Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
decidim-lausanne-budgets
Advanced tools
This repository create a new participatory component, cloned from participatory budgets. It is done on decidim version 0.24.3 exclusively for now.
From the original budget component, the following features are not implemented:
minimu_project
vote flow only. The others rules are un-tested and highly volatileThis repository was done for the very specific use case of Lausanne City, you probably won't find any usage of this module.
The data-protection law in Switzerland is clear: save the minimal data for a limited amount of time.
As at Lausanne we see PB have somehow lower participation rates, we decide to experiment around public access. We go through a another strategy than Authorization in order to:
Add this line to your application's Gemfile:
gem "decidim-lausanne-budgets", git: "https://github.com/octree-gva/decidim-lausanne-budgets"
Then execute:
bundle
bundle exec rails decidim_lausanne_budgets:install:migrations
bundle exec rails db:migrate
The Rakefile is shipped with a
test_app
using docker-compose
to run a database.
If you haven't done it already, install docker](https://docs.docker.com/get-docker/).
bundle exec rake test_app
For decidim version 0.27, use Gemfile.0.27. For version 0.26, use Gemfile.0.26
cp Gemfile.0.27 Gemfile
First, you need to run an empty database with a decidim dev container which runs nothing.
docker-compose down -v --remove-orphans
docker-compose up -d
Once created, you access the decidim container
# Get the id of the decidim dev container
docker ps --format {{.ID}} --filter=label=org.label-schema.name=decidim
# 841ae977c7da
docker exec -it 841ae977c7da bash
You are now in bash, run manually. This will check your environment and do migrations if needed
bundle exec rake decidim_lausanne_budgets:install:migrations
docker-entrypoint
You are now ready to use your container in the way you want for development:
bundle exec rails db:seed
bin/webpack-dev-server
bundle exec rails g migration AddSomeColumn
bundle exec rails s -b 0.0.0.0
To stop everything, uses:
docker-compose down
to stop the containersdocker-compose down -v
to stop the containers and remove all previously saved data.To debug something on the container:
decidim-app
is runningdocker ps --all
# CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
# 0517244cbdde decidim-module-lausanne_budgets-decidim-app "sleep infinity" 20 hours ago Up 20 hours 0.0.0.0:3000->3000/tcp, :::3000->3000/tcp, 0.0.0.0:3035->3035/tcp, :::3035->3035/tcp decidim-lausanne-budgets-app
# 5399fc0c0866 postgres:14-alpine "docker-entrypoint.s…" 20 hours ago Up 20 hours (healthy) 0.0.0.0:5432->5432/tcp, :::5432->5432/tcp decidim-module-lausanne_budgets-pg-1
docker exec -it 0517244cbdde bash
tail -f $ROOT/log/development.log
to access logsbundle exec rails restart
to restart rails server AND keeps webpacker runningcd $ROOT
to access the development_app
cd $ROOT/../decidim_module_lausanne_budgets
to access the module directoryThis repository is not yet ready for contributions.
This engine is distributed under the GNU AFFERO GENERAL PUBLIC LICENSE.
FAQs
Unknown package
We found that decidim-lausanne-budgets demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.