From 0425a835771b453b32a0a0dfcc0fc5c17dcad86a Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Mon, 6 Oct 2025 23:44:42 -0400 Subject: [PATCH 1/4] seeds: drop the 'bare' option --- db/seeds.rb | 8 ++------ db/seeds/cleanslate.rb | 2 +- 2 files changed, 3 insertions(+), 7 deletions(-) diff --git a/db/seeds.rb b/db/seeds.rb index 26e1a40ff..4ffde4a80 100644 --- a/db/seeds.rb +++ b/db/seeds.rb @@ -10,12 +10,8 @@ def seed_account(name) puts " #{elapsed.round(2)} sec" end -def create_tenant(signal_account_name, bare: false) - if bare - tenant_id = Digest::SHA256.hexdigest(signal_account_name)[0..8].to_i(16) - else - tenant_id = ActiveRecord::FixtureSet.identify signal_account_name - end +def create_tenant(signal_account_name) + tenant_id = ActiveRecord::FixtureSet.identify signal_account_name ApplicationRecord.destroy_tenant tenant_id ApplicationRecord.create_tenant(tenant_id) do diff --git a/db/seeds/cleanslate.rb b/db/seeds/cleanslate.rb index 4a672d348..d61e0970e 100644 --- a/db/seeds/cleanslate.rb +++ b/db/seeds/cleanslate.rb @@ -1 +1 @@ -create_tenant "cleanslate", bare: true +create_tenant "cleanslate" From eb9ed86f64dceb65ea3432475dc6b98e7734fd9e Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Mon, 6 Oct 2025 23:57:39 -0400 Subject: [PATCH 2/4] seeds: make sure the admin has the secret password --- db/seeds.rb | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/db/seeds.rb b/db/seeds.rb index 4ffde4a80..0ae3c46b1 100644 --- a/db/seeds.rb +++ b/db/seeds.rb @@ -22,7 +22,8 @@ def create_tenant(signal_account_name) }, owner: { name: "David Heinemeier Hansson", - email_address: "david@37signals.com" + email_address: "david@37signals.com", + password: "secret123456" } ) account.setup_basic_template @@ -32,16 +33,11 @@ def create_tenant(signal_account_name) end def find_or_create_user(full_name, email_address) - if user = User.find_by(email_address: email_address) - user.password = "secret123456" - user.save! - user - else - User.create!( + unless User.find_by(email_address: email_address) + User.create! \ name: full_name, email_address: email_address, password: "secret123456" - ) end end From 3df6683736e35babaa6660446e3901121386c0dc Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Tue, 7 Oct 2025 00:04:38 -0400 Subject: [PATCH 3/4] Fix filter title when there's only one Collection in the account --- app/models/filter/resources.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/models/filter/resources.rb b/app/models/filter/resources.rb index a12ed368f..9110d3727 100644 --- a/app/models/filter/resources.rb +++ b/app/models/filter/resources.rb @@ -23,7 +23,7 @@ module Filter::Resources def collection_titles if collections.none? - [ Collection.one? ? collections.first.name : "All collections" ] + Collection.one? ? [ Collection.first.name ] : [ "All collections" ] else collections.map(&:name) end From 9bfd21c096914656643fdd735fe3de9ac7b05cd5 Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Tue, 7 Oct 2025 00:16:47 -0400 Subject: [PATCH 4/4] ci: remove outdated ignores from brakeman config --- config/brakeman.ignore | 155 ----------------------------------------- 1 file changed, 155 deletions(-) diff --git a/config/brakeman.ignore b/config/brakeman.ignore index 12307b2bd..1dda23af7 100644 --- a/config/brakeman.ignore +++ b/config/brakeman.ignore @@ -1,72 +1,5 @@ { "ignored_warnings": [ - { - "warning_type": "Cross-Site Scripting", - "warning_code": 2, - "fingerprint": "005569e6623f389266d3e1d760851a6ea9af52e21ba65b92d69dee5d3dfb492f", - "check_name": "CrossSiteScripting", - "message": "Unescaped model attribute", - "file": "app/views/searches/_result.html.erb", - "line": 20, - "link": "https://brakemanscanner.org/docs/warning_types/cross_site_scripting", - "code": "Current.new.card_description", - "render_path": [ - { - "type": "controller", - "class": "SearchesController", - "method": "show", - "line": 7, - "file": "app/controllers/searches_controller.rb", - "rendered": { - "name": "searches/show", - "file": "app/views/searches/show.html.erb" - } - }, - { - "type": "template", - "name": "searches/show", - "line": 28, - "file": "app/views/searches/show.html.erb", - "rendered": { - "name": "searches/_result", - "file": "app/views/searches/_result.html.erb" - } - } - ], - "location": { - "type": "template", - "template": "searches/_result" - }, - "user_input": null, - "confidence": "High", - "cwe_id": [ - 79 - ], - "note": "" - }, - { - "warning_type": "SQL Injection", - "warning_code": 0, - "fingerprint": "1261c0a89b23c1d7386d684f41c26cc230fa9b5b00d062d7f8d4d1a15bde96a8", - "check_name": "SQL", - "message": "Possible SQL injection", - "file": "app/models/card/entropic.rb", - "line": 7, - "link": "https://brakemanscanner.org/docs/warning_types/sql_injection/", - "code": "left_outer_joins(:collection => :entropy_configuration).where(\"last_active_at <= DATETIME('now', '-' || COALESCE(entropy_configurations.#{period_name}, ?) || ' seconds')\", Entropy::Configuration.default.public_send(period_name))", - "render_path": null, - "location": { - "type": "method", - "class": "Card::Entropic", - "method": null - }, - "user_input": "period_name", - "confidence": "Weak", - "cwe_id": [ - 89 - ], - "note": "" - }, { "warning_type": "SQL Injection", "warning_code": 0, @@ -113,50 +46,6 @@ ], "note": "" }, - { - "warning_type": "Cross-Site Scripting", - "warning_code": 2, - "fingerprint": "7184deb68ef62f7a71aea3f5536a055b2b42de2173a393e846aada1b1e548042", - "check_name": "CrossSiteScripting", - "message": "Unescaped model attribute", - "file": "app/views/searches/_result.html.erb", - "line": 15, - "link": "https://brakemanscanner.org/docs/warning_types/cross_site_scripting", - "code": "Current.new.card_title", - "render_path": [ - { - "type": "controller", - "class": "SearchesController", - "method": "show", - "line": 7, - "file": "app/controllers/searches_controller.rb", - "rendered": { - "name": "searches/show", - "file": "app/views/searches/show.html.erb" - } - }, - { - "type": "template", - "name": "searches/show", - "line": 28, - "file": "app/views/searches/show.html.erb", - "rendered": { - "name": "searches/_result", - "file": "app/views/searches/_result.html.erb" - } - } - ], - "location": { - "type": "template", - "template": "searches/_result" - }, - "user_input": null, - "confidence": "High", - "cwe_id": [ - 79 - ], - "note": "" - }, { "warning_type": "Remote Code Execution", "warning_code": 24, @@ -179,50 +68,6 @@ 470 ], "note": "" - }, - { - "warning_type": "Cross-Site Scripting", - "warning_code": 2, - "fingerprint": "e94d5d8fe73652df999614040e2a83d64d6be944b19931ff171be0cac4b9078d", - "check_name": "CrossSiteScripting", - "message": "Unescaped model attribute", - "file": "app/views/searches/_result.html.erb", - "line": 27, - "link": "https://brakemanscanner.org/docs/warning_types/cross_site_scripting", - "code": "Current.new.comment_body", - "render_path": [ - { - "type": "controller", - "class": "SearchesController", - "method": "show", - "line": 7, - "file": "app/controllers/searches_controller.rb", - "rendered": { - "name": "searches/show", - "file": "app/views/searches/show.html.erb" - } - }, - { - "type": "template", - "name": "searches/show", - "line": 28, - "file": "app/views/searches/show.html.erb", - "rendered": { - "name": "searches/_result", - "file": "app/views/searches/_result.html.erb" - } - } - ], - "location": { - "type": "template", - "template": "searches/_result" - }, - "user_input": null, - "confidence": "High", - "cwe_id": [ - 79 - ], - "note": "" } ], "brakeman_version": "7.0.2"