Yup Dot Com: Category Ruby on Rails

No Reservations about Keywords in Ruby on Rails

Daniel Butler — Wed, 31 Jan 2007 16:05:00 -0500

Have you ever had the urge to name a data model in your Ruby on Rails application something obvious, like Action, Table, File, Columns, or Database? Well, don’t. Choosing a name like that might work for you in some cases, but it might fail miserably for someone else using a different database engine (i.e., MySQL verses PostgreSQL verses Oracle).

Think you can remember all the problematic names? Think again. There are at least 974 known keywords which can give you problems. I started with the ReservedWords pages on the Ruby on Rails Wiki, and pulled in and merged all the SQL-92, SQL-99, SQL-2003, PostgreSQL, MySQL, SQL Server and ODBC reserved keywords, and put them in one place, mainly for my own future reference.

So what if your data models are about Databases, Tables, Columns, and Files? Simply think of a Good Prefix™, and name all your models accordingly: DaDatabase, DaTable, DaColumn, and DaFile, with resulting table named da_databases, da_tables, da_columns, and da_files. It’s easy, painless, and helps you group similarly-purposed tables and models accordingly, and you don’t have to wrack your brains thinking of synonyms for obvious model names like “Action”. I use Geo- for location-oriented data, Sys- for System-oriented tables, Log- for transactions, and App- for application-oriented tables.

Read on to see the full list …

Better Subversion External Branch Management with Piston

Daniel Butler — Wed, 01 Nov 2006 20:59:00 -0500

Subversion exports can be difficult to manage in your Ruby on Rails application, especially if you want to make local changes to a vendor-supplied plugin that shouldn’t really be applied back to that vendor’s trunk (or cannot be). Another reason to keep the vendor’s code checked into your own tree, is that you’ll be able to better see changes to the vendor’s code as they happen and assess the impact on your own code, as well as audit vendor changes that break your application in some way. Externals cannot provide such a safety net. So, into the cylinder of Rails plugins enters Piston by François Beausoleil of Sherbrooke, Québec, Canada. His description:

Piston is a utility that eases vendor branch management. This is similar to svn:externals, except you have a local copy of the files, which you can modify at will. As long as the changes are mergeable, you should have no problems.

Watch him demonstrate its usage:

$ piston import http://dev.rubyonrails.org/svn/rails/trunk vendor/rails
Exported r4720 from 'http://dev.rubyonrails.org/svn/rails/trunk' to 'vendor/rails'
$ svn commit -m "Importing local copy of Rails"
$ piston update vendor/rails
Updated 'vendor/rails' to r4720.
$ svn commit -m "Updates vendor/rails to the latest revision"

As a bonus feature, you can lock piston-gripped trees with piston lock to prevent subversion from updating past a specific vendor’s revision that works with your application. Nice work, François.

Piston @ RubyForge

Rails Plugins Made Even Easier with RaPT

Daniel Butler — Fri, 27 Oct 2006 11:08:00 -0400

Wow, can discovering and installing helpful Rails plugins get any simpler than this?

