fix security issue

[selectricity-live] / config / environment.rb

diff --git a/config/environment.rb b/config/environment.rb
index 571638d14a3fc1a0ccefbce34442f8cbc1fa8fc0..802b3b90d85257e47ee9a7c81330cccc88efe41c 100644 (file)
--- a/config/environment.rb
+++ b/config/environment.rb
@@ -5,7 +5,7 @@
 # ENV['RAILS_ENV'] ||= 'production'
 
 # Specifies gem version of Rails to use when vendor/rails is not present
-RAILS_GEM_VERSION = '1.2.3' unless defined? RAILS_GEM_VERSION
+RAILS_GEM_VERSION = '2.2.2' unless defined? RAILS_GEM_VERSION
 
 # Bootstrap the Rails environment, frameworks, and default configuration
 require File.join(File.dirname(__FILE__), 'boot')
@@ -28,7 +28,7 @@ Rails::Initializer.run do |config|
 
   # Use the database for sessions instead of the file system
   # (create the session table with 'rake db:sessions:create')
-  # config.action_controller.session_store = :active_record_store
+  config.action_controller.session_store = :active_record_store
 
   # Use SQL instead of Active Record's schema dumper when creating the test database.
   # This is necessary if your schema can't be completely dumped by the schema dumper, 
@@ -59,15 +59,17 @@ end
 
 # Include your application configuration below
 
-MAIL_CONFIG = { :from => 'Selectricity <info@selectricity.media.mit.edu>'} 
+MAIL_CONFIG = { :from => 'Selectricity <team@selectricity.org>'} 
 
 require 'uniq_token'
-require 'randarray'
-require 'gruff'
+require 'gruff-0.2.8/lib/gruff'
 require 'sparklines'
-
 require 'rubyvote'
-ELECTION_TYPES = %w(ssd plurality approval condorcet borda)
+ELECTION_TYPES = {'ssd' => "Schulze Method",
+                  'plurality' => "Plurality",
+                  'approval' => "Approval",
+                  'condorcet' => "Condorcet",
+                  'borda' => "Borda Count"}
 
 class String
   # alternate capitalization method that does not lowercase the rest of
@@ -87,6 +89,10 @@ class String
   end
 end
 
+#Change the session store key, so that it will not conflict with other webapps
+ActionController::Base.session_options[:session_key] = 'selectricity_session_id'
+CGI::Session.expire_after 1.year
+
 # action mailer configuration
 ActionMailer::Base.delivery_method = :sendmail
 ActionMailer::Base.default_charset = "utf-8"
@@ -141,3 +147,8 @@ GeoKit::Geocoders::geocoder_ca = false
 # various geocoders.  Make sure you read up on relevant Terms of Use for each
 # geocoder you are going to use.
 GeoKit::Geocoders::provider_order = [:google,:us]
+
+# fix major security vulnerability: 
+# https://groups.google.com/forum/#!topic/rubyonrails-security/61bkgvnSGTQ/discussion
+ActionController::Base.param_parsers.delete(Mime::XML)
+