Ruby, Ruby with Rails

XSS Protection in Rails 3

2012-02-10T04:10:00.000-08:00

One of the places where web applications are vulnerable to XSS attacks is when they display input from users. It is therefore important to escape any user-generated input that is displayed and in Rails applications this is usually done by making use of the h method.

<%= h comment.content %>

Using the h method to escape output.

In Rails 3, however, output is escaped automatically so there’s no need to put the h method in your views and in this episode we’ll show you how Rails 3 handles the escaping of output.
To demonstrate output escaping we’re going to use a simple blogging application written in Rails 3. In this app we have articles and each article has a number of comments associated with it. To test how the comment system copes with an attempt at cross-site scripting we’ll enter <script>alert('I steal cookies!')</script> in each field in the comments form and submit our evil comment.

When we add the comment and it is displayed on the page we’ll see that Rails 3 has automatically escaped the HTML tags in the fields that we submitted. Let’s take a look at how Rails does this.

The code that displays each comment is contained in a partial and if you look at the code you’ll see that none of the output is escaped with h.

/app/views/comments/_comment.html.erb

<div class="comment">
<strong><%= link_to comment.name, comment.url %></strong>
<p><%= comment.content %></p>
</div>

In Rails 2 this would have meant that the alert messages would have been shown, but all of the output in the partial is being correctly escaped by Rails 3, even when passed through helper methods such as link_to so there’s no need to use the h method here.
What happens, thought, if we’re transitioning an application from Rails 2 and have our output escaped with h? We can find out by escaping the output in the partial above and reloading the page.

/app/views/comments/_comment.html.erb

<div class="comment">
<strong><%= link_to h(comment.name), comment.url %></strong>
<p><%= h comment.content %></p>
</div>

When we reload the page we’ll see that it looks the same and the output hasn’t been double-escaped. Rails is clever here; even if we use the h method it will escape the script tag only the once.
It might seem that the h method does nothing in Rails 3 but that’s not that case. It does still have a purpose and we’ll show you later what that is. But before we do that we’ll look at a related feature. While it’s great to have the output escaped automatically there might be times when we want to display the raw content. If we trust the content that the user enters, say they’re an administrative user, and we want to display exactly what they enter then we can use the new raw method to do that.

<div class="comment">
<strong><%= link_to comment.name, comment.url %></strong>
<p><%= raw comment.content %></p>
</div>

If we reload the page now the JavaScript we entered in the comment field will be executed.

So, in Rails 3 whenever we don’t want content to be HTML escaped we can use the raw method. But how does it work? Rails 3 seems to be pretty clever about when to escape content and when not to. We’ll show you now how that works.
We’ll demonstrate escaping in the console, which in Rails 3 we can invoke with the rails c command.

$ rails c
Loading development environment (Rails 3.0.0.beta)
ruby-1.9.1-p378 >

Rails 3 has a concept of HTML-safe strings. This means that we can check if any string is safe to output as HTML by calling the new method html_safe? on it.

> "foo".html_safe?
 => false

We can mark a string as being HTML-safe by calling the html_safe method on it.

> safe = "safe".html_safe
 => "safe" 
> safe.html_safe?
 => true

No actual escaping goes on here. All that happens is that a boolean property is set against a string to determine whether it should be escaped before being output.
So how does this apply in our view template? Well, Rails looks at each piece of output and sees if it’s marked as HTML-safe. If it’s not then it will be automatically escaped when it is output to the view. If it is safe then it is passed through without being escaped. If we use the h method to escape a string it will perform the escaping and mark the string as HTML-safe. This means that Rails 3 will see that the string is safe and not escape it again.
When the raw method is used on a string it will be marked as HTML-safe but not escaped, ensuring that the string’s content is passed to the output without being changed.
This is an important thing to understand when you’re using helper methods. We’ll explain this by creating a helper method called strong that wraps whatever is passed to it in <strong> tags. We’ll use it in our template like this:

/app/views/comments/_comment.html.erb

<div class="comment">
<%= strong link_to(comment.name, comment.url) %>
<p><%= raw comment.content %></p>
</div>

We’ll create the strong method in the ApplicationHelper:

/app/helpers/application_helper.rb

module ApplicationHelper
def strong(content)
"<strong>#{content}</strong>"
end
end

When we reload the page, however, we’ll see that this hasn’t worked the way we wanted it to.

