From: Michal <lists+rubytalk@...>
Date: 2005-11-27T21:58:47+09:00
Subject: Re: [ANN] Turing 0.0.7 && cry for help

Excerpt from http://turing.rubyforge.org/classes/Turing/CGIHandler.html :

Please note: Using this script verbatim is like having no turing challenge
at all -- any non-braindead attacker will get around it in no time.

M.

On Sun, 27 Nov 2005, zimba-tm wrote:

> I hope your not using
> 
> "cookie" => CGI::Cookie.new({
>              'name' => 'turing_passed',
>              'value' => 'true',
>              'path' => '/',
>              'expires' => Time.now + 3600*24,
>              }),
> 
> to test if the user is authenticated.
> 
> On 27/11/05, Michal <lists+rubytalk@box.cz> wrote:
> > Hi,
> >
> > > You can patch rubygems/builder.rb with
> > > http://rubyforge.org/tracker/index.php?func=detail&aid=2885&group_id=126&atid=577
> >
> > excellent! Thanks!
> >
> > Just released 0.0.9: http://rubyforge.org/frs/shownotes.php?release_id=3633
> >
> > Oh, and I added it to Rakefile so no /usr/lib/ruby/.../rubygems changes
> > are necessary ;)
> >
> > If anyone is interested, the trick is overriding to_yaml method:
> >
> > def spec.to_yaml
> >        out = super
> >        out = '--- ' + out unless out =~ /^---/
> >        out
> > end
> >
> > on Gem::Specification instance :-) God bless Ruby's open classes :-)
> >
> > Rg,
> >          M.
> > --
> > # Michal Safranek, email:
> > a=(("a".."z").to_a+["@","."]);p(("%b"%[0x645bbb83a6a496]
> > ).scan(/...../).map{|x|a[Integer("0b"+x)]}.join.reverse)
> >
> >
> 
> 
> --
> Cheers,
>   zimba
> 
> http://zimba.oree.ch
-- 
# Michal Safranek, email:
a=(("a".."z").to_a+["@","."]);p(("%b"%[0x645bbb83a6a496]
).scan(/...../).map{|x|a[Integer("0b"+x)]}.join.reverse)