Friday, February 22, 2019

Breakman Rails: How to avoid XSS cross site Warning

I will share some trick to avoid XSS cross site warning in Breakman Rails.

  • Example Case: URL 
          Problem :
            <%= raw generated_link_to("View Barcode","schedule/show_barcode?id="+data[0].to_s+"&schedule_id="+@schedule[:id].to_s","edit_schedule",{:class => 'btn btn-mini btn-info',:remote=>"true"}) %>
          Solved :
            <%= raw generated_link_to("View Barcode", schedule_show_barcode_path({:id=>data[0].to_s, :schedule_id=>@schedule[:id].to_s})"edit_schedule",{:class => 'btn btn-mini btn-info',:remote=>"true"}) %>
           *) schedule_show_barcode_path = route alias in config/routes
          
  • Example Case: Javascript or CSS
          Problem :
         <%= raw generated_link_to('<i class="icon-trash"</i>'.html_safe,"#delete_progress","add_schedule",{:class => 'removedbuttonsetting', :onclick => (params[:row_index],params[:form_type])})%>

<script type="text/javascript">
  function delete_row_form_extrarow(index,form_type){
    $("#tr_body_"+form_type+"_"+index).remove();
  }
</script>

          Solved :
            <%= raw generated_link_to('<i class="icon-trash"></i>'.html_safe,"#delete_progress","add_schedule",{:class => 'removedbuttonsetting', :indexattr => params[:row_index].to_json,:typeattr => params[:form_type].to_json})%>

<script type="text/javascript">
  $(function(){
    $(".removedbuttonsetting").click(function(){
        var index = $(this).attr('indexattr');
        var form_type = $(this).attr('typeattr');
        delete_row_form_extrarow(index,form_type);
    })
  });

  function delete_row_form_extrarow(index,form_type){
    var index1 = JSON.parse(index);
    var form_type1 = JSON.parse(form_type);
    $("#tr_body_"+form_type1+"_"+index1).remove();
  }
</script>


Share:

Friday, January 4, 2019

Solving "this exceeds GitHub's file size limit of 100 MB"





When You accidentally push large file to Github this warning will shown :

"this exceeds GitHub's file size limit of 100 MB"

To solve this problem is simple. Just type this command:

git filter-branch -f --index-filter 'git rm --cached --ignore-unmatch YOUR-FILE'

This command will filter chosen file from push process
Share:

Wednesday, November 28, 2018

File Compress,Gunzip,Mysql Command in Terminal Ubuntu

Compress and extract command in Ubuntu.
  • Compress File to Tar:  
tar czf name_of_archive_file.tar.gz name_of_directory_to_tar
  • Extract File from Tar: 
tar -xzvf file.tar.gz
  • Extract gz to MYSQL: 
gunzip < file-name.sql.gz | mysql -u user -p password  database-name
  • Compress MYSQL to gz: 
mysqldump -u user -p password database-name |gzip -9 > file-name.sql.gz 
  • Export: 
mysqldump -u user  -p password database-name > file-name.sql
  • Import: 
mysql -u user -p password database-name < file-name.sql
Share:

Thursday, September 13, 2018

Deploy Code with Capistrano

Developing a web application isn’t going to do much good if we aren’t able to find a way for the world to see it. For other web frameworks,this can often be a tedious and time-consuming process. Application code needs to be updated, database schemas need to be migrated, and application servers must be restarted. We could do all of this manually by ssh into the server, pulling the latest code from the repository, running database migration tasks, and restarting the application server. Even better, we could write some shell scripts that would automatically perform these tasks for us. But why do all that when we could be spending time improving App instead?

The good news is that we don’t have to do all that.Battle-tested and used for deploying many of today’s Rails apps, Capistrano (originally authored by Jamis Buck and now ably maintained by Lee Hambley) is the tool that Rails developers have used for years to get their applications from development to production on a daily basis. It was built from the start for deploying Rails applications, and it has all the tools we need to get App deployed and to help keep deployments running smoothly afterward. Capistrano’s library of tasks, plugins, and utilities has also evolved over the years with the rest of the Rails ecosystem, and thus Capistrano continues to meet the deployment needs of Rails applications both new and old.

Configuration

Add capistrano gem to development environment

group :development do
gem 'capistrano', '~> 2.11.2'
end

Don't forget to bundle update. and check your capistrano instalation by: cap -H

Generate necessarily file with :

capify .

