Skip to content

Commit 5a37575

Browse files
relotnekrelotnek
committed
Merge remote-tracking branch 'upstream/master' into openshift
2 parents e53e47d + df1bae0 commit 5a37575

File tree

12 files changed

+100
-93
lines changed

12 files changed

+100
-93
lines changed

‎app/controllers/sessions_controller.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ def create
1212
path = params[:url].present? ? params[:url] : home_dashboard_index_path
1313
begin
1414
# Normalize the email address, why not
15-
user = User.authenticate(params[:email].to_s.downcase, params[:password])
15+
user = User.authenticate(params[:email].to_s.strip.downcase, params[:password])
1616
rescue RuntimeError => e
1717
# don't do ANYTHING
1818
end

‎app/views/dashboard/home.html.erb

Lines changed: 26 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1,43 +1,37 @@
11
<div class="dashboard-wrapper">
22
<div class="main-container">
33
<div class="row-fluid">
4-
<div class="span12"> <!--begin span12 -->
5-
<div class="widget">
6-
<div class="widget-header">
7-
<div class="title">
8-
<span class="fs1" aria-hidden="true" data-icon="&#xe0a0;"></span> Current Statistics
9-
</div>
10-
<!-- Begin Title Buttons-->
11-
<div class="tools pull-right">
12-
<div class="btn-group">
13-
<a id="change_to_bar_graph" class="btn btn-small">
14-
<span data-icon="&#xe14b;"></span>
15-
</a>
16-
<a id="change_to_pie_charts" class="btn btn-small">
17-
<span data-icon="&#xe096;"></span>
18-
</a>
19-
</div>
20-
</div>
21-
<!-- End Title Buttons-->
22-
</div>
23-
<div id="charts_body" class="widget-body">
24-
<%#= render partial: "dashboard_stats" %>
25-
</div>
26-
<div class="clearfix">
27-
</div>
28-
</div>
29-
</div>
30-
<center><b>Need help using this portal? Check out the <a href="doc?doc=README_FOR_APP">Readme</a></b></center>
31-
</div> <!-- end span12 -->
4+
<div class="span12"> <!--begin span12 -->
5+
<div class="widget">
6+
<div class="widget-header">
7+
<div class="title">
8+
<span class="fs1" aria-hidden="true" data-icon="&#xe0a0;"></span> Current Statistics
9+
</div>
10+
<!-- Begin Title Buttons-->
11+
<div class="tools pull-right">
12+
<div class="btn-group">
13+
<a id="change_to_bar_graph" class="btn btn-small">
14+
<span data-icon="&#xe14b;"></span>
15+
</a>
16+
<a id="change_to_pie_charts" class="btn btn-small">
17+
<span data-icon="&#xe096;"></span>
18+
</a>
19+
</div>
20+
</div>
21+
<!-- End Title Buttons-->
22+
</div>
23+
<div id="charts_body" class="widget-body">
24+
<%#= render partial: "dashboard_stats" %>
25+
</div>
26+
<div class="clearfix">
27+
</div>
28+
</div>
29+
</div> <!-- end span12 -->
3230
</div>
3331
</div>
3432
</div>
3533

36-
37-
38-
3934
<script type="text/javascript">
40-
4135
function makeActive(){
4236
$('li[id="home"]').addClass('active');
4337
};
@@ -60,7 +54,3 @@ $(document).ready(
6054
$("#charts_body").load(<%= sanitize change_graph_dashboard_index_path(:graph => "pie_charts").inspect %>)
6155
);
6256
</script>
63-
64-
65-
66-

