From mmangino at elevatedrails.com  Sun Feb  1 09:06:19 2009
From: mmangino at elevatedrails.com (Mike Mangino)
Date: Sun, 1 Feb 2009 09:06:19 -0500
Subject: [Facebooker-talk] Dynamically setting api/secret keys: a quick
	howto
In-Reply-To: <31e3a0430901311550r5049926bt6b60f9917fbf8d99@mail.gmail.com>
References: <31e3a0430901311550r5049926bt6b60f9917fbf8d99@mail.gmail.com>
Message-ID: <138399D6-8AB0-496B-AB44-57F3BF19977B@elevatedrails.com>

Awesome!

Thanks for posting. The setup code is really messy so I'm sure that  
was a pain to figure out. That's on my todolist for refactoring to  
simplify.

Mike

On Jan 31, 2009, at 6:50 PM, Robert Matei wrote:

> This started out as a request for help, but I figured it out so I  
> figured I'd share. I run several Facebook apps off a single Rails  
> app and I keep track of them in the database, so I wanted to set the  
> Facebooker config for each request, without relying on hard-coded  
> yml files. It's actually pretty simple:
>
> 1) Delete your facebooker.yml file so Facebooker's own  
> initialization doesn't override your settings.
> 2) Run something like this as a prepend_before_filter (might also  
> work as a regular before_filter).
>
> code copied here:
>       # replacement for Facebooker.load_configuration - we need this  
> to set the app
>       # dynamically rather than from facebooker.yml.
>       def self.set_facebooker_config app = App.current
>         puts "Seting Facebooker config for #{app.api_key}..."
>         attributes = app.attributes
>         ENV['FACEBOOK_API_KEY'] = attributes['api_key']
>         ENV['FACEBOOK_SECRET_KEY'] = attributes['secret_key']
>         ENV['FACEBOOKER_RELATIVE_URL_ROOT'] =  
> attributes['canvas_page_name']
>         ENV['FACEBOOKER_API'] = "new"
>         ActionController::Base.asset_host = attributes['callback_url']
>       end
>
> Hope this saves someone some diving through the Facebooker source.
> Robert
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk

--
Mike Mangino
http://www.elevatedrails.com




From adeel at proletariandesign.com  Sun Feb  1 12:51:17 2009
From: adeel at proletariandesign.com (Adeel Ahmad)
Date: Sun, 1 Feb 2009 09:51:17 -0800
Subject: [Facebooker-talk] Session key invalid or no longer valid
In-Reply-To: <168ef1510901312309g6798c8a6k523bb7bce0796292@mail.gmail.com>
References: <168ef1510901312309g6798c8a6k523bb7bce0796292@mail.gmail.com>
Message-ID: <168ef1510902010951u66e53d20yd2dbbf20becb12b3@mail.gmail.com>

This may be related to Aaron's question on Jan. 30. However in my case I
doing Facebook Connect using Facebooker for my site.
Following the Facebook Connect tutorial it does create a session and show
the user as logged in. For now I have the same 'fb' controller just to demo
log in.
However if the user logs out at facebook.com and then refreshes fb/index on
my site, I get "Session key invalid or no longer valid" on the line that
outputs @facebook_session.user.name. Just FYI if I output
@facebook_session.user.to_s it does give me the uid.
If you look at the stack trace below you'll notice that it passes through a
number of actions that test for existence and validity of the session. It
has a problem in the Error class of parser.rb. I would think it should catch
the problem a lot earlier than in parser.rb.
Any thoughts on how to troubleshoot and/or workaround this? I'm on Rails
2.1.1.

========================================
 Facebooker::Session::SessionExpired in Fb#index

Showing fb/index.html.erb where line #10 raised:

Session key invalid or no longer valid

Extracted source (around line #10):

7: <%= fb_login_button%>
8:
9: <% if facebook_session %>
10:   <h2>You are logged in as <%= facebook_session.user.name %></h2>
11: <% else %>
12:   <h2>You are not logged in!</h2>
13: <% end %>

vendor/plugins/facebooker/lib/facebooker/parser.rb:487:in `process'
vendor/plugins/facebooker/lib/facebooker/parser.rb:15:in `parse'
vendor/plugins/facebooker/lib/facebooker/service.rb:20:in `post'
vendor/plugins/facebooker/lib/facebooker/session.rb:473:in
`post_without_logging'
vendor/plugins/facebooker/lib/facebooker/session.rb:484:in `post'
vendor/plugins/facebooker/lib/facebooker/logging.rb:27:in `log_fb_api'
vendor/rails/activesupport/lib/active_support/core_ext/benchmark.rb:8:in
`realtime'
vendor/plugins/facebooker/lib/facebooker/logging.rb:27:in `log_fb_api'
vendor/plugins/facebooker/lib/facebooker/session.rb:483:in `post'
vendor/plugins/facebooker/lib/facebooker/models/user.rb:120:in `populate'
vendor/plugins/facebooker/lib/facebooker/model.rb:35:in `name'
app/views/fb/index.html.erb:10:in
`_run_erb_47app47views47fb47index46html46erb'


-- 
- Adeel
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090201/178154e7/attachment.html>

From klochner at gmail.com  Sun Feb  1 14:09:57 2009
From: klochner at gmail.com (kevin lochner)
Date: Sun, 1 Feb 2009 14:09:57 -0500
Subject: [Facebooker-talk] Session key invalid or no longer valid
In-Reply-To: <168ef1510902010951u66e53d20yd2dbbf20becb12b3@mail.gmail.com>
References: <168ef1510901312309g6798c8a6k523bb7bce0796292@mail.gmail.com>
	<168ef1510902010951u66e53d20yd2dbbf20becb12b3@mail.gmail.com>
Message-ID: <B628ED23-AC24-4D9E-99E3-2040DB490E67@gmail.com>

I'm using a rescue.  I tried advancing this discussion a couple weeks  
ago - the problem is that to really *know* that the session is valid,  
you have to try using it (i.e., hit the facebook rest server with a  
request).  I think it's a waste to
constantly ping the facebook server just to make sure you don't get an  
invalid session error when you're not expecting it, especially given  
that this scenario will be low-frequency with respect to total requests.

So here's what I did in facebooker/rails/controller.rb:

module Facebooker
   module Rails
     module Controller
       def self.included(controller)
         controller.rescue_from  
Facebooker::Session::SessionExpired, :with => :facebook_session_expired
       end

       def facebook_session_expired
           clear_fb_cookies!
           clear_facebook_session_information
           flash[:error] = "Your facebook session has expired."
           redirect_to root_url
         end

I'm hesitant to add this to facebooker because i'm not convinced  
everyone will want to do it this way, and
it probably means adding another parameter like "expired_session_url"  
so that this exception handling
works out of the box (since not everyone will redirect to root_url).

  - kevin


On Feb 1, 2009, at 12:51 PM, Adeel Ahmad wrote:

> This may be related to Aaron's question on Jan. 30. However in my  
> case I doing Facebook Connect using Facebooker for my site.
> Following the Facebook Connect tutorial it does create a session and  
> show the user as logged in. For now I have the same 'fb' controller  
> just to demo log in.
> However if the user logs out at facebook.com and then refreshes fb/ 
> index on my site, I get "Session key invalid or no longer valid" on  
> the line that outputs @facebook_session.user.name. Just FYI if I  
> output @facebook_session.user.to_s it does give me the uid.
> If you look at the stack trace below you'll notice that it passes  
> through a number of actions that test for existence and validity of  
> the session. It has a problem in the Error class of parser.rb. I  
> would think it should catch the problem a lot earlier than in  
> parser.rb.
> Any thoughts on how to troubleshoot and/or workaround this? I'm on  
> Rails 2.1.1.
>
> ========================================
>  Facebooker::Session::SessionExpired in Fb#index
>
> Showing fb/index.html.erb where line #10 raised:
>
> Session key invalid or no longer valid
>
> Extracted source (around line #10):
>
> 7: <%= fb_login_button%>
> 8:
> 9: <% if facebook_session %>
> 10:   <h2>You are logged in as <%= facebook_session.user.name %></h2>
> 11: <% else %>
> 12:   <h2>You are not logged in!</h2>
> 13: <% end %>
>
> vendor/plugins/facebooker/lib/facebooker/parser.rb:487:in `process'
> vendor/plugins/facebooker/lib/facebooker/parser.rb:15:in `parse'
> vendor/plugins/facebooker/lib/facebooker/service.rb:20:in `post'
> vendor/plugins/facebooker/lib/facebooker/session.rb:473:in  
> `post_without_logging'
> vendor/plugins/facebooker/lib/facebooker/session.rb:484:in `post'
> vendor/plugins/facebooker/lib/facebooker/logging.rb:27:in `log_fb_api'
> vendor/rails/activesupport/lib/active_support/core_ext/benchmark.rb: 
> 8:in `realtime'
> vendor/plugins/facebooker/lib/facebooker/logging.rb:27:in `log_fb_api'
> vendor/plugins/facebooker/lib/facebooker/session.rb:483:in `post'
> vendor/plugins/facebooker/lib/facebooker/models/user.rb:120:in  
> `populate'
> vendor/plugins/facebooker/lib/facebooker/model.rb:35:in `name'
> app/views/fb/index.html.erb:10:in  
> `_run_erb_47app47views47fb47index46html46erb'
>
>
> -- 
> - Adeel
>
>
>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090201/67142c4b/attachment.html>

From adeel at proletariandesign.com  Sun Feb  1 16:26:24 2009
From: adeel at proletariandesign.com (Adeel Ahmad)
Date: Sun, 1 Feb 2009 13:26:24 -0800
Subject: [Facebooker-talk] Session key invalid or no longer valid
In-Reply-To: <B628ED23-AC24-4D9E-99E3-2040DB490E67@gmail.com>
References: <168ef1510901312309g6798c8a6k523bb7bce0796292@mail.gmail.com>
	<168ef1510902010951u66e53d20yd2dbbf20becb12b3@mail.gmail.com>
	<B628ED23-AC24-4D9E-99E3-2040DB490E67@gmail.com>
Message-ID: <168ef1510902011326y46e5f365o4802f0e95b3fc072@mail.gmail.com>

Thanks, this looks like it should do well for now. However it's not catching
the exception... must be some other config I have wrong. Odd.

module Facebooker
  module Rails
    module Controller
      include Facebooker::Rails::ProfilePublisherExtensions
      def self.included(controller)
        controller.extend(ClassMethods)
        controller.before_filter :set_adapter
        controller.before_filter :set_fbml_format
        controller.helper_attr :facebook_session_parameters
        controller.helper_method :request_comes_from_facebook?
        controller.rescue_from Facebooker::Session::SessionExpired, :with =>
:facebook_session_expired
      end

      def facebook_session_expired
          clear_fb_cookies!
          clear_facebook_session_information
          flash[:error] = "Your facebook session has expired."
          redirect_to root_url
      end

- Adeel




On Sun, Feb 1, 2009 at 11:09 AM, kevin lochner <klochner at gmail.com> wrote:

> I'm using a rescue.  I tried advancing this discussion a couple weeks ago -
> the problem is that to really *know* that the session is valid, you have to
> try using it (i.e., hit the facebook rest server with a request).  I think
> it's a waste toconstantly ping the facebook server just to make sure you
> don't get an invalid session error when you're not expecting it, especially
> given that this scenario will be low-frequency with respect to total
> requests.
>
> So here's what I did in facebooker/rails/controller.rb:
>
> module Facebooker
>   module Rails
>     module Controller
>       def self.included(controller)
>         controller.rescue_from Facebooker::Session::SessionExpired, :with
> => :facebook_session_expired
>       end
>
>       def facebook_session_expired
>           clear_fb_cookies!
>           clear_facebook_session_information
>           flash[:error] = "Your facebook session has expired."
>           redirect_to root_url
>         end
>
> I'm hesitant to add this to facebooker because i'm not convinced everyone
> will want to do it this way, and
> it probably means adding another parameter like "expired_session_url" so
> that this exception handling
> works out of the box (since not everyone will redirect to root_url).
>
>  - kevin
>
>
> On Feb 1, 2009, at 12:51 PM, Adeel Ahmad wrote:
>
> This may be related to Aaron's question on Jan. 30. However in my case I
> doing Facebook Connect using Facebooker for my site.
> Following the Facebook Connect tutorial it does create a session and show
> the user as logged in. For now I have the same 'fb' controller just to demo
> log in.
> However if the user logs out at facebook.com and then refreshes fb/index
> on my site, I get "Session key invalid or no longer valid" on the line that
> outputs @facebook_session.user.name. Just FYI if I output
> @facebook_session.user.to_s it does give me the uid.
> If you look at the stack trace below you'll notice that it passes through a
> number of actions that test for existence and validity of the session. It
> has a problem in the Error class of parser.rb. I would think it should catch
> the problem a lot earlier than in parser.rb.
> Any thoughts on how to troubleshoot and/or workaround this? I'm on Rails
> 2.1.1.
>
> ========================================
>  Facebooker::Session::SessionExpired in Fb#index
>
> Showing fb/index.html.erb where line #10 raised:
>
> Session key invalid or no longer valid
>
> Extracted source (around line #10):
>
> 7: <%= fb_login_button%>
> 8:
> 9: <% if facebook_session %>
> 10:   <h2>You are logged in as <%= facebook_session.user.name %></h2>
> 11: <% else %>
> 12:   <h2>You are not logged in!</h2>
> 13: <% end %>
>
> vendor/plugins/facebooker/lib/facebooker/parser.rb:487:in `process'
> vendor/plugins/facebooker/lib/facebooker/parser.rb:15:in `parse'
> vendor/plugins/facebooker/lib/facebooker/service.rb:20:in `post'
> vendor/plugins/facebooker/lib/facebooker/session.rb:473:in
> `post_without_logging'
> vendor/plugins/facebooker/lib/facebooker/session.rb:484:in `post'
> vendor/plugins/facebooker/lib/facebooker/logging.rb:27:in `log_fb_api'
> vendor/rails/activesupport/lib/active_support/core_ext/benchmark.rb:8:in
> `realtime'
> vendor/plugins/facebooker/lib/facebooker/logging.rb:27:in `log_fb_api'
> vendor/plugins/facebooker/lib/facebooker/session.rb:483:in `post'
> vendor/plugins/facebooker/lib/facebooker/models/user.rb:120:in `populate'
> vendor/plugins/facebooker/lib/facebooker/model.rb:35:in `name'
> app/views/fb/index.html.erb:10:in
> `_run_erb_47app47views47fb47index46html46erb'
>
>
> --
> - Adeel
>
>
>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090201/7b1c2904/attachment-0001.html>

