Rails 3 turns off the html_safe option by default. I want to revert this thing. I have a rails 2.3.8 app getting converted to rails 3. Almost every page breaks because of the rails3 default html_safe setting. Is there any way I can revert this to where it was in previous versions of rails ? Please help
No, there isn't and even if there is, you shouldn't.
It's a good habit to test (and update) your app using the rails_xss plugin in Rails 2.3.x before actually starting the conversion to Rails 3.
Also, you should have a valid test suite in place so that every error will be spotted by the test suite and you can easily fix it.
Don't try to upgrade unless you have completed these two simple steps. There are also a few other suggestions.
As a side note: Current versions of Rails 3 HTML-escape also non-HTML templates, which is a bug. See: https://rails.lighthouseapp.com/projects/8994/tickets/4858
I'm posting this here, because I found this question while investigating the bug mentioned above, but didn't fine that ticket or anything about this bug on the interwebs. (Bad google skills?) Hope it saves someone time.
Related
I got these updates from rails:
I'd like to announce that 3.2.11, 3.1.10, 3.0.19, and 2.3.15 have been released. These releases contain two extremely critical security fixes so please update IMMEDIATELY.
link
as it says it's critical. I just updated my application with rails 3.1 to 3.11 and did bundle update rails. My questions are:
What was the actual loophole in rails that has now been fixed?
As a learner I'm eager to understand what the problem was and how has it been fixed. I couldn't get anywhere about this.
Is it really a big loophole, and is there any problem for all Rails application which haven't been updated?
Here's an explanation of the hack : http://charlie.bz/blog/rails-3.2.10-remote-code-execution
And the original post by tenderlove : https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/61bkgvnSGTQ
Basically, anyone can inject XML and instantiate any kind of Ruby object using YAML ... it's complicated, but works on all apps (except the patched one of course, and Rails 1.X) and can even execute system commands ...
Anyone having Rails apps around should already have upgraded ... if not, do it NOW!
How do I update to Rails 3.1 ?
I am using windows xp with ruby console.
And is there a smart way to update a rails app from 3.0.3 to 3.1 or do I need to rewrite it all?
This question has a lot of useful information which might help you out: Upgrading from Rails 3 to Rails 3.1
It doesn't answer specifically for Windows, but there's a lot of advice and insight that you'll find useful for the upgrade.
The only advice I can offer on top of reading the answers in the above question is to have a bit of patience and not expect it to work straight away. There's a lot of changes in the way 3.1 works so expect to spend some time fixing it up.
Good luck!
I created one vanilla 3.0 site, added it to Git, then created a vanilla 3.1 site and copied it over the 3.0 site, deleting existing files first. A diff then showed me exactly what changed.
I would strongly recommend this and the following two railscasts in the series
I have this new project I need to build. I want to have at least started on it by the end of this month. So which version should I use though? Should I just stick with the stable Rails2 or try to use Rails3 so I won't have to migrate later? Which one would you suggest for someone that is still learning Rails?
Rails 3 definitely won't have the resources available for it that Rails 2 does, and Rails 3 will still be changing quite fast, so unless you're especially happy getting your support from the source code I'd stick with Rails 2
I know you've already accepted Rails 2, but I'm throwing this out, anyway:
I've been using Rails 3 for my newer projects, and haven't noticed any significant bugs. Of course, I've only used popular gems and plugins that therefore are already have dedicated teams who have made them compatible with Rails 3.
You can fairly easily check if your plugins are compatible at RailsPlugins.org. Some might require you to use a specific Rails 3 branch from Github, so be sure to check the comments on reports that say "Working".
As long as you won't be using anything terribly obscure, you should be good to go for Rails 3, which is a fantastic piece of work from the Rails team. Arel makes my day every day.
Rails 3 will not be out of beta sooner than fall this year and I guess it may shift. Rails 2 works pretty well and you will not need to debug unstable code while learning. Many tools, gems etc. have still not migrated.
I agree with you both.
You should use rails2. Rails3 is still in beta and many problems can be encouter.
In my company we've migrate to rails3 and it's foolish. We spend a lot of time to debug/modify plugins for rails3 ...
Now it's up to you to make your choice :)
Is it time to start new projects in Rails 3? I'm nervous about using beta versions but at the same time I really like what they are doing and don't want to deal with legacy 2.3.5 issues with these apps.
Is it better to wait these things out, or buckle-up, deal with early adopter issues and get a head start on the future. Thanks for any light you can shed.
I'd say no, rails v3.beta3 still has some serious issues that cause it to crash (unexpectedly). As noted from the Riding Rails blog:
Note that Ruby 1.8.7 p248 and p249 has marshaling bugs that crash both Rails 2.3.x and Rails 3.0.0. Ruby 1.9.1 outright segfaults on Rails 3.0.0, so if you want to use Rails 3 with 1.9.x, jump on 1.9.2 trunk for smooth sailing.
