- dancer-users - lists.preshweb.co.uk

color for debug output
by Nick Knutov 10 Oct '15

10 Oct '15

Just ran some nodejs app and saw output. It was without timestamps and debug level was colored at the beginnings of line (debug|info|error|notice etc). It looks better to me. Is it possible to do the same with Dancer? -- Best Regards, Nick Knutov http://knutov.com ICQ: 272873706 Voice: +7-904-84-23-130

2 1

JSON serializer
by Mike Cu 10 Oct '15

10 Oct '15

I have an Ajax call like : $( "#City" ).selectmenu({ select: function( event, ui ) { $.ajax({ url: '/cities', type: "POST", data: {'City':$("#City" ).val()}}).success(function(data){ $("#display").html(data);}); }, }); does the default JSON serializer escape the data to prevent XSS, or should I escape it manually?

2 3

Stored XSS via AJAX
by Mike Cu 09 Oct '15

09 Oct '15

I was reading about Stored XSS via AJAX on Web Application Exploits and Defenses | | | | | | | | | | | Web Application Exploits and DefensesCross-Site Scripting(XSS) | | | | View on google-gruyere.apps... | Preview by Yahoo | | | | | where it says " Second, in the browser, Gruyere converts the JSON by usingJavascript's eval. In general, eval is verydangerous and should rarely be used. If it used, it must be used verycarefully, which is hardly the case here. We should be using the JSONparser which ensures that the string does not include any unsafecontent. The JSON parser is availableat json.org." So I'm wondering what does Dancer do? eval or uses a parser?

3 2

Multiple virtual hosts: one dancer instance or one per vhost?
by Tom Browder 07 Oct '15

07 Oct '15

I am investigating moving several virtual host web sites (some using plain CGI and some purely static) to using dancer2 and wonder (1) can one have one dancer process per vhost and (2) can one dancer process support multiple host? I would like to be able to choose either or a mix of the methods but it is important that the individual vhost sites be independent as far as the public views them. Some features that differ from host to host that must continue working: + TLS server certificates + client certificates (for private sections of a vhost) + mixed static and dynamic pages All sites will continue to be served with Apache 2.4. The candidate sites include: <https://usafa-1965.org> <https://psrr.info> <https://niceville.pm.org> <https://nwflug.org> <https://mbrowder.com> <https://computertechnwf.org> <https://freestatesofamerica.org> <https://novco1968tbs.com> <https://nwflorida.info> Only the first is using CGI currently, but I would like to expand most of the others to use some dynamic pages. Readers may be interested in the second site which has my own implementation of an animated steam loco and cars regularly crossing the front page. The scene includes flashing signals at a highway crossing. The scene uses only svg and html 5 code (and non-animated css). Thanks. Best regards, -Tom

3 4

Delayed and asynchronous Dancer2
by Amelia Ireland 06 Oct '15

06 Oct '15

Hello, I'm very interested in using Dancer2's streaming and async capabilities, and have a number of questions about using Dancer2 asynchronously: - Does the whole app have to be written to be asynchronous / non-blocking? (I assume so) - Do all apps running from the same .psgi file have to be non-blocking? E.g. in app.psgi: builder { mount '/app1' => $nonblocking_app; mount '/app2' => $blocking_app; }; - Are hooks safe to use in a non-blocking Dancer2 app or do they introduce a blocking element? - When I run the drums example in a browser (Safari), it waits until the entire drum loop has completed and then prints the content. Is that what is expected to happen? I expected the content to be written by the browser as it received it. The docs aren't very clear on what Dancer is actually doing under the hood -- it would be useful to have more explanation of what's going on. I'd be happy to write up something myself, but I don't know what's going on. ;-) Thanks! Amelia.

2 2

Template Toolkit Help
by Richard Reina 06 Oct '15

06 Oct '15

I have learned how to display variables in template toolkit with <% varname %>. However, these variables are being named from withing my dancer app and displayed on the template. Is there a way to display variables that a user is entering as they are entering it. So that if I have a menu like form where a user can pick several items and see them each added one by one in a list format before pressing a second submit button that submits his entire lists of entries? It would be a bit like a shopping cart but instead of the items being put in the cart they are displayed right there in the form as they are added. Thanks for any ideas. Richard

5 19

Iteration of hash in template.
by Richard Reina 01 Oct '15

01 Oct '15

Hello All, I ussually iterate a hash that is the result of $rows_ref = $sth->fetchall_hashref('ID'); in my template with <% FOREACH ID Matched_pats.keys.sort %>. However, In this case though the template only displays one row because each resulting row in the SQL query all have the same ID number. Is there any simple change I can make to get the results to fully iterate? Thanks

