
Security News
Follow-up and Clarification on Recent Malicious Ruby Gems Campaign
A clarification on our recent research investigating 60 malicious Ruby gems.
= reflex
Reflex is a gem that allows you to connect your application to the React Social API.
== Install / Usage
=== 1. Install Authlogic and setup your application
Install authlogic (http://github.com/binarylogic/authlogic) in your rails application, and set it up according to the authlogic docs (http://rdoc.info/projects/binarylogic/authlogic).
Take a look at the authlogic example app (http://github.com/binarylogic/authlogic_example), or use it as a basis, if you get stuck.
=== 2. Install Reflex
Add the gem dependencies in your config:
==== Rails 2.3
Add the dependencies to your environment:
config.gem "reflex"
And install them:
$ rake gems:install
==== Rails 3.0 (untested)
Add the dependencies to your Gemfile
gem "reflex"
And install them:
$ bundle install
=== 3. Generate the reflex_connections migration
Now that we have the reflex gem installed, we need to generate a migration that connects our users to a reflex provider:
==== Rails 2.3
$ script/generate reflex_connections_migration
==== Rails 3.0 (untested)
$ rails generate reflex_connections_migration
=== 4. Configure the reflex gem
Create a reflex configuration file:
development: &DEFAULTS key: development_key secret: development_secret endpoint: http://social.react.com/XmlRpc_v2/
production: << DEFAULTS key: production_key secret: production_secret
=== 5. Make sure you save your objects properly
Save your session objects with a block. Why? Because we need to redirect the user to their login provider so that they can authenticate. When we do this, we don't want to execute that block of code, because if we do, we will get a DoubleRender error. Using a block allows us to skip that entire block and send the user along their way if they choose to authenticate via React's OAuth Server.
You probably want to do this in your controllers. It should look something like this:
def create @user_session.save do |result| if result flash[:notice] = "Login successful!" redirect_back_or_default account_url else render :action => :new end end end
When creating new users, react_profile is set if available. In order to make use of this, alter your user class like this:
class User < ActiveRecord::Base acts_as_authentic
def react_profile=(profile)
self.name = profile['real_name'] || profile['user_name']
end
end
=== 6. Add providers to your login form
Add providers to your login form:
<%= f.label :login %>
<%= f.text_field :login %>
<%= f.label :password %>
<%= f.password_field :password %>
<%= f.submit "Login" %>
<h2>Or log in via:</h2>
<% Reflex::OAuthServer.get_providers.each do |provider| %>
<%= f.submit provider, :name => "react_provider" %>
<br>
<% end %>
<% end %>
== Connecting existing users to react
Ofcourse connecting an existing user to a social network should be as easy and straightforward as authenticating a new user. And luckilly it is!
Modify your user update method to accept a block:
def update @user = User.find(params[:id]) @user.attributes = params[:attributes]
@user.save do |result|
if result
flash[:notice] = "User updated successfully!"
redirect_to(@user)
else
render :action => :edit
end
end
end
And add the react providers in the view:
<% form_for(@user) do |f| %> <%= f.error_messages %>
Connect to a provider:
<% Reflex::OAuthServer.get_providers.each do |provider| %>
<%= f.submit provider, :name => "react_provider" %>
<% end %>
<p><%= f.submit "Save" %></p>
<% end %>
== Roadmap
The reflex gem is far from finished. Here are some of the upcoming features:
Easily access the React API — If a user connected to, for example twitter,
then it should be a matter of calling:
@user.twitter.update_status("I've connected my Twitter profile")
Better support for connecting a previously connected user
== Note on Patches/Pull Requests
== Copyright
Copyright (c) 2010 Tom-Eric Gerritsen. See LICENSE for details.
FAQs
Unknown package
We found that reflex demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A clarification on our recent research investigating 60 malicious Ruby gems.
Security News
ESLint now supports parallel linting with a new --concurrency flag, delivering major speed gains and closing a 10-year-old feature request.
Research
/Security News
A malicious Go module posing as an SSH brute forcer exfiltrates stolen credentials to a Telegram bot controlled by a Russian-speaking threat actor.