- dancer-users - lists.preshweb.co.uk

Potential security issues fixed in recent releases
by Russell Jenkins 16 Jun '15

16 Jun '15

Hello fellow Dancers. We've been notified about a potential security issue that affects both Dancer and Dancer2. For releases up to * Dancer v1.3136, or * Dancer2 v0.160001 it was possible to abuse session cookie values so that file-based session stores such as Dancer::Session::YAML or Dancer2::Session::YAML would attempt to read/write from any file on the filesystem with the same extension the file-based store uses, such as '*.yml' for the YAML stores. The issue was reported by Andrew Beverley and fixed in the following releases * Dancer v1.3138 (Yanick Champoux) * Dancer2 v0.160002 (Russell Jenkins) The updated packages are now available from your favorite CPAN mirror. The file-based session stores are intended to be used for prototyping and testing. While we do not recommend using file-based session stores in production, there may be single-machine production environments where they are useful. If you are using any of the file-based session stores in production, we strongly advise you to upgrade. Thanks for your trust, and happy dancing! Sawyer, Yanick & Russell.

1 0

session destroy do not remove session file
by Hugues 08 Jun '15

08 Jun '15

Hello I use dancer1 version Dancer-1.3136 and YAML file to store session informations when I do get '/disconnect' => sub { my $time = session('Time'); my $username = session('username'); session->destroy; debug "Connexion finished for $username @ $time, bye"; .... in log 08/juin/2015 12:04:52 [67867] core @0.020885> entering before hook in /usr/local/share/perl5/Dancer/Hook.pm l. 62 08/juin/2015 12:04:52 [67867] core @0.021410> entering before_template_render hook in /usr/local/share/perl5/Dancer/Hook.pm l. 62 08/juin/2015 12:04:52 [67867] core @0.029130> trying to remove session file: /home/git/xxxxx/sessions/298172675856804521882197134418462808.yml in /usr/local/share/perl5/Dancer/Session/YAML.pm l. 87 08/juin/2015 12:04:52 [67867] debug @0.030032> Connexion finished for hugues(a)max4mail.com @ 1433755846, bye in /home/git/xxxxx/lib/main.pm l. 142 but yml file is not removed, and I can continue to navigate ls sessions/ 298172675856804521882197134418462808.yml if someone has a idea ? Hugues.

1 0

Dancer2 install errors
by mark jones 06 Jun '15

06 Jun '15

Hi, Can anyone help with the errors that I'm getting while trying to install Dancer2, looks a problem with core.app.before_request but there are also some errors regarding new_from_plack. I'm using a fresh install of Ubuntu 64 bit, 14.04. t/00-report-prereqs.t .................................. ok [main:25555] error @2015-06-05 13:28:24> Exception caught in 'core.app.before_request' filter: Hook error: Can't locate object method "failure" via package "Foo" (perhaps you forgot to load "Foo"?) at t/app.t line 150. at /home/mj/.cpanm/work/1433507299.25464/Dancer2-0.160002/blib/lib/Dancer2/Core/App.pm line 953. in /home/mj/.cpanm/work/1433507299.25464/Dancer2-0.160002/blib/lib/Dancer2/Core/App.pm l. 526 t/app.t ................................................ ok t/app_alone.t .......................................... ok t/author-no-tabs.t ..................................... skipped: these tests are for testing by the author t/auto_page.t .......................................... ok t/caller.t ............................................. ok t/charset_server.t ..................................... ok t/classes/Dancer2-Core-Factory/new.t ................... ok t/classes/Dancer2-Core-Hook/new.t ...................... ok # Running test with XS_URL_DECODE # Running test without XS_PARSE_QUERY_STRING # Running test without XS_URL_DECODE t/classes/Dancer2-Core-Request/new.t ................... ok t/classes/Dancer2-Core-Response-Delayed/after_hooks.t .. ok t/classes/Dancer2-Core-Response-Delayed/new.t .......... ok coercion for "headers" failed: Not an ARRAY reference at /home/mj/.cpanm/work/1433507299.25464/Dancer2-0.160002/blib/lib/Dancer2/Core/Role/Headers.pm line 16. # Child (new_from_plack) exited without calling finalize() # Failed test 'new_from_plack' # at /usr/local/share/perl/5.18.2/Test/Builder.pm line 279. # Looks like you failed 1 test of 3. # Looks like your test exited with 29 just after 3. t/classes/Dancer2-Core-Response/new_from.t ............. Dubious, test returned 29 (wstat 7424, 0x1d00) Failed 1/3 subtests I can provide the full log if needed. Cheers MJ