From klochner at gmail.com  Sun Feb  1 16:32:16 2009
From: klochner at gmail.com (kevin lochner)
Date: Sun, 1 Feb 2009 16:32:16 -0500
Subject: [Facebooker-talk] Session key invalid or no longer valid
In-Reply-To: <168ef1510902011326y46e5f365o4802f0e95b3fc072@mail.gmail.com>
References: <168ef1510901312309g6798c8a6k523bb7bce0796292@mail.gmail.com>
	<168ef1510902010951u66e53d20yd2dbbf20becb12b3@mail.gmail.com>
	<B628ED23-AC24-4D9E-99E3-2040DB490E67@gmail.com>
	<168ef1510902011326y46e5f365o4802f0e95b3fc072@mail.gmail.com>
Message-ID: <0670D95F-FC09-4FCE-8E71-45903A555E5C@gmail.com>

it's only going to catch the exception in your controller, so make  
sure you
load any needed data from facebook in the controller (rather than  
leaving
it to the view - e.g., <%= facebook_session.user.name %>

On Feb 1, 2009, at 4:26 PM, Adeel Ahmad wrote:

> Thanks, this looks like it should do well for now. However it's not  
> catching the exception... must be some other config I have wrong. Odd.
>
> module Facebooker
>   module Rails
>     module Controller
>       include Facebooker::Rails::ProfilePublisherExtensions
>       def self.included(controller)
>         controller.extend(ClassMethods)
>         controller.before_filter :set_adapter
>         controller.before_filter :set_fbml_format
>         controller.helper_attr :facebook_session_parameters
>         controller.helper_method :request_comes_from_facebook?
>         controller.rescue_from  
> Facebooker::Session::SessionExpired, :with  
> => :facebook_session_expired
>       end
>
>       def facebook_session_expired
>           clear_fb_cookies!
>           clear_facebook_session_information
>           flash[:error] = "Your facebook session has expired."
>           redirect_to root_url
>       end
>
> - Adeel
>
>
>
>
> On Sun, Feb 1, 2009 at 11:09 AM, kevin lochner <klochner at gmail.com>  
> wrote:
> I'm using a rescue.  I tried advancing this discussion a couple  
> weeks ago - the problem is that to really *know* that the session is  
> valid, you have to try using it (i.e., hit the facebook rest server  
> with a request).  I think it's a waste to
> constantly ping the facebook server just to make sure you don't get  
> an invalid session error when you're not expecting it, especially  
> given that this scenario will be low-frequency with respect to total  
> requests.
>
> So here's what I did in facebooker/rails/controller.rb:
>
> module Facebooker
>   module Rails
>     module Controller
>       def self.included(controller)
>         controller.rescue_from  
> Facebooker::Session::SessionExpired, :with  
> => :facebook_session_expired
>       end
>
>       def facebook_session_expired
>           clear_fb_cookies!
>           clear_facebook_session_information
>           flash[:error] = "Your facebook session has expired."
>           redirect_to root_url
>         end
>
> I'm hesitant to add this to facebooker because i'm not convinced  
> everyone will want to do it this way, and
> it probably means adding another parameter like  
> "expired_session_url" so that this exception handling
> works out of the box (since not everyone will redirect to root_url).
>
>  - kevin
>
>
> On Feb 1, 2009, at 12:51 PM, Adeel Ahmad wrote:
>
>> This may be related to Aaron's question on Jan. 30. However in my  
>> case I doing Facebook Connect using Facebooker for my site.
>> Following the Facebook Connect tutorial it does create a session  
>> and show the user as logged in. For now I have the same 'fb'  
>> controller just to demo log in.
>> However if the user logs out at facebook.com and then refreshes fb/ 
>> index on my site, I get "Session key invalid or no longer valid" on  
>> the line that outputs @facebook_session.user.name. Just FYI if I  
>> output @facebook_session.user.to_s it does give me the uid.
>> If you look at the stack trace below you'll notice that it passes  
>> through a number of actions that test for existence and validity of  
>> the session. It has a problem in the Error class of parser.rb. I  
>> would think it should catch the problem a lot earlier than in  
>> parser.rb.
>> Any thoughts on how to troubleshoot and/or workaround this? I'm on  
>> Rails 2.1.1.
>>
>> ========================================
>>  Facebooker::Session::SessionExpired in Fb#index
>>
>> Showing fb/index.html.erb where line #10 raised:
>>
>> Session key invalid or no longer valid
>>
>> Extracted source (around line #10):
>>
>> 7: <%= fb_login_button%>
>> 8:
>> 9: <% if facebook_session %>
>> 10:   <h2>You are logged in as <%= facebook_session.user.name %></h2>
>> 11: <% else %>
>> 12:   <h2>You are not logged in!</h2>
>> 13: <% end %>
>>
>> vendor/plugins/facebooker/lib/facebooker/parser.rb:487:in `process'
>> vendor/plugins/facebooker/lib/facebooker/parser.rb:15:in `parse'
>> vendor/plugins/facebooker/lib/facebooker/service.rb:20:in `post'
>> vendor/plugins/facebooker/lib/facebooker/session.rb:473:in  
>> `post_without_logging'
>> vendor/plugins/facebooker/lib/facebooker/session.rb:484:in `post'
>> vendor/plugins/facebooker/lib/facebooker/logging.rb:27:in  
>> `log_fb_api'
>> vendor/rails/activesupport/lib/active_support/core_ext/benchmark.rb: 
>> 8:in `realtime'
>> vendor/plugins/facebooker/lib/facebooker/logging.rb:27:in  
>> `log_fb_api'
>> vendor/plugins/facebooker/lib/facebooker/session.rb:483:in `post'
>> vendor/plugins/facebooker/lib/facebooker/models/user.rb:120:in  
>> `populate'
>> vendor/plugins/facebooker/lib/facebooker/model.rb:35:in `name'
>> app/views/fb/index.html.erb:10:in  
>> `_run_erb_47app47views47fb47index46html46erb'
>>
>>
>> -- 
>> - Adeel
>>
>>
>>
>> _______________________________________________
>> Facebooker-talk mailing list
>> Facebooker-talk at rubyforge.org
>> http://rubyforge.org/mailman/listinfo/facebooker-talk
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090201/c579544b/attachment.html>

From adeel at proletariandesign.com  Sun Feb  1 16:36:49 2009
From: adeel at proletariandesign.com (Adeel Ahmad)
Date: Sun, 1 Feb 2009 13:36:49 -0800
Subject: [Facebooker-talk] Session key invalid or no longer valid
In-Reply-To: <0670D95F-FC09-4FCE-8E71-45903A555E5C@gmail.com>
References: <168ef1510901312309g6798c8a6k523bb7bce0796292@mail.gmail.com>
	<168ef1510902010951u66e53d20yd2dbbf20becb12b3@mail.gmail.com>
	<B628ED23-AC24-4D9E-99E3-2040DB490E67@gmail.com>
	<168ef1510902011326y46e5f365o4802f0e95b3fc072@mail.gmail.com>
	<0670D95F-FC09-4FCE-8E71-45903A555E5C@gmail.com>
Message-ID: <168ef1510902011336x5e71af24o49c910e5a0cd7541@mail.gmail.com>

Funny I just realized that as your email popped up. Thanks again.

- Adeel


On Sun, Feb 1, 2009 at 1:32 PM, kevin lochner <klochner at gmail.com> wrote:

> it's only going to catch the exception in your controller, so make sure youload
> any needed data from facebook in the controller (rather than leaving
> it to the view - e.g., <%= facebook_session.user.name %>
>
> On Feb 1, 2009, at 4:26 PM, Adeel Ahmad wrote:
>
> Thanks, this looks like it should do well for now. However it's not
> catching the exception... must be some other config I have wrong. Odd.
>
> module Facebooker
>   module Rails
>     module Controller
>       include Facebooker::Rails::ProfilePublisherExtensions
>       def self.included(controller)
>         controller.extend(ClassMethods)
>         controller.before_filter :set_adapter
>         controller.before_filter :set_fbml_format
>         controller.helper_attr :facebook_session_parameters
>         controller.helper_method :request_comes_from_facebook?
>         controller.rescue_from Facebooker::Session::SessionExpired, :with
> => :facebook_session_expired
>       end
>
>       def facebook_session_expired
>           clear_fb_cookies!
>           clear_facebook_session_information
>           flash[:error] = "Your facebook session has expired."
>           redirect_to root_url
>       end
>
> - Adeel
>
>
>
>
> On Sun, Feb 1, 2009 at 11:09 AM, kevin lochner <klochner at gmail.com> wrote:
>
>> I'm using a rescue.  I tried advancing this discussion a couple weeks ago
>> - the problem is that to really *know* that the session is valid, you have
>> to try using it (i.e., hit the facebook rest server with a request).  I
>> think it's a waste to constantly ping the facebook server just to make
>> sure you don't get an invalid session error when you're not expecting it,
>> especially given that this scenario will be low-frequency with respect to
>> total requests.
>>
>> So here's what I did in facebooker/rails/controller.rb:
>>
>> module Facebooker
>>   module Rails
>>     module Controller
>>       def self.included(controller)
>>         controller.rescue_from Facebooker::Session::SessionExpired, :with
>> => :facebook_session_expired
>>       end
>>
>>       def facebook_session_expired
>>           clear_fb_cookies!
>>           clear_facebook_session_information
>>           flash[:error] = "Your facebook session has expired."
>>           redirect_to root_url
>>         end
>>
>> I'm hesitant to add this to facebooker because i'm not convinced everyone
>> will want to do it this way, and
>> it probably means adding another parameter like "expired_session_url" so
>> that this exception handling
>> works out of the box (since not everyone will redirect to root_url).
>>
>>  - kevin
>>
>>
>> On Feb 1, 2009, at 12:51 PM, Adeel Ahmad wrote:
>>
>> This may be related to Aaron's question on Jan. 30. However in my case I
>> doing Facebook Connect using Facebooker for my site.
>> Following the Facebook Connect tutorial it does create a session and show
>> the user as logged in. For now I have the same 'fb' controller just to demo
>> log in.
>> However if the user logs out at facebook.com and then refreshes fb/index
>> on my site, I get "Session key invalid or no longer valid" on the line that
>> outputs @facebook_session.user.name. Just FYI if I output
>> @facebook_session.user.to_s it does give me the uid.
>> If you look at the stack trace below you'll notice that it passes through
>> a number of actions that test for existence and validity of the session. It
>> has a problem in the Error class of parser.rb. I would think it should catch
>> the problem a lot earlier than in parser.rb.
>> Any thoughts on how to troubleshoot and/or workaround this? I'm on Rails
>> 2.1.1.
>>
>> ========================================
>>  Facebooker::Session::SessionExpired in Fb#index
>>
>> Showing fb/index.html.erb where line #10 raised:
>>
>> Session key invalid or no longer valid
>>
>> Extracted source (around line #10):
>>
>> 7: <%= fb_login_button%>
>> 8:
>> 9: <% if facebook_session %>
>> 10:   <h2>You are logged in as <%= facebook_session.user.name %></h2>
>> 11: <% else %>
>> 12:   <h2>You are not logged in!</h2>
>> 13: <% end %>
>>
>> vendor/plugins/facebooker/lib/facebooker/parser.rb:487:in `process'
>> vendor/plugins/facebooker/lib/facebooker/parser.rb:15:in `parse'
>> vendor/plugins/facebooker/lib/facebooker/service.rb:20:in `post'
>> vendor/plugins/facebooker/lib/facebooker/session.rb:473:in
>> `post_without_logging'
>> vendor/plugins/facebooker/lib/facebooker/session.rb:484:in `post'
>> vendor/plugins/facebooker/lib/facebooker/logging.rb:27:in `log_fb_api'
>> vendor/rails/activesupport/lib/active_support/core_ext/benchmark.rb:8:in
>> `realtime'
>> vendor/plugins/facebooker/lib/facebooker/logging.rb:27:in `log_fb_api'
>> vendor/plugins/facebooker/lib/facebooker/session.rb:483:in `post'
>> vendor/plugins/facebooker/lib/facebooker/models/user.rb:120:in `populate'
>> vendor/plugins/facebooker/lib/facebooker/model.rb:35:in `name'
>> app/views/fb/index.html.erb:10:in
>> `_run_erb_47app47views47fb47index46html46erb'
>>
>>
>> --
>> - Adeel
>>
>>
>>
>> _______________________________________________
>> Facebooker-talk mailing list
>> Facebooker-talk at rubyforge.org
>> http://rubyforge.org/mailman/listinfo/facebooker-talk
>>
>>
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090201/a98cce08/attachment-0001.html>

From nobuba at gmail.com  Sun Feb  1 23:03:32 2009
From: nobuba at gmail.com (Nnanna Obuba)
Date: Sun, 1 Feb 2009 23:03:32 -0500
Subject: [Facebooker-talk] What happens after your app goes live?
Message-ID: <1B205B26-2E44-4357-B69F-904AE756F616@gmail.com>

Hi All,

Once you deploy your facebook app, and point the settings away from  
your development machine, how do you keep adding features/ making  
changes?
I'm thinking of creating a development version of my app, but was  
wondering if there was another method of doing this

Thanks in Advance

Nnanna

From vincentchu at gmail.com  Mon Feb  2 03:23:47 2009
From: vincentchu at gmail.com (vincent chu)
Date: Mon, 2 Feb 2009 00:23:47 -0800
Subject: [Facebooker-talk] Stymied on FB Connect 'show permissions dialog'
Message-ID: <ddc18b3e0902020023t3428113h7c2efaad56dd0486@mail.gmail.com>

Hi all --

I'm pretty stuck here trying to implement a feature using FB Connect.
The basic idea is for me to request an offline_access extended
permission, capture the updated session key, then save it to a user
object on my site. The strategy I've been using is as follows:

0) I embed a hidden form with a user id hash

1) I add a link "enable offline access". The link has an onclick call
to a javascript function 'add_fb_account()'

2) the js function 'add_fb_account' is really simple:

function add_fb_account() {
	FB.Connect.showPermissionDialog('offline_access', function(accepted)
{ document.getElementById('add_fb_user_form').submit(); } );
}

The idea is for the user to click the link, up pops the dialog, then a
form is passed to a controller which will associate the updated
session_key to the user stored int the user hash.

The problem is that the session_keys aren't updated until the next
time the user reloads a page with a call to FB.Facebook.init, which is
too late for my server-side code to capture a valid session_key. This
is because all of the server-side code that captures the session_key
is executed *before* the html-based javascript code that would update
the cookies. Very annoying!

I can't, for the life of me, figure out how to tell the
'showPermissionDialog' to update the session keys before submitting
the form. If I could figure this out, then the session_keys would be
updated by the javascript before redirecting to the form-controller
page, which would then execute the servier-side code to grab the
session key.

