#1392
  • Created on
    2013-02-12 04:03
  • Reported by
    Jan Stępień
  • Status
    Fixed
  • Priority
    Normal (3)
  • Assigned to
    -
  • Milestone
    -
  • Plan Level
    -
  • Due Date
    -

Attachments

Related Tickets

Add new subtask or bug

Update json to 1.7.7 in the 2.1 branch

Older versions of the json gem had vulnerabilities discussed at https://groups.google.com/forum/#!topic/rubyonrails-security/4_YvCpLzL58/discussion . Further reading: http://www.zweitag.de/en/blog/ruby-on-rails-vulnerable-to-mass-assignment-and-sql-injection

A pull request is ready at https://github.com/TracksApp/tracks/pull/148.
User picture
  on 2013-02-13 00:58 *
By lrbalt
was merged. Now we need a pull request with the latest rails 2.3 :-)
User picture
  on 2013-02-13 00:58 *
By lrbalt
Status changed from New to Fixed
Status changed from New to Fixed