Musings

Mostly, there were silly little things.

render_text "You c'yan come in.", '403 Forbidden'

for instance, became

render :text => "You c'yan come in.", :status => 403

and

response.headers['Content-Type'] = 'application/xhtml+xml'

became

response.headers['type'] = 'application/xhtml+xml'

More interesting was that sessions are now, by default, stored in a cookie, rather than on the server. There was, apparently, quite some brouhaha surrounding this change. The session is stored in a cookie as a cryptographically-signed (base64-encoded) cleartext. Many of the objections would, presumably, go away if the session were encrypted, rather than simply signed — a relatively trivial change in the code.

Whatever … there’s nothing particularly earthshaking in Instiki’s session data.

But there’s still the matter of generating a secret signing key. That, I provided by the following bit of code in config/environment.rb

# Secret session key
generator = Rails::SecretKeyGenerator.new("Instiki")
config.action_controller.session = { 
  :session_key => "instiki_session",
  :secret => generator.generate_secret
} 

so a new key is generated every time the server starts up.

In looking through the list of changes to Rails, I was struck by the new Sanitizer code, something I’d complained about previously. It looked vaguely … familiar. But its successor is still superior.

I also squashed a few bugs.

1. The first (reported by Diego Restrepo) led to equations not rendering, in certain circumstances, when utf-8 (non-ascii) text was present.
2. The second had to do with WikiWord processing being mistakenly applied to camel-cased elements, attributes or attribute values (with potentially disastrous, non-well-formed results).

3. The third (reported by Saji N. Hameed) was in the S5 generation code. Or, more correctly, in the latest version of REXML.

   element.write(out_string,indent,transitive=true,ie_hack)

   generates an error. Instead, you need to

   formatter = REXML::Formatters::Default.new(ie_hack)
   formatter.write(element, out_string)

Anyway, enjoy the new version of Instiki … something shiny and new for the Holidays.