Rails 3’s automatic escaping has escaped the <strong> tag here and this is because our helper method doesn’t create an HTML-safe string.
There are two simple rules that need to be need to be followed when working with helper methods that return HTML. Firstly, we need to ensure that any strings returned are marked as HTML-safe.

/app/helpers/application_helper.rb

module ApplicationHelper
def strong(content)
"<strong>#{content}</strong>".html_safe
end
end

This fixes the problem of the <strong> tag being escaped but by doing that the content between the tags will not be escaped. We can solve this by escaping the content with h:

/app/helpers/application_helper.rb

module ApplicationHelper
def strong(content)
"<strong>#{h(content)}</strong>".html_safe
end
end

So as long as we remember to escape all input with h and then mark the resulting string as html_safe it will be rendered properly. If we reload our comments page now we’ll see that the <strong> tag hasn’t been escaped but that the content of the second comment, which includes the potentially dangerous JavaScript is escaped.

That’s it for this episode. The automatic escaping is a welcome addition to Rails 3’s views and it removes the need to remember to escape every piece of output with h, this reducing the changes of your application being a victim of cross-site scripting.

Cross-site Scripting

2012-02-10T04:08:00.000-08:00

Cross-site scripting is another common security issue to consider when developing web applications. It happens when you allow the users of your site to enter HTML or JavaScript directly. In the website below we’re not escaping the input that’s entered in the comments textbox, which leaves our site vulnerable.

f we enter JavaScript into the comment box, surrounded by <script> tags, that script will be executed when the page reloads and every time it it viewed afterwards. For example if we entered <script>alert(’hello’)</script> into the comments box and clicked the button then every subsquent time the page is viewed the user would see an alert box.

If we look at the source of the page we can see the JavaScript embedded in it.

<h2>Comments</h2>
  <p>I'll start on this now - Paul</p>
  <p><script>alert('hello!');</script></p>
<hr/>

Causing an alert box to be shown on a page is annoying, but cross-site 
scripting can be used for much more malicious purposes. For example it 
could be used to read the cookies for the site’s other users. We’ll just
 alert the cookie, but it could just as easily be sent to a remote 
server where the session id information in the cookie could be used to 
hijack another user’s session

Stopping The Attacks

To stop these attacks you need to escape any user input before you 
display it on the screen.  We’re currently taking the comment’s content 
directly from the database and outputting it into the HTML stream. Rails
 provides a method simply called h to escape the content before it is 
output.


<% @task.comments.each do |comment| %>  

  <p><%= h(comment.content) %></p>  

<% end %>

Now, when we reload the page we can see that the script is no longer executed. The h command escapes the angle brackets so that the comments entered by the user are displayed safely.



Rails also provides a sanitize method which allows 
certain tags to be included via a white list. To be on the safe side and
 escape any HTML that may be entered by a user it is safer to stick to h.


An Alternative Approach

Instead of escaping the user’s input when sending it out to the 
browser we could escape it when we store it in the database. The h method isn’t available in a controller so instead we’ll use CGI::escapeHTML().





def create  

  @task = Task.find(params[:task_id])  

  @comment = @task.comments.new(params[:comment])  

  @comment.content = CGI::escapeHTML(params[:comment][:content])  

  @comment.save  

  redirect_to task_path(@task)  

end  


Escaping the comment’s HTML before it is stored in the database.

Storing escaped HTML in the database is fine as long as you only ever
 want to display that data in a browser. If you think you might need it 
in its unescaped form as well then it’s better to escape the output with
 h.  
http://en.wikipedia.org/wiki/Session_hijacking

How to identify that object belong to which class?

