September 2015 - dancer-users - lists.preshweb.co.uk

Dancer2::Plugin::Database side effects?
by Mike Cu 07 Nov '15

07 Nov '15

I've replaced all my $dbh = DBI->connect, $sth = $dbh->prepare calls with the Dancer2::Plugin::Database equivalents Before that, when there was interaction with the UI, I would explicitly connect, run all my sql and then disconnect, on every Ajax call . After I switched to Dancer2::Plugin::Database,I have to do the same interaction, for example, clicking a button which invokes an Ajax call which in turn calls the database retrieving the new data and updates the UI, does not have an immediate effect ,the UI is not being updated. So I have to do the same move (click a second time) for getting the desirable outcome Has that something to do with caching and reusing the connection?

4 6

Template Toolkit Help
by Richard Reina 06 Oct '15

06 Oct '15

I have learned how to display variables in template toolkit with <% varname %>. However, these variables are being named from withing my dancer app and displayed on the template. Is there a way to display variables that a user is entering as they are entering it. So that if I have a menu like form where a user can pick several items and see them each added one by one in a list format before pressing a second submit button that submits his entire lists of entries? It would be a bit like a shopping cart but instead of the items being put in the cart they are displayed right there in the form as they are added. Thanks for any ideas. Richard

5 19

Iteration of hash in template.
by Richard Reina 01 Oct '15

01 Oct '15

Hello All, I ussually iterate a hash that is the result of $rows_ref = $sth->fetchall_hashref('ID'); in my template with <% FOREACH ID Matched_pats.keys.sort %>. However, In this case though the template only displays one row because each resulting row in the SQL query all have the same ID number. Is there any simple change I can make to get the results to fully iterate? Thanks

7 16

Re: [dancer-users] XSS
by Rick Leir 29 Sep '15

29 Sep '15

On Tue, Sep 29, 2015 at 3:05 AM, <dancer-users-request(a)dancer.pm> wrote: > > Well , if end users can insert data into the table somehow, then it's still > vulnerable. Furthermore, if the fields in the table contain special HTML > characters like < , > , & , etc. then it may confuse the browser's HTML > parser, > and cause the HTML to not validate. So it's a good idea to escape the > fields > anyway when passing them to the output. > I had problems with taint mode and Dancer2, is that related to this thread? My problem is shown by using -T in this: $ perl -T -Ilib t/001_base.t 1..1 not ok 1 - use CFOO::CBAR; # Failed test 'use CFOO::CBAR;' # at t/001_base.t line 5. # Tried to use 'CFOO::CBAR'. # Error: Unable to load class for Logger component File: Insecure dependency in require while running with -T switch at /usr/local/share/perl/5.20.1/Dancer2/Core/App.pm line 165. # BEGIN failed--compilation aborted at lib/CFOO/CBAR.pm line 7. # Compilation failed in require at t/001_base.t line 5. # BEGIN failed--compilation aborted at t/001_base.t line 5. # Looks like you failed 1 test of 1. possibly related: https://github.com/PerlDancer/Dancer2/issues/567 https://github.com/PerlDancer/Dancer2/issues/609 This latter 609 suggests that the taint problem goes away when using plackup/Starman. I will try to run the tests via plackup/Starman. >From the changelog: * GH #567: Check for proper module names in loading engines. Might help with taint mode. (Sawyer X) cheers -- Rick

1 0

Returning JSON Data
by Kadir Beyazlı 29 Sep '15

29 Sep '15

Hi All, I will return JSON data from a route. If I don't use Dancer2 framework, I do it as follow and it works: sub json_branch_list { my $sth_branch = $dbh->prepare (qq(SELECT BranchID,Branch FROM branch WHERE Deleted=0 )); $sth_branch->execute || die 'SQL_ERROR'; my $branch_list = []; while (my $branch = $sth_branch->fetchrow_hashref) { push @$branch_list, { BranchID => $branch->{BranchID}, Branch => $branch->{Branch} }; } use JSON; my $result = { total => scalar(@$branch_list), branch => $branch_list, success => JSON::true }; print $q->header(-content_type => "application/json; charset='utf8'); print to_json($result); exit; } At Dancer2, when I write below definition : use JSON; it does not allow with a warning that to_json and from_json functions are duplicated. I of course know that Dancer2 is using following definition set serializer => 'JSON'; But I still could not achieve returnin JSON data: Here my route is get '/json_branch_list' => sub { my $sth_branch = database->prepare (qq(SELECT BranchID,Branch FROM branch WHERE Deleted=0 )); $sth_branch->execute || die 'SQL_ERROR'; my $branch_list = []; while (my $branch = $sth_branch->fetchrow_hashref) { push @$branch_list, { BranchID => $branch->{BranchID}, Branch => $branch->{Branch} }; } set serializer => 'JSON'; return $branch_list; }; No data is displayed -- Kadir Beyazlı Computer Engineer GSM : +90 535 821 50 00

