403,
:allow_empty_referrer => true,
:report_key => "protection.failed",
- :html_types => %w[text/html application/xhtml]
+ :html_types => %w[text/html application/xhtml text/xml
application/xml]
}
attr_reader :app, :options
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/lib/rack/protection/version.rb
new/lib/rack/protection/version.rb
--- old/lib/rack/protection/version.rb 2018-02-16 16:43:47.000000000 +0100
+++ new/lib/rack/protection/version.rb 2018-06-08 18:04:25.000000000 +0200
@@ -1,5 +1,5 @@
module Rack
module Protection
- VERSION = '2.0.1'
+ VERSION = '2.0.3'
end
end
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/metadata new/metadata
--- old/metadata 2018-02-16 16:43:47.000000000 +0100
+++ new/metadata 2018-06-08 18:04:25.000000000 +0200
@@ -1,14 +1,14 @@
--- !ruby/object:Gem::Specification
name: rack-protection
version: !ruby/object:Gem::Version
- version: 2.0.1
+ version: 2.0.3
platform: ruby
authors:
- https://github.com/sinatra/sinatra/graphs/contributors
autorequire:
bindir: bin
cert_chain: []
-date: 2018-02-16 00:00:00.000000000 Z
+date: 2018-06-08 00:00:00.000000000 Z
dependencies:
- !ruby/object:Gem::Dependency
name: rack
@@ -103,7 +103,7 @@
version: '0'
requirements: []
rubyforge_project:
-rubygems_version: 2.6.8
+rubygems_version: 2.7.6
signing_key:
specification_version: 4
summary: Protect against typical web attacks, works with all Rack apps,
including