2012-02-10T02:51:00.001-08:00

irb(main):001:0> str = Class.new(String)
=> #<Class:0xb5cfc3c0>

irb(main):002:0> str.class
=> Class

irb(main):003:0> str.parent
=> Object

irb(main):004:0> str.class.superclass
=> Module

irb(main):005:0> str.superclass
=> String

my_str = str.new("hello")
=> "hello"

irb(main):008:0> my_str.class
=> #<Class:0xb5e66080>

irb(main):009:0> my_str.parent
NoMethodError: undefined method `parent' for "hello":#<Class:0xb5e66080>
from (irb):9

irb(main):010:0> my_str.class.superclass
=> String

irb(main):011:0> my_str.class.parent

=> Object

irb(main):012:0> my_str.class.superclass.parent

=> Object

Class and Instance Methods in Ruby

2012-02-10T01:38:00.000-08:00

In ruby, classes are also objects, so the methods you define as class methods only exist in the object that defined them (the class) and nowhere else. If you define class_method in a class named Test, class_method will only live into the object Test, which is an instance of a built-in ruby class named Class.

class methods are singleton methods of instances of Class

But in general u will feel that Class methods are methods that are called on a class and instance methods are methods that are called on an instance of a class.

Every instances that you create contain a variable that points to their corresponding class. Say you create a new instance of class Test and that you name this instance T (T = Test.new). T will contain every instance variables/methods that have been defined as such in the class as well as a reference to the object Test, which will contain the variables that need to be shared among every instances of this class (class variables) as well as methods that will be local to this object (class methods). That’s the reason why ruby complain when you write something like T.class_method. It complains because class_method just doesn’t reside in T, it resides in Test.
You have 2 ways for defining a class method.

1) You can use the name of the class directly

    class My #My is now an instance of a built-in class named Class
          
            def My.class_method
               "It's a class method."
            end
       end

2) You can use the self variable, which is always pointing to the current object

     class My
       def self.class_method
          "It's a class method."
       end
     end


3  It consists of building a new anonymous class only for the current object (self). To create the anonymous class, we use the << notation.


    class test
            class << self
                def bar
                    puts 'It's a class Method'
                end
           end
       end
4     class Test;         end
          def Test.bar
            puts 'It's a class Method'

          end
5 Way to call class method
   class_name.method_name
      like here
                  my.class_method      or 
                  test.bar

Once you understand that classes are objects, this use of the self variable to define a class method finally makes sense.

Remember what we have to do to add a new instance method in a class :

class Test
  def hello
    "It's an instance method"
    "It'saccessible in every single instance of class Test"
  end
end
T = Test.new

When you look at it, it's exactly the same trick that we previously used to add a new class method. The only difference is that instead of adding a method to an instance of class Class, we added a method to an instance of class Test.

The value of self

Not too surprinsingly, when you are inside a class method, the value of self refers to the object that holds the class structure (the instance of class Class). This means that :

class Test
  def self.class_method
    self.T
  end
end

is equivalent to :

class Test
  def self.class_method
    Test.x
  end
end

When you are inside an instance method, the value of self still refers to the current object. This time however, the current object is an instance of class Test, not an instance of class Class.

other uses of class methods in Rails are validations and associations in ActiveRecord and before/after/around filters in ActionPack. The way this works is something like this (simplified for clarity):

module ActiveRecord
  class Base
    def self.validates_presence_of(...)
      # make sure present
    end
  end
end

class Foo < ActiveRecord::Base
  validates_presence_of :bar
end

When you say validates_presence_of, the class method in AR::Base is what gets called.

So what are some examples uses of instance methods in Rails, to give you a better idea? Ever do a find in a destroy action and then call destroy on the found instance? destroy is an instance method.

class FoosController < ActionController
  def destroy
    foo = Foo.find(params[:id])
    foo.destroy
    redirect_to foos_url
  end
end

So are save and update_attributes, which you have definitely used before if you’ve done any Rails.

foo = Foo.new(:title => 'Bar')
foo.save # is an instance method

ruby shortcut and format specifier

2012-02-08T23:27:00.000-08:00

NOTE: Some of these seem only to work for DateTime (e.g. %L, %N)

%a - The abbreviated weekday name (“Sun”)
%A - The full weekday name (“Sunday”)
%b - The abbreviated month name (“Jan”)
%B - The full month name (“January”)
%c - The preferred local date and time representation
%C - Century (20 in 2009)
%d - Day of the month (01..31)
%D - Date (%m/%d/%y)
%e - Day of the month, blank-padded ( 1..31)
%F - Equivalent to %Y-%m-%d (the ISO 8601 date format)
%h - Equivalent to %b
%H - Hour of the day, 24-hour clock (00..23)
%I - Hour of the day, 12-hour clock (01..12)
%j - Day of the year (001..366)
%k - hour, 24-hour clock, blank-padded ( 0..23)
%l - hour, 12-hour clock, blank-padded ( 0..12)
%L - Millisecond of the second (000..999)
%m - Month of the year (01..12)
%M - Minute of the hour (00..59)
%n - Newline (n)
%N - Fractional seconds digits, default is 9 digits (nanosecond)

