1

My site is currently dead therefore I can't explain how urgent for me this is.

Situation: A few days ago I received an e-mail from Heroku "ACTION REQUIRED: Rails Security Vulnerability " advising me to update rails to version '3.2.11'. After I followed all the steps in the e-mail I tried to open my web site. I was extremely surprised when I saw that I can't open my site. My site is made with RefineryCMS.

Is it possible, using git, to restore my site to the previous point in time when everything was working great?

When I run the site locally I get the following error:

ActiveRecord::RecordNotFound in Refinery::PagesController#home

Couldn't find Refinery::Page with id=torte-za-rodendan

...

app/views/stranice/naslovnica/_favourite_products.html.erb:7:in `_app_views_stranice_naslovnica__favourite_products_html_erb__4156700835010289094_66485000'

app/views/refinery/pages/home.html.erb:16:in `_app_views_refinery_pages_home_html_erb___2482419061129865361_67

Community
  • 1
  • 1
Adam
  • 2,347
  • 12
  • 55
  • 81
  • 1
    Well, yes. That's the whole point of a versioning system. – JJJ Jan 12 '13 at 15:54
  • please help. i am new to it – Adam Jan 12 '13 at 15:56
  • Was your site versionned with Git before you did that upgrade? – Mat Jan 12 '13 at 16:02
  • yes it was versionned with git before the update – Adam Jan 12 '13 at 16:03
  • You certainly can roll back using git. A better question is, should you? This particular Rails vulnerability is quite serious. A better route would be to run your test suite and check your site on a local box, and then if you can't figure out the errors you see there, ask a question about those. You need your site running with the latest Rails version. – jdl Jan 12 '13 at 16:07
  • I really wouldn't if I were you -- that security vulnerability allows attackers to execute arbitrary code as the user that runs your Rails app – hdgarrood Jan 12 '13 at 16:08
  • Can you help me to revive my site first, and than I will locally try to find the error? P.S. i can access backend of my site, but not the frontend – Adam Jan 12 '13 at 16:09
  • thanks all for your help! The site is alive. Here is what helped me: https://groups.google.com/forum/?fromgroups=#!topic/refinery-cms/iW_ehZeu1mU the gem friendly_id has to be installed in order everything to work. Last question is: How can I proof that my productive version is running on the new version of rails? – Adam Jan 12 '13 at 16:45

1 Answers1

3

Yep, we all got that email from Heroku.

Since your site was versioned with git before, you can undo the last commit by following these steps.

However, I am not sure whether you really need to do the above. You just need to make sure that your heroku app runs on rails 3.2.11 - it is a pretty serious security issue, maybe heroku even blocks sites that aren't upgraded quickly enough.

Follow these steps:

  • Run your tests and make sure everything works
  • Open up a new branch through git (git checkout -b new_rails)
  • Change Rails 3.2.11 in your Gemfile
  • Change RAILS_GEM_VERSION to '3.2.11' in environment.rb
  • Run bundle update rails
  • Run the tests and see if everything still works
  • If not, reverse back to the old branch by doing git checkout master; optionally delete the new branch by doing git branch -D new_rails

Doing it only on the new branch ensures nothing breaks.

If you still get errors afterwards, please tell us what's in heroku's log.

Community
  • 1
  • 1
Dennis Hackethal
  • 13,662
  • 12
  • 66
  • 115
  • thanks for your answer Charles. When I tried to run the site locally I got the error which I placed it the problem description above. – Adam Jan 12 '13 at 16:18
  • thanks all for your help! The site is alive. Here is what helped me: https://groups.google.com/forum/?fromgroups=#!topic/refinery-cms/iW_ehZeu1mU the gem friendly_id has to be installed in order everything to work. Last question is: How can I proof that my productive version is running on the new version of rails? – Adam Jan 12 '13 at 16:45
  • @Adam Upgrading locally and running your tests (this is one of the reasons why extensive test coverage is so important) should be enough. However, you can of course run the production environment locally as well to see that it works for yourself. First, run `RAILS_ENV=production rake db:create`, which will create your production database, then run `rails s -e production`, which will start the server in production mode. – Dennis Hackethal Jan 12 '13 at 18:36