‎app/views/pay/index.html.erb

Lines changed: 14 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,23 @@
11
<div class="dashboard-wrapper">
22
<div class="main-container">
33
<div class="row-fluid">
4-
<div class="span12">
5-
<div id="success" style="display: none;" class="alert alert-block alert-success fade in">
6-
<h4 class="alert-heading">
7-
Success!
8-
</h4>
9-
<p>
10-
Information successfully updated.
11-
</p>
12-
</div>
4+
<div id="success" style="display: none;" class="alert alert-block alert-success fade in">
5+
<h4 class="alert-heading">
6+
Success!
7+
</h4>
8+
<p>
9+
Information successfully updated.
10+
</p>
1311
</div>
1412
</div>
1513
<div class="row-fluid">
16-
<div class="span12">
17-
<div id="failure" style="display: none;" class="alert alert-block alert-error fade in">
18-
<h4 class="alert-heading">
19-
Error!
20-
</h4>
21-
<p>
22-
Failed to update.
23-
</p>
24-
</div>
14+
<div id="failure" style="display: none;" class="alert alert-block alert-error fade in">
15+
<h4 class="alert-heading">
16+
Error!
17+
</h4>
18+
<p>
19+
Failed to update.
20+
</p>
2521
</div>
2622
</div>
2723
<!-- Begin Row-Fluid for Inputs -->

‎app/views/users/account_settings.html.erb

Lines changed: 14 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,22 @@
11
<div class="dashboard-wrapper">
22
<div class="main-container">
33
<div class="row-fluid">
4-
<div class="span12">
5-
<div id="success" style="display: none;" class="alert alert-block alert-success fade in">
6-
<h4 class="alert-heading">
7-
Success!
8-
</h4>
9-
<p>
10-
Information successfully updated.
11-
</p>
12-
</div>
4+
<div id="success" style="display: none;" class="alert alert-block alert-success fade in">
5+
<h4 class="alert-heading">
6+
Success!
7+
</h4>
8+
<p>
9+
Information successfully updated.
10+
</p>
1311
</div>
1412
</div>
15-
<div class="row-fluid">
16-
<div class="span12">
17-
<div id="failure" style="display: none;" class="alert alert-block alert-error fade in">
18-
<h4 class="alert-heading">
19-
Error!
20-
</h4>
21-
<p>
22-
Failed to update.
23-
</p>
24-
</div>
25-
</div>
13+
<div id="failure" style="display: none;" class="alert alert-block alert-error fade in">
14+
<h4 class="alert-heading">
15+
Error!
16+
</h4>
17+
<p>
18+
Failed to update.
19+
</p>
2620
</div>
2721
<div class="row-fluid">
2822
<div class="span6">

‎app/views/work_info/index.html.erb

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -12,26 +12,26 @@
1212
<table class="table table-bordered table-striped">
1313
<thead>
1414
<tr>
15-
<th style="width:16%">Full Name</th>
15+
<th style="width:16%">Full Name</th>
1616
<th style="width:16%">Income</th>
17-
<th style="width:16%">Bonus/th>
17+
<th style="width:16%">Bonus</th>
1818
<th style="width:16%">Years w/ MetaCorp</th>
1919
<th style="width:16%">SSN</th>
20-
<th style="width:16%">DoB</th>
20+
<th style="width:16%">DoB</th>
2121
</tr>
2222
</thead>
2323
<tbody>
2424

25-
<tr>
25+
<tr>
2626
<td><%= "#{@user.first_name} #{@user.last_name}" %></td>
2727
<td><%= @user.work_info.income %></td>
2828
<td><%= @user.work_info.bonuses %></td>
2929
<td><%= @user.work_info.years_worked %></td>
30-
<td class="ssn"><%= @user.work_info.SSN %></td>
31-
<!-- Begin Secure Version>-->
32-
<!--<td class="ssn"><%#= @user.work_info.last_four %></td>-->
33-
<!-- End Secure Version -->
34-
<td><%= @user.work_info.DoB %></td>
30+
<td class="ssn"><%= @user.work_info.SSN %></td>
31+
<!-- Begin Secure Version>-->
32+
<!--<td class="ssn"><%#= @user.work_info.last_four %></td>-->
33+
<!-- End Secure Version -->
34+
<td><%= @user.work_info.DoB %></td>
3535
</tr>
3636

