We are deprecating webapp based signup. It leads to an inconsistent state for mail providers and offers no useful interactions for vpn providers either. Instead of trying to deal with the halve way signup through the webapp we require signup through bitmask app which can also create the pgp keys for email and download and use the cert for vpn. In addition this reduces the attack surface for js injection, phishing and other browser based attacks. For now we still keep the signup form in case providers link to it directly. We also keep all the tests based on it. Cleanup will happen right after 0.10.0 release.
We now use the hash of the token for comparison and as the id. In order to use it you need the original token though. So forms and thus the session should have token.to_s rather than token.id.
* reran the simple form initializer. * wrapped submit buttons are now broken and need a fix. * disabled confirmation validation in client side validations as the error message always is attached to the wrong field.
our special error handler for json requests would turn all exceptions into 500s - removed it. now the rescue_responses can do their thing again.
enable testing error responses on the full rack stack.
That's the only thing the controller handles meaningful. Before the route would also catch anything that started with a . interpreting it as a format string. This lead to lots of false positives in our security scanner.
Related with https://github.com/pixelated/pixelated-user-agent/issues/924 With @aarni
If you inherit respond to and call it again in your controller it will not overwrite the previous but add to it. Since we always have some exceptions from the rules it's probably easiest to be explicit in the controllers that require it themselves.