- dancer-users - lists.preshweb.co.uk

Public web server by default is insecure
by Gabor Szabo 20 Mar '15

20 Mar '15

When we launch a newly created Dancer2 application it will listen on every interface of the computer. So anyone on the network will be able to access it. This can be good for a production server, but it is quite insecure as a development practice. Wouldn't it be more secure to allow only 127.0.0.1 by default and make it easy to allow other interfaces as well? What do you think? Gabor

7 11

return redirect vs return
by David H 20 Mar '15

20 Mar '15

So I had this question and I couldn't find any answer, since the two options were giving me confusion. I wanted t pass control off to another route if a certain action happened. I had this in a route: if ($actionHappened) { redirect '/CheckOffOrderItem/'; } and it was working fine, it would pass control off to that route and then any return would go to the page and return what I wanted. I then went to add another line for something else below this one if ($theOtherThingHappened) { redirect '/CheckOffProduct/' } and it worked, about twice, then stopped working and wouldn't process the redirect, it would get to the condition and go through but just skip processing the route and continue with the existing route, so I read somewhere that "return redirect" should be used and not "redirect" when redirecting. Is this true? and why? My top one is still working and hasn't stopped but I want to know what the logic behind these two are. When I changed the second one to 'return redirect' it started working again. Thanks, David Hancock

4 3

serialiser scope
by Zahir Lalani 19 Mar '15

19 Mar '15

Hi All A little confused about the serialiser scope. I get that in the config file, it will apply to the entire application. I have a need to setup template driven routes and ajax routes. So I have a number of route files, and all use the app name to link the routes into one application. Had assumed that the “set serialiser “ would be active in the current package only (i.e. the ajax routes file) but it seems it applies to the application since all routes are linked into the same application. I have hunted for clues, but in all honesty I am a little confused as to the solution. I know creating a separate app would work, but these routes are part of the same app and need to be centrally controlled in terms of session management etc. Any advice most appreciated Z

2 2

serialize
by Zahir Lalani 19 Mar '15

19 Mar '15

Hi In order work around the routing issue I posted earlier, I am trying to serialise the output but I get nulls. The dump of the output structure is: $VAR1 = [ bless( { 'org_name' => 'Fashion', 'id' => 3 }, 'org_list_dom' ), bless( { 'org_name' => 'Market', 'id' => 4 }, 'org_list_dom' ), bless( { 'org_name' => 'Property', 'id' => 5 }, 'org_list_dom' ), bless( { 'org_name' => 'Misc', 'id' => 6 }, 'org_list_dom' ) Passing this ($res) into serialize: my $json = to_json( $res, { allow_blessed => 1, convert_blessed => 1 } ); gives [null,null,null,null] Any clues as to what I may be doing wrong? Z

2 2

New release of Dancer2::Plugin::Auth::Extensible
by Stefan Hornburg (Racke) 17 Mar '15

17 Mar '15

Thanks to the copious amount of pull requests from Henk van Oers, Andrew Beverly and Gabor Szabo there is a new release of Dancer2::Plugin::Auth::Extensible on CPAN. After bundling up these bug fixes and little improvements in a release, I'm going to further review Andrew's work on creating user, updating users and password reset. To make this even better, we need help with testing the distribution and write tests that covers all aspect of this module. Regards Racke -- Modern Perl, Dancer and eCommerce consulting.

2 1

Devel::Cover and Dancer
by Gabor Szabo 17 Mar '15

17 Mar '15

When last time I ran the tests of my Dancer2 based app through Devel::Cover it did not provide any report for the routes. If I use names subroutines and set them as get '/' => \&serve_index; sub serve_index { } then Devel::Cover takes those subs into account. Do you know how can I convince Devel::Cover to report properly even with anonymous subs? Gabor

3 2

Updates to Dancer2::Plugin::Auth::Extensible
by Andrew Beverley 14 Mar '15

14 Mar '15

Hi guys, I mentioned a while ago that I was hoping to add features into Dancer2::Plugin::Auth::Extensible from https://github.com/abeverley/libdancer2-plugin-auth-complete-perl I'm going to hopefully look at this properly tomorrow, with the aim to migrate one of my projects across. This is just a heads-up, as I'd like to get this done pretty quickly. As a taster, I'm hoping to add the following functionality: * Password resets * Generate fixed passwords * DBIC support * Ability to update user details (providing backend supports it) Does anyone have any immediate comments on the above? Presumably the best thing for me to do is create PRs in Github? Thanks, Andy

3 10

Auto-serialising of parameters
by Andrew Beverley 14 Mar '15

14 Mar '15

Hi guys, In the code for Dancer2::Plugin::Auth::Extensible I see the following: # For security, ensure the username and password are straight # scalars; if the app is using a serializer and we were sent a # blob of JSON, they could have come from that JSON, and thus # could be hashrefs (JSON SQL injection) - for database providers, # feeding a carefully crafted hashref to the SQL builder could # result in different SQL to what we'd expect. That all makes sense. However, from what I understand, auto-serializing now happens either for all request or for none. Therefore, are these sort of checks required when running a recent version of Dancer2? Or is it just the case that they should remain there in case an older version of Dancer2 is being used? Thanks, Andy

1 0

Calling plugin_setting from a plugedin keyword
by Henk van Oers 11 Mar '15

11 Mar '15

In Dancer2::Plugin::Passphrase on line 75 I have: my $settings = plugin_setting(); Keyword 'plugin_setting' is exported by Dancer2::Plugin. In an app I can use the keyword 'passphrase' and it's in the dsl. In an other plugin I want to use the 'passphrase' keyword. package Dancer2::Plugin::Peek; # ABSTRACT: Peek around use Dancer2::Plugin; use Data::Peek; sub peekplugin { my ($dsl, @args) = plugin_args(@_); my $phrase = $dsl->passphrase( 'my password' )->generate->rfc2307; $dsl->var(peekphrase => DDumper \$phrase); } register peekplugin => \&peekplugin; register_plugin; 1; __END__ Yes. I can see the generated phrase in a template. But I also get: DEPRECATED: Dancer2::Plugin::Peek calls 'dsl' instead of '$dsl->dsl'. at /usr/local/lib/perl5/site_perl/Dancer2/Plugin/Passphrase.pm line 75. So, the question is: How do I call 'plugin_setting' in a D2 plugin? -- Henk van Oers

1 1

Proposed additions to Dancer2
by Snigdha Dagar 04 Mar '15

04 Mar '15

Hi everyone, Under Sawyer's mentorship, I have been working on adding new features to the current Dancer2 tutorial. Following is a brief list of the addtions that we have made as of now: 1. More HTTP verbs : '/edit' and '/delete' for editing or deleting an entry 2. User logins - enable registration of new users, created another table for user details 3. Authenticating user credentials 4. Enabling picture uploads for an entry The code-base for this application can be found in this repository - https://github.com/SnigdhaD/Dancr And the additions have been documented in this gist - https://gist.github.com/SnigdhaD/4b3b31bf950d68d9240f The work on the tutorial is still going on and it definitely requires some polishing. We also plan to add more features such as: 1. Improving the css 2. Creating user profile pages 3. Creating an API for a blog feed, showing the most recent blog posts. It will be very helpful to get community feedback on both the tutorial and application code. Please let us know if there are parts of the tutorial which aren't clear and/or can be rephrased better. If you wish to see some other feature being a part of the tutorial, please feel free to let us know. Thank you. Regards, -- Snigdha Dagar Electronics and Communication Engineering IIIT Hyderabad

1 0