Kolodvor » plugin http://www.kolodvor.net ruby, rails, javascript, jquery, ... Mon, 16 Jan 2012 15:24:32 +0000 en hourly 1 http://wordpress.org/?v=3.3.1 MarkItUp: Rails plugin that turns any textarea into a markup editor http://www.kolodvor.net/2010/07/05/markitup-rails-plugin-that-turns-any-textarea-into-a-markup-editor/?utm_source=rss&utm_medium=rss&utm_campaign=markitup-rails-plugin-that-turns-any-textarea-into-a-markup-editor http://www.kolodvor.net/2010/07/05/markitup-rails-plugin-that-turns-any-textarea-into-a-markup-editor/#comments Mon, 05 Jul 2010 16:14:09 +0000 vlado http://www.kolodvor.net/?p=254 Continue reading →]]> I recently published a plugin that helps you turn any textarea into a markup editor. It is based on excellent markItUp! jQuery plugin.

Example

The most simple usage with preset defaults

<html>
<head>
  <%= javascript_include_tag "path/to/jquery" %>
  <%= mark_it_up '#miu_test' %>
</head>
<body>
  <%= form_tag do %>
    <%= text_area_tag "miu_test" %>
  <% end %>
</body>
</html>

You can see a lot more cool examples in action on markitup.cingel.hr.

More info

markitup.cingel.hr
github.com/cingel/mark_it_up

]]> http://www.kolodvor.net/2010/07/05/markitup-rails-plugin-that-turns-any-textarea-into-a-markup-editor/feed/ 8 Rails, CSRF and Ajax requests http://www.kolodvor.net/2010/01/02/rails-csrf-and-ajax-requests/?utm_source=rss&utm_medium=rss&utm_campaign=rails-csrf-and-ajax-requests http://www.kolodvor.net/2010/01/02/rails-csrf-and-ajax-requests/#comments Sat, 02 Jan 2010 00:36:03 +0000 vlado http://kolodvor.net/?p=64 Continue reading →]]> Rails protects controller actions from CSRF (Cross-Site Request Forgery) attacks with a token based on a random string stored in the session. The token parameter is named authenticity_token by default and will be embedded in all forms and Ajax requests generated by Rails.

You should also add this token to all Ajax request that you hand coded. As suggested in Rails documentation you can add this line in head section.

  <%= javascript_tag "window._token = '#{form_authenticity_token}'" %>;

and then add authenticity_token to parameters option of Ajax requests

  new Ajax.Request('/some/url', {
    parameters: "foo=bar&authenticity_token="+_token
  });

Remote forgery protection plugin

This can get tedious if you have a lot of Ajax requests so I wrote a simple plugin that adds authenticity token to all Ajax requests automatically.

You can install it with

  script/plugin install git://github.com/vlado/remote_forgery_protection.git

Now all you have to do is add this line inside head section of you’re layout

  <%= remote_forgery_protection %>

and all non GET Ajax request will have authenticity_token parameter automatically included.

Magic is done by wrapping Ajax.Base using Function#wrap method so this will work only if you are using Prototype.
I plan to add support for other libraries (if there is interest) in the future so keep in touch.

Remote forgery protection currently supports Prototype, jQuery and ExtJS. Let me know if you would like to see it working with some other library

Plugin page: http://github.com/vlado/remote_forgery_protection

More info:
api.rubyonrails.org/classes/ActionController/RequestForgeryProtection/ClassMethods.html
isc.sans.org/diary.html?storyid=1750
en.wikipedia.org/wiki/Cross-site_request_forgery
opensoul.org/2008/10/24/ajax-and-request-forgery-protection

]]> http://www.kolodvor.net/2010/01/02/rails-csrf-and-ajax-requests/feed/ 2