I feel like this is possible -- I'm looking for behavior similar to
the login-window where the session-key is set immediately after the
user logs in to FB Connect (before being passed to the next page).

Can anyone suggest anything?

Thanks,

Vince

From lee at crossbonesystems.com  Mon Feb  2 03:27:37 2009
From: lee at crossbonesystems.com (Lee Mallabone)
Date: Mon, 2 Feb 2009 08:27:37 +0000
Subject: [Facebooker-talk] What happens after your app goes live?
In-Reply-To: <1B205B26-2E44-4357-B69F-904AE756F616@gmail.com>
References: <1B205B26-2E44-4357-B69F-904AE756F616@gmail.com>
Message-ID: <e8c2bee00902020027j72289670v565cac61273f710a@mail.gmail.com>

Hi Nianna,

I've done what you described. I assume that's the easiest thing to do;
I've got a blog post drafted about it because I'd not managed to read
about any best practice approaches to the dev-test-production cycle
with facebook app development.

Lee.


2009/2/2 Nnanna Obuba <nobuba at gmail.com>:
> Hi All,
>
> Once you deploy your facebook app, and point the settings away from your
> development machine, how do you keep adding features/ making changes?
> I'm thinking of creating a development version of my app, but was wondering
> if there was another method of doing this
>
> Thanks in Advance
>
> Nnanna
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk
>



-- 
Lee Mallabone.
Crossbone Systems Ltd.

Tired of hunting for great people?
Post jobs on your facebook profile with Head Hunting:
http://apps.facebook.com/headhunting/pages/recruiter

From aurelien.malisart.mailinglists at gmail.com  Mon Feb  2 03:36:07 2009
From: aurelien.malisart.mailinglists at gmail.com (=?ISO-8859-1?Q?Malisart_Aur=E9lien?=)
Date: Mon, 2 Feb 2009 09:36:07 +0100
Subject: [Facebooker-talk] What happens after your app goes live?
In-Reply-To: <1B205B26-2E44-4357-B69F-904AE756F616@gmail.com>
References: <1B205B26-2E44-4357-B69F-904AE756F616@gmail.com>
Message-ID: <E3DBE468-9919-4F64-80A2-9AF674A58D0A@gmail.com>

Hi,

>
> I'm thinking of creating a development version of my app, but was  
> wondering if there was another method of doing this

I think that's what we do all...

From pierre at tiiptop.com  Mon Feb  2 05:14:17 2009
From: pierre at tiiptop.com (Pierre Valade)
Date: Mon, 2 Feb 2009 11:14:17 +0100
Subject: [Facebooker-talk] feed publisher
In-Reply-To: <7C28D23E-F3BB-4D0C-BCFB-1FAB5A659266@gmail.com>
References: <7C28D23E-F3BB-4D0C-BCFB-1FAB5A659266@gmail.com>
Message-ID: <5af28ee50902020214l1e393761ndd370171659df494@mail.gmail.com>

Nope, but here is the small code that I use :
in the view :

FB.Connect.showFeedDialog(<%= @user_action.template_id %>, <%=
@user_action.data.to_json %>, null, null, FB.FeedStorySize.shortStory,
FB.RequireConnect.promptConnect);

in the controller :

@user_action = FacebookPublisher.create_new_review(@facebook_session.user,
@review, polymorphic_path(@review.item))

Pierre Valade
+33.6.89.04.15.30
www.tiiptop.com


On Tue, Jan 27, 2009 at 1:57 AM, kevin lochner <klochner at gmail.com> wrote:

> For connect, it looks like you have to use the javascript library to
> publish feed stories
> (and get the pop-up feed dialogue window).  Has anyone written a helper to
> generate
> the javascript?
>
>  - kevin
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090202/3f8577a0/attachment.html>

From pierre at tiiptop.com  Mon Feb  2 07:34:41 2009
From: pierre at tiiptop.com (Pierre Valade)
Date: Mon, 2 Feb 2009 13:34:41 +0100
Subject: [Facebooker-talk] Session key invalid or no longer valid
In-Reply-To: <168ef1510902011336x5e71af24o49c910e5a0cd7541@mail.gmail.com>
References: <168ef1510901312309g6798c8a6k523bb7bce0796292@mail.gmail.com>
	<168ef1510902010951u66e53d20yd2dbbf20becb12b3@mail.gmail.com>
	<B628ED23-AC24-4D9E-99E3-2040DB490E67@gmail.com>
	<168ef1510902011326y46e5f365o4802f0e95b3fc072@mail.gmail.com>
	<0670D95F-FC09-4FCE-8E71-45903A555E5C@gmail.com>
	<168ef1510902011336x5e71af24o49c910e5a0cd7541@mail.gmail.com>
Message-ID: <5af28ee50902020434y5fa5fc1cp577a901e22461b85@mail.gmail.com>

Note that you can also add it in your application.rb
rescue_from Facebooker::Session::SessionExpired, :with =>
:facebook_session_expired


Pierre Valade
+33.6.89.04.15.30
www.tiiptop.com


On Sun, Feb 1, 2009 at 10:36 PM, Adeel Ahmad <adeel at proletariandesign.com>wrote:

> Funny I just realized that as your email popped up. Thanks again.
>
> - Adeel
>
>
>
> On Sun, Feb 1, 2009 at 1:32 PM, kevin lochner <klochner at gmail.com> wrote:
>
>> it's only going to catch the exception in your controller, so make sure
>> you load any needed data from facebook in the controller (rather than
>> leaving
>> it to the view - e.g., <%= facebook_session.user.name %>
>>
>> On Feb 1, 2009, at 4:26 PM, Adeel Ahmad wrote:
>>
>> Thanks, this looks like it should do well for now. However it's not
>> catching the exception... must be some other config I have wrong. Odd.
>>
>> module Facebooker
>>   module Rails
>>     module Controller
>>       include Facebooker::Rails::ProfilePublisherExtensions
>>       def self.included(controller)
>>         controller.extend(ClassMethods)
>>         controller.before_filter :set_adapter
>>         controller.before_filter :set_fbml_format
>>         controller.helper_attr :facebook_session_parameters
>>         controller.helper_method :request_comes_from_facebook?
>>         controller.rescue_from Facebooker::Session::SessionExpired, :with
>> => :facebook_session_expired
>>       end
>>
>>       def facebook_session_expired
>>           clear_fb_cookies!
>>           clear_facebook_session_information
>>           flash[:error] = "Your facebook session has expired."
>>           redirect_to root_url
>>       end
>>
>> - Adeel
>>
>>
>>
>>
>> On Sun, Feb 1, 2009 at 11:09 AM, kevin lochner <klochner at gmail.com>wrote:
>>
>>> I'm using a rescue.  I tried advancing this discussion a couple weeks ago
>>> - the problem is that to really *know* that the session is valid, you have
>>> to try using it (i.e., hit the facebook rest server with a request).  I
>>> think it's a waste to constantly ping the facebook server just to make
>>> sure you don't get an invalid session error when you're not expecting it,
>>> especially given that this scenario will be low-frequency with respect to
>>> total requests.
>>>
>>> So here's what I did in facebooker/rails/controller.rb:
>>>
>>> module Facebooker
>>>   module Rails
>>>     module Controller
>>>       def self.included(controller)
>>>         controller.rescue_from Facebooker::Session::SessionExpired, :with
>>> => :facebook_session_expired
>>>       end
>>>
>>>       def facebook_session_expired
>>>           clear_fb_cookies!
>>>           clear_facebook_session_information
>>>           flash[:error] = "Your facebook session has expired."
>>>           redirect_to root_url
>>>         end
>>>
>>> I'm hesitant to add this to facebooker because i'm not convinced everyone
>>> will want to do it this way, and
>>> it probably means adding another parameter like "expired_session_url" so
>>> that this exception handling
>>> works out of the box (since not everyone will redirect to root_url).
>>>
>>>  - kevin
>>>
>>>
>>> On Feb 1, 2009, at 12:51 PM, Adeel Ahmad wrote:
>>>
>>> This may be related to Aaron's question on Jan. 30. However in my case I
>>> doing Facebook Connect using Facebooker for my site.
>>> Following the Facebook Connect tutorial it does create a session and show
>>> the user as logged in. For now I have the same 'fb' controller just to demo
>>> log in.
>>> However if the user logs out at facebook.com and then refreshes fb/index
>>> on my site, I get "Session key invalid or no longer valid" on the line that
>>> outputs @facebook_session.user.name. Just FYI if I output
>>> @facebook_session.user.to_s it does give me the uid.
>>> If you look at the stack trace below you'll notice that it passes through
>>> a number of actions that test for existence and validity of the session. It
>>> has a problem in the Error class of parser.rb. I would think it should catch
>>> the problem a lot earlier than in parser.rb.
>>> Any thoughts on how to troubleshoot and/or workaround this? I'm on Rails
>>> 2.1.1.
>>>
>>> ========================================
>>>  Facebooker::Session::SessionExpired in Fb#index
>>>
>>> Showing fb/index.html.erb where line #10 raised:
>>>
>>> Session key invalid or no longer valid
>>>
>>> Extracted source (around line #10):
>>>
>>> 7: <%= fb_login_button%>
>>> 8:
>>> 9: <% if facebook_session %>
>>> 10:   <h2>You are logged in as <%= facebook_session.user.name %></h2>
>>> 11: <% else %>
>>> 12:   <h2>You are not logged in!</h2>
>>> 13: <% end %>
>>>
>>> vendor/plugins/facebooker/lib/facebooker/parser.rb:487:in `process'
>>> vendor/plugins/facebooker/lib/facebooker/parser.rb:15:in `parse'
>>> vendor/plugins/facebooker/lib/facebooker/service.rb:20:in `post'
>>> vendor/plugins/facebooker/lib/facebooker/session.rb:473:in
>>> `post_without_logging'
>>> vendor/plugins/facebooker/lib/facebooker/session.rb:484:in `post'
>>> vendor/plugins/facebooker/lib/facebooker/logging.rb:27:in `log_fb_api'
>>> vendor/rails/activesupport/lib/active_support/core_ext/benchmark.rb:8:in
>>> `realtime'
>>> vendor/plugins/facebooker/lib/facebooker/logging.rb:27:in `log_fb_api'
>>> vendor/plugins/facebooker/lib/facebooker/session.rb:483:in `post'
>>> vendor/plugins/facebooker/lib/facebooker/models/user.rb:120:in `populate'
>>> vendor/plugins/facebooker/lib/facebooker/model.rb:35:in `name'
>>> app/views/fb/index.html.erb:10:in
>>> `_run_erb_47app47views47fb47index46html46erb'
>>>
>>>
>>> --
>>> - Adeel
>>>
>>>
>>>
>>> _______________________________________________
>>> Facebooker-talk mailing list
>>> Facebooker-talk at rubyforge.org
>>> http://rubyforge.org/mailman/listinfo/facebooker-talk
>>>
>>>
>>>
>>
>>
>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090202/d2b59d78/attachment-0001.html>

From pierre at tiiptop.com  Mon Feb  2 07:44:47 2009
From: pierre at tiiptop.com (Pierre Valade)
Date: Mon, 2 Feb 2009 13:44:47 +0100
Subject: [Facebooker-talk] hashed_content and action_links
Message-ID: <5af28ee50902020444k2dc83825m834137af45067209@mail.gmail.com>

Hello,
Just a simple question, should not the action_links be included in the hash
for template ?

Thanks,

Pierre Valade
+33.6.89.04.15.30
www.tiiptop.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090202/1ec14b05/attachment.html>

From pierre at tiiptop.com  Mon Feb  2 08:29:24 2009
From: pierre at tiiptop.com (Pierre Valade)
Date: Mon, 2 Feb 2009 14:29:24 +0100
Subject: [Facebooker-talk] Actions links with datas
Message-ID: <5af28ee50902020529p75249493y2e4573d12aa77a19@mail.gmail.com>

Hello,
Has anybody managed to use data in actions links ?

In my template publisher, I use :

action_links action_link("...", "{{*item_url*}}"),
                 action_link("..", "{{*item_url*}}")

But action links never get linked in Facebook...

Any ideas?

Thanks,

Pierre Valade
+33.6.89.04.15.30
www.tiiptop.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090202/a5a9ba7d/attachment.html>

From carlosparamio at gmail.com  Tue Feb  3 07:37:08 2009
From: carlosparamio at gmail.com (Carlos Paramio)
Date: Tue, 3 Feb 2009 13:37:08 +0100
Subject: [Facebooker-talk] [OT] "Wanna wine?",
	a new app built with Facebooker
Message-ID: <FC3218F1-2E33-49FE-9724-1119E90E837E@gmail.com>

Hi everybody!

I wanted to announce that we've published our new Facebook application  
built with the help of Facebooker. It's currently in beta and some of  
the missing features are coming this week, but you maybe are  
interested into take a look. His name is "Wanna wine?", and it's a  
social network for wine lovers where they can discover new wines that  
matches their personal tastes.

http://apps.facebook.com/wannawine/

Thanks to the Facebooker team for the fantastic gem!

Carlos Paramio
evolve studio | www.evolve.st

From mmangino at elevatedrails.com  Tue Feb  3 09:07:04 2009
From: mmangino at elevatedrails.com (Mike Mangino)
Date: Tue, 3 Feb 2009 09:07:04 -0500
Subject: [Facebooker-talk] [OT] "Wanna wine?",
	a new app built with Facebooker
In-Reply-To: <FC3218F1-2E33-49FE-9724-1119E90E837E@gmail.com>
References: <FC3218F1-2E33-49FE-9724-1119E90E837E@gmail.com>
Message-ID: <C4A0BE3D-3F5E-4C53-8939-50DCC0DAF088@elevatedrails.com>

Congratulations! It looks good! I'll be adding my wine to the list  
shortly.

I'd love to hear what apps other people are releasing user Facebooker.