%3N millisecond (3 digits)
%6N microsecond (6 digits)
%9N nanosecond (9 digits)

%p - Meridian indicator (“AM” or “PM”)
%P - Meridian indicator (“am” or “pm”)
%r - time, 12-hour (same as %I:%M:%S %p)
%R - time, 24-hour (%H:%M)
%s - Number of seconds since 1970-01-01 00:00:00 UTC.
%S - Second of the minute (00..60)
%t - Tab character (t)
%T - time, 24-hour (%H:%M:%S)
%u - Day of the week as a decimal, Monday being 1. (1..7)
%U - Week number of the current year, starting with the first Sunday as the first day of the first week (00..53)
%v - VMS date (%e-%b-%Y)
%V - Week number of year according to ISO 8601 (01..53)
%W - Week number of the current year, starting with the first Monday as the first day of the first week (00..53)
%w - Day of the week (Sunday is 0, 0..6)
%x - Preferred representation for the date alone, no time
%X - Preferred representation for the time alone, no date
%y - Year without a century (00..99)
%Y - Year with century
%z - Time zone as hour offset from UTC (e.g. +0900)
%Z - Time zone name
%% - Literal “%” character

t = Time.now                        #=> 2007-11-19 08:37:48 -0600
t.strftime("Printed on %m/%d/%Y")   #=> "Printed on 11/19/2007"
t.strftime("at %I:%M%p")            #=> "at 08:37AM"

WORKING WITH YIELD AND content_for METHOD

2012-02-07T23:44:00.000-08:00

Within the context of a layout, yield identifies a section where content from the view should be inserted.

<html>
<head><title>Home Page</title></head>
<body>
  <table width="100%">
    <tr><td>
      <%= yield %>
    </td><td>
      <%= yield :sidebar %>
    </td></tr>
      </table>
  </body>
 </html>

The first yield will be replaced with HOME view when rendered.  The second yield

 is a different: we are passing it a symbol, saying he wants to yield :sidebar

 at that point in time

Now The content_for method allows you to insert content into a named yield block

 in your layout

<% content_for :sidebar do %>
  <title>sidebar</title>
<% end %>

Blocking default design present in application layout

2012-02-07T23:29:00.000-08:00

This is the way from where you are calling your default sidebar in application.html.erb

<div id="define_according_to_your_stylesheet" class="<%= sidebar_disabled? %>">

<%= yield :sidebar %>
<%= app_screen_tip -%>

</div>

Here <%=sidebar_disabled? %> is calling method present in application helper

define a method in application helper which is loaded automatically when your application loaded

def sidebar_disabled?
current_page = "#{controller.controller_name}.#{controller.action_name}"
current_controller = controller.controller_name
pages = %w(
home.index
#comment [home(its your controller name).index(its your action)]

) return pages.include?(current_controller) || pages.include?(current_page)
end

by this way you can block anything which loaded by default when application loaded

Download YouTube Videos from Ubuntu 11.10

2012-02-06T04:41:00.000-08:00

YouTube Video Downloader in Ubuntu 11.10

You can use various ways to download a youtube video into your ubuntu 11.1o. Using a yoututbe client, a command lineutility, a web browser plugin are available for downloading videos from youtube.

MiniTube

Minitube is the best youtube client in ubuntu 11.1o. You can watch Youtube Videos right from your desktop. You can easly download youtube videos into ubuntu 11.10 using minitube. It has a very simple and easy GUI. You can configure the video size, related videos etc. You can easily search using keywords or a youtube channel name. The project is hosted in gitorius and is released as GPL.

Install Minitube, The Youtube Downloader in Ubuntu 11.10

Minitube is available in official package repository. To install minitube just type the command in command line.

sudo apt-get install minitube

you can install using Ubuntu Software Centre also. Just search for minitube in the software centre and click install.

Download videos using MiniTube in Ubuntu 11.1o

To download a video just play the video in minitube. The go Video > Download in the menu. The videos will be saved to /home/username/Videos.