// Will generate:
[add] writing './Capfile' // created in project’s root directory and takes care of loading Capistrano’s default tasks
[add] writing './config/deploy.rb' // Rails asset pipeline tasks, and our primary deployment script
[done] capified!

Settings

Example of config settings in /config/deploy.rb
require 'bundler/capistrano'

// Configurations from repository
set :application, "massiveapp"
set :scm, :git
set :repository, "git://github.com/myapp/myapp.git"

// Tell capistrano about server address host
server "localhost", :web, :app, :db, :primary => true
// port running in server
ssh_options[:port] = 2222
// path to private key
ssh_options[:keys] = "~/.vagrant.d/insecure_private_key"

set :user, "vagrant"
set :stages, %w(staging production)
set :default_stage, 'staging'
set :use_sudo, false
set :group, "vagrant"
set :deploy_to, "/var/myapp"
set :deploy_via, :copy
set :copy_strategy, :export

namespace :deploy do
  task :start do ; end
  task :stop do ; end
  desc "Restart the application"
  task :restart, :roles => :app, :except => { :no_release => true } do
    run "#{try_sudo} touch #{File.join(current_path,'tmp','restart.txt')}"
  end
  desc "Copy the database.yml file into the latest release"
  task :copy_in_database_yml do
    run "cp #{shared_path}/config/database.yml #{latest_release}/config/"
  end
end
// task that copy database.yml file into place, so we’ll put that here as well as a before directive that will force that task to be called as part of a deployment
before "deploy:assets:precompile", "deploy:copy_in_database_yml"

Setting in Server

From console application
cap deploy:setup

- /releases
- /shared
|- /log
|- /system
|- /pids


Each time we deploy, Capistrano will create a new subdirectory in the releases directory and place the source code for Application there. The shared directory will contain various, well, shared resources. Thus, shared/log will contain Application log files, and shared/system will contain any files that need to be kept from deployment to deployment. We also have shared/config, which we created with Puppet and which contains Application database.yml.

Push Command from Local


// as describe in /config/deploy.rb set_staging.
cap deploy staging



Share:

Thursday, August 16, 2018

Breakman Rails: How to avoid SQL injection

Breakman is static analysis security scanner for Ruby on Rails. It's open source vulnerability scanner specifically designed for Ruby on Rails applications. It statically analyzes Rails application code to find security issues at any stage of development.

I will share some trick to avoid Breakman SQL Injection medium settings warning.

1. Example Case "IN query": 
Wrong Format :
  id = [1,2,3,4,5]
  query = self.find(:all, :conditions =>["id in ("+id.joins(",")+")"])
Correct Format :
  id = [1,2,3,4,5]
   query = self.find(:all, :conditions =>["id in (?)", id])
  or
   query = self.where("id in (?)", id)

2. Example Case "string query": 
Wrong Format :
  query = self.where("id = '"+id+"' and place = '"+place+"' and user = '"+user+"' ")
Correct Format :
  query_conditions = []
  unless id.blank?
  query_conditions << {"id = '"+id+"'"}
  end
  unless id.blank?
  query_conditions << {"place= '"+place+"'"}
  end
  unless id.blank?
  query_conditions << {"user = '"+user+"'"}
  end
  query_where = query_conditions.joins("and")
  result = self.where(query_where)
Share:

Sunday, July 8, 2018

Vagrant Rails Puppet. Organizing Manifests with Modules

Built Puppet Manifests using modules allow us to organize our manifests into logical pieces, much as we do with modules in Ruby or packages in Java. We’ve already gotten started on a module structure for our Apache-related Puppet configuration by creating a modules/apache2/files directory holding our customized apache2.conf


Configurations

in your puppet folder create this filer manifests/site.pp

apply your puppet and check it's working: sudo puppet apply --verbose manifests/site.pp

 Exec {
  path => "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 }
 include apache2


create your virtual host in here: modules/apache2/files/massiveapp.conf


  ServerName myapp
  DocumentRoot "/var/myapp/current/public/"
  CustomLog /var/log/apache2/myapp-access_log combined
  ErrorLog /var/log/apache2/myapp-error_log