4 8

New TRIAL version of Dancer 1 on its way to CPAN
by Yanick Champoux 05 Jun '15

05 Jun '15

Hi all, v1.3137 of Dancer1 is on its way to CPAN. This is a trial release. If nothing wrong is being reported within a week, it'll be promoted to a GA release. For your pleasure, the changelog is copied below. As usual, a big 'thank you' to everybody who had a part in the work involved. Y'all rock. 1.3137 2015-06-05 [ BUG FIXES ] - Dancer::Logger->init invocation was using `setting()` instead of `settings()`. (GH#1103, jwittkoski) - Skip utf8 tests on cygwin. (GH#1046, mokko) - Dancer::Session::YAML now refuse cookies that aren't alphanumerical. (yanick) [ ENHANCEMENTS ] - Provide a way to load settings directly from hash. (GH#1113, fgabolde) - Remove 'auto-reload' feature. (GH#1058, alambike) - Add methods to interact with TT's wrappers. (GH#1034, David Zurborg) [ STATISTICS ] - code churn: 13 files changed, 277 insertions(+), 212 deletions(-) Joy, `/anick

1 0

Access logging in Dancer
by Matthew Mallard 02 Jun '15

02 Jun '15

Hi, I’m trying to do some custom access logging in Dancer2. I note that plackup does the access logging (--access-log) and the man page for Plack::Middleware::AccessLog says that the format can be modified in the app.psgi file: # in app.psgi use Plack::Builder; builder { enable "Plack::Middleware::AccessLog", format => "combined"; $app; }; I tried something similar in app.pl, but it kind of works, but doesn’t fully replace the existing access logging. That is: * the log file specified with --access-log remains unchanged - i.e. it keeps getting written to in ‘combined’ format * the new format specified gets written to STDERR (i.e. the location specified with --error-log (for plackup) Here’s the config I’m using: use Plack::Builder; use mymod::api; builder { enable "AccessLog", format => '%h %l %u %t "%r" %>s %b "%{User-agent}i" "%{content-type}i'; mount '/api' => mymod::api->to_app; }; Any ideas on how I can get it to overwrite the default access logging? Thanks, Matt

1 1

Article: Password protecting web pages in Dancer 2
by Gabor Szabo 02 Jun '15

02 Jun '15

an example using Dancer2::Plugin::Auth::Extensible http://perlmaven.com/password-protecting-web-pages-in-dancer2 regards Gabor

1 0

Question about the Dancer2 tutorial under Windows/Apache as an app...
by Prairie Nyx 31 May '15

31 May '15

Perl Dancer Community: I am converting from Dancer to Dancer2 (better late than never) and also developing some preliminary curriculum materials for CoderDojo using Perl Dancer2 as a framework for web development. I started with SawyerX's tutorial page: http://search.cpan.org/~xsawyerx/Dancer2/lib/Dancer2/Tutorial.pod The "dancr.pl" tutorial program ran just fine under the port 3000 server and the tutorial was useful and instructive: C:\Users\CoderDojo\Perl\Dancer\dancr>perl dancr.pl >> Dancer2 v0.160001 server 2496 listening on http://0.0.0.0:3000 I ran into an issue when I tried to convert this demo into an app that would run under Apache in a Windows environment, however. The *crux* of the issue is that the "$flash message" does not work in the app (I suspect because the global variable $flash and the two subroutines are not part of a route, but I could *really* use an explanation, if this issue is obvious to someone: I created the app as normal: C:\Apache24\htdocs>*dancer2 -a dancr* + dancr + dancr\config.yml + dancr\cpanfile + dancr\Makefile.PL + dancr\MANIFEST.SKIP + dancr\bin + dancr\bin\app.psgi + dancr\environments + dancr\environments\development.yml + dancr\environments\production.yml + dancr\lib + dancr\lib\dancr.pm + dancr\public + dancr\public\dispatch.cgi + dancr\public\dispatch.fcgi + dancr\public\404.html + dancr\public\500.html + dancr\public\favicon.ico + dancr\public\css + dancr\public\css\error.css + dancr\public\css\style.css + dancr\public\images + dancr\public\images\perldancer-bg.jpg + dancr\public\images\perldancer.jpg + dancr\public\javascripts + dancr\public\javascripts\jquery.js + dancr\t + dancr\t\001_base.t + dancr\t\002_index_route.t + dancr\views + dancr\views\index.tt + dancr\views\layouts + dancr\views\layouts\main.tt With the resulting app files, I added the code from the original "dancr.pl" demo to the applications "dancr.pm" module: package dancr; use Dancer2; our $VERSION = '0.1'; get '/' => sub { template 'index'; }; true; I had to make the following adjustments to the code for Windows/Apache: (1) Change the session to YAML #set 'session' => 'Simple'; set 'session' => 'YAML'; (2) Adjust the path for request->base: # $tokens->{'css_url'} = request->base . 'css/dancr.css'; $tokens->{'css_url'} = request->base . '/css/dancr.css'; Everything with the app works as expected *except* for the "$flash message" code: my $flash; sub set_flash($message) { my $message = shift; $flash = $message; } sub get_flash { my $message = $flash; $flash = ''; return $message; } I suspect that since these subs are outside a route, perhaps I'm getting an effect about the scope of the variables... but calls to these subroutines do *not* set $flash or $message as expected: template 'show_entries.tt', { 'msg' => get_flash, set_flash('New entry posted!'); set_flash('You are logged in.'); set_flash('You are logged out.'); For each of these, the $flash variable (which is a free-standing global in the module) is never set... and so the get_flash sub never returns a value. -- Prairie Nyx prairienyx(a)gmail.com