Download Youtube Videos Using Terminal Utility

You can download youtube videos by using the command line. To download videos from command line you can use the command youtube-dl. Install install a utility youtube-dl. Open terminal and type

sudo apt-get install youtube-dl

Now, open the youtube video in the browser and copy the URL from the address bar.

Then execute the following command -

youtube-dl "http://youtube.com/?v=VideoID"

IE9 DELETES stuff

2012-02-05T22:12:00.000-08:00

THANKS TO:-
http://techno-weenie.net/2011/8/19/ie9-deletes-stuff (FROM WHERE I GOT THIS INFORMATION)

Using more of the HTTP methods lets us keep the URLs cleaner. Web browsers don't understand PUT/PATCH/DELETE in forms, so a workaround was needed. Rails looks at a _method GET parameter on POST requests to determine what HTTP verb it should be recognized as. The GData API supports this behavior through the X-HTTP-Method-Override header.
A typical Rails controller might look like this:

class WidgetsController < ApplicationController
  # DELETE /widgets/1
  def destroy
    @widget.destroy
    redirect_to '/widgets'
  end
end

If you don't like Rails, just close your eyes and think of your favorite web framework...
This action works great for a simple form in a browser. You click "Submit", it POSTs to the server, and then you end up back at the root page. Then, you can add some jQuery to spice things up for newer browsers. Progressive enhancement and all that.

$('.remove-widget').click(function() {
  $.del(this.href, function() {
    // celebrate, disable a spinner, etc
  })
  return false
})

This works great in all modern browsers, except IE9. We discovered that not only does IE9 send a real DELETE request, it also follows the redirect with another DELETE. If that redirect points to another resource, you can get a dangerous cascading effect.
RFC 2616 is not clear about what to do in this case, but strongly suggests that redirects are not automatically followed unless coming from a safe method.

If the 302 status code is received in response to a request other than GET or HEAD, the user agent MUST NOT automatically redirect the request unless it can be confirmed by the user, since this might change the conditions under which the request was issued.

Standard practice for browsers over the years is that redirects from POST requests are followed with a GET request. GET/HEAD requests are usually safe, so this seems like reasonable behavior. It's expected by web developers, and consistent across browsers.

I can't imagine that this behavior in IE9 was on purpose. It feels like an edge case that slipped through an if statement because "DELETE" != "POST". I've submitted feedback to the IE9 team about this issue. I'm curious to see what they say.

So, if your application might be responding to ajax requests with redirects, you should probably start sending back 200 OK...

Update: Eric Law on the IEInternals blog responded to one of Kyle's tweets. Apparently the behavior is correct according to HTTP 1.0, and IE has been following DELETE redirects since at least IE6.
Here's the breakdown of browser behavior when receiving a 302 redirect from a DELETE request:

IE 6-10	DELETE method is preserved
Chrome 13	Converts to GET
Firefox 6	Converts to GET
Safari 5.1	Converts to GET
Opera 11.5	Converts to GET

We didn't see the behavior in IE8, so we assumed it was new to IE9. At least, no one was sending in crazy bug reports from other browsers. This is another example why developers hate dealing with IE. Kudos to the standards compliance, though!

Installing a gem fork from Github source

2012-02-05T22:05:00.000-08:00

THANKS TO:-
http://raflabs.com/blogs/silence-is-foo/2010/07/19/installing-a-gem-fork-from-github-source/

Usually, installing a gem is as easy as issuing:

1.gem install gem_name

but, what if you want to install a fork of a gem?
As you may know Github no longer hosts gems, so doing the following won't work:

$ sudo gem install technoweenie-grit --source http://gems.github.com

NOTE: Actually it'd work if the gem you're trying to install is in this list: http://gems.github.com/list.html

Disecting the "Download Source" button

Let's suppose we want to install the Techno Weenie's fork of Grit from Github:
Main repo => http://github.com/mojombo/grit
Techno Weenie's fork => http://github.com/technoweenie/grit
Github has a "Download Source" button, if you click it you'll be presented with two big images (say buttons): "ZIP" and "TAR", clicking these buttons will start downloading the code of the master branch in the selected format; below those buttons you'll find the list of tags of the repository, you'll be able to click one of the tags and again you'll be presented with "ZIP" and "TAR" to download the source of such tag.