7 26

Re: [dancer-users] Template Toolkit Sort Hash
by Shlomi Fish 28 Sep '15

28 Sep '15

Hi Richard, replying to the list. Please reply to the list next time - see the last line of my signature. On Mon, 28 Sep 2015 08:32:08 -0500 Richard Reina <gatorreina(a)gmail.com> wrote: > 2015-09-28 3:28 GMT-05:00 Shlomi Fish <shlomif(a)shlomifish.org>: > > > Hi Richard, > > > > some comments on your code: > > > > On Sun, 27 Sep 2015 17:59:42 -0500 > > Richard Reina <gatorreina(a)gmail.com> wrote: > > > > > 2015-09-27 11:24 GMT-05:00 Dave Cross <dave(a)dave.org.uk>: > > > > > > > > > > > On 27/09/15 16:34, Richard Reina wrote: > > > > > > > > I think I am going to try to figure out how to use an array reference > > > >> instead. Traveling so can't try it until I get back tomorrow. > > > >> > > > > > > > > You can, of course, try whatever approach you want. But my second > > solution > > > > will work. > > > > > > > > Dave... > > > > > > > > -- > > > > > > > > > > Hi Dave, > > > > > > This did in fact work. Here is how I ended up incorporating your > > solution. > > > > > > <div class="well" style="max-height: 300px;overflow: auto;"> > > > <ul class="list-group fancy-list-items">  > > > <table style="width:100%"> > > > <% FOREACH Pat IN Pats.values.sort('SNAME') -%> > > > <tr class="list-group-item"> > > > <td width="25"><% Pat.ID %> > > > <td width="70"><% Pat.SNAME %> > > > <td width="75"><% Pat.ANAME %> > > > <td width="35"><% Pat.SSN %> > > > <td width="35"><% Pat.YR %> > > > <td width="250"><% Pat.CHNAME %> > > > <td width="550"><% Pat.DESCRIP %> > > > > 1. You're missing the closing tag - "</td>". > > > > Thanks for pointing out. Can't believe I missed that. > You're welcome. Are you validating your output? Do you have automated tests to do it for you? > > > 2. Are you sure you're avoiding > > https://en.wikipedia.org/wiki/Cross-site_scripting ? Also see > > http://perl-begin.org/tutorials/bad-elements/#code_and_markup_injection . > > > > > I am not sure. Despite reading the recommended links I don't know enough to > be sure. Why do you ask? Because cross-site scripting (XSS) can be a serious security vulnerability. Let's suppose you put a field called "myfield" that was input from the user directly into the HTML: <td><% myfield %></td> Then a malicious user can put something like this in "myfield": <script type="text/javascript">alert('XSS!')</script> And this is just the beginning of malicious JS that can be inserted. For a cautionary measure, see: https://metacpan.org/release/Template-Stash-AutoEscaping Regards, Shlomi Fish -- ----------------------------------------------------------------- Shlomi Fish http://www.shlomifish.org/ Optimising Code for Speed - http://shlom.in/optimise A: I’m hungry today. B: Well, wait until tomorrow. Maybe this feeling will pass. Please reply to list if it's a mailing list post - http://shlom.in/reply .

3 3

Re: [dancer-users] Content-disposition-header.
by Rick Leir 28 Sep '15

28 Sep '15

On Mon, Sep 28, 2015 at 7:00 AM, <dancer-users-request(a)dancer.pm> wrote: > Using send_file seems not appropriate, because it sets > Content-disposition-header. > Strange. I do not get Content-disposition-header in the response from this: get '/' => sub { send_file 'index.html'; }; Only these: Content-Length439Content-Typetext/html; charset=utf-8DateMon, 28 Sep 2015 13:26:01 GMTServerHTTP::Server::PSGI Do not use Content-disposition-header unless you have a reason to need it: http://stackoverflow.com/questions/1012437/uses-of-content-disposition-in-a… cheers -- Rick

2 1

Dancer2 before_file_render hook
by Alex Mestiashvili 28 Sep '15

28 Sep '15

Is there a way to protect a file in the public directory with Dancer2? In Dancer I was using before_file_render hook to achieve that. before_file_render is still present in Dancer2::Handler::File, but It doesn't work out of box for me. Thank you

3 4

Template Toolkit Sort Hash
by Richard Reina 28 Sep '15

28 Sep '15

I display a hash reference in a template. It works well but is there a way I can sort it by SNAME instead of ID? <ul class="list-group fancy-list-items">  <table style="width:100%"> <% FOREACH ID IN Pats.keys.sort %> <tr class="list-group-item"> <td width="70"><% Pats.$ID.SNAME %></td> <td width="75"><% Pats.$ID.ANAME %></td> <td width="35"><% Pats.$ID.SSN %></td> <td width="35"><% Pats.$ID.YR %></td> <td width="250"><% Pats.$ID.CHNAME %></td> <td width="550"><% Pats.$ID.DESCRIP %></td> <% END %> </tr> </ul> </table> Thanks

6 17

Change of Dancer1 release manager, and feature-freeze
by David Precious 26 Sep '15

26 Sep '15

Hi all, Yanick is standing down from D1 release manager in order to be able to focus on D2 development - please join me in thanking him for all his hard work keeping D1 maintained and useful! I'm happy to put my hand up and announce that I'm taking over as release manager for Dancer1 - I still make heavy use of Dancer 1 at $work, and we're not in a position to convert over to Dancer 2 yet, so I'll need it maintained for some time either way :) I'd also like to make clear the policy that Dancer 1 is essentially feature-frozen, but will still receive bug fixes for any high-impact or trivial to fix bugs, and will of course receive prompt fixes for any discovered security issues - I shan't be turning my back on D1 at any point soon. In the near future I plan to review outstanding issues and pull requests and see what should be fixed and what's better to consider a "let's get this done in Dancer 2" plan, and get a new D1 release out. In a slightly longer term, I'd like to work on some documentation and tools to make migration from D1 to D2 easier - I need to have a long think about what I can do there! Cheers Dave P (bigpresh)

5 4