Upgrade to Rails 2.3.9 session no longer works

I just upgraded to the newly released Rails 2.3.9, and session data stopped getting saved. I could set session data and it was accessible within the same request, but on the next request, the session data is gone.

After digging a little deeper, I found that I was specifying the options for the session in the wrong place. Previously, the session options were specified in environment.rb. Now, Rails has moved this in to a different file, config/initializers/session_store.rb. Simply create this file with the following code:



Change the key to what you previously set as :session_key, and set secret to your previous :secret value. Be sure to uncomment the last line if you're using the database as the session store. Also, be sure to delete all session code from environment.rb after you do this.

However, this still didn't do the trick for the main Rails app that I work on. I'm using ActiveRecord to store session data for this app - data is too sensitive to store in a cookie. After adding the file session_store.rb to config/initializers, data still wasn't getting stored in the session. This appears to be a bug in Rails 2.3.9, as evidenced by ticket #5581. I tried the patch that Mislav posted in the comments of the ticket, but the session still didn't work for me. So, it's back to Rails 2.3.5 for my main app. The ticket is closed, so it appears as if this has been fixed in the Rails code, but I'm not sure if/when a 2.3.10 version of Rails will be released.

Error installing ruby-debug-base19

The ruby-debug19 gems are used for interactive debugging with Ruby 1.9 (the gems without 19 on the end are for Ruby 1.8). To use the debugging feature in Rubymine (which is awesome if you haven't tried it yet) you need to install these gems (ruby-debug-base19 and ruby-debug-ide19). I had previously used these with no problems, but yesterday when I tried installing ruby-debug-base19 on a new Ubuntu 10 system with Ruby 1.9.1 yesterday I got the following error:

make
gcc -I. -I/usr/local/include/ruby-1.9.1/i686-linux -I/usr/local/include/ruby-1.9.1/ruby/backward -I/usr/local/include/ruby-1.9.1 -I. -DHAVE_VM_CORE_H -DHAVE_ISEQ_H -DHAVE_INSNS_INC -DHAVE_INSNS_INFO_INC -DHAVE_EVAL_INTERN_H -I/usr/local/include/ruby-1.9.1/ruby-1.9.1-p376 -fPIC  -O2 -g -Wall -Wno-parentheses  -o breakpoint.o -c breakpoint.c
gcc -I. -I/usr/local/include/ruby-1.9.1/i686-linux -I/usr/local/include/ruby-1.9.1/ruby/backward -I/usr/local/include/ruby-1.9.1 -I. -DHAVE_VM_CORE_H -DHAVE_ISEQ_H -DHAVE_INSNS_INC -DHAVE_INSNS_INFO_INC -DHAVE_EVAL_INTERN_H -I/usr/local/include/ruby-1.9.1/ruby-1.9.1-p376 -fPIC  -O2 -g -Wall -Wno-parentheses  -o ruby_debug.o -c ruby_debug.c
ruby_debug.c: In function ‘ruby_method_ptr’:
ruby_debug.c:141: error: ‘rb_method_entry_t’ undeclared (first use in this function)
ruby_debug.c:141: error: (Each undeclared identifier is reported only once
ruby_debug.c:141: error: for each function it appears in.)
ruby_debug.c:141: error: ‘method’ undeclared (first use in this function)
ruby_debug.c:142: warning: implicit declaration of function ‘rb_method_entry’
ruby_debug.c: In function ‘debug_event_hook’:
ruby_debug.c:719: error: ‘rb_method_entry_t’ undeclared (first use in this function)
ruby_debug.c:719: error: ‘me’ undeclared (first use in this function)
make: *** [ruby_debug.o] Error 1

Apparently version 0.11.24 of ruby-debug-base19 was released on August 22, 2010, and it won't install correctly on Ruby 1.9.1. This version fixed support in Ruby 1.9.2, but broke 1.9.1 support. I went back to the previous version and it works fine. So to install the ruby-debug19 gems on a Ruby 1.9.1 system, run these two commands:

sudo gem install ruby-debug-base19 -v=0.11.23
sudo gem install ruby-debug-ide19

One important note! If you've already attempted to install the latest version of ruby-debug-base19 and gotten the failure, ruby-debug-ide19 may fail, even if you install the working version of ruby-debug-base19. You have to actually delete the files for 0.11.24 of ruby-debug-base19, and then reinstall ruby-debug-ide19. For me on a Ubuntu system where Ruby was compiled from source:

sudo rm -rf /usr/local/lib/ruby/gems/1.9.1/gems/ruby-debug-base19-0.11.24
sudo gem install ruby-debug-ide19

Also this bug has been reported on as ticket #28512.

Rails 2.3.8 automatically escaping HTML when you don't want it to

I was upgrading my application to Rails 2.3.8 from 2.3.5 and found a pretty annoying bug in Rails 2.3.8. This bug HAS BEEN FIXED in Rails 2.3.9, so simply install Rails 2.3.9 to get around this problem. However, there are a lot of other problems with Rails 2.3.9, read my posting at Upgrade to Rails 2.3.9 session no longer works for a killer bug for me. Other problems have been reported too. I'm just sticking with 2.3.5.