Mike

On Feb 3, 2009, at 7:37 AM, Carlos Paramio wrote:

> Hi everybody!
>
> I wanted to announce that we've published our new Facebook  
> application built with the help of Facebooker. It's currently in  
> beta and some of the missing features are coming this week, but you  
> maybe are interested into take a look. His name is "Wanna wine?",  
> and it's a social network for wine lovers where they can discover  
> new wines that matches their personal tastes.
>
> http://apps.facebook.com/wannawine/
>
> Thanks to the Facebooker team for the fantastic gem!
>
> Carlos Paramio
> evolve studio | www.evolve.st
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk

--
Mike Mangino
http://www.elevatedrails.com




From nobuba at gmail.com  Tue Feb  3 10:14:14 2009
From: nobuba at gmail.com (Nnanna Obuba)
Date: Tue, 3 Feb 2009 10:14:14 -0500
Subject: [Facebooker-talk] [OT] "Wanna wine?",
	a new app built with Facebooker
In-Reply-To: <FC3218F1-2E33-49FE-9724-1119E90E837E@gmail.com>
References: <FC3218F1-2E33-49FE-9724-1119E90E837E@gmail.com>
Message-ID: <E6EB9473-8424-47F8-81B6-59B95CEE39AD@gmail.com>



I've just installed the app. I don't know if you noticed, but it shows  
"Wanna a wine" not "Wanna wine" in the app

Nnanna

On Feb 3, 2009, at 7:37 AM, Carlos Paramio wrote:

> Hi everybody!
>
> I wanted to announce that we've published our new Facebook  
> application built with the help of Facebooker. It's currently in  
> beta and some of the missing features are coming this week, but you  
> maybe are interested into take a look. His name is "Wanna wine?",  
> and it's a social network for wine lovers where they can discover  
> new wines that matches their personal tastes.
>
> http://apps.facebook.com/wannawine/
>
> Thanks to the Facebooker team for the fantastic gem!
>
> Carlos Paramio
> evolve studio | www.evolve.st
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk


From carlosparamio at gmail.com  Tue Feb  3 10:29:07 2009
From: carlosparamio at gmail.com (Carlos Paramio)
Date: Tue, 3 Feb 2009 16:29:07 +0100
Subject: [Facebooker-talk] [OT] "Wanna wine?",
	a new app built with Facebooker
In-Reply-To: <E6EB9473-8424-47F8-81B6-59B95CEE39AD@gmail.com>
References: <FC3218F1-2E33-49FE-9724-1119E90E837E@gmail.com>
	<E6EB9473-8424-47F8-81B6-59B95CEE39AD@gmail.com>
Message-ID: <2C6410B1-B05B-4367-8ADD-5BB1C36453EB@gmail.com>

> I've just installed the app. I don't know if you noticed, but it  
> shows "Wanna a wine" not "Wanna wine" in the app

Good eye :) Yeah, we realize later that it should be "Wanna wine" and  
not "Wanna a wine". We already have an app called "Wanna Wine"  
redirecting to this other, but we need to maintain the old one for at  
least a couple of weeks because we already did some contacts using the  
old name.

Anyway, the app name for the about page should say "Wanna wine" too.  
Thanks for notify it!

Carlos Paramio
evolve studio | www.evolve.st

>
>
> Nnanna
>
> On Feb 3, 2009, at 7:37 AM, Carlos Paramio wrote:
>
>> Hi everybody!
>>
>> I wanted to announce that we've published our new Facebook  
>> application built with the help of Facebooker. It's currently in  
>> beta and some of the missing features are coming this week, but you  
>> maybe are interested into take a look. His name is "Wanna wine?",  
>> and it's a social network for wine lovers where they can discover  
>> new wines that matches their personal tastes.
>>
>> http://apps.facebook.com/wannawine/
>>
>> Thanks to the Facebooker team for the fantastic gem!
>>
>> Carlos Paramio
>> evolve studio | www.evolve.st
>> _______________________________________________
>> Facebooker-talk mailing list
>> Facebooker-talk at rubyforge.org
>> http://rubyforge.org/mailman/listinfo/facebooker-talk



From nobuba at gmail.com  Tue Feb  3 19:48:36 2009
From: nobuba at gmail.com (Nnanna Obuba)
Date: Tue, 3 Feb 2009 19:48:36 -0500
Subject: [Facebooker-talk] How do you find user's friends that have
	installed your app?
In-Reply-To: <2C6410B1-B05B-4367-8ADD-5BB1C36453EB@gmail.com>
References: <FC3218F1-2E33-49FE-9724-1119E90E837E@gmail.com>
	<E6EB9473-8424-47F8-81B6-59B95CEE39AD@gmail.com>
	<2C6410B1-B05B-4367-8ADD-5BB1C36453EB@gmail.com>
Message-ID: <355F9A0F-2F3E-457C-8FF2-433550A452C6@gmail.com>


I did not quite get how the example in the Mike Mangino book did it

Thanks in Advance

Nnanna

From aurelien.malisart.mailinglists at gmail.com  Wed Feb  4 01:40:56 2009
From: aurelien.malisart.mailinglists at gmail.com (=?ISO-8859-1?Q?Malisart_Aur=E9lien?=)
Date: Wed, 4 Feb 2009 07:40:56 +0100
Subject: [Facebooker-talk] How do you find user's friends that have
	installed your app?
In-Reply-To: <355F9A0F-2F3E-457C-8FF2-433550A452C6@gmail.com>
References: <FC3218F1-2E33-49FE-9724-1119E90E837E@gmail.com>
	<E6EB9473-8424-47F8-81B6-59B95CEE39AD@gmail.com>
	<2C6410B1-B05B-4367-8ADD-5BB1C36453EB@gmail.com>
	<355F9A0F-2F3E-457C-8FF2-433550A452C6@gmail.com>
Message-ID: <47847316-A5FE-4B40-9C10-FBDACC3F3CCC@gmail.com>

Hi,

There is a "friends_with_this_app" method inside Facebooker::User. So  
you need to call it on the current facebooker user:

facebook_session.user.friends_with_this_app

Hope it helps.

Aur?lien


From vincentchu at gmail.com  Wed Feb  4 02:40:47 2009
From: vincentchu at gmail.com (vincent chu)
Date: Tue, 3 Feb 2009 23:40:47 -0800
Subject: [Facebooker-talk] Solution: Snagging offline_access cookies using
	FB Connect
Message-ID: <ddc18b3e0902032340k320c0ae4r33e1919a2d6bad32@mail.gmail.com>

Hi all --

I sent out an email asking for help on how to synchronize cookies after
requesting offline_access. I've solved it and wrote a little blog entry
about it, in case anybody is interested:

http://vccv.posterous.com/updating-cookies-for-facebook

I think my solution is a bit hacky, so it would be great if somebody else
could suggest a better way to do this. I originally tried looking at writing
a lot of javascript, but I couldn't really figure out facebook's code and
gave up after awhile

Cheers,

Vince
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090203/37211d48/attachment.html>

From nobuba at gmail.com  Wed Feb  4 07:58:45 2009
From: nobuba at gmail.com (Nnanna Obuba)
Date: Wed, 4 Feb 2009 07:58:45 -0500
Subject: [Facebooker-talk] How do you find user's friends that have
	installed your app?
In-Reply-To: <47847316-A5FE-4B40-9C10-FBDACC3F3CCC@gmail.com>
References: <FC3218F1-2E33-49FE-9724-1119E90E837E@gmail.com>
	<E6EB9473-8424-47F8-81B6-59B95CEE39AD@gmail.com>
	<2C6410B1-B05B-4367-8ADD-5BB1C36453EB@gmail.com>
	<355F9A0F-2F3E-457C-8FF2-433550A452C6@gmail.com>
	<47847316-A5FE-4B40-9C10-FBDACC3F3CCC@gmail.com>
Message-ID: <EABE7A1A-5975-4A41-A505-99C3FD291175@gmail.com>


Thanks. for anyone who is interested, here's the syntax as I used it  
to return an array of uids for friends of the current user who have  
installed your app

1. Using the facebooker method

@current_users =  
current_user.facebook_session.user.friends_with_this_app.map {|x| x.uid}

   2. Using FQL

         already_in = current_user.facebook_session.fql_query(
                 "SELECT uid FROM user WHERE uid IN (SELECT uid2 FROM  
friend WHERE uid1= #{current_user.facebook_id} ) AND is_app_user")
         @current_users = already_in.map  {|y| y.uid}


Of course if you want the user objects instead of the uids you can  
just remove the map stuff at the end

Hope it makes someone's life easier, like Aurelien's post made mine

Nnanna



On Feb 4, 2009, at 1:40 AM, Malisart Aur?lien wrote:

> Hi,
>
> There is a "friends_with_this_app" method inside Facebooker::User.  
> So you need to call it on the current facebooker user:
>
> facebook_session.user.friends_with_this_app
>
> Hope it helps.
>
> Aur?lien
>


From mmangino at elevatedrails.com  Wed Feb  4 08:51:11 2009
From: mmangino at elevatedrails.com (Mike Mangino)
Date: Wed, 4 Feb 2009 08:51:11 -0500
Subject: [Facebooker-talk] A few announcements
Message-ID: <E091D547-E2B0-4BEE-B745-77C24A3E99DC@elevatedrails.com>

Hey everyone. There's been a lot of activity on this list recently,  
which is great to see. People are asking good questions and getting  
helpful answers. Unfortunately, the answers aren't archived anywhere.

What do you think about moving to a google group so that we'll have a  
message archive? I created a Facebooker group at http://groups.google.com/group/facebooker


Also, I'm going to spend some time this weekend hacking on Facebooker.  
I want to try to clean up some of the ugly internal bits to make it  
easier for people to contribute. Let me know what your least favorite  
parts are.

Mine are:

Bootstrap and configuration
Adapter loading
params[:format]="fbml"


Anything else?

Mike
--
Mike Mangino
http://www.elevatedrails.com




From alexis at yoolink.fr  Wed Feb  4 09:10:58 2009
From: alexis at yoolink.fr (Alexis Sukrieh)
Date: Wed, 04 Feb 2009 15:10:58 +0100
Subject: [Facebooker-talk] A few announcements
In-Reply-To: <E091D547-E2B0-4BEE-B745-77C24A3E99DC@elevatedrails.com>
References: <E091D547-E2B0-4BEE-B745-77C24A3E99DC@elevatedrails.com>
Message-ID: <4989A1F2.90600@yoolink.fr>

Mike Mangino a ?crit :
> Anything else?

Maybe off-topic, but what about the patch I sent a week ago? Isn't that 
welcome ? Or maybe should I have send it elsewhere?

The patch fixes a real issue (Feed are always published in the small 
size with Facebooker), I thought it could be helpfull to integrate it in 
the core...

Thanks!

Regards,

-- 
Alexis Sukrieh

From lee at crossbonesystems.com  Wed Feb  4 09:43:09 2009
From: lee at crossbonesystems.com (Lee Mallabone)
Date: Wed, 4 Feb 2009 14:43:09 +0000
Subject: [Facebooker-talk] A few announcements
In-Reply-To: <E091D547-E2B0-4BEE-B745-77C24A3E99DC@elevatedrails.com>
References: <E091D547-E2B0-4BEE-B745-77C24A3E99DC@elevatedrails.com>
Message-ID: <e8c2bee00902040643j22f55670me1d17b00f03ec138@mail.gmail.com>

Hi Mike,

I find the names of the class-level filters a bit confusing/redundant.
Am I right in thinking that having two filters
(ensure_authenticated... and ensure_app_is_installed...) is a hangover
from the days of the "old" facebook app install model?

In my app I use ensure_application_is_installed_by_facebook_user and a
filter I created myself. I'd like to use
ensure_authenticated_to_facebook but it always prompts the user to
install the app, which imho it should not.

I get around this problem at the moment by using the facebook_params
hash to ensure that when I check for a user ID, the signature is
present and valid. It would be nicer if I could just use an explicit
filter that guarantees a request has come via facebook without
requiring the user to authorize my app.

I know these constructs already exist internally in facebooker, I
think it would be nicer if they were more explicit to new developers.

Kind regards,
Lee.


2009/2/4 Mike Mangino <mmangino at elevatedrails.com>:
> Hey everyone. There's been a lot of activity on this list recently, which is
> great to see. People are asking good questions and getting helpful answers.
> Unfortunately, the answers aren't archived anywhere.
>
> What do you think about moving to a google group so that we'll have a
> message archive? I created a Facebooker group at
> http://groups.google.com/group/facebooker
>
>
> Also, I'm going to spend some time this weekend hacking on Facebooker. I
> want to try to clean up some of the ugly internal bits to make it easier for
> people to contribute. Let me know what your least favorite parts are.
>
> Mine are:
>
> Bootstrap and configuration
> Adapter loading
> params[:format]="fbml"
>
>
> Anything else?
>
> Mike
> --
> Mike Mangino
> http://www.elevatedrails.com
>
>
>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk
>



-- 
Lee Mallabone.
Crossbone Systems Ltd.

Tired of hunting for great people?
Post jobs on your facebook profile with Head Hunting:
http://apps.facebook.com/headhunting/pages/recruiter

From digidigo at gmail.com  Wed Feb  4 09:39:18 2009
From: digidigo at gmail.com (David Clements)
Date: Wed, 4 Feb 2009 07:39:18 -0700
Subject: [Facebooker-talk] A few announcements
In-Reply-To: <E091D547-E2B0-4BEE-B745-77C24A3E99DC@elevatedrails.com>
References: <E091D547-E2B0-4BEE-B745-77C24A3E99DC@elevatedrails.com>
Message-ID: <ea9161c50902040639g639a4190se41015df16d32263@mail.gmail.com>

Ha... I totally have sent people here before to go look at the archives.
We definitely need a google group.


Dave

On Wed, Feb 4, 2009 at 6:51 AM, Mike Mangino <mmangino at elevatedrails.com>wrote:

> Hey everyone. There's been a lot of activity on this list recently, which
> is great to see. People are asking good questions and getting helpful
> answers. Unfortunately, the answers aren't archived anywhere.
>
> What do you think about moving to a google group so that we'll have a
> message archive? I created a Facebooker group at
> http://groups.google.com/group/facebooker
>
>
> Also, I'm going to spend some time this weekend hacking on Facebooker. I
> want to try to clean up some of the ugly internal bits to make it easier for
> people to contribute. Let me know what your least favorite parts are.
>
> Mine are:
>
> Bootstrap and configuration
> Adapter loading
> params[:format]="fbml"
>
>
> Anything else?
>
> Mike
> --
> Mike Mangino
> http://www.elevatedrails.com
>
>
>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090204/80f2df73/attachment.html>

From carlosparamio at gmail.com  Wed Feb  4 09:53:18 2009
From: carlosparamio at gmail.com (Carlos Paramio)
Date: Wed, 4 Feb 2009 15:53:18 +0100
Subject: [Facebooker-talk] A few announcements
In-Reply-To: <DC44AA55-93D3-47E4-AC8C-D7B2B8B6C312@gmail.com>
References: <E091D547-E2B0-4BEE-B745-77C24A3E99DC@elevatedrails.com>
	<DC44AA55-93D3-47E4-AC8C-D7B2B8B6C312@gmail.com>
Message-ID: <E39494AC-A266-40F7-9ADE-9FD9E96E98CB@gmail.com>

For anyone that could be interested, here is a list of pros and cons I  
find with the Google Groups move:

PROS
- RSS and Atom feeds.
- Ability to join a group without receiving email messages.
- Ability to receive email messages only if they match a particular  
keyword.
- Ability to upload files to the group.
- Ability to maintain group pages in a wiki.
- Ability to look at the members of the group easily.
- Better UI.
- Better search capabilities to use the archives as a Knowledge Base.

