jeremyevans / rodauth

Ruby's Most Advanced Authentication Framework
http://rodauth.jeremyevans.net
MIT License
1.69k stars 95 forks source link

Overwriting render plugin options #216

Closed muellerj closed 2 years ago

muellerj commented 2 years ago

I think I might have found a regression with the new additional_view_directories plugin.

The rodauth plugin seems to overwrite opts[:render], such that the modification of opts[:render][:allowed_paths] in particular vanishes and the additional paths are not allowed anymore.

Minimal example:

# /srv/auth/auth_app.rb

class AuthApp < Roda

  # ...

  plugin :render, engine: "slim"
  plugin :additional_view_directories, ["/srv/core/views"]

  STDERR.puts "[1]: #{opts[:render][:allowed_paths].inspect}"

  plugin :rodauth

  STDERR.puts "[2]: #{opts[:render][:allowed_paths].inspect}"

  # ...

end

results in

[...]
[1]: ["/srv/auth/views", "/srv/core/views"]
[2]: ["/srv/auth/views"]
[...]
jeremyevans commented 2 years ago

This wouldn't be a bug in the rodauth plugin, but it could be an issue with reloading the render plugin after loading the additional_view_directories plugin. If so, that's a bug in Roda that should be fixed. I'll leave this open until I determine the cause of the issue.

jeremyevans commented 2 years ago

Yep, confirmed to be an issue with Roda's additional_view_directories. I'll fix the problem there. Thanks for the report!

jeremyevans commented 2 years ago

Fixed by https://github.com/jeremyevans/roda/commit/a2b81e81de3fe5a7003b75da954fa6e2c521c6b8

muellerj commented 2 years ago

Awesome, thank you for the fast response!