7 16

Hooks in dancer2
by Rubén Amórtegui 01 Oct '15

01 Oct '15

Hi all, I have an issue executing hooks in dancer2, The code is running twice but I'm just calling once. This is a sample code (minimum) File: lib/Dancer2/Plugin/MyPluginTest.pm ::::::::::::::::::::::::: MyPluginTest.pm ::::::::::::::::::::::::: package Dancer2::Plugin::MyPluginTest; use Dancer2::Plugin; register_hook 'my_new_hook_after'; register new_function => sub { my $dsl = shift; execute_hook 'my_new_hook_after'; }; register_plugin; ::::::::::::::::::::::::: Test File: plugin.pl :::::::::::::: plugin.pl :::::::::::::: use strict; use warnings; use Test::More; use Plack::Test; use HTTP::Request::Common; { package MyTestApp; use Dancer2; use Dancer2::Plugin::MyPluginTest; my $var = 0; get '/' => sub { new_function; $var; }; hook 'my_new_hook_after' => sub { $var++; debug "Executing hook - $var"; return; }; }; my $test = Plack::Test->create( MyTestApp->to_app ); my $res = $test->request( GET '/' ); is( $res->content, '1', 'Var is 1 after one call on /' ); $res = $test->request( GET '/' ); is( $res->content, '2', 'Var is 1 after one call on /' ); done_testing(); :::::::::::::: The result after : prove -l lib/ plugin.pl -v plugin.pl .. [MyTestApp:14688] debug @2015-10-01 09:25:43> Executing hook - 1 in plugin.pl l. 21 [MyTestApp:14688] debug @2015-10-01 09:25:43> Executing hook - 2 in plugin.pl l. 21 not ok 1 - Var is 1 after one call on / # Failed test 'Var is 1 after one call on /' # at plugin.pl line 28. # got: '2' # expected: '1' [MyTestApp:14688] debug @2015-10-01 09:25:43> Executing hook - 3 in plugin.pl l. 21 [MyTestApp:14688] debug @2015-10-01 09:25:43> Executing hook - 4 in plugin.pl l. 21 not ok 2 - Var is 1 after one call on / # Failed test 'Var is 1 after one call on /' # at plugin.pl line 30. # got: '4' # expected: '2' 1..2 # Looks like you failed 2 tests of 2. Dubious, test returned 2 (wstat 512, 0x200) Failed 2/2 subtests Test Summary Report ------------------- plugin.pl (Wstat: 512 Tests: 2 Failed: 2) Failed tests: 1-2 Non-zero exit status: 2 Files=1, Tests=2, 2 wallclock secs ( 0.04 usr 0.00 sys + 0.44 cusr 0.02 csys = 0.50 CPU) Result: FAIL Does someone an idea what i'm doing wrong? or if is it something about the hooks? Thanks in advance! Ruben. -- ____________________________ Rubén Darío Amórtegui Medina MCE - Ingeniero de Sistemas

1 0

Re: [dancer-users] XSS
by Rick Leir 29 Sep '15

29 Sep '15

On Tue, Sep 29, 2015 at 3:05 AM, <dancer-users-request(a)dancer.pm> wrote: > > Well , if end users can insert data into the table somehow, then it's still > vulnerable. Furthermore, if the fields in the table contain special HTML > characters like < , > , & , etc. then it may confuse the browser's HTML > parser, > and cause the HTML to not validate. So it's a good idea to escape the > fields > anyway when passing them to the output. > I had problems with taint mode and Dancer2, is that related to this thread? My problem is shown by using -T in this: $ perl -T -Ilib t/001_base.t 1..1 not ok 1 - use CFOO::CBAR; # Failed test 'use CFOO::CBAR;' # at t/001_base.t line 5. # Tried to use 'CFOO::CBAR'. # Error: Unable to load class for Logger component File: Insecure dependency in require while running with -T switch at /usr/local/share/perl/5.20.1/Dancer2/Core/App.pm line 165. # BEGIN failed--compilation aborted at lib/CFOO/CBAR.pm line 7. # Compilation failed in require at t/001_base.t line 5. # BEGIN failed--compilation aborted at t/001_base.t line 5. # Looks like you failed 1 test of 1. possibly related: https://github.com/PerlDancer/Dancer2/issues/567 https://github.com/PerlDancer/Dancer2/issues/609 This latter 609 suggests that the taint problem goes away when using plackup/Starman. I will try to run the tests via plackup/Starman. >From the changelog: * GH #567: Check for proper module names in loading engines. Might help with taint mode. (Sawyer X) cheers -- Rick

1 0

Returning JSON Data
by Kadir Beyazlı 29 Sep '15

29 Sep '15

Hi All, I will return JSON data from a route. If I don't use Dancer2 framework, I do it as follow and it works: sub json_branch_list { my $sth_branch = $dbh->prepare (qq(SELECT BranchID,Branch FROM branch WHERE Deleted=0 )); $sth_branch->execute || die 'SQL_ERROR'; my $branch_list = []; while (my $branch = $sth_branch->fetchrow_hashref) { push @$branch_list, { BranchID => $branch->{BranchID}, Branch => $branch->{Branch} }; } use JSON; my $result = { total => scalar(@$branch_list), branch => $branch_list, success => JSON::true }; print $q->header(-content_type => "application/json; charset='utf8'); print to_json($result); exit; } At Dancer2, when I write below definition : use JSON; it does not allow with a warning that to_json and from_json functions are duplicated. I of course know that Dancer2 is using following definition set serializer => 'JSON'; But I still could not achieve returnin JSON data: Here my route is get '/json_branch_list' => sub { my $sth_branch = database->prepare (qq(SELECT BranchID,Branch FROM branch WHERE Deleted=0 )); $sth_branch->execute || die 'SQL_ERROR'; my $branch_list = []; while (my $branch = $sth_branch->fetchrow_hashref) { push @$branch_list, { BranchID => $branch->{BranchID}, Branch => $branch->{Branch} }; } set serializer => 'JSON'; return $branch_list; }; No data is displayed -- Kadir Beyazlı Computer Engineer GSM : +90 535 821 50 00

7 26