Security

Gemfile

@@ -1,11 +1,10 @@
 source 'https://rubygems.org'
 
 git_source(:github) do |repo_name|
-  repo_name = "#{repo_name}/#{repo_name}" unless repo_name.include?("/")
-  "https://github.com/#{repo_name}.git"
+    repo_name = "#{repo_name}/#{repo_name}" unless repo_name.include?('/')
+    "https://github.com/#{repo_name}.git"
 end
 
-
 # Bundle edge Rails instead: gem 'rails', github: 'rails/rails'
 gem 'rails', '~> 5.0.2'
 
@@ -32,6 +31,8 @@ gem 'jquery-rails'
 gem 'turbolinks', '~> 5'
 # Build JSON APIs with ease. Read more: https://github.com/rails/jbuilder
 gem 'jbuilder', '~> 2.5'
+gem 'rack-attack'
+
 # Use Redis adapter to run Action Cable in production
 # gem 'redis', '~> 3.0'
 # Use ActiveModel has_secure_password
@@ -41,20 +42,22 @@ gem 'jbuilder', '~> 2.5'
 # gem 'capistrano-rails', group: :development
 
 group :development, :test do
-  gem 'rspec-rails'
-  # Call 'byebug' anywhere in the code to stop execution and get a debugger console
-  gem 'byebug', platform: :mri
+    gem 'rspec-rails'
+    gem 'brakeman'
+    gem 'bundler-audit'
+    # Call 'byebug' anywhere in the code to stop execution and get a debugger console
+    gem 'byebug', platform: :mri
 end
 
 group :development do
-  gem 'faker'
-
-  # Access an IRB console on exception pages or by using <%= console %> anywhere in the code.
-  gem 'web-console', '>= 3.3.0'
-  gem 'listen', '~> 3.0.5'
-  # Spring speeds up development by keeping your application running in the background. Read more: https://github.com/rails/spring
-  gem 'spring'
-  gem 'spring-watcher-listen', '~> 2.0.0'
+    gem 'faker'
+
+    # Access an IRB console on exception pages or by using <%= console %> anywhere in the code.
+    gem 'web-console', '>= 3.3.0'
+    gem 'listen', '~> 3.0.5'
+    # Spring speeds up development by keeping your application running in the background. Read more: https://github.com/rails/spring
+    gem 'spring'
+    gem 'spring-watcher-listen', '~> 2.0.0'
 end
 
 # Windows does not include zoneinfo files, so bundle the tzinfo-data gem

Gemfile.lock

@@ -46,7 +46,11 @@ GEM
     bootstrap-sass (3.3.7)
       autoprefixer-rails (>= 5.2.1)
       sass (>= 3.3.4)
+    brakeman (3.6.2)
     builder (3.2.3)
+    bundler-audit (0.5.0)
+      bundler (~> 1.2)
+      thor (~> 0.18)
     byebug (9.0.6)
     coffee-rails (4.2.1)
       coffee-script (>= 2.2.0)
@@ -98,6 +102,8 @@ GEM
     orm_adapter (0.5.0)
     puma (3.8.2)
     rack (2.0.1)
+    rack-attack (5.0.1)
+      rack
     rack-test (0.6.3)
       rack (>= 1.0)
     rails (5.0.2)
@@ -192,6 +198,8 @@ PLATFORMS
 
 DEPENDENCIES
   bootstrap-sass
+  brakeman
+  bundler-audit
   byebug
   coffee-rails (~> 4.2)
   devise
@@ -200,6 +208,7 @@ DEPENDENCIES
   jquery-rails
   listen (~> 3.0.5)
   puma (~> 3.0)
+  rack-attack
   rails (~> 5.0.2)
   rspec-rails
   sass-rails (~> 5.0)

app/controllers/application_controller.rb

@@ -1,29 +1,25 @@
 class ApplicationController < ActionController::Base
+    protect_from_forgery with: :exception
 