How does this works?

This is how the URL is built:

http://github.com/USER/REPOSITORY/FORMAT/BRANCH_OR_TAG

"ZIP" => http://github.com/technoweenie/grit/zipball/master
"TAR" => http://github.com/technoweenie/grit/tarball/master
said this:

$ wget http://github.com/technoweenie/grit/zipball/master
 
$ unzip technoweenie-grit-v2.0.0-12-g0bd0c5f.zip
 
$ cd technoweenie-grit-0bd0c5f

Installing the gem

Gems source code has a special file called gem_name.gemspec, this is like the DNA of the gem and it's used to build it:

1.$ gem build grit.gemspec

Issuing this command will generate a gem_name-version.gem file which is the gem itself, let's install it:

1.$ sudo gem install grit-2.0.0.gem

Some projects doesn't have a .gemspec file but rake tasks, in that case you just need to do:

1.$ rake build
2.$ rake install

If any of these methods work, you'd have to look at the Rakefile for tasks to generate the .gemspec file.
...and we're done!

NOTE: 'gem build' will not take in consideration special and external dependencies the gem might require, so you must take care of the dependencies manually. Check in the code all the 'require' lines to see dependencies.
Hope it helps.

Gems On Rails Get Version 0.7.2 → ‘gemsonrails’

2012-02-05T21:37:00.000-08:00

THANKS TO:-
http://gemsonrails.rubyforge.org and Dr Nic Williams from where i got this information

BASIC WORK

Link or freeze RubyGems into your rails apps, instead of just plugins. This allows you to ‘vendor everything’ – pushing all dependent gems into your rails app thus ensuring your application will be guaranteed to work when deployed. Your application is no longer dependent on the gems that are/aren’t available on your target deployment environment.

Installation and The Basics

First you install the gem:

$ sudo gem install gemsonrails

Then you deploy the gem into your target Rails application:

$ cd rails_app_folder
$ gemsonrails

This installs some rake tasks into your app to help you freeze or link gems:

$ rake -T | grep "gems:" 
rake gems:freeze    # Freeze a RubyGem into this Rails application; init.rb will be loaded on startup.
rake gems:link      # Link a RubyGem into this Rails application; init.rb will be loaded on startup.
rake gems:unfreeze  # Unfreeze/unlink a RubyGem from this Rails application

Finally, for each gem your application uses you can either freeze a version into the app (only for gems that do not require native compilation), or link a gem with your app (useful for gems that require native compilation)

$ rake gems:freeze GEM=map_by_method
Unpacked map_by_method 0.6.0 to 'map_by_method-0.6.0'

$ ls vendor/gems/map_by_method-0.6.0/

CHANGELOG    README    Rakefile     init.rb      lib     test

$ cat vendor/gems/map_by_method-0.6.0/init.rb 
require File.join(File.dirname(__FILE__), 'lib', 'map_by_method')

Restricting which environments a gem is loaded into

You can restrict which RAILS_ENVs the gem will be loaded for, using ONLY; e.g.

$ rake gems:freeze GEM=<gemname> ONLY=development
$ rake gems:link GEM=<gemname> ONLY=production,staging

In the former, only in development mode will the gem be loaded. In the latter, only in production or staging mode will the gem be loaded from the deployment gem server

Upgrading from old GemsOnRails versions

All the freezing and linking functionality is in the plugin installed by the gemsonrails command. To upgrade, simple install the new gem version, and re-run the gemsonrails command. You application will now have the newest rake tasks and functionality.

Forum

http://groups.google.com/group/gemsonrails

How to submit patches

Read the 8 steps for fixing other people’s code and for section 8b: Submit patch to Google Groups, use the Google Group above.

Licence

This code is free to use under the terms of the MIT licence.

Bort: Better Skeleton Applications

2012-01-15T22:06:00.000-08:00

We’re all familiar with the rails command-line tool. It generates a Rails skeleton application with everything you need to start your Rails application–directories, configuration, even a default index page.
But the more you develop Rails applications, the more you begin to realize that some tools and gems are valuable on every project. Need a user management system? Likely restful_authentication. Rails pagination slow? Grab will_paginate. Even things like setting sessions to use the database, or using MySQL instead of sqlite3 as your database.