CONS
- Group separated from the other services at Rubyforge (I'm thinking  
on the bug tracking system mainly, because the main SCM repository  
seems to be the copy at Github now, and the forums aren't used too  
much probably because people find the mailing list more comfortable).  
Anyway, it seems that the bug tracking system is a little abandoned in  
favor of pull requests at Github, or at least there are tons of  
patches there that never received attention (including a couple of  
ones by myself).
- Lack of support to download the list archives as mbox files (AFAIK).
- The current archive will remain at Rubyforge (is there a way to  
import the mbox files to Google Groups?).

Any others you might been seeing?

Carlos Paramio



El 04/02/2009, a las 15:33, Carlos Paramio escribi?:

> Well, there is certainly an archive of messages here:
>
> http://rubyforge.org/pipermail/facebooker-talk/
>
> However, I also think that Google Groups has a much better  
> interface, and allows you to belong to a group without receiving  
> emails from it (so you just check it at the web interface, but still  
> are allowed to send messages to the list).
>
> So I vote for +1 for the migration.
>
> Carlos Paramio
>
>
> El 04/02/2009, a las 14:51, Mike Mangino escribi?:
>
>> Hey everyone. There's been a lot of activity on this list recently,  
>> which is great to see. People are asking good questions and getting  
>> helpful answers. Unfortunately, the answers aren't archived anywhere.
>>
>> What do you think about moving to a google group so that we'll have  
>> a message archive? I created a Facebooker group at http://groups.google.com/group/facebooker
>>
>>
>> Also, I'm going to spend some time this weekend hacking on  
>> Facebooker. I want to try to clean up some of the ugly internal  
>> bits to make it easier for people to contribute. Let me know what  
>> your least favorite parts are.
>>
>> Mine are:
>>
>> Bootstrap and configuration
>> Adapter loading
>> params[:format]="fbml"
>>
>>
>> Anything else?
>>
>> Mike
>> --
>> Mike Mangino
>> http://www.elevatedrails.com
>>
>>
>>
>> _______________________________________________
>> Facebooker-talk mailing list
>> Facebooker-talk at rubyforge.org
>> http://rubyforge.org/mailman/listinfo/facebooker-talk
>
>

Un saludo,
Carlos Paramio


From carlosparamio at gmail.com  Wed Feb  4 09:33:59 2009
From: carlosparamio at gmail.com (Carlos Paramio)
Date: Wed, 4 Feb 2009 15:33:59 +0100
Subject: [Facebooker-talk] A few announcements
In-Reply-To: <E091D547-E2B0-4BEE-B745-77C24A3E99DC@elevatedrails.com>
References: <E091D547-E2B0-4BEE-B745-77C24A3E99DC@elevatedrails.com>
Message-ID: <DC44AA55-93D3-47E4-AC8C-D7B2B8B6C312@gmail.com>

Well, there is certainly an archive of messages here:

http://rubyforge.org/pipermail/facebooker-talk/

However, I also think that Google Groups has a much better interface,  
and allows you to belong to a group without receiving emails from it  
(so you just check it at the web interface, but still are allowed to  
send messages to the list).

So I vote for +1 for the migration.

Carlos Paramio


El 04/02/2009, a las 14:51, Mike Mangino escribi?:

> Hey everyone. There's been a lot of activity on this list recently,  
> which is great to see. People are asking good questions and getting  
> helpful answers. Unfortunately, the answers aren't archived anywhere.
>
> What do you think about moving to a google group so that we'll have  
> a message archive? I created a Facebooker group at http://groups.google.com/group/facebooker
>
>
> Also, I'm going to spend some time this weekend hacking on  
> Facebooker. I want to try to clean up some of the ugly internal bits  
> to make it easier for people to contribute. Let me know what your  
> least favorite parts are.
>
> Mine are:
>
> Bootstrap and configuration
> Adapter loading
> params[:format]="fbml"
>
>
> Anything else?
>
> Mike
> --
> Mike Mangino
> http://www.elevatedrails.com
>
>
>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk



From mixonic at synitech.com  Wed Feb  4 09:59:35 2009
From: mixonic at synitech.com (Matthew Beale)
Date: Wed, 04 Feb 2009 09:59:35 -0500
Subject: [Facebooker-talk] A few announcements
In-Reply-To: <E091D547-E2B0-4BEE-B745-77C24A3E99DC@elevatedrails.com>
References: <E091D547-E2B0-4BEE-B745-77C24A3E99DC@elevatedrails.com>
Message-ID: <1233759575.8736.1.camel@localhost>

A Google group would be amazing, the lag on this list and lack of CC
support is....well it won't be a problem any more :-)

Great to hear things will be more hackable- I look forward to pushing
back some code.

-- 
Matthew Beale :: 607 227 0871
Resume & Portfolio @ http://madhatted.com

On Wed, 2009-02-04 at 08:51 -0500, Mike Mangino wrote:
> Hey everyone. There's been a lot of activity on this list recently,  
> which is great to see. People are asking good questions and getting  
> helpful answers. Unfortunately, the answers aren't archived anywhere.
> 
> What do you think about moving to a google group so that we'll have a  
> message archive? I created a Facebooker group at http://groups.google.com/group/facebooker
> 
> 
> Also, I'm going to spend some time this weekend hacking on Facebooker.  
> I want to try to clean up some of the ugly internal bits to make it  
> easier for people to contribute. Let me know what your least favorite  
> parts are.
> 
> Mine are:
> 
> Bootstrap and configuration
> Adapter loading
> params[:format]="fbml"
> 
> 
> Anything else?
> 
> Mike
> --
> Mike Mangino
> http://www.elevatedrails.com
> 
> 
> 
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk



From carlosparamio at gmail.com  Wed Feb  4 10:01:58 2009
From: carlosparamio at gmail.com (Carlos Paramio)
Date: Wed, 4 Feb 2009 16:01:58 +0100
Subject: [Facebooker-talk] Actions links with datas
In-Reply-To: <5af28ee50902020529p75249493y2e4573d12aa77a19@mail.gmail.com>
References: <5af28ee50902020529p75249493y2e4573d12aa77a19@mail.gmail.com>
Message-ID: <08E18341-9CC8-4622-ACF9-CF06DB1E4C9A@gmail.com>

Maybe it isn't that, but you're using double braces, and that might be  
confusing the parser that Facebook uses to replace the items. It  
should be:

action_links action_link("...", "{*item_url*}"),
                  action_link("..", "{*item_url*}")


Carlos Paramio


El 02/02/2009, a las 14:29, Pierre Valade escribi?:

> Hello,
>
> Has anybody managed to use data in actions links ?
>
> In my template publisher, I use :
>
> action_links action_link("...", "{{*item_url*}}"),
>                  action_link("..", "{{*item_url*}}")
>
> But action links never get linked in Facebook...
>
> Any ideas?
>
> Thanks,
>
> Pierre Valade
> +33.6.89.04.15.30
> www.tiiptop.com
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk

Un saludo,
Carlos Paramio

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090204/a69df40a/attachment-0001.html>

From pierre at tiiptop.com  Wed Feb  4 10:44:57 2009
From: pierre at tiiptop.com (Pierre Valade)
Date: Wed, 4 Feb 2009 16:44:57 +0100
Subject: [Facebooker-talk] Actions links with datas
In-Reply-To: <08E18341-9CC8-4622-ACF9-CF06DB1E4C9A@gmail.com>
References: <5af28ee50902020529p75249493y2e4573d12aa77a19@mail.gmail.com>
	<08E18341-9CC8-4622-ACF9-CF06DB1E4C9A@gmail.com>
Message-ID: <5af28ee50902040744j5ede287fqcc4419e5c729d874@mail.gmail.com>

Thanks. simple braces work !

Pierre Valade
+33.6.89.04.15.30
www.tiiptop.com


On Wed, Feb 4, 2009 at 4:01 PM, Carlos Paramio <carlosparamio at gmail.com>wrote:

> Maybe it isn't that, but you're using double braces, and that might be
> confusing the parser that Facebook uses to replace the items. It should be:
> action_links action_link("...", "{*item_url*}"),
>                  action_link("..", "{*item_url*}")
>
>
> Carlos Paramio
>
>
> El 02/02/2009, a las 14:29, Pierre Valade escribi?:
>
> Hello,
> Has anybody managed to use data in actions links ?
>
> In my template publisher, I use :
>
> action_links action_link("...", "{{*item_url*}}"),
>                  action_link("..", "{{*item_url*}}")
>
> But action links never get linked in Facebook...
>
> Any ideas?
>
> Thanks,
>
> Pierre Valade
> +33.6.89.04.15.30
> www.tiiptop.com
>  _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk
>
>
> Un saludo,
> Carlos Paramio
>
>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090204/c1dfcd37/attachment.html>

From stephane.akkaoui at imeuble.info  Wed Feb  4 10:53:23 2009
From: stephane.akkaoui at imeuble.info (=?ISO-8859-1?Q?St=E9phane_Akkaoui?=)
Date: Wed, 4 Feb 2009 16:53:23 +0100
Subject: [Facebooker-talk] A few announcements
In-Reply-To: <e8c2bee00902040643j22f55670me1d17b00f03ec138@mail.gmail.com>
References: <E091D547-E2B0-4BEE-B745-77C24A3E99DC@elevatedrails.com>
	<e8c2bee00902040643j22f55670me1d17b00f03ec138@mail.gmail.com>
Message-ID: <960BF296-D237-44E8-8126-FBEBA79FD8AC@imeuble.info>

Hi Lee,

Le 4 f?vr. 09 ? 15:43, Lee Mallabone a ?crit :
> I find the names of the class-level filters a bit confusing/redundant.
> Am I right in thinking that having two filters
> (ensure_authenticated... and ensure_app_is_installed...) is a hangover
> from the days of the "old" facebook app install model?

I totaly agree with that.

> ensure_authenticated_to_facebook but it always prompts the user to
> install the app, which imho it should not.

I've made a patch about that, but since I didn't have wrote tests  
about it, i didn't made a pull request, yet.

-- 
St?phane Akkaoui
http://soiabliz.com
http://imeuble.info

From alexis at yoolink.fr  Wed Feb  4 11:22:41 2009
From: alexis at yoolink.fr (Alexis Sukrieh)
Date: Wed, 04 Feb 2009 17:22:41 +0100
Subject: [Facebooker-talk] A few announcements
In-Reply-To: <D1BCC050-526F-464E-A6CA-EF69AB1B82B5@elevatedrails.com>
References: <E091D547-E2B0-4BEE-B745-77C24A3E99DC@elevatedrails.com>
	<4989A1F2.90600@yoolink.fr>
	<D1BCC050-526F-464E-A6CA-EF69AB1B82B5@elevatedrails.com>
Message-ID: <4989C0D1.3000703@yoolink.fr>

Mike Mangino a ?crit :

>> Maybe off-topic, but what about the patch I sent a week ago? Isn't 
>> that welcome ? Or maybe should I have send it elsewhere?
>>
> 
> I have 15 messages on GitHub I need to wade through. That's part of why 
> I'm going to work on things this weekend :)

Ah ok then! :-)

Regards,

-- 
Alexis Sukrieh


From mmangino at elevatedrails.com  Wed Feb  4 11:21:47 2009
From: mmangino at elevatedrails.com (Mike Mangino)
Date: Wed, 4 Feb 2009 11:21:47 -0500
Subject: [Facebooker-talk] A few announcements
In-Reply-To: <4989A1F2.90600@yoolink.fr>
References: <E091D547-E2B0-4BEE-B745-77C24A3E99DC@elevatedrails.com>
	<4989A1F2.90600@yoolink.fr>
Message-ID: <D1BCC050-526F-464E-A6CA-EF69AB1B82B5@elevatedrails.com>


On Feb 4, 2009, at 9:10 AM, Alexis Sukrieh wrote:

> Mike Mangino a ?crit :
>> Anything else?
>
> Maybe off-topic, but what about the patch I sent a week ago? Isn't  
> that welcome ? Or maybe should I have send it elsewhere?
>

I have 15 messages on GitHub I need to wade through. That's part of  
why I'm going to work on things this weekend :)

Mike

> The patch fixes a real issue (Feed are always published in the small  
> size with Facebooker), I thought it could be helpfull to integrate  
> it in the core...
>
> Thanks!
>
> Regards,
>
> -- 
> Alexis Sukrieh

--
Mike Mangino
http://www.elevatedrails.com




From zhao.lu.us at gmail.com  Wed Feb  4 12:30:20 2009
From: zhao.lu.us at gmail.com (Zhao Lu)
Date: Wed, 4 Feb 2009 09:30:20 -0800
Subject: [Facebooker-talk] A few announcements
In-Reply-To: <4989C0D1.3000703@yoolink.fr>
References: <E091D547-E2B0-4BEE-B745-77C24A3E99DC@elevatedrails.com>
	<4989A1F2.90600@yoolink.fr>
	<D1BCC050-526F-464E-A6CA-EF69AB1B82B5@elevatedrails.com>
	<4989C0D1.3000703@yoolink.fr>
Message-ID: <c1861420902040930i64be0377r662d483d704d000e@mail.gmail.com>

I also vote for migrating to google group.

On Wed, Feb 4, 2009 at 8:22 AM, Alexis Sukrieh <alexis at yoolink.fr> wrote:

> Mike Mangino a ?crit :
>
>  Maybe off-topic, but what about the patch I sent a week ago? Isn't that
>>> welcome ? Or maybe should I have send it elsewhere?
>>>
>>>
>> I have 15 messages on GitHub I need to wade through. That's part of why
>> I'm going to work on things this weekend :)
>>
>
> Ah ok then! :-)
>
> Regards,
>
> --
> Alexis Sukrieh
>
>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk
>



-- 
Zhao
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090204/7cbca158/attachment.html>

From aurelien.malisart.mailinglists at gmail.com  Wed Feb  4 13:47:29 2009
From: aurelien.malisart.mailinglists at gmail.com (=?ISO-8859-1?Q?Aur=E9lien_Malisart?=)
Date: Wed, 4 Feb 2009 19:47:29 +0100
Subject: [Facebooker-talk] A few announcements
In-Reply-To: <c1861420902040930i64be0377r662d483d704d000e@mail.gmail.com>
References: <E091D547-E2B0-4BEE-B745-77C24A3E99DC@elevatedrails.com>
	<4989A1F2.90600@yoolink.fr>
	<D1BCC050-526F-464E-A6CA-EF69AB1B82B5@elevatedrails.com>
	<4989C0D1.3000703@yoolink.fr>
	<c1861420902040930i64be0377r662d483d704d000e@mail.gmail.com>
Message-ID: <b2a23de70902041047m452f8a44sf3b78554ec921fef@mail.gmail.com>

See you on the google group!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090204/4e96c26d/attachment.html>

From mixonic at synitech.com  Thu Feb  5 18:30:20 2009
From: mixonic at synitech.com (Matthew Beale)
Date: Thu, 05 Feb 2009 18:30:20 -0500
Subject: [Facebooker-talk] Facebook profile publisher
Message-ID: <1233876620.8744.22.camel@localhost>

Hi all,

Anyone have good links for using the profile publisher? I see there is
some code for it, but don't really see any complete docs.

