Switch to using Rails LTS community edition for Rails 2.3 to pick up security patches

Author: asalant

Gemfile

@@ -1,6 +1,14 @@
 source 'https://rubygems.org'
 
-gem "rails", "2.3.17"
+git 'https://github.com/makandra/rails.git', :branch => '2-3-lts' do
+  gem 'rails', '~> 2.3.18'
+  gem 'actionmailer', :require => false
+  gem 'actionpack', :require => false
+  gem 'activerecord', :require => false
+  gem 'activeresource', :require => false
+  gem 'activesupport', :require => false
+  gem 'rack', :require => false
+end
 gem "mysql"
 gem "tzinfo", "~> 0.3.61"  # See https://github.com/asalant/freehub/pull/56
 gem 'authorization', git:  "https://github.com/asalant/rails-authorization-plugin"

Gemfile.lock

@@ -4,19 +4,37 @@ GIT
   specs:
     authorization (1.0.12)
 
+GIT
+  remote: https://github.com/makandra/rails.git
+  revision: c5617b2672bb0a51d01aee619c9329a0b38f6322
+  branch: 2-3-lts
+  specs:
+    actionmailer (2.3.18.60)
+      actionpack (= 2.3.18.60)
+    actionpack (2.3.18.60)
+      activesupport (= 2.3.18.60)
+      rack (< 1.5)
+    activerecord (2.3.18.60)
+      activesupport (= 2.3.18.60)
+    activeresource (2.3.18.60)
+      activesupport (= 2.3.18.60)
+    activesupport (2.3.18.60)
+    rack (1.4.7.27)
+    rails (2.3.18.60)
+      actionmailer (= 2.3.18.60)
+      actionpack (= 2.3.18.60)
+      activerecord (= 2.3.18.60)
+      activeresource (= 2.3.18.60)
+      activesupport (= 2.3.18.60)
+      railties (= 2.3.18.60)
+    railties (2.3.18.60)
+      actionpack (= 2.3.18.60)
+      activesupport (= 2.3.18.60)
+      rake (>= 0.8.3)
+
 GEM
   remote: https://rubygems.org/
   specs:
-    actionmailer (2.3.17)
-      actionpack (= 2.3.17)
-    actionpack (2.3.17)
-      activesupport (= 2.3.17)
-      rack (~> 1.1.0)
-    activerecord (2.3.17)
-      activesupport (= 2.3.17)
-    activeresource (2.3.17)
-      activesupport (= 2.3.17)
-    activesupport (2.3.17)
     acts-as-taggable-on (2.0.6)
     annotate (2.6.2)
       activerecord (>= 2.3.0)
@@ -33,14 +51,6 @@ GEM
     mysql (2.9.1)
     newrelic_rpm (3.7.3.204)
     power_assert (0.3.0)
-    rack (1.1.6)
-    rails (2.3.17)
-      actionmailer (= 2.3.17)
-      actionpack (= 2.3.17)
-      activerecord (= 2.3.17)
-      activeresource (= 2.3.17)
-      activesupport (= 2.3.17)
-      rake (>= 0.8.3)
     raindrops (0.19.0)
     rake (10.1.1)
     rdoc (4.1.1)
@@ -58,6 +68,11 @@ PLATFORMS
   ruby
 
 DEPENDENCIES
+  actionmailer!
+  actionpack!
+  activerecord!
+  activeresource!
+  activesupport!
   acts-as-taggable-on (= 2.0.6)
   annotate
   authorization!
@@ -68,7 +83,8 @@ DEPENDENCIES
   json (= 1.7.7)
   mysql
   newrelic_rpm
-  rails (= 2.3.17)
+  rack!
+  rails (~> 2.3.18)!
   rdoc
   test-unit
   thoughtbot-shoulda
@@ -77,4 +93,4 @@ DEPENDENCIES
   validates_email_format_of
 
 BUNDLED WITH
-   1.15.4
+   1.17.3

MIGRATION_CHECKLIST.md

@@ -14,6 +14,10 @@
 - [x] **Homepage N+1 queries** - Replaced per-org queries with single `active` scope using SQL aggregation and correlated subquery. Added composite index on `visits(person_id, arrived_at)`. Upgraded DB to Premium AMD 2GB. Homepage: 30s+ → ~1.9s.
 - [x] **Review other slow pages** if any
 
+## Security
+
+- [x] **Rails LTS** - Switched to [Rails LTS community edition](https://github.com/makandra/rails/tree/2-3-lts) (2.3.18.60). Patches 209+ CVEs including remote code execution, SQL injection, XSS, and directory traversal. Rack upgraded from 1.1.6 to 1.4.7.27. Hardened mode enabled (disables XML/JSON parameter parsing, escapes HTML in JSON).
+
 ## DNS Cutover
 
 - [ ] **Add custom domains** in App Platform settings:

config/environment.rb

@@ -1,8 +1,5 @@
 # Be sure to restart your server when you modify this file
 
-# Specifies gem version of Rails to use when vendor/rails is not present
-RAILS_GEM_VERSION = '2.3.17' unless defined? RAILS_GEM_VERSION
-
 # Bootstrap the Rails environment, frameworks, and default configuration
 require File.join(File.dirname(__FILE__), 'boot')
 
@@ -38,6 +35,11 @@
   config.time_zone = 'Pacific Time (US & Canada)'
   config.active_record.default_timezone = :utc
 
+  # Rails LTS security hardening: disables XML/JSON parameter parsing,
+  # escapes HTML entities in JSON, and other security improvements.
+  # See https://makandracards.com/railslts/16311-enabling-additional-security-features-rails-lts
+  config.rails_lts_options = { :default => :hardened }
+
   # The default locale is :en and all translations from config/locales/*.rb,yml are auto loaded.
   # config.i18n.load_path += Dir[Rails.root.join('my', 'locales', '*.{rb,yml}')]
   # config.i18n.default_locale = :de

config/initializers/utf8_params.rb

@@ -1,4 +1,4 @@
-raise "Check if this is still needed on #{Rails.version} (it is not in Rails 3.x)" unless Rails.version == '2.3.17'
+raise "Check if this is still needed on #{Rails.version} (it is not in Rails 3.x)" unless Rails.version.start_with?('2.3.')
 
 class ActionController::Base