diff --git a/Gemfile.lock b/Gemfile.lock index f7747543..b3d34898 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -26,47 +26,47 @@ GEM remote: https://rubygems.org/ specs: Ascii85 (1.1.0) - actioncable (7.0.1) - actionpack (= 7.0.1) - activesupport (= 7.0.1) + actioncable (7.0.4.3) + actionpack (= 7.0.4.3) + activesupport (= 7.0.4.3) nio4r (~> 2.0) websocket-driver (>= 0.6.1) - actionmailbox (7.0.1) - actionpack (= 7.0.1) - activejob (= 7.0.1) - activerecord (= 7.0.1) - activestorage (= 7.0.1) - activesupport (= 7.0.1) + actionmailbox (7.0.4.3) + actionpack (= 7.0.4.3) + activejob (= 7.0.4.3) + activerecord (= 7.0.4.3) + activestorage (= 7.0.4.3) + activesupport (= 7.0.4.3) mail (>= 2.7.1) net-imap net-pop net-smtp - actionmailer (7.0.1) - actionpack (= 7.0.1) - actionview (= 7.0.1) - activejob (= 7.0.1) - activesupport (= 7.0.1) + actionmailer (7.0.4.3) + actionpack (= 7.0.4.3) + actionview (= 7.0.4.3) + activejob (= 7.0.4.3) + activesupport (= 7.0.4.3) mail (~> 2.5, >= 2.5.4) net-imap net-pop net-smtp rails-dom-testing (~> 2.0) - actionpack (7.0.1) - actionview (= 7.0.1) - activesupport (= 7.0.1) + actionpack (7.0.4.3) + actionview (= 7.0.4.3) + activesupport (= 7.0.4.3) rack (~> 2.0, >= 2.2.0) rack-test (>= 0.6.3) rails-dom-testing (~> 2.0) rails-html-sanitizer (~> 1.0, >= 1.2.0) - actiontext (7.0.1) - actionpack (= 7.0.1) - activerecord (= 7.0.1) - activestorage (= 7.0.1) - activesupport (= 7.0.1) + actiontext (7.0.4.3) + actionpack (= 7.0.4.3) + activerecord (= 7.0.4.3) + activestorage (= 7.0.4.3) + activesupport (= 7.0.4.3) globalid (>= 0.6.0) nokogiri (>= 1.8.5) - actionview (7.0.1) - activesupport (= 7.0.1) + actionview (7.0.4.3) + activesupport (= 7.0.4.3) builder (~> 3.1) erubi (~> 1.4) rails-dom-testing (~> 2.0) @@ -76,22 +76,22 @@ GEM activemodel (>= 4.1, < 7.1) case_transform (>= 0.2) jsonapi-renderer (>= 0.1.1.beta1, < 0.3) - activejob (7.0.1) - activesupport (= 7.0.1) + activejob (7.0.4.3) + activesupport (= 7.0.4.3) globalid (>= 0.3.6) - activemodel (7.0.1) - activesupport (= 7.0.1) - activerecord (7.0.1) - activemodel (= 7.0.1) - activesupport (= 7.0.1) - activestorage (7.0.1) - actionpack (= 7.0.1) - activejob (= 7.0.1) - activerecord (= 7.0.1) - activesupport (= 7.0.1) + activemodel (7.0.4.3) + activesupport (= 7.0.4.3) + activerecord (7.0.4.3) + activemodel (= 7.0.4.3) + activesupport (= 7.0.4.3) + activestorage (7.0.4.3) + actionpack (= 7.0.4.3) + activejob (= 7.0.4.3) + activerecord (= 7.0.4.3) + activesupport (= 7.0.4.3) marcel (~> 1.0) mini_mime (>= 1.1.0) - activesupport (7.0.1) + activesupport (7.0.4.3) concurrent-ruby (~> 1.0, >= 1.0.2) i18n (>= 1.6, < 2) minitest (>= 5.1) @@ -182,6 +182,7 @@ GEM activerecord (>= 5.a) database_cleaner-core (~> 2.0.0) database_cleaner-core (2.0.1) + date (3.3.3) delayed_job (4.1.11) activesupport (>= 3.0, < 8.0) delayed_job_active_record (4.1.7) @@ -196,7 +197,6 @@ GEM devise_ichain_authenticatable (0.3.2) devise (>= 2.2) diff-lcs (1.5.0) - digest (3.1.1) docile (1.4.0) domain_name (0.5.20190701) unf (>= 0.0.5, < 1.0.0) @@ -278,7 +278,7 @@ GEM jwt (2.7.0) launchy (2.5.2) addressable (~> 2.8) - leaflet-rails (1.7.0) + leaflet-rails (1.9.3) rails (>= 4.2.0) letter_opener (1.8.1) launchy (>= 2.2, < 3) @@ -327,10 +327,9 @@ GEM multi_json (1.15.0) multi_xml (0.6.0) mysql2 (0.5.5) - net-imap (0.2.3) - digest + net-imap (0.3.4) + date net-protocol - strscan net-pop (0.1.2) net-protocol net-protocol (0.2.1) @@ -416,20 +415,20 @@ GEM rack rack-test (2.1.0) rack (>= 1.3) - rails (7.0.1) - actioncable (= 7.0.1) - actionmailbox (= 7.0.1) - actionmailer (= 7.0.1) - actionpack (= 7.0.1) - actiontext (= 7.0.1) - actionview (= 7.0.1) - activejob (= 7.0.1) - activemodel (= 7.0.1) - activerecord (= 7.0.1) - activestorage (= 7.0.1) - activesupport (= 7.0.1) + rails (7.0.4.3) + actioncable (= 7.0.4.3) + actionmailbox (= 7.0.4.3) + actionmailer (= 7.0.4.3) + actionpack (= 7.0.4.3) + actiontext (= 7.0.4.3) + actionview (= 7.0.4.3) + activejob (= 7.0.4.3) + activemodel (= 7.0.4.3) + activerecord (= 7.0.4.3) + activestorage (= 7.0.4.3) + activesupport (= 7.0.4.3) bundler (>= 1.15.0) - railties (= 7.0.1) + railties (= 7.0.4.3) rails-controller-testing (1.0.5) actionpack (>= 5.0.1.rc1) actionview (>= 5.0.1.rc1) @@ -442,9 +441,9 @@ GEM rails-i18n (7.0.6) i18n (>= 0.7, < 2) railties (>= 6.0.0, < 8) - railties (7.0.1) - actionpack (= 7.0.1) - activesupport (= 7.0.1) + railties (7.0.4.3) + actionpack (= 7.0.4.3) + activesupport (= 7.0.4.3) method_source rake (>= 12.2) thor (~> 1.0) @@ -575,7 +574,6 @@ GEM dante (>= 0.2.0) multi_json (~> 1.0) stripe (> 5, < 6) - strscan (3.0.1) sysexits (1.2.0) temple (0.10.0) thor (1.2.1) diff --git a/config/application.rb b/config/application.rb index 9897473c..1953c529 100644 --- a/config/application.rb +++ b/config/application.rb @@ -35,5 +35,7 @@ module Osem config.generators.system_tests = nil # This is a nightmare with our current data model, no one ever thought about this. config.active_record.belongs_to_required_by_default = false + # https://discuss.rubyonrails.org/t/cve-2022-32224-possible-rce-escalation-bug-with-serialized-columns-in-active-record/81017 + config.active_record.yaml_column_permitted_classes = ['Date', 'DateTime', 'Symbol', 'Time'] end end