-  # protect_from_forgery with: :exception
+    helper_method :current_cart
 
-  helper_method :current_cart
-
-  def current_cart
-    @current_cart ||= find_cart
-  end
+    def current_cart
+        @current_cart ||= find_cart
+    end
 
-  private
+    private
 
-  def find_cart
-    cart = Cart.find_by(id: session[:cart_id])
-    if cart.blank?
-      cart = Cart.create
+    def find_cart
+        cart = Cart.find_by(id: session[:cart_id])
+        cart = Cart.create if cart.blank?
+        session[:cart_id] = cart.id
+        cart
     end
-      session[:cart_id] = cart.id
-      return cart
-  end
 
-  def require_admin!
-    unless current_user.is_admin?
-      flash[:alert] = "您的權限不足"
-      redirect_to root_path
+    def require_admin!
+        unless current_user.is_admin?
+            flash[:alert] = '您的權限不足'
+            redirect_to root_path
+        end
     end
-  end
-
 end

app/controllers/events_controller.rb

@@ -1,21 +1,19 @@
 class EventsController < ApplicationController
+    def index
+        @events = Event.all
+    end
 
-  def index
-    @events = Event.all
-  end
+    def show
+        @event = Event.find(params[:id])
+        @comments = @event.comments
 
-  def show
-    @event = Event.find(params[:id])
-    @comments = @event.comments
+        if params[:keyword]
 
-    if params[:keyword]
-      @comments = @comments.where( "comments.content LIKE '%#{params[:keyword]}%'")
-    end
+            @comments = @comments.where('comments.content LIKE ?', "%#{params[:keyword]}%")
+        end
 
-    if params[:sort]
-      @comments = @comments.order(params[:sort])
+        if params[:sort] && ['id DESC', 'id ASC'].include?(params[:sort]) # 只有白名单内的参数可以用
+            @comments = @comments.order(params[:sort])
+          end
     end
-
-  end
-
 end

app/controllers/users_controller.rb

@@ -1,27 +1,25 @@
 class UsersController < ApplicationController
+    def show
+        @user = User.find(params[:id])
+    end
 
-  def show
-    @user = User.find( params[:id] )
-  end
-
-  def edit
-    @user = current_user
-  end
+    def edit
+        @user = current_user
+    end
 
-  def update
-    @user = current_user
+    def update
+        @user = current_user
 
-    if @user.update(user_params)
-      redirect_to user_path(@user)
-    else
-      render "edit"
+        if @user.update(user_params)
+            redirect_to user_path(@user)
+        else
+            render 'edit'
+        end
     end
-  end
 
-  protected
-
-  def user_params
-    params.require(:user).permit(:nickname, :role)
-  end
+    protected
 
+    def user_params
+        params.require(:user).permit(:nickname)
+    end
 end

app/helpers/users_helper.rb

@@ -1,15 +1,13 @@
 require 'digest/md5'
 
 module UsersHelper
-
-  def user_avatar_link(user)
-    # https://cn.gravatar.com/
-    email_md5 = Digest::MD5.hexdigest(user.email)
-    gravatar_url = "https://www.gravatar.com/avatar/#{email_md5}"
-
-    str = "<div class ='user-link'>" + link_to(image_tag(gravatar_url), user_path(user)) + " " + user.display_name + "</div>"
-
-    str.html_safe
-  end
-
+    def user_avatar_link(user)
+        # https://cn.gravatar.com/
+        email_md5 = Digest::MD5.hexdigest(user.email)
+        gravatar_url = "https://www.gravatar.com/avatar/#{email_md5}"
+
+        content_tag(:div,
+                    link_to(image_tag(gravatar_url), user_path(user)) + ' ' + user.display_name,
+                    class: 'user-link')
+    end
 end