$ gem install rapt
Successfully installed rapt-0.2.1
$ rapt search "full text search"
Active Search
  Info: http://www.agilewebdevelopment.com/plugins/show/22
  Install: http://julik.textdriven.com/svn/tools/rails_plugins/simple_search
Indexed search engine
  Info: http://www.agilewebdevelopment.com/plugins/show/63
  Install: http://langwell-ball.com/svn/indexed-search/trunk/indexed_search_engine/
Acts as Ferret
  Info: http://www.agilewebdevelopment.com/plugins/show/83
  Install: svn://projects.jkraemer.net/acts_as_ferret/trunk/plugin/acts_as_ferret
Searchable
  Info: http://www.agilewebdevelopment.com/plugins/show/236
  Install: http://svn.mojodna.net/repository/acts_as_searchable/trunk
Query Analyzer
  Info: http://www.agilewebdevelopment.com/plugins/show/392
  Install: http://svn.nfectio.us/plugins/query_analyzer
acts_as_solr
  Info: http://www.agilewebdevelopment.com/plugins/show/400
  Install: http://opensvn.csie.org/thiago/rails/plugins/acts_as_solr/
ExceptionTextable
  Info: http://www.agilewebdevelopment.com/plugins/show/268
  Install: http://svn.pinds.com/rails/plugins/exception_textable/
FCKeditor
  Info: http://www.agilewebdevelopment.com/plugins/show/369
  Install: svn://rubyforge.org//var/svn/fckeditorp/trunk/fckeditor
$ rapt install http://opensvn.csie.org/thiago/rails/plugins/acts_as_slr/
+ ./acts_as_solr/CHANGE_LOG
+ ./acts_as_solr/README
+ ./acts_as_solr/init.rb
+ ./acts_as_solr/install.rb
+ ./acts_as_solr/lib/acts_as_solr.rb
+ ./acts_as_solr/lib/templates/solr.yml
+ ./acts_as_solr/schema.xml

All made possible by Ben Curtis’ RaPT tool and the Rails Plugin Directory. Thanks, Ben!

Ben’s Blog Entry on RaPT
RaPT @ RubyForge

Ruby FlexImage Plugin Now Especially Effective

Daniel Butler — Thu, 26 Oct 2006 16:08:00 -0400

Alex Wayne has updated his FlexImage plugin for Ruby on Rails, and it now allows for all sorts of special effects such as translucent overlays, drop shadows, and borders, in addition to its existing image processing capabilities. The plugin is described as:

“FlexImage is a plugin that allows you to put image data in your database And retrieve at any size, qulaity or cropping you like. Combine this with page caching and you have a fast and easy way to manage large numbers of uploaded images that are always just the right size for your needs.”

As an example, an image can be resized with an added drop shadow with the following snippet:

flex_image  :action => 'show',
            :class  => MyImage,
            :size   => 200,
            :crop   => true,
            :shadow => true

Thanks, Alex!

Alex’s Blog Posting
FlexImage API Documentation
FlexImage at the Ruby Plugins Directory

Exploitable Denial of Service in Ruby's cgi.rb Library

Daniel Butler — Wed, 25 Oct 2006 18:24:00 -0400

Zed Shaw, author of Mongrel, has provided a fix for the exploitable error in Ruby’s cgi.rb library. The error occurs when incorrectly crafted MIME boundaries for multipart uploads causes cgi.rb to loop infinitely waiting for input.

The following servers are affected:

Mongrel
Lightspeed
CGI Standalone
Any other server using cgi.rb

If you’re running any of these, you may want to upgrade or patch. More information on the error can be found in Zed’s post to the Ruby on Rails forum.

Rails Documentation in CHM Format

Daniel Butler — Tue, 17 Oct 2006 11:03:00 -0400

DeLynn Berry from Denver, Colorado, has converted the Rails Documentation to CHM format, which is quite a bit easier to use than the online HTML format. CHM, or Microsoft Compressed HTML Help, is a proprietary format for online help files, but it can be read on other platforms like Linux and Mac with additional software. DeLynn writes of the update:

“This update has the documentation for the 1.1.6 release of Rails. This version also has a much more organized Contents section that has a folder group for each gem, which will hopefully lead to easier browsing of the entire file.”

If you’re on Mac, try Chamonix, which has better search features than Chmox, but both tools work. On Linux, try GnoCHM or KchmViewer.

Link to DeLynn’s Blog Announcement
Direct Link to CHM File

Ruby on Rails date_finder plugin

Daniel Butler — Wed, 20 Sep 2006 09:07:00 -0400

Jonathan Viney of New Zealand has announced his date_finder plugin for Ruby on Rails. The plugin allows the following types of actions:

To find the next five Mondays and Fridays:

DateFinderBase.weekly.day(:monday).day(:friday).find(:max => 5)

To find the 10th of the month for the next five months:

DateFinderBase.monthly.day_number(10).find(:max => 5)

To find the last Thursday in September for the next 3 years

DateFinderBase.yearly.month (:september).day(:thursday).day_occurrence(:last).find(:max => 3)

To find the next 5 Wednesdays on a fortnightly basis (skips every second week):

DateFinderBase.weekly(2).day(:wednesday).find(:max => 5)

To install, execute script/plugin install http://svn.viney.net.nz/things/rails/plugins/date_finder.