The bug is that when you concatenate HTML strings in helper methods, Rails will automatically HTML escape the string under certain conditions. There is NO way to tell Rails not to do this. Here is an example that reproduces the problem. Add these two methods to your application helper:


Then simply output the outer_helper method in one of your views:

  <%= outer_helper %>

This is the result:

about to call inner_helper method

inside p content tag

a space should be between the following words: hello&nbsp;worldmore <span style="font-weight:bold;">dirty HTML</span>

inside div content tag

outside of inner_helper method in p tag

This is obviously not what it should be producing. Rails 3 automatically escapes HTML rendered, but you can simply call .html_safe on the output to mark that you don't want it to escape, or call raw(string), from what I've read. But these don't exist in Rails 2.3.8. This bug has been fixed in this commit to the Rails code, which has been included in Rails 2.3.9.

The blog posting at http://breakthebit.org/post/647352254/rails-2-3-8-forced-html-escaping-of-concatenated shows some ways you can get around this, but in my opinion you shouldn't have to work around this. Just stick with 2.3.5, or if you're brave you can try 2.3.9.

Gem for getting Google static maps

I've created a gem for getting maps from the Google Maps static API service called googlestaticmap. With static maps, you can specify parameters for a map, from image size, image type, and markers, path lines, and polygons to draw on the map, and in one http get to Google, retrieve the map. This is great for mobile sites where many visitors won't be able to use the Google Maps 2D API. It's also great if you have a map image that you want people to see, but don't want to load all of the Google maps javascript on your page.

To install the gem, simply type "gem install googlestaticmap" (the gem is on gemcutter, and I believe you need version 1.3.6 or higher of Rubygems to get gems from there). Documentation for the gem is at http://coordinatecommons.com/googlestaticmap with several examples of how to use it. Also if you want to see the source, it's on Github at http://github.com/brentsowers1/googlestaticmap.

Getting Facebooker app to run in subdirectory

When I set up My Trips, my Facebook app that I used the Facebooker gem for the Facebook interface for, I intended to run it as a subdirectory of my domain name. This way I could set up multiple Facebook apps with the same domain name and IP address. However, no matter what I tried, I could not get everything to work correctly. I thought that it was issues with my web server, Nginx. However, after looking in to this more I found that it was an issue with Facebooker. You'll have to edit a Facebooker source code file. It's best to unpack the gem to your vendor directory, that way you can edit this file for the specific project.

Once you've unpacked it, edit the file vendor/gems/facebooker-1.0.xx/lib/facebooker/rails/facebook_url_rewriting.rb. Modify the relative_url_root method to the following:

class Base
class << self
alias :old_relative_url_root :relative_url_root
def relative_url_root
#Facebooker.path_prefix
'/subdirectory_name'
end
end
end

Where subdirectory_name is the name of the subdirectory that you want to run this app from. This is a bit of a hack, hard coding the directory that you want to run from, but it works. After you do this, you'll then have to configure your web server to run your app in a subdirectory. For Nginx with Passenger, simply add "passenger_base_url /subdirectory_name" to your nginx.conf in the server { } block. Now you can change your Canvas URL to http://www.yourdomainname.com/subdirectory_name.

Twitter and LinkedIn

I've finally gotten with the times and have set up profiles on Twitter and LinkedIn. I'll probably post a bunch on Twitter for a week or so and then forget about it though, we'll see how this goes. I added a gadget to the blog which shows my 3 latest tweets.

@sowersb on Twitter

Brent Sowers on LinkedIn

Signature verification does NOT work with Facebooker and Rails 2.3

I've been working on a Facebook application called My Trips (http://apps.facebook.com/my_trips/) for several months now in my free time. I am using the Facebooker gem for this project. If you are interesting in developing Facebook applications with Rails, I would highly recommend reading Developing Facebook Platform Applications With Rails, about developing Facebook applications with Facebooker.

At some point I'm going to do a comprehensive write up of my experiences developing a Facebook application with Rails and Facebooker. But until then, I figured I should share one important thing I found.

Facebook passes signatures to your application on every request. The checksum of all signature parameters, plus your "secret key" (a key assigned to your application when it's installed, and never sent in HTTP requests) must equal the signature parameter sent to you by Facebook in params. This ensures that the request actually came from Facebook and not from a third party spoofing Facebook. This is a great security feature. Facebooker automatically checks the signature on every request from Facebook, and throws an exception if the signature doesn't match before your controller code is hit. At least that's how it works with Rails 2.2 and earlier.

With Rails 2.3, Facebooker adds the Rack::Facebook rack extension that is supposed to do this signature verification one level above Facebooker, among other things. However, Rack::Facebook didn't actually verify signatures in my application. I made requests by spoofing Facebook, and just manually typing in URLs without even attempting to spoof, and my requests were processed. They should not have been.

I couldn't really figure out why Rack::Facebook wasn't doing this. Since the signature verification code is in Facebooker and works in Rails 2.2 and earlier, I decided to modify the Facebooker code to do this check explicitly. To do this, edit the facebooker/lib/facebooker/rails/controller.rb file, find the verify_signature method, and comment out the first 3 lines that does a check to see if Rack::Facebook is loaded. When you restart your application, Facebooker goes back to verifying the signature itself. After doing this, my spoofed and manual requests were correctly caught.