In your puppet folder built this directory files: modules/apache2/manifests/init.pp
in init.pp create this config:

package {
  "apache2":
  ensure => present,
  before => File["/etc/apache2/apache2.conf"]
}

service {
  "apache2":
  ensure => true,
  enable => true,
  subscribe => File["/etc/apache2/apache2.conf"]
}

file {
"/etc/apache2/apache2.conf":
  owner => root,
  group => root,
  mode => 644,
  source => "puppet:///modules/apache2/apache2.conf";

"/etc/apache2/sites-enabled/massiveapp.conf":
  source => "puppet:///modules/apache2/massiveapp.conf",
  owner => root,
  group => root,
  notify => Service["apache2"],
  require => Package["apache2"];
}

file {
"/etc/apache2/apache2.conf":
  owner => root,
  group => root,
  mode => 644,
  source => "puppet:///modules/apache2/apache2.conf";
"/etc/apache2/sites-enabled/massiveapp.conf":
  source => "puppet:///modules/apache2/massiveapp.conf",
  owner => root,
  group => root,
  notify => Service["apache2"],
  require => Package["apache2"];
}








Share:

Monday, June 18, 2018

Jzebra setting on Ubuntu

jZebra is a Java applet which allows you to print barcodes, receipts, and more from a Web page to your device printer. It sends raw print commands and basic HTML and PDFs to your raw, PostScript, or LaserJet printer. It has been tested with Firefox, Safari, Internet Explorer, Chrome, and Opera. It supports parallel, serial, USB, and network printers.

To start installing jZebra, you need to install JDK and JRE on your system. Check your JDK by type "java -version" on your terminal and it must show something like this:

     java version "1.7.0_60"
     Java(TM) SE Runtime Environment (build 1.7.0_60-b19)
     Java HotSpot(TM) 64-Bit Server VM (build 24.60-b09, mixed mode)

In your browser type 'about:plugins'. If your JDK and JRE installation is correct, Your browser will show something like this (On Firefox):


If everything is ready, we will start jzebra instalation.
  1. Download the source in here Jzebra.
  2. Extract The File. There's a bunch of file, but we will using "sample.html" and  "qz-print.jar". Make sure "sample.html" and "qz-print.jar" resides in the same folder/location.  You can see this working example with jZebra Printer Device. Download
  3. Set Your Device Printer, Go to system settings > Printing.
  4. Add Printer (or New) and select your printer device.
  5. Select printer make "Generic" Click "Forward" 
  6. Click mode "Raw", Drivers "Generic Raw Queue en". Click "Forward'
  7. Fill Name and Apply
  8. For Configuration Margin etc in EPL2. You can download the manual PDF in here.
  9. I have used 2 type of Barcode Text and Barcode Code, below is general configurations:
  • Text
         Format : Ap1,p2,p3,p4,p5,p6,p7,”DATA”
         A = text

         p1 : Horizontal Start Position (X in dots)
         p2 : Vertical Start Position (X in dots)
         p3 : Rotate (0 = normal, 1 = 90 degrees, 2 = 180 degrees, 3 = 270 degrees)
         p4 : Font Type (1 until 5 = Fixed Pitch, 8 and 9 = Asian Language)
         p5 : Horizontal Multiplier (Accepted Value : 1-6,8)
         p6 : Vertical multiplier(Accepted Value : 1-9)
         p7 : Reverse Image (N = Normal, R = reverse)
        Data : backslash (\) characters designates the following character is a literal and will encode into data field. For Example: code= \"Test\", Printed = "Test"

        Working Example = A50,0,0,1,1,1,N,"Example 1", A50,300,0,3,2,2,R,"Example 6"↵

  • Barcode 
         1 : Horizontal Start Position (X in dots)
         2 : Vertical Start Position (X in dots)
         3 : Rotate(0 = normal, 1 = 90 degrees, 2 = 180 degrees, 3 = 270 degrees)
         4 : Barcode Type Selection (See Image Below)

         5 : Narrow Bar (See Image in Barcode Type)
         6 : Wide Bar (See Image in Barcode Type)
         7 : Barcode Height(X in dots)
         8 : Print Human Readable (B = yes, N = No)
         9 : Data:backslash (\) characters designates the following character is a literal and will encode into  data field. For Example: code= \"Test\", Printed = "Test"

        Working Example : 
  • B10,10,0,PL,5,5,5,N,"12-34567-890123".
  • B10,10,0,3,3,7,200,B,"998152-001"



Share: