Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
larsklevan_s3_swf_upload
Advanced tools
h1. S3SwfUpload Gem For Rails 3
S3SwfUpload allows user to upload a file to S3 directly, so you can save the cost of uploading process in your app server.
The flex application in this fork was completely re-written so that there are no flash or flex UI components. The one exception to that is the browse button, which, for security purposes MUST be flash. But even then, you get to pass the URLs for images to use for that button!
The goal of this re-write is to put the power to customize this powerful took back in the hands of non-flex-savvy developers. The look and feel is controlled by CSS, and any behavior is controlled by JavaScript. Flex only handles the file management portion. A nice result of this is that the flash file is only 46 kb, down from 288 kb. If you see any way that this can be done better, please don't hesitate to let me know!
h2. Example
!http://static.nathancolgate.com/images/s3_swf_uploader_screenshot.png!
Watch a video of an example app being built using the gem on "Vimeo":http://vimeo.com/11363680
There is also a demo app running on heroku at "http://s3swfuploader.heroku.com/":http://s3swfuploader.heroku.com/
h2. Usage
Gemfile
and add this as a gemgem 's3_swf_upload', :git => 'git://github.com/nathancolgate/s3-swf-upload-plugin'
$ bundle install
$ rails generate s3_swf_upload:uploader
If you are using Rails 3.1, you will need to move the generated s3_upload.js from the public/javascripts directory to the app/assets/javascripts directory.
Configure your amazon parameters via the generated config/amazon_s3.yml
file.
Make the bucket
There used to be a rake task for this, but it was removed so that there would be no dependency of aws/s3.
There used to be a rake task for this, but it was removed so that there would be no dependency of aws/s3.
Make sure the file is in the root and is publicly readable.
app/controller/s3_uploads_controller.rb
In my tests in Rails 3, the application was able to correctly handle the requests from the flash object.
This means that your authentication systems can still be used to protect the signature generation.
<%=raw s3_swf_upload_tag %>
startUploading
function. For example:
However, you will have no feedback or interface to let you know that anything is actually happening.
And the "CSS":http://gist.github.com/383118 to go along.
h2. File Renaming
In my applications I upload all files to tmp folder and then have rails manipulate the file (renaming, resizing, etc). Here's a starting point to give you an idea of what that looks like using Paperclip:
"How to integrate with Paperclip":http://gist.github.com/575842
I prefer this solution because it allows the application to keep tabs on the files. However, if you are looking for a pure javascript solution, check out some of the forks of this project.
h2. General Parameters
h3. :buttonWidth (integer = 100)
h3. :buttonHeight (integer = 30)
h3. :flashVersion (string = '9.0.0')
h3. :queueSizeLimit (integer = 100)
Maximum number of files that can be added to the queue.
h3. :fileSizeLimit (integer = 524288000)
Individual file size limit in bytes (default is 512 MB)
h3. :fileTypes (string = '.')
Something like this also works: '.jpg;.gif;*.png;'
h3. :fileTypeDescs (string = 'All Files')
Something like this also works: 'Image files.'
h3. :selectMultipleFiles (boolean = true)
Set this to false if you only want to allow users to pick one file at a time.
h3. :keyPrefix (string = '')
String to be prepended to the uploaded file name to make the Amazon S3 key (location in bucket).
h3. :signaturePath (string = '/s3_uploads.xml')
Fully qualified path to the controller and action that will serve up the Amazon S3 signature
h3. :swfFilePath (string = '/flash/s3_upload.swf')
Fully qualified path to the SWF file (this is the one that does all the work).
h3. :buttonUpPath (string = '/flash/s3_up_button.gif')
Fully qualified path to an image to be used as the Browse Button (in the up state). Image should have same dimensions as the buttonWidth and buttonHeight parameters.
h3. :buttonOverPath (string = '/flash/s3_over_button.gif')
Fully qualified path to an image to be used as the Browse Button (in the over state). Image should have same dimensions as the buttonWidth and buttonHeight parameters.
h3. :buttonDownPath (string = '/flash/s3_down_button.gif')
Fully qualified path to an image to be used as the Browse Button (in the down state). Image should have same dimensions as the buttonWidth and buttonHeight parameters.
h2. Callback Parameters
The real power of this refactoring is that the flex application makes all of the following calls to JavaScript. What you do with the calls is totally up to you:
h2. JavaScript Functions
The following functions can be called on the generated object. Normally the call looks something like this:
s3_swf_1_object.startUploading();
h3. startUploading
Starts the uploading process
h3. stopUploading
Stops the uploading process. Note: Stopping and restarting the uploading process is buggy. I'd avoid it.
h3. clearQueue
Clears all files out of the queue.
h3. removeFileFromQueue(integer)
Removes a specific file from the queue.
h2. Will it work with < Rails 3?
You bet. The Rails 3 specific gem only makes installation and setup easier. Here are some tips for getting this to work with < Rails 3:
script/plugin install git://github.com/nathancolgate/s3-swf-upload-plugin.git
/lib
directory.
require 'view_helpers'
require 'patch/integer'
* load the config file by adding this to the bottom of your environment.rb file: S3SwfUpload::S3Config.load_config
* replace references to Rails.root or Rails.env in the /vendor/plugins/s3-swf-upload-plugin/lib/s3_swf_upload/s3_config.rb
file.
* comment out the require railties inside /vendor/plugins/s3-swf-upload-plugin/lib/s3_swf_upload.rb
* you may need to require 's3_swf_upload' and 'aws/s3' in your environment.rb file
* your route will be map.resources instead of resources.
h2. Known Issues
bq. "With Adobe Flash Player 10, the FileReference.browse
and FileReference.download
operations may be initiated only through ActionScript that originates from user interaction." - "Adobe TechNote":http://kb2.adobe.com/cps/405/kb405546.html
The next best thing I could come up with was to pass images in as buttons.
-If the startUploading
call is made after calling stopUploading
, only the first file in the queue is successfully uploaded.-
h2. Kudos
Original plugin is Copyright (c) 2008 elctech, released under the MIT license
Updates to plugin for multiple file uploader are Copyright (c) 2010 PRX, released under the MIT license
Conversion of plugin to gem for rails 3 is Copyright (c) 2010 Nathan Colgate Clark, released under the MIT license
Stripping the flex application of UI and adding callbacks Copyright (c) 2010 Nathan Colgate Clark, released under the MIT license
Thanks to yickster (Nick Merwin) for fixing the stopUploading issue
FAQs
Unknown package
We found that larsklevan_s3_swf_upload demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.