<commit_before>This is a list of issues that we need to fix before making a Mephisto
release based on Rails 2.2.

  Drop TZInfo completely--see app/models/site.rb (fix docs, too)
  Handle inactive users with named scopes, not acts_as_versioned
  SECURITY: Don't ship :session_key in environment.rb!
  Try to upgrade to gem version of coderay
  We need to review our TODO comments
  Clean out the issue tracker: http://ar-code.lighthouseapp.com/projects/34-mephisto
  rake rails:update:javascripts => complicated because mephisto/application.js depends on older versions.

== Other issues

When running the unit tests, we need theme directories in themes/site-$ID.
But this namespace is also used by the development and production
databases.  Are the test suites clobbering user themes accidentally?  See
spec/models/membership_spec.rb for one quick-and-dirty workaround.  Perhaps
for all non-production environments, we should prepend RAILS-ENV to the
theme name, giving us themes/test-site-$ID?<commit_msg>Add notes for a security audit<commit_after>This is a list of issues that we need to fix before making a Mephisto
release based on Rails 2.2.

  Drop TZInfo completely--see app/models/site.rb (fix docs, too)
  Handle inactive users with named scopes, not acts_as_versioned
  SECURITY: Don't ship :session_key in environment.rb!
  Try to upgrade to gem version of coderay
  We need to review our TODO comments
  Clean out the issue tracker: http://ar-code.lighthouseapp.com/projects/34-mephisto
  rake rails:update:javascripts => complicated because mephisto/application.js depends on older versions.

== Other issues

When running the unit tests, we need theme directories in themes/site-$ID.
But this namespace is also used by the development and production
databases.  Are the test suites clobbering user themes accidentally?  See
spec/models/membership_spec.rb for one quick-and-dirty workaround.  Perhaps
for all non-production environments, we should prepend RAILS-ENV to the
theme name, giving us themes/test-site-$ID?

== Security

We need to do a basic security audit.

  Cookies
    Make sure cookies are HTTP-only whenever possible
    Can we restrict admin cookies to /admin ?
    Make sure logging out clears all relevant cookies and tokens
  Cross-site scripting
    Check all fields in comments
    Check macro:* bodies and parameters
      filtered_column_code_macro
      filtered_column_flikr_macro
    Do we have trackback support to check?
    Do we need to upgrade to an industrial-strength HTML sanitizer?
    For now, we'll assume that users with access to /admin don't try XSS
  Everything else
    Review http://guides.rubyonrails.org/security.html
{'fraction_non_alphanumeric': 0.05337812616648003, 'fraction_numerical': 0.0029861888764464353, 'mean_word_length': 4.143953934740883, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4694362', 'n_tokens_mistral': 757, 'n_tokens_neox': 715, 'n_words': 338}