links not rendering as HTML

[Jim Harvey]

I'm having a problem with my links not being recognized as HTML. For
example, in a table displaying all users, instead of the name with a
link to the user's profile I see:

<a class="user-link" href="/admin/users/1-john-smith"><span
class="view user-name">John Smith</span></a>

on the page.

As far as I know I haven't overwritten any of the standard Rapid tags
that would apply in this situation. There is nothing in
application.dryml or /admin/users/index.dryml that changes the default
behavior. Does anyone have any clues as to where I can look to see why
this escaping is going on? I know that I can overwrite it with a link
but the above example is not the only place this is happening so I
want to root out the cause rather than introduce an unknown number of
patches. Thanks for any help you can give!

Jim

[Bryan Larsen]

You've run afoul of Rails cross-site scripting protection (XSS).

Every part of a string has to be marked as html_safe, if there's just
one part that isn't, you get the behavior you've noticed.

<a><%= "John Smith".html_safe %></a>

I assume you're using Hobo 1.3 with Rails 3.

If you're using Hobo 1.0 with Rails 2.3, turn off XSS protection,
because Hobo 1.0 doesn't support it.

Bryan

> --
> You received this message because you are subscribed to the Google Groups "Hobo Users" group.
> To post to this group, send email to hobo...@googlegroups.com.
> To unsubscribe from this group, send email to hobousers+...@googlegroups.com.
> For more options, visit this group at http://groups.google.com/group/hobousers?hl=en.
>
>

[Raklet]

If using Hobo 1.3, rails 3.0.7 will display the links instead of the
HTML markup.

On Jun 23, 6:12 am, Bryan Larsen <br...@larsen.st> wrote:
> You've run afoul of Rails cross-site scripting protection (XSS).
>
> Every part of a string has to be marked as html_safe, if there's just
> one part that isn't, you get the behavior you've noticed.
>
> <a><%= "John Smith".html_safe %></a>
>
> I assume you're using Hobo 1.3 with Rails 3.
>
> If you're using Hobo 1.0 with Rails 2.3, turn off XSS protection,
> because Hobo 1.0 doesn't support it.
>

[ylluminate]

Interestingly I am building an app presently and in the stock
generated links I'm seeing an anomaly. For example, I added some
counties who are parents of cities. Upon adding a new city, it
selected the county appropriately, but emitted the escaped html:
Screenshot: http://bit.ly/jIFY87
Code: <span class="county-tag view city-county model::county:1">&lt;a
class=&quot;county-link&quot; href=&quot;/counties/1-
jackson&quot;&gt;&lt;span class=&quot;view county-name
&quot;&gt;Jackson&lt;/span&gt;&lt;/a&gt;</span>

I've not modified anything in the controllers or views so far.

[Bryan Larsen]

It's certainly possible that this is a bug in the Hobo taglibs, we may
have missed a spot when adding Hobo XSS support. If you can generate
the bug on a minimal Hobo app, we'd love to take a look.

Bryan

[ylluminate]

All I have so far are models set up... so I'd say that's pretty
minimal. Would you like to take a look at this, or do I need to pare
it down further?

[Bryan Larsen]

Thanks for the sample app. I've tracked down the issue and pushed a
fix to github.

[ylluminate]

Thanks so much for taking a look at this Bryan, what's the best way to
update to this when normally using the hobo gems?

[Bryan Larsen]

Put

gem "hobo", :git => "git://github.com/tablatom/hobo.git", :branch => "rails3"

into your Gemfile and

bundle update hobo

[André Fischer]

So will Rails 3.0.9 (with ruby 1.9.2p180, I don't know about other Ruby versions)

[Bryan Larsen]

Did you do a "bundle update" or "bundle update hobo"?

Bryan

On Wed, Jun 29, 2011 at 4:12 PM, André Fischer <amfi...@gmail.com> wrote:
> I have exactly the same problem, and tried to update Hobo by adding
> the line mentioned in this thread to the gemfile.
>
> I am using Rails 3.0.9 together with ruby 1.9.2p180 (2011-02-18
> revision 30909) [x86_64-darwin10.7.4]
>
> I am trying to go through the tutorial at http://cookbook-staging.hobocentral.net/tutorials/agility,
> so the app is about as simple as can get, yet all links show up as
> their html source in the browser...
>
> What should I do, short of completely deleting Rails and Hobo from my
> system and starting over?
>
> André

[André Fischer]

Tried putting this in the app's Gemfile and ran bundle update hobo, to no avail. How should I go about making sure I have the "correct" version of Hobo on my system? I'm quite prepared to delete the application and start from scratch — how would I go about making sure I gem install the correct (truly latest) version of Hobo?

[André Fischer]

I ran "bundle update hobo". When that ran, it listed the hobo version as 1.3.0.RC1 from git://github.com/tablatom/hobo.git (at rails3)

When I now "gem list" I see I have hobo 1.3.0.pre31 and 1.3.0.RC on the system...

[Bryan Larsen]

If you type `bundle show hobo`, it should show something like:

/home/blarsen/.rvm/gems/ruby-1.9.2-p180/bundler/gems/hobo-cf8150539533/hobo

where cf8150539533 is the latest commit here:

https://github.com/tablatom/hobo/commits/rails3/

There is an issue with running the correct version of Hobo from the
command line (type `bundle exec hobo` to get around that), but bundler
should always run the correct version when you run "rails server".

It sounds like your app is pretty simple at this point. You're
welcome to send it to me if you still are having troubles.

