Project

General

Profile

Bug #13666

Partials in app/overrides must be moved into a views path

Added by Dominic Cleal over 6 years ago. Updated about 4 years ago.

Status:
Closed
Priority:
High
Assignee:
Category:
Foreman
Difficulty:
Triaged:
Bugzilla link:
Fixed in Releases:
Found in Releases:

Description

On Rails 4.1.14.1 and 3.2.22.1, the deface overrides in foreman_remote_execution look like they will fail to render in a similar way to #13592.

These Rails versions fix an Activeview security issue that requires partials be in registered view directories (i.e. app/views/) and not be accessed via ../ etc.

foreman_remote_execution registers overrides with partials under app/overrides/foreman/ but must either register this directory and update the paths accordingly, or move them to app/views/.

e.g.

Deface::Override.new(:virtual_path  => 'nic/_base_form',
                     :name          => 'add_execution_interface',
                     :insert_after  => 'erb[loud]:contains("interface_provision")',
                     :partial       => '../overrides/foreman/nics/execution_interface')

This is likely to affect 1.10-stable and 1.11+.


Related issues

Related to Foreman - Feature #12873: Update Rails to 4.1.latestClosed2015-12-18
Related to Foreman - Bug #13372: Update Rails to 3.2.22.1Rejected2016-01-26

Associated revisions

Revision 0611891b (diff)
Added by David Davis over 6 years ago

Fixes #13666 - Moving deface templates to app/views

Revision 3d540066
Added by Stephen Benjamin over 6 years ago

Merge pull request #154 from daviddavis/temp/20160211100505

Fixes #13666 - Moving deface templates to app/views

History

#1 Updated by Dominic Cleal over 6 years ago

#2 Updated by Dominic Cleal over 6 years ago

  • Related to Bug #13372: Update Rails to 3.2.22.1 added

#3 Updated by The Foreman Bot over 6 years ago

  • Status changed from Assigned to Ready For Testing
  • Target version set to 98
  • Pull request https://github.com/theforeman/foreman_remote_execution/pull/154 added

#4 Updated by Stephen Benjamin over 6 years ago

  • Legacy Backlogs Release (now unused) set to 133

#5 Updated by David Davis over 6 years ago

  • Status changed from Ready For Testing to Closed
  • % Done changed from 0 to 100

Also available in: Atom PDF