Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Seamess is an extremely opinionated CMS framework.
(To be more clear, I am opinionated. It is just an inert pile of code. But the effect is the same.)
Seamess is a Rails 5.1-based engine that can be used with any other Rack app.
It also uses:
And when I say it's opinionated, I mean that I won't entertain requests to change any of the above.
It's also opinionated because it believes and enforces the following:
my-page/
and my-page/sub-page/
.Install the gem into your Rack application by adding to Gemfile
:
gem 'seamess'
Don't forget to bundle
.
Mount the engine in your config/routes.rb
:
Rails.application.routes.draw do
mount Seamess::Engine, at: "/my-path"
root to: "some_controller#some_action"
end
If you're going to serve the application at the root of your site, change that to this:
Rails.application.routes.draw do
mount Seamess::Engine, at: "/"
root to: Seamess::Engine
end
Add to db/seeds.rb
:
Seamess::Engine.load_seed
Then run rake seamess:install:migrations db:migrate db:seed
.
Seamess defines base stylesheets but expects that you will override them. So you have to actually create your own, and use sass imports to bring the Seamess sheets into your site. This gives you the bonus of being able to override any variables we define.
Create the app/assets/stylesheets/partials
directory and create app/assets/stylesheets/partials/variables.sass
within it.
Create app/assets/stylesheets/application.(scss|sass)
and add to it:
@import "partials/variables"
@import "seamess/seamess"
Create app/assets/stylesheets/manager.(scss|sass)
and add to it:
@import "partials/variables"
@import "seamess/manager"
Create app/views/layouts/application.html.haml
and add the following content:
= extends :'layouts/seamess/application'
Seamess also ships with a few layouts:
seamess/application
: The base template. Gives you the basics. You should probably not use this layout, but extend it on your own.
seamess/columnar
: A basic template that can be used for a 12-column reduced-width grid layout. You'd use this on most pages, unless you want a full-width layout. Note that this layout extends from application
, not seamess/application
.
seamess/fluid
: Another basic template that uses Bootstrap's .container-fluid
styling for a full-width responsive display. This also extends from application
, not seamess/application
.
seamess/pages
: A template which extends seamess/columnar
. I use it to display full-width pages, which look a little bulky when they are the full 12 columns. So this template provides a simple wrapper to further shrink down columnar content.
seamess/manager
: A template which is used for the manager. This extends from seamess/fluid
. In general, you probably don't want to mess around with this one.
Seamess makes great use out of the nestive
gem for parent/child layouts, and for denoting overridable content chunks. If you override a template that has a slash in it, you must prepend layout/
, or the layout won't be found.
Nestive does let us do some pretty amazing things. For example, the default brand in Seamess is just controlled by ENV['SITE_TITLE']
. But say we want to replace that with something interesting. The layout inheritance lets us do something like the following:
-# app/views/layouts/application.html.haml
= extends :'layouts/seamess/application' do
= replace :nav_brand do
= link_to seamess.root_url, class: "navbar-brand" do
%span.something-funky MyBrand
-# You need to have 'yield' here or else body content will be missing.
= yield
Since all of Seamess's layouts inherit from the main app's application
layout (excepting application
), this will be present on all of the site's pages.
You must have at very least a user class in your home application. It's
recommended that you also have an Admin
class. Be sure to set these in an
initializer:
Seamess.admin_class = "Admin"
Seamess also makes the assumption that the following methods will be available to it within both controllers and views:
authenticate_admin!
current_admin
admin_signed_in?
And looks for the following route:
main_app.destroy_admin_session_path [DELETE]
You should make sure these are defined in your ApplicationHelper and set as view
helpers if they aren't already done so for you. (Coincidentally, if you're using
Devise in your host app with an Admin
class, this is done for you! How easy.)
Be sure to set config.router_name = :main_app
in your
config/initializers/devise.rb
if you choose Devise for your users.
It's still private. Just ping me.
The gem is available as open source under the terms of the MIT License.
FAQs
Unknown package
We found that seamess demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.