Luke's Danebook

# Highlights a potential bug where a nested resour

@@ -0,0 +1,22 @@
+# Highlights a potential bug where a nested resource could have the same ID as the current user causing the logical expression `params[:id] == current_user.id.to_s` to be true and not redirecting when it should
+
+# user/:user_id/posts/:id/
+# user_id == 1
+# post.id == 1
+
+
+# HAS BUG
+def require_current_user
+  unless params[:id] == current_user.id.to_s || params[:user_id] == current_user.id.to_s
+    # redirect here
+  end
+end
+
+
+# Fixes bug
+def require_current_user
+  user_id_key = controller_name == 'users' ? :id : :user_id
+  unless params[user_id_key] == current_user.id.to_s
+    # 
+  end
+end

.gitignore

@@ -0,0 +1,20 @@
+# See https://help.github.com/articles/ignoring-files for more about ignoring files.
+#
+# If you find yourself ignoring temporary files generated by your text editor
+# or operating system, you probably want to add a global ignore instead:
+#   git config --global core.excludesfile '~/.gitignore_global'
+
+# Ignore bundler config.
+/.bundle
+
+# Ignore all logfiles and tempfiles.
+/log/*
+/tmp/*
+!/log/.keep
+!/tmp/.keep
+
+# Ignore Byebug command history file.
+.byebug_history
+
+# Ignore application configuration
+/config/application.yml

.rspec

@@ -0,0 +1,3 @@
+--color
+--require spec_helper
+--format documentation

Gemfile

@@ -0,0 +1,79 @@
+source 'https://rubygems.org'
+ruby '2.3.0'
+
+gem 'bootstrap-sass'
+
+gem 'binding_of_caller'
+
+# Bundle edge Rails instead: gem 'rails', github: 'rails/rails'
+gem 'rails', '~> 5.0.0', '>= 5.0.0.1'
+# Use postgresql as the database for Active Record
+gem 'pg', '~> 0.18'
+# Use Puma as the app server
+gem 'puma', '~> 3.0'
+# Use SCSS for stylesheets
+gem 'sass-rails', '~> 5.0'
+# Use Uglifier as compressor for JavaScript assets
+gem 'uglifier', '>= 1.3.0'
+# Use CoffeeScript for .coffee assets and views
+gem 'coffee-rails', '~> 4.2'
+# See https://github.com/rails/execjs#readme for more supported runtimes
+# gem 'therubyracer', platforms: :ruby
+
+# Use jquery as the JavaScript library
+gem 'jquery-rails'
+
+# Build JSON APIs with ease. Read more: https://github.com/rails/jbuilder
+gem 'jbuilder', '~> 2.5'
+# Use Redis adapter to run Action Cable in production
+# gem 'redis', '~> 3.0'
+# Use ActiveModel has_secure_password
+gem 'bcrypt', '~> 3.1.7'
+
+gem 'paperclip'
+
+gem 'aws-sdk'
+
+gem 'figaro'
+
+gem 'delayed_job_active_record'
+
+gem 'faker'
+
+# Use Capistrano for deployment
+# gem 'capistrano-rails', group: :development
+
+group :development, :test do
+  # Call 'byebug' anywhere in the code to stop execution and get a debugger console
+  gem 'byebug', platform: :mri
+  gem 'jazz_fingers'
+  gem 'rspec-rails'
+  gem 'factory_girl_rails', '~> 4.0'
+  gem 'shoulda-matchers'
+end
+
+group :development do
+  # Access an IRB console on exception pages or by using <%= console %> anywhere in the code.
+  gem 'web-console'
+  gem 'listen', '~> 3.0.5'
+  # Spring speeds up development by keeping your application running in the background. Read more: https://github.com/rails/spring
+  gem 'spring'
+  gem 'spring-watcher-listen', '~> 2.0.0'
+  gem 'better_errors'
+  gem 'guard-rspec'
+  gem 'letter_opener'
+end
+
+group 'test' do
+  gem 'capybara'
+  gem 'launchy'
+end
+
+group :production do 
+
+  gem 'rails_12factor'
+
+end
+
+# Windows does not include zoneinfo files, so bundle the tzinfo-data gem
+gem 'tzinfo-data', platforms: [:mingw, :mswin, :x64_mingw, :jruby]