Thanks,

-- 
Matthew Beale :: 607 227 0871
Resume & Portfolio @ http://madhatted.com


From mixonic at synitech.com  Thu Feb  5 19:32:30 2009
From: mixonic at synitech.com (Matthew Beale)
Date: Thu, 05 Feb 2009 19:32:30 -0500
Subject: [Facebooker-talk] Facebook profile publisher
In-Reply-To: <1233876620.8744.22.camel@localhost>
References: <1233876620.8744.22.camel@localhost>
Message-ID: <1233880350.8744.23.camel@localhost>

On Thu, 2009-02-05 at 18:30 -0500, Matthew Beale wrote:
> Hi all,
> 
> Anyone have good links for using the profile publisher? I see there is
> some code for it, but don't really see any complete docs.
> 
> Thanks,
> 
-- 
Matthew Beale :: 607 227 0871
Resume & Portfolio @ http://madhatted.com


From mixonic at synitech.com  Thu Feb  5 19:49:26 2009
From: mixonic at synitech.com (Matthew Beale)
Date: Thu, 05 Feb 2009 19:49:26 -0500
Subject: [Facebooker-talk] Facebook profile publisher
In-Reply-To: <1233876620.8744.22.camel@localhost>
References: <1233876620.8744.22.camel@localhost>
Message-ID: <1233881366.8744.25.camel@localhost>

Nm, found something in the book (yay!).

I'll be sure to blog it up.

(also disregard the blank email)

-- 
Matthew Beale :: 607 227 0871
Resume & Portfolio @ http://madhatted.com

On Thu, 2009-02-05 at 18:30 -0500, Matthew Beale wrote:
> Hi all,
> 
> Anyone have good links for using the profile publisher? I see there is
> some code for it, but don't really see any complete docs.
> 
> Thanks,
> 



From lex.luthor747 at gmail.com  Fri Feb  6 06:18:45 2009
From: lex.luthor747 at gmail.com (Jamal Burgess)
Date: Fri, 6 Feb 2009 06:18:45 -0500
Subject: [Facebooker-talk] Facebooker log in/log out/settings appears then
	disappears?
Message-ID: <c0bb1fbc0902060318r5b0d71b0kd9bbfdd3599a526f@mail.gmail.com>

So i'm trying to get the Facebooker Connect feature working(really I want to
see the facebook connect button) and this morning I'm seeing (Log in, Log
Out and I believe Settings) pop up really quickly before disappearing where
the FB Connect button should appear.

Before tinkering around it would automatically just log me in and pull the
data I asked for(name, id and picture)...which wasn't what I wanted.  Has
anyone else gotten this?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090206/b00ba914/attachment-0001.html>

From pierre at expertinternet.com  Fri Feb  6 10:42:52 2009
From: pierre at expertinternet.com (pierre derome - expertinternet.com)
Date: Fri, 6 Feb 2009 16:42:52 +0100
Subject: [Facebooker-talk] fb:profile-pic picture size (other than small,
	thumb, square, big)
Message-ID: <8EFA449C-042C-4C2B-B372-B841A72F22AA@expertinternet.com>

sounds so easy and obvious,

but I can't figure out how to output a profile picture at the size I  
want say  20X20 or whatever,

many thanks, this list is very useful to me,

Pierre

From jordanr at cs.washington.edu  Fri Feb  6 11:23:09 2009
From: jordanr at cs.washington.edu (Richard Jordan)
Date: Fri, 6 Feb 2009 08:23:09 -0800 (PST)
Subject: [Facebooker-talk] fb:profile-pic picture size (other than small, thumb,
 square, big)
Message-ID: <Pine.LNX.4.64N.0902060821090.30452@attu4.cs.washington.edu>

Dear Pierre,

Try using CSS.  So try something like:
<style>
          .picky {
                 height: 20px;
                 width: 20px;
          }
</style>

<%= fb_profile_pic(1234, :class =>'picky') %>

Play around with it to avoid distortion.  Try bounding the size
instead of fixing it with CSS's "max-height", "min-width", etc.

Sincerely,
Richard

On Fri, 6 Feb 2009, pierre derome - expertinternet.com wrote:

> sounds so easy and obvious,
>
> but I can't figure out how to output a profile picture at the size I 
want say
> 20X20 or whatever,
>
> many thanks, this list is very useful to me,
>
> Pierre


From hyukyoo at gmail.com  Fri Feb  6 14:28:36 2009
From: hyukyoo at gmail.com (Hyuk Yoo)
Date: Fri, 6 Feb 2009 14:28:36 -0500
Subject: [Facebooker-talk] fb connect session problem.
Message-ID: <3643dac30902061128g7417026bh2ce8785891437bd0@mail.gmail.com>

i'm new to facebooker and rails and i'm having problems with the session.

i put this in application.rb


 before_filter :set_facebook_session
  helper_method :facebook_session


and

<% if facebook_session %>
  <h2>You are logged in as <%= facebook_session.user.name %></h2><%=
link_to_function "Sign Out from Facebook",
"FB.Connect.logoutAndRedirect('/')"%>
<% else %>
  <h2>You are not logged in!</h2><%= fb_login_button%>
<% end %>
this in my index.rhtml


when i sign out i get the:

Facebooker::Session::SessionExpired in Welcome#index

looks like the session didn't reset.

i'm looking for way to reset the session when i log out. any ideas?

thanks

richard yoo
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090206/c63d25ad/attachment.html>

From brian at brianculler.com  Mon Feb  9 11:47:38 2009
From: brian at brianculler.com (Brian Culler)
Date: Mon, 9 Feb 2009 11:47:38 -0500
Subject: [Facebooker-talk] Flex, facebooker,
	and sessions not being maintained
Message-ID: <a1d56cfe0902090847x6346531fw45edcc4376464b13@mail.gmail.com>

I have a Flex based SWF being loaded with FBML into my facebook
application.   When the application is initially loaded and the SWF is
served up, a rails session is created.  At that request, I have a full
facebooker session object and everything is fine.

However, on any subsequent *flex* requests back to our API (using
httpservice), it doesn't maintain that initial session setup when the
application first loaded.  It creates a new session, and the fb_sig
parameters are no where to be found.

If I do a full browser refresh of the page though, it goes back and uses
that initial session that was created when the app first loaded.  It would
appear that the browser is working with rails correctly to maintain the
session, but since Flex doesn't send http calls through the browser that
way, it gets a new session any time it makes a call by itself.

Any ideas on how to go about making the Flex app be able to talk back to the
rails app and use the same initial session that was created upon loading the
app?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090209/d5a047c7/attachment.html>

From swivelmaster at yahoo.com  Mon Feb  9 16:12:43 2009
From: swivelmaster at yahoo.com (Aaron Nemoyten)
Date: Mon, 9 Feb 2009 13:12:43 -0800 (PST)
Subject: [Facebooker-talk] Flex, facebooker,
	and sessions not being maintained
References: <a1d56cfe0902090847x6346531fw45edcc4376464b13@mail.gmail.com>
Message-ID: <613417.87205.qm@web33006.mail.mud.yahoo.com>

Brian,

Chances are that the problem is a little weirder than you think.

All calls that Flex makes should seem to originate from the same page the app is embedded in.  So if you're talking about the session being stored in the cookies, then you're relying on the browser's cookie policy to get it right for you.

Is this what you mean by 'session' - the Rails cookie-based session data?

I can give you some pointers on how to make it work correctly if that's what's happening.  (Hint:  Don't rely on cookies at all.)

-Aaron




________________________________
From: Brian Culler <brian at brianculler.com>
To: facebooker-talk at rubyforge.org
Sent: Monday, February 9, 2009 8:47:38 AM
Subject: [Facebooker-talk] Flex, facebooker, and sessions not being maintained

I have a Flex based SWF being loaded with FBML into my facebook application.   When the application is initially loaded and the SWF is served up, a rails session is created.  At that request, I have a full facebooker session object and everything is fine.

However, on any subsequent *flex* requests back to our API (using httpservice), it doesn't maintain that initial session setup when the application first loaded.  It creates a new session, and the fb_sig parameters are no where to be found.  

If I do a full browser refresh of the page though, it goes back and uses that initial session that was created when the app first loaded.  It would appear that the browser is working with rails correctly to maintain the session, but since Flex doesn't send http calls through the browser that way, it gets a new session any time it makes a call by itself.  

Any ideas on how to go about making the Flex app be able to talk back to the rails app and use the same initial session that was created upon loading the app?



      
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090209/a96db456/attachment.html>

From mixonic at synitech.com  Mon Feb  9 17:20:07 2009
From: mixonic at synitech.com (Matthew Beale)
Date: Mon, 09 Feb 2009 17:20:07 -0500
Subject: [Facebooker-talk] Curb causing errors?
Message-ID: <1234218007.8778.11.camel@localhost>

Hi all,

I updated facebooker for the first time in a month a few days ago, and
with it installed curb.  Curb looks great.

I've had an increase of:

Facebooker::Session::UnknownError: An unknown error occurred

Facebooker::Session::UnknownError: An unknown error occurred (out of
memory)

and 

Curl::Err::GotNothingError: server returned nothing (no headers, no
data)

Errors since then.  Anyone else having something similar happen?
	
-- 
Matthew Beale :: 607 227 0871
Resume & Portfolio @ http://madhatted.com


From brian at brianculler.com  Mon Feb  9 19:02:21 2009
From: brian at brianculler.com (Brian Culler)
Date: Mon, 9 Feb 2009 19:02:21 -0500
Subject: [Facebooker-talk] Flex, facebooker,
	and sessions not being 	maintained
In-Reply-To: <613417.87205.qm@web33006.mail.mud.yahoo.com>
References: <a1d56cfe0902090847x6346531fw45edcc4376464b13@mail.gmail.com>
	<613417.87205.qm@web33006.mail.mud.yahoo.com>
Message-ID: <a1d56cfe0902091602m6d8715edld70976f643e726fe@mail.gmail.com>

We're using ActiveRecordStore for session management.  So the session data
is actually being saved in the database I believe, and all that is going in
the cookie (should be) the session ID.

I have no idea why that session ID is not getting sent.  So as a work
around, we included the session ID into the Flash Vars that get loaded into
the SWF with the fb:swf tag.  Then our Flex app appends the _session_id to
every call back to the rails server.  This forces the rails app to use the
correct (original) session.

Thanks!

On Mon, Feb 9, 2009 at 4:12 PM, Aaron Nemoyten <swivelmaster at yahoo.com>wrote:

> Brian,
>
> Chances are that the problem is a little weirder than you think.
>
> All calls that Flex makes should seem to originate from the same page the
> app is embedded in.  So if you're talking about the session being stored in
> the cookies, then you're relying on the browser's cookie policy to get it
> right for you.
>
> Is this what you mean by 'session' - the Rails cookie-based session data?
>
> I can give you some pointers on how to make it work correctly if that's
> what's happening.  (Hint:  Don't rely on cookies at all.)
>
> -Aaron
>
>
> ------------------------------
> *From:* Brian Culler <brian at brianculler.com>
> *To:* facebooker-talk at rubyforge.org
> *Sent:* Monday, February 9, 2009 8:47:38 AM
> *Subject:* [Facebooker-talk] Flex, facebooker, and sessions not being
> maintained
>
> I have a Flex based SWF being loaded with FBML into my facebook
> application.   When the application is initially loaded and the SWF is
> served up, a rails session is created.  At that request, I have a full
> facebooker session object and everything is fine.
>
> However, on any subsequent *flex* requests back to our API (using
> httpservice), it doesn't maintain that initial session setup when the
> application first loaded.  It creates a new session, and the fb_sig
> parameters are no where to be found.
>
> If I do a full browser refresh of the page though, it goes back and uses
> that initial session that was created when the app first loaded.  It would
> appear that the browser is working with rails correctly to maintain the
> session, but since Flex doesn't send http calls through the browser that
> way, it gets a new session any time it makes a call by itself.
>
> Any ideas on how to go about making the Flex app be able to talk back to
> the rails app and use the same initial session that was created upon loading
> the app?
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090209/548b7721/attachment-0001.html>

From swivelmaster at yahoo.com  Tue Feb 10 02:09:13 2009
From: swivelmaster at yahoo.com (Aaron Nemoyten)
Date: Mon, 9 Feb 2009 23:09:13 -0800 (PST)
Subject: [Facebooker-talk] Flex, facebooker,
	and sessions not being  maintained
References: <a1d56cfe0902090847x6346531fw45edcc4376464b13@mail.gmail.com>
	<613417.87205.qm@web33006.mail.mud.yahoo.com>
	<a1d56cfe0902091602m6d8715edld70976f643e726fe@mail.gmail.com>
Message-ID: <860684.35781.qm@web33001.mail.mud.yahoo.com>

Okay, well, you actually are doing what I was going to suggest anyway, so there you go.

It's important to understand WHY you need to do that though!  

Basically the cookie policy of the browser you're using is preventing the cookie from being sent with the initial request.  It's probably Safari - it does this weird thing where it DOES set A cookie with the right key but not the right value.  Then when you try to check for the cookie's existence, yeah it's there, but there's no session associated with it so nothing works.

The only workaround that will always work (as far as I've figured) for iFrame apps is NOT TO RELY ON COOKIES AT ALL, EVER, EVER, no matter how you think you've conquered the issue.

What's nice is that we've been using a class designed for our own web service calls, so fixing the session id issue was a matter of modifying that class to add it to XML requests and/or GET params and setting a static variable when the app starts up based on the flash vars.

Another thing to note is that FileReference.upload() will not ever send browser cookies from the current tab/window/session, so even if you think you've got cookies covered (IE you're not in an iFrame) and you're using them to track sessions, this will still force you to come up with another way to authenticate requests if you want users to be able to select and upload files.  Lame.

-Aaron




________________________________
From: Brian Culler <brian at brianculler.com>
To: Aaron Nemoyten <swivelmaster at yahoo.com>
Cc: facebooker-talk at rubyforge.org
Sent: Monday, February 9, 2009 4:02:21 PM
Subject: Re: [Facebooker-talk] Flex, facebooker, and sessions not being  maintained

We're using ActiveRecordStore for session management.  So the session data is actually being saved in the database I believe, and all that is going in the cookie (should be) the session ID.