Thanks, Jonathan.

Date Finder @ Ruby Plugins Directory

Ruby on Rails Plugin: CriteriaQuery

Daniel Butler — Wed, 06 Sep 2006 21:00:00 -0400

You’ll like this code:

Person.query.name_like('name').join('address').city_like('city')

… and CriteriaQuery brings it to you (via Max Muermann) as a Ruby on Rails plugin. Head to the README for some useful examples, like this awkward beauty:

  pq = Person.query
  pq.disjunction.first_name_eq(params[:name]).last_name_eq(params[:name]) if params[:name]
  pq.category_id_eq(params[:category]) if params[:category]
  ...
  address = pq.join("address")
  address.state_eq(params[:address[:state]]) if params[:address[:state]]
  ...
  end

Neat, huh?

CriteriaQuery Plugin Documentation Page
Ruby Plugins Directory Entry

Prototype Carousel Class for Ruby on Rails

Daniel Butler — Wed, 06 Sep 2006 19:32:00 -0400

Sébastien Gruhier of Carquefou, France, a new Rails convert (after 13 years of C++/Java) has provided a handy Prototype/Scriptaculous Carousel component, which does not use any Yahoo User Interface JavaScript components. A carousel component allows you to view a window into a image stream, with forward and reverse buttons that allow you to navigate through the images.

Yahoo’s page describes the component:

The carousel component manages a list of content (HTML UL and LI elements) that can be displayed horizontally or vertically. The content can be scrolled back and forth with or without animation. The content can reference static HTML content or the list items can be created dynamically on-the-fly (with or without Ajax).

The current version supports both static and Ajax content.

Prototype Carousel Component Home Page
Original Carousel Component Documentation

The New Ruby-Lang.org

Daniel Butler — Wed, 30 Aug 2006 18:00:00 -0400

A new design for ruby-lang.org is coming, and it’s very Web 2.0. Sweet.

_why’s Blog Article
New Site
Old Site

Rails No-Nos Now

Daniel Butler — Wed, 30 Aug 2006 17:45:00 -0400

Kevin Clark of San Diego has posted an article describing several deprecated features of Rails–thing you should fix now or they’ll break later. Quickly, they are:

Accessing Instance Variables You Didn’t Create
Stop using find_all and find_first
Don’t write the AJAX-enabled feature before you write the simple fallback feature.
Stop asking for things not directly related to your problem.
Don’t use scaffolding.
Don’t use components.
Don’t use engines unless you’re going to do it right.
Use layouts more
Don’t use Rails Paginator class
Don’t put controllers into namespaces.

I don’t completely agree with all of Kevin’s findings, but you should at least view the article to be aware of some of the problems that you might encounter using these less than best practices features.

Things You Shouldn’t Be Doing in Rails

Beware of "Assumed Logged In" Attacks

Daniel Butler — Wed, 30 Aug 2006 07:01:00 -0400

Brian Ellin of Portland, Oregon, warns us of “assumed logged in” attacks, which are cross-site attacks in which another site carefully crafts a URL that opens in a hidden frame which performs a destructive action on a different site that you are assumed to have been logged in to. His solution: the secure-action-plugin. He describes the problem and the solution:

In an assumed logged in attack, a malicious site assumes the visitor is logged into your site. The malicious site manually crafts a URL to a destructive action on your site (change email, delete account, etc.) and opens the URL to that action in a hidden iframe. The browser then sends the user’s cookies and actions may be performed on your user’s behalf without them ever knowing. This technique may be used to steal accounts, inject or delete account data, or perform other malicious actions.

