Stability & Security updates #85
Open
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is similar to PR #79 .
UPDATES:
Security updates for Rails includes previously mentioned:
CVE-2016-6317 5/10 Threat
Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does
not properly consider differences in parameter handling
between the Active Record component and the JSON
implementation, which allows remote attackers to bypass
intended database-query restrictions and perform NULL
checks or trigger missing WHERE clauses via a crafted
request, as demonstrated by certain "[nil]" values, a
related issue to CVE-2012-2660, CVE-2012-2694, and
CVE-2013-0155.
CVE-2016-6316 4.3/10 Threat
Cross-site scripting (XSS) vulnerability in Action View
in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1,
and 5.x before 5.0.0.1 might allow remote attackers to
inject arbitrary web script or HTML via text declared as
"HTML safe" and used as attribute values in tag handlers.
Server was complaining about
backbone-min.mapandunderscore-min.mapmissing so I added those in.ActiveAdmin pages when first visited from the main site
would falsely include the application template. A
Javascript fix was implemented for this.
ActiveAdmin logout would previously exit to the admin
login page. This has been fixed.
Navbar had a drop down menu with no useful links. This
has been removed.
A few links were painfully huge at header 1 size. I've
reduced those to header 3 size.