Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
These are the building blocks of a page. All the markup is written using the Liquid templating engine. This allows anyone to be able to write templates without the dangers of exposing the whole stack to the template editor.
On top of its own innate elements (title, permalink, etc), each page belongs to a template and through the template, has a set of available content containers. To each container, pieces of content can be added and organized via various "Content Blocks".
A "Content Block" is simply an ActiveRecord model with a Smithy inclusion (include Smithy::ContentBlocks::Model
), a _form_fields
partial (preferably utilizing formtastic) and it's own set of templates, managed within Smithy.
To get started, add this to your Gemfile
gem 'smithycms'
If you need basic authentication and don't want to integrate with existing auth in your system, add this to your Gemfile too: gem 'smithycms-auth'
Installing the CMS is simple, you can just
bundle install
rake smithy:install:migrations
rake smithy_auth:install:migrations # (if you are using smithy-auth)
rake db:migrate
To your routes file, you need to mount Smithy - typically, this would be done at the root
mount Smithy::Engine => "/"
Now start up your server and go to http://localhost:nnnn/smithy
Add this to your routes file (before the mount Smithy::Engine
line). It will redirect smithy/login|logout (the built-in paths) to your existing authentication paths.
scope "/smithy" do
match "/login" => redirect("/your/login/path"), :as => :login
match '/logout' => redirect("/"), :as => :logout
end
Add the following to your application controller:
def smithy_current_user
current_user # use whichever method name you have implemented to return the current_user
end
helper_method :smithy_current_user
If you wish for all of your users to have access to smithy, simply add this method to your user model:
def smithy_admin?
true
end
Alternatively, you can add a boolean field (via migration) named smithy_admin
to your users table and manage the field with with your existing user management.
Restart your local server and you should be good to go.
In version 0.6, Smithy switched it's asset engine from Dragonfly to Refile. Your assets should automatically be migrated to Refile, but if you have any direct links to assets in your content, the migration will warn you that they need to be changed. Refile doesn't store images the same way, so it isn't possible to link directly to them.
Pay close attention to the database migration. If any warnings come up, make sure you follow the instructions to fix them.
There are two different errors that might occur:
[WARNING] Asset Not Found in S3
[WARNING] Direct Link found in the page
Create your first Template, naming it whatever you want ("Home" or "Default" or something equally original). In the content, add {{ page.container.main_content }}
. In the background, this will auto-create a container that will be used by any page using your template. You can name your container whatever you would like: {{ page.container.foo }}
works as well. After you have created new page containers, they will automatically show up on the Page edit screen and allow you to add content to the container.
If you want, you can create Includes. For instance, if you create an Include named "header", you can utilize it in your Template via {% include 'header' %}
.
Note, you can also create stylesheet and javascript files, included in your templates via smithy_stylesheet_link_tag and smithy_javascript_include_tag. javascript_include_tag calls out directly to ActionView so you can also access files from your host application directly. Eg. {% smithy_javascript_include_tag 'my_special_javascript' %}
Follow the "Manage Content" link in the header and create your first page. Add a Title ("Home" for instance), select your Template and save the page. The page will save and you will be on the Edit screen for your new page. You can see that your "Main Content" container is now available.
Smithy comes with some useful Content Blocks already created, though you may need to add them to your system: Content, Image, PageList. After adding a Content Block, you must also create at least one template for it before you can use it on a page. Once you have added a template, you can utilize that Content Block in any available Page container.
While Smithy has some default Content Blocks, you will often want to add your own structured content, allowing you to manage templates for more structured content. To add a custom Content Block, do the following:
include Smithy::ContentBlocks::Model
to the top of your model. This gives some extra functionality for Smithy.Your _form_fields.html.erb file could look something like this:
<%= f.inputs "Client Story" do %>
<%= f.input :client_name %>
<%= f.input :project_name %>
<%= f.input :content, :as => :text, :input_html => { :class => "span12" } %>
<% end %>
If you want to customize which columns are available to your liquid template, you can add a #to_liquid method to your model. Eg.:
def to_liquid
{
'id' => self.id,
'client_name' => self.client_name,
'project_name' => self.project_name,
'content' => self.content,
'story_images' => self.images.map(&:to_liquid),
'formatted_content' => self.formatted_content
}
end
Using the above #to_liquid method, your template could look like this:
<article class="client_story" id="client_story-{{ id }}">
<div class="content">
<h3>{{ client_name }}</h3>
{% unless project_name == blank %}<h4>{{ project_name }}</h4>{% endunless %}
{{ formatted_content }}
</div>
<div class="images">
<div class="cycle-slideshow">
{% for story_image in story_images %}
<img src="{{ story_image.thumbnail.url }}" alt="">
{% endfor %}
</div>
</div>
</article>
If you want to be able to represent your ContentBlock uniquely in different contexts, you can simply create more templates and choose which template to use in each context.
FAQs
Unknown package
We found that smithycms demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.