The plugin works by overriding ActionController.url_for and adding a signature of the user’s session_id and some salt to URL query strings. By adding a sig that includes the user’s session_id, it makes it impossible to for malicious sites to create URLs that will work on your site for anyone but themselves. The signature is verified before a secure action is executed.

Until now, I had not conceived of this type of attack. Thanks, Brian.

Secure Action on the Rails Wiki Page
Plugin Home Page
Ruby Plugins Directory Entry

Modal Information Boxes: RedBoxPlugin for Ruby on Rails

Daniel Butler — Tue, 29 Aug 2006 10:22:00 -0400

Craig Ambrose, an Aussie from Melbourne, has announced the RedBox Plugin for Ruby on Rails. He writes,

I’ve written a little plugin to use for displaying a block of html over a page while fading out the background. This is like the lightbox.js library, and all it’s related offshoots (thickbox, greybox, etc.). My plugin, Redbox, is not really any better than these others (in fact, it’s less mature, and less tested), but it builds on prototype and scriptaculous, is available as a rails plugin, provides easy to use helpers, and unlike the other libraries, works very well with rails’ ajax functionality.

Looks nice, and it’s easy to use. Thanks, Craigh.

Craig’s Blog Entry
Demo Page
Ruby Plugins Directory Entry

Ruby on Rails Forums in about 500 LOC: Beast

Daniel Butler — Thu, 17 Aug 2006 13:58:00 -0400

Josh Goebel and Rick Olsen are working on Beast, a “small, light-weight forum in Rails with a scary name and a goal of around 500 lines of code when we’re done.” Beast is not mature yet, but forums is one application domain that is sorely lacking in the RoR world, and it’s good to see people working on innovative applications. phpBB is difficult to maintain, modify, and full of security holes, and I’ve been searching for a better alternative, perhaps even going so far as to start writing my own forum system.

So far, RForum (stuck at version 0.2 since December 2005) looks like the most mature forum application available for Rails, and it comes complete with email gateway functionality, but hopefully other forum applications will start populating the thriving ecosystem.

Beast Demo Site
Beast Subversion Repository

Bruce Tate on Rails Migrations

Daniel Butler — Thu, 17 Aug 2006 10:41:00 -0400

Bruce Tate, a Java book author and Ruby on Rails advocate, discusses the advantages of Ruby on Rails database migration strategy, and concludes:

The migrations story in Java programming is not nearly as robust. Some products have spot solutions for some of the schema migrations problems, but without a systemic process for coordinating schema changes – both up and down – dealing with changes in the data and object model can be a difficult task. The Rails solution has some core advantages:

Rails migrations are DRY (don’t repeat yourself). With Rails, you specify each column definition exactly once: in the migration. Some other mappers force you to specify a column six times: in the schema, the getter, the setter, the model’s instance variable, the “from” mapping, and the “to” mapping.

Rails migrations allow data migration as well as schema migration.

Rails migrations let you use model logic with your data migration where SQL scripts don’t.

Rails migrations are database independent, but SQL scripts aren’t.

Rails migrations allow direct SQL for unsupported extensions (such as stored procedures or constraints), while some ORM mappers don’t.

With all of the benefits of migrations, you’d expect a complex piece of code, but they are incredibly simple. Migrations have meaningful names and version numbers. Each migration, has an up and down method. Finally, a rake task coordinates running them in the correct order. This simple strategy is also revolutionary. The idea of expressing each schema change not in the model but as a distinct migration is both elegant and effective. Coordinating both data and schema changes is another paradigm shift, and an effective one. Best of all, these ideas are completely language agnostic. If you’re building a new Java wrapping framework, you’d do well to consider migrations.

I personally take full advantage of migrations during development and maintenance of Ruby on Rails, and they have forever solved the chicken-and-egg data, code, and schema synchronization problem which made moving from development to production a unweildy and error-prone process in the past. It’s also important to have a histor of the schema changes over time so that if a problem arises, you can track back to the exact change and schema migration which caused it.