Bryan

> --
> You received this message because you are subscribed to the Google Groups
> "Hobo Users" group.

> To view this discussion on the web visit
> https://groups.google.com/d/msg/hobousers/-/Iftu33kWtAUJ.

[André Fischer]

I indeed get this:

/Users/andre/.rvm/gems/ruby-1.9.2-p180/bundler/gems/hobo-cf8150539533/hobo

When you say "There is an issue with running the correct version of Hobo from the

command line (type `bundle exec hobo` to get around that)" — could this impact the views and taglibs etc generated when I ran "hobo new agility" and the setup wizard?

At this point, I'd rather delete the app, and remove all the hobo gems completely to make sure I don't have things that bite each other, and then reinstall the "latest" Hobo. What would be the best way of making sure of that?

Thanks for the offer to look at the app, though. But it´s just the tutorial one from the cookbook, so nothing special. Standard user model, and then resources for Project, Story and Task, with the expected has_many and belongs_to stuff. :)

André

[André Fischer]

I have exactly the same problem, and tried to update Hobo by adding
the line mentioned in this thread to the gemfile.

I am using Rails 3.0.9 together with ruby 1.9.2p180 (2011-02-18
revision 30909) [x86_64-darwin10.7.4]

I am trying to go through the tutorial at http://cookbook-staging.hobocentral.net/tutorials/agility,
so the app is about as simple as can get, yet all links show up as
their html source in the browser...

What should I do, short of completely deleting Rails and Hobo from my
system and starting over?

André

[Bryan Larsen]

On Wed, Jun 29, 2011 at 4:30 PM, André Fischer <amfi...@gmail.com> wrote:
> I indeed get this:
> /Users/andre/.rvm/gems/ruby-1.9.2-p180/bundler/gems/hobo-cf8150539533/hobo
> When you say "There is an issue with running the correct version of Hobo
> from the
> command line (type `bundle exec hobo` to get around that)" — could this
> impact the views and taglibs etc generated when I ran "hobo new agility" and
> the setup wizard?

Yes, it could have. But I'm fairly sure that nothing substantial
changed in that area since rc1.

Bryan

[André Fischer]

Hi Bryan,

I gem uninstalled all copies of Hobo on my box, and installed only 1.3.0.RC, and the problem persists.

I'm taking you up on your kind offer to have a look at the application for me—please find, attached, the whole directory including the sqlite db and all.

Thank you so much for your help and your replies in the Group!

Kindest Regards,

André Fischer

--
You received this message because you are subscribed to the Google Groups "Hobo Users" group.

[Domizio Demichelis]

There was a little bug fixed only recently, that caused the hobo gem included in the gemfile to have a ">=" version condition instead of a "=". That's fixed in rails3 edge, but it has not been pushed in any gem yet.

Please, change it manually in the Gemfile.

ciao
dd

[André Fischer]

Thank you for that tip! :)

Please excuse yet another newbie question: is that the Gemfile under my application's path? And, once I've changed that, do I need to run a special command to get Hobo to update everything, or is that automatic?

[Bob Sleys]

First list out your gems and see which version of Hobo you have installed. With the >= bundler likes to install the pre versions over the RC version.  If you want to be safe just remove all versions of hobo, hobo_support, hobo_fields and dryml and then do a bundle install in your app root dir after you've made the above change of course.

Bob

[André Fischer]

Ah okay - thanks, Bob! :)

On 30 June 2011 14:33, Bob Sleys <bsl...@gmail.com> wrote:

First list out your gems and see which version of Hobo you have installed. With the >= bundler likes to install the pre versions over the RC version.  If you want to be safe just remove all versions of hobo, hobo_support, hobo_fields and dryml and then do a bundle install in your app root dir after you've made the above change of course.

Bob

--

You received this message because you are subscribed to the Google Groups "Hobo Users" group.

To view this discussion on the web visit https://groups.google.com/d/msg/hobousers/-/MYvPgAzGThcJ.

[André Fischer]

Although "gem list hobo -d --local" gives me:

*** LOCAL GEMS ***

hobo (1.3.0.RC)

    Author: Tom Locke

    Rubyforge: http://rubyforge.org/projects/hobo

    Homepage: http://hobocentral.net

    Installed at: /Users/andre/.rvm/gems/ruby-1.9.2-p180

    The web app builder for Rails

hobo_fields (1.3.0.RC)

    Author: Tom Locke

    Rubyforge: http://rubyforge.org/projects/hobo

    Homepage: http://hobocentral.net

    Installed at: /Users/andre/.rvm/gems/ruby-1.9.2-p180

    Rich field types and migration generator for Rails

hobo_support (1.3.0.RC)

    Author: Tom Locke

    Rubyforge: http://rubyforge.org/projects/hobo

    Homepage: http://hobocentral.net

    Installed at: /Users/andre/.rvm/gems/ruby-1.9.2-p180

    Core Ruby extensions from the Hobo project

Does that mean I have a "clean" 1.3.0.RC? Because if so, then the problem persists despite everything.

[Bryan Larsen]

You have

gem "hobo", ">= 1.3.0.RC"

in your Gemfile

You need

gem "hobo", :git => "git://github.com/tablatom/hobo.git", :branch => "ralis3"

instead. After you've changed that, type `bundle install hobo`.

Bryan

On Thu, Jun 30, 2011 at 2:39 AM, André Fischer <amfi...@gmail.com> wrote: