Archive for June, 2007

Migrating user accounts w/o Firewire Target Disk

Perhaps this is an edge case, but recently I wanted to migrate my wife’s account from a G4 Yikes (1st generation G4 desktop machine) to a MacBook. It turns out that the G4 Yikes (aka, non-AGP graphics G4) is the only G4 (or, I believe G3) with built-in Firewire that won’t go into target disk mode.

You can, however, use the Migration Assistant with a mounted volume — if you happen to be able to yank the drive from the old machine and pop it in the new one, you’re good to go. I couldn’t, but had an external Firewire/USB drive. I used SuperDuper! to make a backup of the G4 HD, copied that to the external drive and then migrated from that onto the MacBook.

It worked great, but beware: you have to register SuperDuper! to get the full copy capability. I had registered, but was using a demo copy on the G4 and kept getting only the Users folder copied (which isn’t enough to Migrate from). With the registered version it will actually make a bootable volume.

Technorati Tags: ,

Preventing XSS from entering your database

I had all of our data being html-escaped as it was rendered to the page, but the problem is that other systems interact with ours — we send data to web analytics systems and to SalesForce.com. In that case you can’t count on escaping entities on display — you need to catch it on the way into your database.

I found a few sites with some fixes, though most were still focused on cleaning the data on display. I ended up taking Rick’s plugin and applying it at save time in the model object. I’m not sure it’s the cleanest — I’d almost certainly say there is a more elegant way to do this — but this was quick and works great.

It’s still basically designed to be used at output time:

<%= white_list @article.body %>

But instead I include the helper directly to a model and overwrite the attribute setters:


class Contact < ActiveRecord::Base

include WhiteListHelper

def name=(text) write_attribute(:name, white_list(text)) end

end

I tried setting up a before_filter and stepping through the param[] object, but my data was fairly simple and the above was dead easy.