| Jamis' Whole Wheat Bread | |
| Ingredients | |
| (Pardon the mixed metric/imperial units. I'm a product of my time.) | |
| 27 oz warm water | |
| 1 tbl shortening | |
| 2 tbl yeast (active dry or instant) |
| package main | |
| import ( | |
| "bufio" | |
| "fmt" | |
| "net" | |
| ) | |
| func requestHandler(conn net.Conn) { | |
| defer conn.Close() |
| package main | |
| import ( | |
| "bufio" | |
| "errors" | |
| "fmt" | |
| "log" | |
| "net" | |
| "strings" | |
| ) |
Given the ruby code in the script, I would expect user.groups to be scoped by both of the deleted_at conditions. This was the behavior up thru Rails f55c60f. This was changed in bc6ac8 to fix a regression. This issue persists thru master.
Rails f55c60f
SELECT "groups".*
FROM "groups"
INNER JOIN "assignments"
ON "groups"."id" = "assignments"."assignable_id"
WHERE "assignments"."deleted_at" IS NULL -- This is the missing clause
AND "assignments"."user_id" = 1
| (function() { | |
| var CalendarDate, RelativeTime, browserIsCompatible, domLoaded, iso8601, months, pad, parse, process, relativeDate, relativeTimeAgo, relativeTimeOrDate, relativeWeekday, run, strftime, update, weekdays; | |
| browserIsCompatible = function() { | |
| return document.querySelectorAll && document.addEventListener; | |
| }; | |
| if (!browserIsCompatible()) { | |
| return; | |
| } |
I hereby claim:
To claim this, I am signing this object:
It’s probably a pretty bad idea to have your site go down, when people are supposed to read the blog post explaining the hack.
Notice how another site reporting the hack received more attention than Twitter’s own announcement. Why was that?
| # Is the following safe from SQL injection? | |
| Model.where(Model.arel_table[:name].matches("%#{params[:q]}%")) |