May 2018 - dancer-users - lists.preshweb.co.uk

Request Context uploads - changed?
by Zahir Lalani 30 May '18

30 May '18

Hi All Our current application uploader mechanism has broken since the dancer update. The issue seems to be how the tempfilename is reported. In Dancer2 0.205, the temp file name would report as : /tmp/XKdggo8aBt.pptx Since 0.206, the extension is dropped off Is this expected? Zahir Lalani Head of Development & Architecture [cid:96F784CA-E917-4CC1-A9A9-96CBDA2AF2BC] 151 Rosebery Avenue, London, EC1R 4AB m: +44 (0)7956 455168 t: +44 (0)203 142 3619 e: zahirlalani@oliver<mailto:zahirlalani@oliver-marketing.com>.agency w: www.oliver.agency

1 0

External access to Dancer2 settings
by Nathan Bailey 30 May '18

30 May '18

1. The script from the Cookbook <https://metacpan.org/pod/release/XSAWYERX/Dancer2-0.08/lib/Dancer2/Cookbook…> : # bin/script2.pl use FindBin <https://metacpan.org/pod/FindBin>; use Cwd <https://metacpan.org/pod/Cwd> qw/realpath/; use Dancer2 <https://metacpan.org/pod/Dancer2>; #tell the Dancer2 where the app lives my $appdir=realpath( "$FindBin::Bin/.."); Dancer2::Config::setting('appdir',$appdir); Dancer2::Config::load(); #getter print "environment:".config->{environment}."\n"; #development print "log:".config->{log}."\n"; #value from development environment fails with: Undefined subroutine &Dancer2::Config::setting called at script2.pl line 9. Although I can see a setting function in Dancer2::Core::Role::ConfigReader? 2. What's the best way for my perl modules to access settings? eg. if Main.pm says: my $foo = myApp::FooMaker->new(); FooMaker.pm can get config settings via: a) Using an approach similar to the above b) Having all config or specific parts of config passed in since FooMaker is Dancer2 unaware. Does adding: use Dancer2; to FooMaker make it Dancer2 aware? (ie. give it access to all the Dancer environment?) and if so, what kind of Dancer2 environment does one need to make for unit tests of FooMaker functions/methods? thanks, Nathan

1 0

Dancer2 -- multiple apps with different config(.yml) in one process
by Erik Huelsmann 28 May '18

28 May '18

Hi, Over at the LedgerSMB project (https://ledgersmb.org/) we moved a lot of our old CGI code to PSGI over the last year. Recently, I've factored out many "infrastructure" level items into Plack middleware. We've wanted to move to Dancer as our web framework for years. And this weekend I made a first stab at such a move. As a result I have some questions (but more may come). Some questions were immediately answered by Stephan Hornburg in our chat channel (thanks Stephan!) but the most important one remains open. Question: Dancer2's documentation points out that we can use 2 applications hosted on 1 PSGI server. The relevant section is: http://search.cpan.org/~cromedome/Dancer2-0.205002/lib/Dancer2/Manual.pod#R… And while that works, both of these applications resolve their configuration to one and the same "config.yml". This is where my problem is: while I don't mind (would like to, even) share 99% of the configuration between two applications I want to mount, the two applications I want to mount, need separate authentication cookies. As far as I'm aware, I'd need to resolve to two different "config.yml" files (in my case I'd prefer "main_config.yml" and "setup_config.yml"). A bit of background to my question: LedgerSMB is an ERP application which consists of two logically separate applications: 'main' and 'setup'. "main" is the application for regular users while "setup" is for application/functional maintenance (application admin). Since many businesses have a "superuser" appointed as their admin, this user has 2 roles. He may want to log into both applications at the same time, each in a separate window on the same browser. In order to be able to do that, I need to be able to set the session cookie for both applications to be different from each other. It's my understanding that the "best" way to set cookie names through the configuration. Hence my question how to get two applications pointing to two different configuration files. I've tried multiple approaches so far without success: 1. "use Dancer2 config_location => 'path/to/config';" 2. read the sources of Dancer2 for a couple of hours 3. Ask racke Could you please advise? Thanks in advance! -- Bye, Erik. http://efficito.com -- Hosted accounting and ERP. Robust and Flexible. No vendor lock-in.

2 2

Dancer::Plugin::SimpleCRUD security update
by David Precious 07 May '18

07 May '18

Hi all, Importance notice for anyone using Dancer::Plugin::SimpleCRUD - if you use the `auth` option to control access to the CRUD interface/routes via DPAE, then please update to 1.15 immediately; previous versions contain a security vulnerability as a result of incorrect calls to _ensure_auth(), meaning that only some routes are correctly protected, and some others aren't. Full details can be see in PR #109 which fixes this problem: https://github.com/bigpresh/Dancer-Plugin-SimpleCRUD/pull/109 This is a pretty embarassing fuckup - a security problem on one of my projects. I hold my hands up and apologise to anyone affected by this, for this is a stupid mistake. A better test suite would have caught this. I'm not sure if a CVE ID is warranted or not, but I have submitted a request for one via Distributed Weakness Filing Project, so they can decide if one is required for this or not. So, again, please upgrade immediately if you rely on the `auth` option, and sorry. Also, many many thanks to Josh Rabinowitz (joshrabinowitz) for finding this problem and submitting a test which illustrates it. Cheers Dave P (bigpresh)

2 1