2 4

My Second [or so] Dancer Project: a Server for AJAX Requests for Testing JS Code
by Shlomi Fish 30 May '15

30 May '15

Hi all, I hereby would like to announce the successful completion of my second (or so) Dancer project: https://bitbucket.org/shlomif/fc-solve/src/f1b428dec2cdecd547264a79cd4c2db8… (Short URL - http://is.gd/URhahd ). What it does is provide a server for AJAX requests of command lines whose functionality was duplicated in JavaScript code and which I wanted to test that it yielded identical results to the original code. The AJAX requests were consumed by jQuery and compared against the results from the JS code. Here is the test case that uses that: https://bitbucket.org/shlomif/fc-solve/src/f1b428dec2cdecd547264a79cd4c2db8… (short URL - http://is.gd/Uj3JTR ). I originally wanted to use Dancer2, but then realised that https://metacpan.org/pod/Dancer2::Plugin::REST became broken recently (or at least failed its tests), so I opted for using Dancer1 instead whose Dancer::Plugin::REST is working fine. After that, a Dancer developer told me that he feels that Dancer2::Plugin::REST does not give too much, and that I could have avoided it. Oh well. Regards, Shlomi Fish -- ----------------------------------------------------------------- Shlomi Fish http://www.shlomifish.org/ Optimising Code for Speed - http://shlom.in/optimise If a tree falls down in the middle of the forest, and there’s no one there to hear it… what colour is the tree? — Monkey Island 2: LeChuck’s Revenge Please reply to list if it's a mailing list post - http://shlom.in/reply .

1 0

Usage Of Plugins Out Of CPAN
by Kadir Beyazlı 28 May '15

28 May '15

Hi, I understood how to use plugins which are already installed to CPAN. I install it and use. But how will I test my own plugins I wrote at local? For example, I want to test following code taken from dancer manual (https://metacpan.org/pod/Dancer2::Manual) # Start of plugin package Dancer2::Plugin::OnTuesday; # ABSTRACT: Make sure a route only works on Tuesday use Dancer2::Plugin; register on_tuesday => sub { my ( $dsl, $route_sub, @args ) = plugin_args(@_); my $day = (localtime)[6]; $day == 2 or return pass; return $route_sub->( $dsl, @args ); }; register_plugin; # End of plugin To be able to use above plugin at my local, I created .pm file at following folder: MyApp/lib/Dancer2/Plugin/OnTuesday.pm I wrote following code at folder MyApp/test.pl # Start of script use Dancer2; use lib "lib"; use Dancer2::Plugin::OnTuesday; get '/' => on_tuesday => sub { return "tuesday" }; # every other day get '/' => sub { return "other day" }; start; # End of script When I rub test.pl I got following error: Can't locate Dancer2/Plugin/OnTuesday.pm in @INC Kadir Beyazlı Computer Engineer GSM : +90 535 821 50 00

3 7

Dancer1 v1.3136 on its way to CPAN
by Yanick Champoux 24 May '15

24 May '15

Hey all, A new version of D1 is on its way to CPAN. The changelog is copied below for your enjoyment. The big thing in this release is a patch to the session handling that makes Dancer only query the backend for the session data once per request, which should makes things much better for some session engines. 1.3136 2015-05-24 [DOCUMENTATION] - Remove mention of format 'with_id' from Dancer::Logger::Abstract. (GH#112, Fabrice Gabolde) [ENHANCEMENTS] - Cache sessions such that they are only retrieved once per request. (GH#1105, GH#992, Yanick Champoux) [STATISTICS] - code churn: 7 files changed, 119 insertions(+), 16 deletions(-) Enjoy! `/anick

1 0