search

florence-social / mastodon-fork

Florence's fork of Mastodon
GNU Affero General Public License v3.0
138 stars 15 forks source link

Fix CVE 2015-9284 #150

Closed 1011X closed 5 years ago

1011X commented 5 years ago

This PR is meant to fix #102 through the changes recommended by this guide.

To my understanding, since Mastodon doesn't currently use any other authentication providers, this doesn't affect either of us. However, if we decide to add providers in the future, this fix ensures users stay safe.

Since this introduces a new dependency, I tried to update Gemfile.lock, but that led me down a rabbithole that ultimately came to a dead-end and I didn't know how to proceed, so for now I'll just give what I have.

clarfonthey commented 5 years ago

You forgot a comma between the name and the version; Ruby automatically concatenates strings without any operators between them like Python and C.

1011X commented 5 years ago

yep, got it fixed

clarfonthey commented 5 years ago

Double checked the guide and it does look like you did everything right.