Also of note:
Known regressions: Rails crashes unless configuration.action_controller.session is set, config.thread_safe does not work, Unable to run a RJS partial from an HTML template, Backtrace silencers oftem remove application lines from test failures backtraces, Active Record double escapes error_messages_for
I am doing all of my new development work on Rails 3. I have found a couple of issues in general stability, but they are really in the fringe/edge cases - I have a system running on Heroku that is quite stable. The core platform itself is quite stable and the various APIs should not significantly change heading to release.
You need to ask yourself what you've got to lose, but one thing is clear: Rails 2.x is history.
I'm developing an application with Ruby on Rails that I want to maintain for at least a few years, so I'm concerned about the next version coming up soon.
Going from Rails 1 to Rails 2 was such a big pain that I didn't bother and froze my gems and let the application die, alone, in the dark.
On this project I don't want to do that. First because this new version looks awesome, but also because this application may turn into a real product.
How can I prepare my application so that it will be upgradable with as little changes as possible.
How time consuming do you think switching version will be?
And what about my server? Deployment?
I'm already looking at deprecation notices... what else can I do?
The best thing you could do would be to follow development of Rails 3 via blogs and the Github repository and keep up a copy of your app along with it.
The official Ruby on Rails blog is updated with "What's new in Edge" posts every once in awhile. There are other blogs that often write about new things in edge as well. Larger features are often highlighted in these blogs, so you know about all the cool new features you can play with.
I'm not sure how close Rails 3 is to release (last I heard the core team was talking about a release at RailsConf 2009 in May), but you can always freeze the edge version of Rails into your application and just see what breaks. If you are using git, or another DVCS, you might make a branch specifically for Rails 3 and periodically update Rails to the latest edge code. Just be aware that edge Rails is a moving target so things in your app may break or fix themselves as you are pulling in newer Rails code.
Update:
Jeremy McAnally has a ton of info on upgrading from Rails 2 to Rails 3 on his blog.
http://omgbloglol.com/
I don't think there is going to be a major problem. Going off what was said in that initial report the Rails team realized that they can't do a major rewrite like they did from 1 to 2.
They even say:
I’m sure there’ll be some parts of Rails 3 that are incompatible, but we’ll try to keep them to a minimum and make it really easy to convert a Rails 2.x application to Rails 3.
I would be more concerned going from Merb to Rails 3.
The single most important thing you can do to make it easy to migrate to a new version of rails is to have a comprehensive test suite. Without a good test suite, I would never have the confidence that the new version of rails hasn't broken something in my app. On the current Rails app I'm working on, we started on Rails 2.1.1 back in October of 2008. Since then, we've migrated to Rails 2.1.2, 2.2.2, 2.3.2, 2.3.3 and now 2.3.4. I did the migrations to 2.3.2, 2.3.3 and 2.3.4...and for the 2.3.2 and 2.3.3 upgrades, we had some failing tests that alerted us to problems we would not have discovered without having such a good test suite. The failing tests actually alerted us to a regressive bug in rails that there was a patch for on the Rails lighthouse but that was not included in the release (since it was discovered, right after the release).
Once you've got that test suite in place, just stay current with each rails release (waiting a couple weeks to upgrade is fine, just don't skip any of the releases).
Yehuda Katz (a member of the Rails core team) has stated that there will most likely be a transitional release, containing deprecation warnings and such.
So as long as you have a good test suite to expose the inevitable upgrade problems, and stay current with the Rails release, the migration to Rails 3 should not be too difficult.
As simple as:
One
Two
Three
Great screencasts from Ryan Bates.
For preparing your application, the best way it what Jared said. Follow the Rails3 development.
For the time consuming, I think it depends of how you've followed the rails3 development before it's release.
And for the deployment, it shouldn't take too much problems. Rails 3 will be using Rack. So you can start it with mongrel, passenger or any server/gateway it shouldn't give you any problem.
There are some major changes in Rails 3, I posted about my experience upgrading my app to Rails 3 here: http://rails3.community-tracker.com/permalinks/5/notes-from-the-field-upgrading-to-rails-3
A good start in preparing would be to migrate over to using bundler. And doing a very deep review of strings that will go through the new XSS protection scheme.
There are going to be some automated compatibility checkers. Also, keep an eye on http://www.railsplugins.org/ so that you know if the libraries you depend on are going to be upgraded. The Rails Core team seems to be giving a lot of advance notice to the community this time around, so any lib that is actively maintained should be good to go.
Just do one thing
take a backup of your old version project first and then
on terminal(command prompt) write
rails new path/of/the/project
for example if my 2.3.* project is at home/rails_projects/myproject then
rails new home/rails_projects/myproject
or
cd home/rails_projects
rails new myproject
It will ask if there is any modifications done in any /config or other files. Do appropriate.