On Thu, Feb 14, 2013 at 03:47:13PM -0500, Matt Wagner wrote:
> On Thu, Feb 14, 2013 at 10:44:49AM -0500, John Eckersberg wrote:
>> We're still running on the 3.2.12-ish stack that I put in after the
>> first round of security holes came through. There's been several more
>> rounds and probably more to come, so we need to keep pulling in updates.
>> I just took a brief stab at updating to 3.2.12 proper, and a bunch of
>> tests exploded as usual. I don't have time at the moment to bang on it
>> myself, so if anybody wants to jump on it, you can be a hero.
>
> So it looks like a continuation of
>
https://github.com/rails/rails/pull/8895#issuecomment-12156101
>
> It turns out that 3.2.12 was a security-only release, so it was just
> 3.2.11 plus the CVE fixes -- keeping this HABTM bug that was in 3.2.11.
> (See
>
https://github.com/plataformatec/simple_form/issues/735#issuecomment-1344...
> )
>
> I'll poke around and see if we can just advance the commit we're using
> now, to include the security fixes.
So, partial progress.
I updated the Gemfile, to move the ref from
63970dc7db273551f977483109dde936c8a7554f to
de83b017a90e9fe68da1359a97ac5b58b7c0f3fe which is presently the head of
the 3-2-stable branch. (That way we get the security fixes in 3.2.12,
but also keep the revert commit for the habtm crap.)
This solved the mass-failures from the HABTM stuff above, but left a
small number of failing tests, as I identify here:
https://gist.github.com/n1zyy/4957377
I've dug into a few, and keep coming back to this exception:
undefined local variable or method `through_scope' for
#<ActiveRecord::Associations::Preloader::HasManyThrough:0x000000082b9e10>
I need to dig a little further to see where this is coming from and why
it's breaking. If you want to play along at home (read: someone please
over for me!), update the commit ID near the top of our Gemfile to match
what I mentioned above, and then run "bundle update rails".
I'm hopeful that these remaining failures all have the same fix, but
it's late enough that I've got to head out for the night.
-- Matt
Hi Matt,
thanks for update. I wanted to look at it, but the
de83b017a90e9fe68da1359a97ac5b58b7c0f3fe seems to be broken. If I
checkout this commit, method 'through_scope' is really not defined
there, although this method is defined in regular branches.
I couldn't find this commit hash in any branch including 3-2-stable.
Current 3-2-stable head is: 9d023c87de98f8c85574ecec019dd30a3dfc6f03
And if I try rails 3-2-stable branch, then I get various gem deps
conflicts in Conductor Gemfile because rails bumped rails version to
4.0.0beta in this branch (I wonder what led them to such do such a crazy
step).
At this point I don't know about any valid branch which includes both
security fixes and reverted HABTM patch :(.
Jan