Enter bort. Bort is a replacement of the standard skeleton application; it includes these features (and more), already setup and configurated to work out-of-the-box. And it is a bigger box–it includes:

RESTful Authentication, for a RESTful user-management system (registering users, logging in, etc.). Even includes the forgotten password feature!
User Roles, to make your application users easier to manage; includes a default admin role and an admin user.
Will Paginate, an efficient, pretty pagination plugin. Beats the standard Rails pagination by ages!
OpenID integration, in case you want to support OpenID with your users.
Rspec, a better way to write tests.
Exception Notifier, to email you when your application hiccups.
Asset Packager, which combines javascript and CSS to save download time.
Database Sessions, MySQL DB YAML, an application-wide layout file, and no default index.html and rails.png, all of which make your life a little easier.

This is a big step up from your standard Rails skeleton. Best of all, if you don’t use half of this stuff, it won’t affect you much; and it’ll be there when you need it.

You can Grab bort from the GitHub page,
http://github.com/fudgestudios/bort

Rails "The MVC Architecture"

2012-01-13T00:14:00.000-08:00

At the core of Rails is the Model, View, Controller architecture, usually just called MVC. MVC benefits include:

Isolation of business logic from the user interface
Ease of keeping code DRY
Making it clear where different types of code belong for easier maintenance

Models

The model manages the behavior and data of the application domain, responds to requests for information about its state (usually from the view), and responds to instructions to change state (usually from the controller). In event-driven systems, the model notifies observers (usually views) when the information changes so that they can react.

A model represents the information (data) of the application and the rules to manipulate that data. In the case of Rails, models are primarily used for managing the rules of interaction with a corresponding database table. In most cases, each table in your database will correspond to one model in your application. The bulk of your application’s business logic will be concentrated in the models.

Views

The view renders the model into a form suitable for interaction, typically a user interface element. Multiple views can exist for a single model for different purposes. A view port typically has a one to one correspondence with a display surface and knows how to render to it.

Views represent the user interface of your application. In Rails, views are often HTML files with embedded Ruby code that perform tasks related solely to the presentation of the data. Views handle the job of providing data to the web browser or other tool that is used to make requests from your application.

Controllers

The controller receives user input and initiates a response by making calls on model objects. A controller accepts input from the user and instructs the model and a view port to perform actions based on that input.

Controllers provide the “glue” between models and views. In Rails, controllers are responsible for processing the incoming requests from the web browser, interrogating the models for data, and passing that data on to the views for presentation.

Ruby Basic "Variables"

2011-12-14T22:22:00.000-08:00

Ruby is a loosely typed language means if we want to declare any variable of different datatype we don't need to write like other language like in Java here we can directly assign value to a variable and it belong to that datatype class which kind of value its have example :-

a = 5        # "a" type as Fixnum

a = "text"   # "a" is re-typed as String

Ruby, Ruby with Rails

XSS Protection in Rails 3

Cross-site Scripting

Stopping The Attacks

An Alternative Approach

How to identify that object belong to which class?

Class and Instance Methods in Ruby

ruby shortcut and format specifier

WORKING WITH YIELD AND content_for METHOD

<% content_for :sidebar do %> <title>sidebar</title><% end %>

Blocking default design present in application layout

Download YouTube Videos from Ubuntu 11.10

YouTube Video Downloader in Ubuntu 11.10

MiniTube

Install Minitube, The Youtube Downloader in Ubuntu 11.10

Download videos using MiniTube in Ubuntu 11.1o

IE9 DELETES stuff

Installing a gem fork from Github source

Disecting the "Download Source" button

How does this works?

Installing the gem

Gems On Rails Get Version 0.7.2 → ‘gemsonrails’

BASIC WORK

Installation and The Basics

Restricting which environments a gem is loaded into

Upgrading from old GemsOnRails versions

Forum

How to submit patches

Licence

Bort: Better Skeleton Applications

Rails "The MVC Architecture"

Models

Views

Controllers

Ruby Basic "Variables"

Ruby is a loosely typed language means if we want to declare any variable of different datatype we don't need to write like other language like in Java here we can directly assign value to a variable and it belong to that datatype class which kind of value its have example :-

`<%` `content_for` `:sidebar` `do` `%>`
`<title>sidebar</title>`
`<%` `end` `%>`