I have no idea why that session ID is not getting sent.  So as a work around, we included the session ID into the Flash Vars that get loaded into the SWF with the fb:swf tag.  Then our Flex app appends the _session_id to every call back to the rails server.  This forces the rails app to use the correct (original) session.

Thanks!


On Mon, Feb 9, 2009 at 4:12 PM, Aaron Nemoyten <swivelmaster at yahoo.com> wrote:

Brian,

Chances are that the problem is a little weirder than you think.

All calls that Flex makes should seem to originate from the same page the app is embedded in.  So if you're talking about the session being stored in the cookies, then you're relying on the browser's cookie policy to get it right for you.

Is this what you mean by 'session' - the Rails cookie-based session data?

I can give you some pointers on how to make it work correctly if that's what's happening.  (Hint:  Don't rely on cookies at all.)

-Aaron




________________________________
 From: Brian Culler <brian at brianculler.com>
To: facebooker-talk at rubyforge.org
Sent: Monday, February 9, 2009 8:47:38 AM
Subject: [Facebooker-talk] Flex, facebooker, and sessions not being maintained


I have a Flex based SWF being loaded with FBML into my facebook application.   When the application is initially loaded and the SWF is served up, a rails session is created.  At that request, I have a full facebooker session object and everything is fine.

However, on any subsequent *flex* requests back to our API (using httpservice), it doesn't maintain that initial session setup when the application first loaded.  It creates a new session, and the fb_sig parameters are no where to be found.  

If I do a full browser refresh of the page though, it goes back and uses that initial session that was created when the app first loaded.  It would appear that the browser is working with rails correctly to maintain the session, but since Flex doesn't send http calls through the browser that way, it gets a new session any time it makes a call by itself.  

Any ideas on how to go about making the Flex app be able to talk back to the rails app and use the same initial session that was created upon loading the app?


      
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090209/c0140c70/attachment.html>

From jacob.refstrup at hp.com  Tue Feb 10 13:20:51 2009
From: jacob.refstrup at hp.com (Jacob Refstrup)
Date: Tue, 10 Feb 2009 10:20:51 -0800
Subject: [Facebooker-talk] javascript_include_tag -- 500 internal server
	error
Message-ID: <4991C583.7030304@hp.com>

Hi,

I'm trying to use (in my view/layout) javascript_include_tag and it 
generates something like:

<script type="text/javascript" 
src="http://apps.facebook.com/fbml_static_get.php?src=%2Fcanvas_name%2Fjavascripts%2Ffacebooker.js%3F1234225416&appid=my_app_id&pv=1&sig=995d0e338609600ecbc28c3caf156f29&filetype=js"></script>

But when trying to fetch it Firebug shows that it gets an internal 
server error (500).

Anybody else run into this?

- Jacob

From lee.a.connell at gmail.com  Sat Feb 14 13:57:57 2009
From: lee.a.connell at gmail.com (Lee Connell)
Date: Sat, 14 Feb 2009 13:57:57 -0500
Subject: [Facebooker-talk] facebook "save my login info" login code
Message-ID: <c2bc197b0902141057q395be177g55742d936886fd07@mail.gmail.com>

I am trying to find information about this and can't find it anywhere, the
application "Amigo" uses this to keep the application logged in so you don't
have to keep logging into facebook to use the application. The url it goes
to is: https://login.facebook.com/code_gen.php, generates a code, you put it
into the app and you're all set.
I'm looking into doing this for my app, does anyone have information on this
to help me understand and implement this process specifically with
facebooker if possible?

thanks!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090214/3ffb1b2a/attachment.html>

From lee.a.connell at gmail.com  Sat Feb 14 15:27:53 2009
From: lee.a.connell at gmail.com (Lee Connell)
Date: Sat, 14 Feb 2009 15:27:53 -0500
Subject: [Facebooker-talk] MissingOrInvalidParameter
Message-ID: <c2bc197b0902141227t48cf417dgec3da9ebf5209dd7@mail.gmail.com>

Is there an issue with facebooker or my code? here is the error:
"/Library/Ruby/Gems/1.8/gems/facebooker-0.9.5/lib/facebooker/parser.rb:345:in
`process': Invalid parameter
(Facebooker::Session::MissingOrInvalidParameter)
 from
/Library/Ruby/Gems/1.8/gems/facebooker-0.9.5/lib/facebooker/parser.rb:15:in
`parse'
from
/Library/Ruby/Gems/1.8/gems/facebooker-0.9.5/lib/facebooker/service.rb:13:in
`post'
 from
/Library/Ruby/Gems/1.8/gems/facebooker-0.9.5/lib/facebooker/session.rb:321:in
`post'
from
/Library/Ruby/Gems/1.8/gems/facebooker-0.9.5/lib/facebooker/session.rb:137:in
`secure!'
 from
/Library/Ruby/Gems/1.8/gems/facebooker-0.9.5/lib/facebooker/session.rb:368:in
`uid'
from
/Library/Ruby/Gems/1.8/gems/facebooker-0.9.5/lib/facebooker/session.rb:167:in
`user'
 from ./fbook.rb:15
"

code:

"
#!/usr/bin/env ruby
require 'rubygems'
require 'facebooker'

# ensure_application_is_installed_by_facebook_user

session = Facebooker::Session.create('mykey', 'mysecret')

puts "Paste the URL into your web browser and login"
puts session.login_url()
puts "Hit return to continue..."
gets
puts "What are you doing?"
puts "#{session.user.facebook_id}"
"
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090214/96ed4e0b/attachment.html>

From digidigo at gmail.com  Sat Feb 14 17:34:24 2009
From: digidigo at gmail.com (David Clements)
Date: Sat, 14 Feb 2009 15:34:24 -0700
Subject: [Facebooker-talk] MissingOrInvalidParameter
In-Reply-To: <c2bc197b0902141227t48cf417dgec3da9ebf5209dd7@mail.gmail.com>
References: <c2bc197b0902141227t48cf417dgec3da9ebf5209dd7@mail.gmail.com>
Message-ID: <ea9161c50902141434k2f9aa8d6y538bd4453c9e015f@mail.gmail.com>

THis is the code that I have working.  I think you need to call auth_token
which will request a token.


session = Facebooker::Session.create( ''APIKEY', 'SECRET' )

puts session.auth_token  #this makes the call to get auth token


puts "Paste the URL into your web browser and login:"
puts session.login_url + "&auth_token=#{session.auth_token}";

puts "Hit return to continue..."
gets



puts "What are you doing?"
puts "#{session.user.name} #{session.user.status.message}"





On Sat, Feb 14, 2009 at 1:27 PM, Lee Connell <lee.a.connell at gmail.com>wrote:

> Is there an issue with facebooker or my code? here is the error:
> "/Library/Ruby/Gems/1.8/gems/facebooker-0.9.5/lib/facebooker/parser.rb:345:in
> `process': Invalid parameter
> (Facebooker::Session::MissingOrInvalidParameter)
>  from
> /Library/Ruby/Gems/1.8/gems/facebooker-0.9.5/lib/facebooker/parser.rb:15:in
> `parse'
> from
> /Library/Ruby/Gems/1.8/gems/facebooker-0.9.5/lib/facebooker/service.rb:13:in
> `post'
>  from
> /Library/Ruby/Gems/1.8/gems/facebooker-0.9.5/lib/facebooker/session.rb:321:in
> `post'
> from
> /Library/Ruby/Gems/1.8/gems/facebooker-0.9.5/lib/facebooker/session.rb:137:in
> `secure!'
>  from
> /Library/Ruby/Gems/1.8/gems/facebooker-0.9.5/lib/facebooker/session.rb:368:in
> `uid'
> from
> /Library/Ruby/Gems/1.8/gems/facebooker-0.9.5/lib/facebooker/session.rb:167:in
> `user'
>  from ./fbook.rb:15
> "
>
> code:
>
> "
> #!/usr/bin/env ruby
> require 'rubygems'
> require 'facebooker'
>
> # ensure_application_is_installed_by_facebook_user
>
> session = Facebooker::Session.create('mykey', 'mysecret')
>
> puts "Paste the URL into your web browser and login"
> puts session.login_url()
> puts "Hit return to continue..."
> gets
> puts "What are you doing?"
> puts "#{session.user.facebook_id}"
> "
>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090214/38684108/attachment-0001.html>

From digidigo at gmail.com  Sat Feb 14 17:56:39 2009
From: digidigo at gmail.com (David Clements)
Date: Sat, 14 Feb 2009 15:56:39 -0700
Subject: [Facebooker-talk] MissingOrInvalidParameter
In-Reply-To: <c2bc197b0902141444v6d985e69p834cbd9ad8b028c6@mail.gmail.com>
References: <c2bc197b0902141227t48cf417dgec3da9ebf5209dd7@mail.gmail.com>
	<ea9161c50902141434k2f9aa8d6y538bd4453c9e015f@mail.gmail.com>
	<c2bc197b0902141444v6d985e69p834cbd9ad8b028c6@mail.gmail.com>
Message-ID: <ea9161c50902141456r66be4cby487ebdee2c0cd4d5@mail.gmail.com>

Don't use the Desktop Session.  It has been deprecated by Facebook.  You
should be able to create a session with the code I sent.  I am using it in a
non-web app.

Dave

On Sat, Feb 14, 2009 at 3:44 PM, Lee Connell <lee.a.connell at gmail.com>wrote:

> thanks for the quick response, here is my code below and now i am getting
> "IncorrectSignature" (from
> /Library/Ruby/Gems/1.8/gems/facebooker-0.9.5/lib/facebooker/model.rb:35:in
> `name' from ./fbook.rb:14)
>
> #!/usr/bin/env ruby
> require 'rubygems'
> require 'facebooker'
>
> session = Facebooker::Session::Desktop.create('mykey', 'mysecret')
> puts session.auth_token()
>
> puts "Paste the URL into your web browser and login"
> puts session.login_url()
> puts "Hit return to continue..."
> gets
> puts "#{session.auth_token()}"
> puts "#{session.user.name} #{session.user.status.message}"
>
> friends = session.user.friends!( :name, :status  )
> friends.each do |friend|
>   puts "#{friend.name} #{friend.status.message}"
> end
>
>
>
> On Sat, Feb 14, 2009 at 5:34 PM, David Clements <digidigo at gmail.com>wrote:
>
>> THis is the code that I have working.  I think you need to call auth_token
>> which will request a token.
>>
>>
>> session = Facebooker::Session.create( ''APIKEY', 'SECRET' )
>>
>> puts session.auth_token  #this makes the call to get auth token
>>
>>
>> puts "Paste the URL into your web browser and login:"
>> puts session.login_url + "&auth_token=#{session.auth_token}";
>>
>> puts "Hit return to continue..."
>> gets
>>
>>
>>
>> puts "What are you doing?"
>> puts "#{session.user.name} #{session.user.status.message}"
>>
>>
>>
>>
>>
>> On Sat, Feb 14, 2009 at 1:27 PM, Lee Connell <lee.a.connell at gmail.com>wrote:
>>
>>> Is there an issue with facebooker or my code? here is the error:
>>> "/Library/Ruby/Gems/1.8/gems/facebooker-0.9.5/lib/facebooker/parser.rb:345:in
>>> `process': Invalid parameter
>>> (Facebooker::Session::MissingOrInvalidParameter)
>>>  from
>>> /Library/Ruby/Gems/1.8/gems/facebooker-0.9.5/lib/facebooker/parser.rb:15:in
>>> `parse'
>>> from
>>> /Library/Ruby/Gems/1.8/gems/facebooker-0.9.5/lib/facebooker/service.rb:13:in
>>> `post'
>>>  from
>>> /Library/Ruby/Gems/1.8/gems/facebooker-0.9.5/lib/facebooker/session.rb:321:in
>>> `post'
>>> from
>>> /Library/Ruby/Gems/1.8/gems/facebooker-0.9.5/lib/facebooker/session.rb:137:in
>>> `secure!'
>>>  from
>>> /Library/Ruby/Gems/1.8/gems/facebooker-0.9.5/lib/facebooker/session.rb:368:in
>>> `uid'
>>> from
>>> /Library/Ruby/Gems/1.8/gems/facebooker-0.9.5/lib/facebooker/session.rb:167:in
>>> `user'
>>>  from ./fbook.rb:15
>>> "
>>>
>>> code:
>>>
>>> "
>>> #!/usr/bin/env ruby
>>> require 'rubygems'
>>> require 'facebooker'
>>>
>>> # ensure_application_is_installed_by_facebook_user
>>>
>>> session = Facebooker::Session.create('mykey', 'mysecret')
>>>
>>> puts "Paste the URL into your web browser and login"
>>> puts session.login_url()
>>> puts "Hit return to continue..."
>>> gets
>>> puts "What are you doing?"
>>> puts "#{session.user.facebook_id}"
>>> "
>>>
>>> _______________________________________________
>>> Facebooker-talk mailing list
>>> Facebooker-talk at rubyforge.org
>>> http://rubyforge.org/mailman/listinfo/facebooker-talk
>>>
>>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090214/d30729e1/attachment.html>

From lee.a.connell at gmail.com  Sat Feb 14 21:57:52 2009
From: lee.a.connell at gmail.com (Lee Connell)
Date: Sat, 14 Feb 2009 21:57:52 -0500
Subject: [Facebooker-talk] infinite session key
Message-ID: <c2bc197b0902141857i1252c856r87ff0a3c69db2d5f@mail.gmail.com>

Below is code that i'm trying to get to use infinite sessions, i went on
facebook and created my one-time key using the code-gen which is suppose to
keep you logged in permanently.  When I try to secure_with! it tells me
session is expired or not valid, what am I doing wrong?
#!/usr/bin/env ruby
require 'rubygems'
require 'facebooker'

API_KEY = 'myapikey'
API_SECRET = 'mysecret'

session = Facebooker::Session.create API_KEY, API_SECRET
cached = true

if cached then
  token = "my6digitkey"
  userid = "myuserid"
  session.secure_with! token, userid, 0
else
  token = session.auth_token
  puts "Paste the URL into your web browser and login"
  puts session.login_url + "&auth_token=#{token}"
  puts "Hit return to continue..."
  gets
end

session.user.populate :name, :status, :pic_square, :uid

puts "ID: #{session.user.uid}"
puts "Full Name: #{session.user.name}"
puts "Status: #{session.user.status.message}"
puts "Picture: #{session.user.pic_square}"

friends = session.user.friends! :name, :status
friends.each do |friend|
  puts "First Name: #{friend.name}"
  puts "Status: #{friend.status.message}"
end
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090214/97cfeae3/attachment.html>