Crossing Borders: Rails Migrations Article
Understanding Migrations @ Rails Wiki

New Rails Security Mailing List

Daniel Butler — Thu, 10 Aug 2006 21:01:00 -0400

If you’re running any Rails installations in production, do yourself a favor and sign up to the Rails-Security mailing list. DHH says:

In light of the past days of fun and games, we’ve started a new mailing list focused entirely around security. This list will be much lower volume than the main list and be exclusively about security concerns. You can signup at the rails-security mailing list page.

You’ll only receive announcements about Rails security, not discussion, so it won’t be too painful when something like this happens again.

David’s Blog Entry
Rails-Security Mailing List Signup Page

Typo 4.0.1 Released

Daniel Butler — Thu, 10 Aug 2006 07:04:00 -0400

Scott Laird has released version 4.0.1 of Typo, the premiere blogging application written in Ruby on Rails. This release includes Rails 1.1.5, which fixes substantial security problems, and everyone is encouraged to upgrade.

The new installer script has several changes, according to Scott:

It has been spun off into its own .gem and lives in its own source repository, so other projects can use it as well.
It now supports Postgres as well as SQLite3. I’ll write about this soon.
It performs database-agnostic backups to a .yml file.
A number of bugs have been squashed.

Thanks for all the hard work!

Scott’s Blog Annoucement
Typo 4.0.1 @ RubyForge
Download Page @ TypoSphere

Upgrade your old Rails installations ... Now!

Daniel Butler — Wed, 09 Aug 2006 18:59:00 -0400

DHH has decreed:

This is a MANDATORY upgrade for anyone not running on a very recent edge (which isn’t affected by this). If you have a public Rails site, you MUST upgrade to Rails 1.1.5. The security issue is severe and you do not want to be caught unpatched.

The issue is in fact of such a criticality that we’re not going to dig into the specifics. No need to arm would-be assailents.

So upgrade today, not tomorrow. We’ve made sure that Rails 1.1.5 is fully drop-in compatible with 1.1.4. It only includes a handful of bug fixes and no new features.

So, if this blog goes down in the next few minutes for a nick, that’s bloody well why.

Better Scaffolding with Ruby on Rails: dry_scaffold

Daniel Butler — Wed, 09 Aug 2006 10:07:00 -0400

Ed Moss loves the DRY principle enough that he’s posted a Rails engine that attempts to prevent code duplication across model, views, and controllers that allow data editing.

The engine includes support for parent-child relationships, sorting, filtering, in-context editing, as well as being completely customizable. Take a look:

The engine looks great and is easy to use. Thanks, Ed!

dry_scaffold Page @ Rubyforge
Download Plugin from Rubyforge
DRY Rails Engine Plugin Demo

Yet Another Ruby on Rails IDE: RideMe

Daniel Butler — Mon, 07 Aug 2006 17:23:00 -0400

While nothing can really compare to TextMate on OS X for its simplicity and natural flexibility, Windows users have yet another Ruby on Rails IDE to satiate your need of file drawers, tab completions, and that debilitating syntax-highlighting addiction: RideMe. Jeff Cohen declared version 1.0 as indulging you in the following ways:

100% free, open source, and not built on top of anything else. You just need Ruby 1.8.2 and .NET 2.0 installed.
Mission in life is to be lightweight and very fast. This is not a general purpose Ruby editor, it’s an IDE for getting your Rails work done.
File-system based approach. No messy workspace files or extra RIDE-ME specifics junking up your directory.
Syntax highlighting for Ruby Files, Views, Layouts, JavaScript, SQL, CSS, and HTML.
Familiar Visual Studio-style tabbed document editor.
Model / Member drop downs for easy movability in code. (Think Visual Studio above your code file)
Code folding for Ruby files
script/console built into the IDE (think Visual Studio “Immediate Mode”)
Server Error notification (template errors will actually open the view file and go to the LOC)
Internal web browser (optional)

Project RideMe
Download Installer: RideMe.Setup.msi