From ab81dd667b5a4de30c8f209c874d40e5863c25a5 Mon Sep 17 00:00:00 2001
From: Henne Vogelsang <hvogel@opensuse.org>
Date: Tue, 11 Apr 2023 12:55:30 +0200
Subject: [PATCH 1/2] Stop pinning nokogiri for security updates...

The bundle does this already.
---
 Gemfile      | 6 +-----
 Gemfile.lock | 1 -
 2 files changed, 1 insertion(+), 6 deletions(-)

diff --git a/Gemfile b/Gemfile
index 3c7da75d..b19b52f7 100644
--- a/Gemfile
+++ b/Gemfile
@@ -221,14 +221,10 @@ gem 'selectize-rails'
 # For collecting performance data
 gem 'skylight'
 
-# Nokogiri < 1.8.1 is subject to:
-# CVE-2017-0663, CVE-2017-7375, CVE-2017-7376, CVE-2017-9047, CVE-2017-9048,
-# CVE-2017-9049, CVE-2017-9050
-gem 'nokogiri', '>= 1.8.1'
-
 # memcached binary connector
 gem 'dalli'
 
+# to generate ical files
 gem 'icalendar'
 
 group :development do
diff --git a/Gemfile.lock b/Gemfile.lock
index 2fb68c07..5cb15e25 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -683,7 +683,6 @@ DEPENDENCIES
   money-rails
   mysql2
   next_rails
-  nokogiri (>= 1.8.1)
   omniauth
   omniauth-facebook
   omniauth-github

From 21ce273520a9a114be0116e04d5bb2622ac2294b Mon Sep 17 00:00:00 2001
From: Henne Vogelsang <hvogel@opensuse.org>
Date: Tue, 11 Apr 2023 12:56:17 +0200
Subject: [PATCH 2/2] Introduces lograge

for more terse logging
---
 Gemfile                           |  3 +++
 Gemfile.lock                      |  6 ++++++
 config/environments/production.rb | 16 ++++++++++++++++
 3 files changed, 25 insertions(+)

diff --git a/Gemfile b/Gemfile
index b19b52f7..301ff1a6 100644
--- a/Gemfile
+++ b/Gemfile
@@ -227,6 +227,9 @@ gem 'dalli'
 # to generate ical files
 gem 'icalendar'
 
+# to tame logs
+gem 'lograge'
+
 group :development do
   # for static code analisys
   gem 'rubocop', require: false
diff --git a/Gemfile.lock b/Gemfile.lock
index 5cb15e25..ead493fa 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -300,6 +300,11 @@ GEM
       letter_opener (~> 1.7)
       railties (>= 5.2)
       rexml
+    lograge (0.12.0)
+      actionpack (>= 4)
+      activesupport (>= 4)
+      railties (>= 4)
+      request_store (~> 1.0)
     loofah (2.19.1)
       crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
@@ -677,6 +682,7 @@ DEPENDENCIES
   leaflet-rails
   letter_opener
   letter_opener_web
+  lograge
   matrix (~> 0.4)
   mina
   mini_magick
diff --git a/config/environments/production.rb b/config/environments/production.rb
index a301acc8..5671c653 100644
--- a/config/environments/production.rb
+++ b/config/environments/production.rb
@@ -67,6 +67,22 @@ Rails.application.configure do
   # require "syslog/logger"
   # config.logger = ActiveSupport::TaggedLogging.new(Syslog::Logger.new "app-name")
 
+  # Enable lograge
+  config.lograge.enabled = true
+  config.lograge.custom_payload do |controller|
+    # exceptions = ['controller', 'action', 'format', 'id']
+    {
+      # params: event.payload[:params].except(*exceptions),
+      user: controller.current_user.try(:username)
+    }
+  end
+  config.lograge.custom_options = lambda do |event|
+    exceptions = %w[controller action format id _method authenticity_token]
+    {
+      params: event.payload[:params].except(*exceptions)
+    }
+  end
+
   if ENV['RAILS_LOG_TO_STDOUT'].present?
     logger           = ActiveSupport::Logger.new(STDOUT)
     logger.formatter = config.log_formatter