3737
</tbody>

‎lib/encryption.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ def self.decrypt_sensitive_value(val = "")
1515
aes = OpenSSL::Cipher.new(cipher_type)
1616
aes.decrypt
1717
aes.key = key[0..31]
18-
aes.iv = iv[0.15] if iv != nil
18+
aes.iv = iv[0..15] if iv != nil
1919
decoded = Base64.strict_decode64("#{val}")
2020
aes.update("#{decoded}") + aes.final
2121
end

‎spec/lib/encryption_spec.rb

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# frozen_string_literal: true
2+
require "spec_helper"
3+
require_relative "../../lib/encryption"
4+
5+
describe Encryption do
6+
let(:value) {
7+
allow(Encryption).to receive(:key).and_return(SecureRandom.bytes(32))
8+
allow(Encryption).to receive(:iv).and_return(SecureRandom.bytes(16))
9+
10+
"OMG PII"
11+
}
12+
13+
it "encrypts values" do
14+
encrypted = Encryption.encrypt_sensitive_value(value)
15+
expect(Base64.decode64(encrypted)).not_to eq(value)
16+
end
17+
18+
it "decrypts values" do
19+
encrypted = Encryption.encrypt_sensitive_value(value)
20+
decrypted = Encryption.decrypt_sensitive_value(encrypted)
21+
22+
expect(decrypted).to eq(value)
23+
end
24+
end

‎spec/vulnerabilities/csrf_spec.rb

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
pending unless verifying_fixed?
1111
end
1212

13-
scenario "attack\nTutorial: https://github.com/OWASP/railsgoat/wiki/R5-A8-CSRF", js: true do
13+
scenario "attack\nTutorial: https://github.com/OWASP/railsgoat/wiki/R4-A8-CSRF", js: true do
1414
visit "/"
1515
# TODO: is there a way to get this without visiting root first?
1616
base_url = current_url

‎spec/vulnerabilities/insecure_dor_spec.rb

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,15 +18,17 @@
1818
visit download_url.sub(/name=(.*?)&/, "name=config/database.yml&")
1919

2020
expect(page.status_code).not_to eq(200)
21-
expect(page.response_headers["Content-Disposition"]).not_to include("database.yml")
21+
expect(page.response_headers["Content-Disposition"].to_a).not_to include("database.yml")
2222
end
2323

2424
scenario "attack two\nTutorial: https://github.com/OWASP/railsgoat/wiki/A4-Insecure-Direct-Object-Reference" do
25+
login(normal_user)
26+
2527
expect(normal_user.id).not_to eq(another_user.id)
2628

2729
visit "/users/#{another_user.id}/work_info"
2830

29-
expect(first("td").text).not_to include(another_user.name)
30-
expect(first("td").text).to include(normal_user.name)
31+
expect(first("td").text).not_to include(another_user.full_name)
32+
expect(first("td").text).to include(normal_user.full_name)
3133
end
3234
end

‎spec/vulnerabilities/mass_assignment_spec.rb

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@
2323
expect(normal_user.reload.admin).to be_falsy
2424
end
2525

26-
scenario "attack two, Tutorial: https://github.com/OWASP/railsgoat/wiki/R5-Extras-Mass-Assignment-Admin-Role" do
26+
scenario "attack two, Tutorial: https://github.com/OWASP/railsgoat/wiki/R4-Extras-Mass-Assignment-Admin-Role" do
2727
params = { user: { admin: "t",
2828
email: "hackety@h4x0rs.c0m",
2929
first_name: "hackety",
@@ -33,6 +33,6 @@
3333

3434
page.driver.post "/users", params
3535

36-
expect(User.find_by(email: "hackety@h4x0rs.c0m")).to be_nil
36+
expect(User.find_by(email: "hackety@h4x0rs.c0m").admin).to be_falsy
3737
end
3838
end

0 commit comments

Comments
 (0)