app/views/events/show.html.erb

@@ -1,53 +1,41 @@
 <h1><%= @event.name %></h1>
-
 <%= simple_format @event.description %>
-
-
 <%= form_tag event_path(@event), :method => :get do %>
-  <p>
-    <%= text_field_tag "keyword", "", :size => 50 %>
-    <%= submit_tag "Search" %>
-  </p>
+    <p>
+        <%= text_field_tag "keyword", "", :size => 50 %>
+        <%= submit_tag "Search" %>
+    </p>
 <% end %>
-
 <p>
-  <%= link_to "新留言在上", event_path(@event, :sort => "id DESC") %>
-  <%= link_to "舊留言在上", event_path(@event, :sort => "id ASC") %>
+    <%= link_to "新留言在上", event_path(@event, :sort => "id DESC") %>
+    <%= link_to "舊留言在上", event_path(@event, :sort => "id ASC") %>
 </p>
-
 <% @comments.each do |comment| %>
-  <div id="comment-<%= comment.id%>" class="panel panel-default <%= (comment.highlight_at.present?)? "highlight" : "" %>">
-    <div class="panel-heading">
-      <%= user_avatar_link(comment.author) %>
+    <div id="comment-<%= comment.id%>" class="panel panel-default <%= (comment.highlight_at.present?)? "highlight" : "" %>">
+        <div class="panel-heading">
+            <%= user_avatar_link(comment.author) %>
+        </div>
+        <div class="panel-body">
+            <%= sanitize comment.content %>
+        </div>
+        <div class="panel-footer text-right">
+            <%= comment.created_at.to_s %>
+            <% if current_user && current_user.is_admin? %>
+                <%= link_to "Highligh", highlight_event_comment_path(@event, comment), :method => :post,:class => "btn btn-default" %>
+            <% end %>
+            <% if comment.can_deleted_by(current_user) %>
+                <%= link_to "Delete", event_comment_path(@event, comment), :data => { :confirm => "Are you sure?"}, :method => :delete, :class => "btn btn-danger" %>
+            <% end %>
+        </div>
     </div>
-
-    <div class="panel-body">
-      <%= raw comment.content %>
-    </div>
-
-    <div class="panel-footer text-right">
-      <%= comment.created_at.to_s %>
-
-      <% if current_user && current_user.is_admin? %>
-        <%= link_to "Highligh", highlight_event_comment_path(@event, comment), :class => "btn btn-default" %>
-      <% end %>
-
-      <% if comment.can_deleted_by(current_user) %>
-        <%= link_to "Delete", event_comment_path(@event, comment), :data => { :confirm => "Are you sure?"}, :method => :delete, :class => "btn btn-danger" %>
-      <% end %>
-    </div>
-  </div>
 <% end %>
-
 <hr>
-
 <%= form_for [@event, Comment.new] do |f| %>
-  <div class="form-group">
-    <%= f.label :content %>
-    <%= f.text_area :content, :class => "form-control" %>
-  </div>
-
-  <div class="form-group">
-    <%= f.submit "Comment", :class => "btn btn-primary" %>
-  </div>
-<% end %>
+    <div class="form-group">
+        <%= f.label :content %>
+        <%= f.text_area :content, :class => "form-control" %>
+    </div>
+    <div class="form-group">
+        <%= f.submit "Comment", :class => "btn btn-primary" %>
+    </div>
+<% end %>

config/application.rb

@@ -7,13 +7,14 @@
 Bundler.require(*Rails.groups)
 
 module RailsRecipes
-  class Application < Rails::Application
-    # Settings in config/environments/* take precedence over those specified here.
-    # Application configuration should go into files in config/initializers
-    # -- all .rb files in that directory are automatically loaded.
-    config.time_zone = "Beijing"
-
-  end
+    class Application < Rails::Application
+        # Settings in config/environments/* take precedence over those specified here.
+        # Application configuration should go into files in config/initializers
+        # -- all .rb files in that directory are automatically loaded.
+        config.time_zone = 'Beijing'
+        config.middleware.use Rack::Attack
+    end
 end
 
-Time::DATE_FORMATS.merge!(:default => '%Y/%m/%d %I:%M %p', :ymd => '%Y/%m/%d')
+Time::DATE_FORMATS[:default] = '%Y/%m/%d %I:%M %p'
+Time::DATE_FORMATS[:ymd] = '%Y/%m/%d'