adamthedeveloper / wepay-rails

Collect payments from wepay in your rails application.
MIT License
32 stars 24 forks source link

Security issue #12

Closed adamthedeveloper closed 12 years ago

adamthedeveloper commented 12 years ago

A change was needed in app/controllers/wepay/authorize_controller.rb to protect against unwanted access_token changes.

Please upgrade to version 2.2.9 to get the change.

Adam

adamthedeveloper commented 12 years ago

Fixed. Closing.

SteveAquino commented 12 years ago

Hey Adam, I added another small change for consistency and I didn't know if I should just be pushing any updates directly to the repo or if you still wanted me to do a pull request.

I apologize for seeming naive, I haven't worked on an active collaborative project like this on Github before, mostly just my own forks or private projects. I also noticed that my gem won't update unless the version number changes, or I uninstall the gem and reinstall it (using bundler and specificing with :git => "git@github.com:adamthedeveloper/wepay-rails.git"), so I didn't know if I needed to update the version number on every small change. I've pulled your changes, resolved conflicts, and pushed the result back out to my github fork, so you can see what it looks like there, it's pretty trivial.

On 05/28/2012 11:01 AM, Adam Medeiros wrote:

A change was needed in app/controllers/wepay/authorize_controller.rb to protect against unwanted access_token changes.

Please upgrade to version 2.2.9 to get the change.

Adam


Reply to this email directly or view it on GitHub: https://github.com/adamthedeveloper/wepay-rails/issues/12

adamthedeveloper commented 12 years ago

Hi Steve,

I like what you are doing. Feel free to submit directly to the project. No need for a pull request. I would eventually like us (current contributors) to be the core group and then only accept pull requests from then on. I have tickled the ear of another guy who has forked wepay-rails and has added pre-approval functionality that I like a lot - I sent him an email too see if he wants to be part of the core team as well. Then I think we would have pretty good coverage at that point - future contributions from outside the core group would need to be pull requests.

If someone wants to make a change to say - the component you added, I would trust you to monitor that pull requests and issues and either take it or ask for more changes before accepting it. Same goes for the guy I mentioned building out the pre-approval part.

We are going to need tests very soon - so we should probably start writing some = D

As for patch levels, please keep upping the patch levels for a little bit - especially while we are working through the beta-ness of it. I made a pretty important security change - without a patch, bundler wouldn't know to pull it in - that's why it's important to up the patch level until we have all the kinks worked out.

Hopefully this all sounds good to you! I'll try to keep my ears open for more open source software contributions for the team (ie, RubyMine, Other tools) as rewards for our hard work.

Thanks again!

Adam

On Mon, May 28, 2012 at 11:56 AM, Steve Aquino reply@reply.github.com wrote:

Hey Adam, I added another small change for consistency and I didn't know if I should just be pushing any updates directly to the repo or if you still wanted me to do a pull request.

I apologize for seeming naive, I haven't worked on an active collaborative project like this on Github before, mostly just my own forks or private projects.  I also noticed that my gem won't update unless the version number changes, or I uninstall the gem and reinstall it (using bundler and specificing with :git => "git@github.com:adamthedeveloper/wepay-rails.git"), so I didn't know if I needed to update the version number on every small change.  I've pulled your changes, resolved conflicts, and pushed the result back out to my github fork, so you can see what it looks like there, it's pretty trivial.

On 05/28/2012 11:01 AM, Adam Medeiros wrote:

A change was needed in app/controllers/wepay/authorize_controller.rb to protect against unwanted access_token changes.

Please upgrade to version 2.2.9 to get the change.

Adam


Reply to this email directly or view it on GitHub: https://github.com/adamthedeveloper/wepay-rails/issues/12


Reply to this email directly or view it on GitHub: https://github.com/adamthedeveloper/wepay-rails/issues/12#issuecomment-5970296

A.R. Medeiros

SteveAquino commented 12 years ago

Awesome, I've got plenty of tests working on my current project so I'll just copy them over to the project and start with the changes I've added before I push it out. And thanks for RubyMine, in a word it is amazing.

On 05/28/2012 12:10 PM, Adam Medeiros wrote:

Hi Steve,

I like what you are doing. Feel free to submit directly to the project. No need for a pull request. I would eventually like us (current contributors) to be the core group and then only accept pull requests from then on. I have tickled the ear of another guy who has forked wepay-rails and has added pre-approval functionality that I like a lot - I sent him an email too see if he wants to be part of the core team as well. Then I think we would have pretty good coverage at that point - future contributions from outside the core group would need to be pull requests.

If someone wants to make a change to say - the component you added, I would trust you to monitor that pull requests and issues and either take it or ask for more changes before accepting it. Same goes for the guy I mentioned building out the pre-approval part.

We are going to need tests very soon - so we should probably start writing some = D

As for patch levels, please keep upping the patch levels for a little bit - especially while we are working through the beta-ness of it. I made a pretty important security change - without a patch, bundler wouldn't know to pull it in - that's why it's important to up the patch level until we have all the kinks worked out.

Hopefully this all sounds good to you! I'll try to keep my ears open for more open source software contributions for the team (ie, RubyMine, Other tools) as rewards for our hard work.

Thanks again!

Adam

On Mon, May 28, 2012 at 11:56 AM, Steve Aquino reply@reply.github.com wrote:

Hey Adam, I added another small change for consistency and I didn't know if I should just be pushing any updates directly to the repo or if you still wanted me to do a pull request.

I apologize for seeming naive, I haven't worked on an active collaborative project like this on Github before, mostly just my own forks or private projects. I also noticed that my gem won't update unless the version number changes, or I uninstall the gem and reinstall it (using bundler and specificing with :git => "git@github.com:adamthedeveloper/wepay-rails.git"), so I didn't know if I needed to update the version number on every small change. I've pulled your changes, resolved conflicts, and pushed the result back out to my github fork, so you can see what it looks like there, it's pretty trivial.

On 05/28/2012 11:01 AM, Adam Medeiros wrote:

A change was needed in app/controllers/wepay/authorize_controller.rb to protect against unwanted access_token changes.

Please upgrade to version 2.2.9 to get the change.

Adam


Reply to this email directly or view it on GitHub:

https://github.com/adamthedeveloper/wepay-rails/issues/12

Reply to this email directly or view it on GitHub: https://github.com/adamthedeveloper/wepay-rails/issues/12#issuecomment-5970296