On Thu, Feb 14, 2013 at 03:47:13PM -0500, Matt Wagner wrote:

On Thu, Feb 14, 2013 at 10:44:49AM -0500, John Eckersberg wrote:

...

We're still running on the 3.2.12-ish stack that I put in after the first round of security holes came through. There's been several more rounds and probably more to come, so we need to keep pulling in updates. I just took a brief stab at updating to 3.2.12 proper, and a bunch of tests exploded as usual. I don't have time at the moment to bang on it myself, so if anybody wants to jump on it, you can be a hero.

So it looks like a continuation of https://github.com/rails/rails/pull/8895#issuecomment-12156101

It turns out that 3.2.12 was a security-only release, so it was just 3.2.11 plus the CVE fixes -- keeping this HABTM bug that was in 3.2.11. (See https://github.com/plataformatec/simple_form/issues/735#issuecomment-1344867... )

I'll poke around and see if we can just advance the commit we're using now, to include the security fixes.

So, partial progress.

I updated the Gemfile, to move the ref from 63970dc7db273551f977483109dde936c8a7554f to de83b017a90e9fe68da1359a97ac5b58b7c0f3fe which is presently the head of the 3-2-stable branch. (That way we get the security fixes in 3.2.12, but also keep the revert commit for the habtm crap.)

This solved the mass-failures from the HABTM stuff above, but left a small number of failing tests, as I identify here: https://gist.github.com/n1zyy/4957377

I've dug into a few, and keep coming back to this exception:

undefined local variable or method `through_scope' for #ActiveRecord::Associations::Preloader::HasManyThrough:0x000000082b9e10

I need to dig a little further to see where this is coming from and why it's breaking. If you want to play along at home (read: someone please over for me!), update the commit ID near the top of our Gemfile to match what I mentioned above, and then run "bundle update rails".

I'm hopeful that these remaining failures all have the same fix, but it's late enough that I've got to head out for the night.

-- Matt

Hi Matt, thanks for update. I wanted to look at it, but the de83b017a90e9fe68da1359a97ac5b58b7c0f3fe seems to be broken. If I checkout this commit, method 'through_scope' is really not defined there, although this method is defined in regular branches.

I couldn't find this commit hash in any branch including 3-2-stable. Current 3-2-stable head is: 9d023c87de98f8c85574ecec019dd30a3dfc6f03

And if I try rails 3-2-stable branch, then I get various gem deps conflicts in Conductor Gemfile because rails bumped rails version to 4.0.0beta in this branch (I wonder what led them to such do such a crazy step).

At this point I don't know about any valid branch which includes both security fixes and reverted HABTM patch :(.

Jan

Ignore above - I messed my local rails repo.

It seems that commit c5451777b038c5e48567f69256986ae42a2cde48 introduces the error with using undefined through_scope method.

Jan