From vincentchu at gmail.com  Sun Feb 15 03:04:00 2009
From: vincentchu at gmail.com (vincent chu)
Date: Sun, 15 Feb 2009 00:04:00 -0800
Subject: [Facebooker-talk] infinite session key
In-Reply-To: <c2bc197b0902141857i1252c856r87ff0a3c69db2d5f@mail.gmail.com>
References: <c2bc197b0902141857i1252c856r87ff0a3c69db2d5f@mail.gmail.com>
Message-ID: <ddc18b3e0902150004g20d9cf20n4bf50ae9e7975cf7@mail.gmail.com>

Lee ---

Don't use One Time Passwords as that route has been deprecated by Facebook.
Instead, you should prompt the user for the appropriate extended permission.

http://wiki.developers.facebook.com/index.php/Extended_permissions

Cheers

Vince

----
Vincent Chu

On Sat, Feb 14, 2009 at 6:57 PM, Lee Connell <lee.a.connell at gmail.com>wrote:

> Below is code that i'm trying to get to use infinite sessions, i went on
> facebook and created my one-time key using the code-gen which is suppose to
> keep you logged in permanently.  When I try to secure_with! it tells me
> session is expired or not valid, what am I doing wrong?
> #!/usr/bin/env ruby
> require 'rubygems'
> require 'facebooker'
>
> API_KEY = 'myapikey'
> API_SECRET = 'mysecret'
>
> session = Facebooker::Session.create API_KEY, API_SECRET
> cached = true
>
> if cached then
>   token = "my6digitkey"
>   userid = "myuserid"
>   session.secure_with! token, userid, 0
> else
>   token = session.auth_token
>   puts "Paste the URL into your web browser and login"
>   puts session.login_url + "&auth_token=#{token}"
>   puts "Hit return to continue..."
>   gets
> end
>
> session.user.populate :name, :status, :pic_square, :uid
>
> puts "ID: #{session.user.uid}"
> puts "Full Name: #{session.user.name}"
> puts "Status: #{session.user.status.message}"
> puts "Picture: #{session.user.pic_square}"
>
> friends = session.user.friends! :name, :status
> friends.each do |friend|
>   puts "First Name: #{friend.name}"
>   puts "Status: #{friend.status.message}"
> end
>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090215/953370e5/attachment.html>

From lee.a.connell at gmail.com  Sun Feb 15 12:27:39 2009
From: lee.a.connell at gmail.com (Lee Connell)
Date: Sun, 15 Feb 2009 12:27:39 -0500
Subject: [Facebooker-talk] Facebooker Documentation
Message-ID: <c2bc197b0902150927i50e0662brcb1bcd58ff32efc0@mail.gmail.com>

Is the documentation going to be updated for the current release of
facebooker?  for instance set_status is not available, i looked in the
source of users.rb and it indeed is not an available method from what I can
see, how do we set status?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090215/4d86c716/attachment.html>

From lee.a.connell at gmail.com  Sun Feb 15 15:58:58 2009
From: lee.a.connell at gmail.com (Lee Connell)
Date: Sun, 15 Feb 2009 15:58:58 -0500
Subject: [Facebooker-talk] documentation
Message-ID: <c2bc197b0902151258m37c69ca9xb826a7f6ed48e860@mail.gmail.com>

http://emmanueloga.wordpress.com/2008/12/08/facebooker-gem-outdated-on-rubyforge/has
instructions for anyone who wants the most up to date version of
facebooker, the home site of facebooker is 0.9.9, the gem you install from
ruby gems is only 0.9.5, would be nice to have that listed on the main
facebooker page as this has caused quite some headache for me.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090215/2aa8b2bd/attachment-0001.html>

From klochner at gmail.com  Sun Feb 15 16:14:47 2009
From: klochner at gmail.com (kevin lochner)
Date: Sun, 15 Feb 2009 16:14:47 -0500
Subject: [Facebooker-talk] documentation
In-Reply-To: <c2bc197b0902151258m37c69ca9xb826a7f6ed48e860@mail.gmail.com>
References: <c2bc197b0902151258m37c69ca9xb826a7f6ed48e860@mail.gmail.com>
Message-ID: <0FD83792-1060-4699-B05A-6AACCD1ECB92@gmail.com>

It's probably easier to just install as a plugin:

  script/plugin install git://github.com/mmangino/facebooker.git

The code changes almost daily, so you may want to use git submodule to  
track changes.




On Feb 15, 2009, at 3:58 PM, Lee Connell wrote:

> http://emmanueloga.wordpress.com/2008/12/08/facebooker-gem-outdated-on-rubyforge/ 
>  has instructions for anyone who wants the most up to date version  
> of facebooker, the home site of facebooker is 0.9.9, the gem you  
> install from ruby gems is only 0.9.5, would be nice to have that  
> listed on the main facebooker page as this has caused quite some  
> headache for me.
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090215/50a82ae3/attachment.html>

From lee.a.connell at gmail.com  Sun Feb 15 16:23:57 2009
From: lee.a.connell at gmail.com (Lee Connell)
Date: Sun, 15 Feb 2009 16:23:57 -0500
Subject: [Facebooker-talk] error in facebooker 1.0.13 using URI.parse,
	fix below
Message-ID: <c2bc197b0902151323k2b1d93f7q741ded1e41025d21@mail.gmail.com>

begin
 + require 'uri'
  require 'curb'
  Facebooker.use_curl = true
rescue LoadError
  $stderr.puts "Curb not found. Using Net::HTTP."
  require 'net/http'
end

require 'uri' is need for the url method.

also anyone using the latest, make sure json and curb is installed, curb
however is optional.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090215/093a881b/attachment.html>

From jnylund at yahoo.com  Mon Feb 16 11:27:38 2009
From: jnylund at yahoo.com (Joel Nylund)
Date: Mon, 16 Feb 2009 11:27:38 -0500
Subject: [Facebooker-talk] sharing statistics page with other users
Message-ID: <D1494D83-EE62-4FFA-A6BA-8872929D5DDE@yahoo.com>

Hey,

sorry this is not a facebooker specific question but I figured someone  
on the list might know, is there a way I can give other fb users  
access to my "Statistics" page for my application?

thanks
Joel



From herdrick at gmail.com  Thu Feb 19 03:46:49 2009
From: herdrick at gmail.com (Ethan Herdrick)
Date: Thu, 19 Feb 2009 00:46:49 -0800
Subject: [Facebooker-talk] Users.getInfo
Message-ID: <91f48dbf0902190046s64ad5e06ib748340e33dc9837@mail.gmail.com>

Where is Facebooker's wrapper of the FB API Users.getInfo ?

(http://wiki.developers.facebook.com/index.php/Users.getInfo)

Thanks!

From heiko.seebach at web.de  Thu Feb 19 17:08:33 2009
From: heiko.seebach at web.de (Heiko Seebach)
Date: Thu, 19 Feb 2009 23:08:33 +0100
Subject: [Facebooker-talk] Hash in @current_adapter (instead of
	FacebookAdapter)
Message-ID: <499DD861.5040803@web.de>

Hi everybody,

I'm using the current facebooker version from 
http://github.com/mmangino/facebooker/tree/master in production, and I 
had a strange problem.


About every fifth (or tenth) time I (and others too) reload our homepage 
with the browser I got the following stacktrace:


ActionView::TemplateError (undefined method `api_key' for 
#<Hash:0x2aeb25fd3b68>) on line #2 of facebook/_login_button.html.erb:
1: <%= fb_connect_javascript_tag %>
2: <%= init_fb_connect "XFBML"%>


    vendor/plugins/facebooker/lib/facebooker.rb:104:in `send'
    vendor/plugins/facebooker/lib/facebooker.rb:104:in `api_key'
    
vendor/plugins/facebooker/lib/facebooker/rails/helpers/fb_connect.rb:15:in 
`init_fb_connect'
    app/views/facebook/_login_button.html.erb:2:in 
`_run_erb_47app47views47facebook47_login_button46html46erb'
    
/var/lib/gems/1.8/gems/actionpack-2.1.2/lib/action_view/base.rb:342:in 
`send'
    
/var/lib/gems/1.8/gems/actionpack-2.1.2/lib/action_view/base.rb:342:in 
`execute'
    
/var/lib/gems/1.8/gems/actionpack-2.1.2/lib/action_view/template_handlers/compilable.rb:29:in 
`send'
    
/var/lib/gems/1.8/gems/actionpack-2.1.2/lib/action_view/template_handlers/compilable.rb:29:in 
`render'
    
/var/lib/gems/1.8/gems/actionpack-2.1.2/lib/action_view/partial_template.rb:20:in 
`render'
    
/var/lib/gems/1.8/gems/actionpack-2.1.2/lib/action_controller/benchmarking.rb:26:in 
`benchmark'
...


This happened even when I deleted all session and domain cookies before 
the reload.


I debugged very long time and now and found out, thats ometimes there 
was a Hash in the
@current_adapter
of facebooker.rb
instead of a FacebookAdapter object

@current_adatper.inspect
showed, that the hash is the facebook_config object! (so the 
FacebookAdapter wrapper around it is missing)



I fixed it temporarily by disabling loading a specific adapter
    def current_adapter
      #@current_adapter ||
      Facebooker::AdapterBase.default_adapter
    end


so that always the default_adapter is used.
This works for now and for me.

I've no idea how this could happen, but maybe it helps somebody to find 
this bug or has any idea about it.


thanks, Heiko Seebach



From alan.larkin at gmail.com  Fri Feb 20 20:09:34 2009
From: alan.larkin at gmail.com (Alan)
Date: Fri, 20 Feb 2009 17:09:34 -0800 (PST)
Subject: [Facebooker-talk] 2.3
Message-ID: <08be9e43-7574-4cf1-9c0b-e218d46c0cf7@13g2000yql.googlegroups.com>

Whats the state of play w.r.t. 2.3? Is facebooker (or any forks there
of) fully compatible?

From lee.a.connell at gmail.com  Sat Feb 21 21:28:11 2009
From: lee.a.connell at gmail.com (Lee Connell)
Date: Sat, 21 Feb 2009 21:28:11 -0500
Subject: [Facebooker-talk] Users.getInfo
In-Reply-To: <91f48dbf0902211422p10aff002mb0265f56a0acc038@mail.gmail.com>
References: <91f48dbf0902190046s64ad5e06ib748340e33dc9837@mail.gmail.com>
	<c2bc197b0902200735w2bc95b97r331812f8effffb00@mail.gmail.com>
	<91f48dbf0902202152o70b85501h2c6dd9831e474d42@mail.gmail.com>
	<c2bc197b0902210756t3cc0219epd2728a208f4e0b33@mail.gmail.com>
	<91f48dbf0902211422p10aff002mb0265f56a0acc038@mail.gmail.com>
Message-ID: <c2bc197b0902211828m50a78366j69bf0d9cd7ee7962@mail.gmail.com>

Sure you can widen the conversation.  Well i should have explained why the
auth_token is there, to be honest I haven't tested if i really need it.  I
got that code when I went to
http://www.facebook.com/code_gen.php?v=1.0&api_key=YOUR_API_KEY.  See the
article here:
http://shimikoif.wordpress.com/2008/04/13/how-to-create-mobile-service-as-faceb/

Also what version of facebooker are you using, make sure you have at least
0.9.9 if you want to follow the online documentation, there is a newer
version as well, i think its somewhere around 1.0.13.

On Sat, Feb 21, 2009 at 5:22 PM, Ethan Herdrick <herdrick at gmail.com> wrote:

> Thanks for the code, Lee.  Funny thing - I have no idea what an
> auth_token is.  I have a live FB app running that uses infinite
> session keys and works OK even though I've ever set an auth token.
> What are they?
>
> You've been very helpful would you mind if I widened our conversation
> to the mailing list?
> -Ethan
>
> P.S.  By the way, in examining the source code I've found that the
> most direct way to call Users.getInfo is indeed
> Facebooker::Session.users.  Or it's supposed to be that way.  It
> doesn't work as written, but I find if I remove some code from the
> source of that method then it works, more or less.
>
> On Sat, Feb 21, 2009 at 7:56 AM, Lee Connell <lee.a.connell at gmail.com>
> wrote:
> > if you don't have an infinite session key, change cached to false. make
> sure
> > to put your key and secret.
> > #!/usr/bin/env ruby
> > require 'rubygems'
> > require 'facebooker'
> > API_KEY = 'yourkey'
> > API_SECRET = 'yoursecret'
> > session = Facebooker::Session.create(API_KEY, API_SECRET)
> > cached = true
> > if cached then
> >   token = "yourtoken"
> >   user_id = "youruserid"
> >   session_key = "yourinfinitesessionkey"
> >   session.auth_token = token
> >   #puts session.infinite?.to_s
> >   session.secure_with!(session_key, user_id, 0)
> > else
> >   token = session.auth_token
> >   puts "Paste the URL into your web browser and login"
> >   puts session.login_url + "&auth_token=#{token}"
> >   puts "Hit return to continue..."
> >   gets
> > end
> > session.user.populate(:name, :status, :pic_square, :uid)
> > puts "Session: #{session.session_key}"
> > puts "ID: #{session.user.uid}"
> > puts "Full Name: #{session.user.name}"
> > puts "Status: #{session.user.status.message}"
> > puts "Picture: #{session.user.pic_square}"
> > friends = session.user.friends!(:name, :status)
> > friends.each do |friend|
> >   puts "First Name: #{friend.name}"
> >   puts "Status: #{friend.status.message}"
> > end
> > session.user.set_status("Home with the family")
> >
> >
> > On Sat, Feb 21, 2009 at 12:52 AM, Ethan Herdrick <herdrick at gmail.com>
> wrote:
> >>
> >> Thanks, Lee!
> >>
> >> But Facebooker::Session doesn't have a populate method.  I've tried
> >> Facebooker::Session.users, but it breaks, claiming my session key is
> >> invalid.  Not sure what's going on there.
> >>
> >> -Ethan
> >>
> >> On Fri, Feb 20, 2009 at 7:35 AM, Lee Connell <lee.a.connell at gmail.com>
> >> wrote:
> >> > you get it through calling the method populate on your facebook
> session,
> >> > passing it arguments of what fields you want, lilke :name, :last_name,
> >> > :uid
> >> > etc... then you access it through the user object, "session.user.name
> ,
> >> > session.user.last_name" I don't have the code i was working on in
> front
> >> > of
> >> > me but that should get you started.
> >> >
> >> > On Thu, Feb 19, 2009 at 3:46 AM, Ethan Herdrick <herdrick at gmail.com>
> >> > wrote:
> >> >>
> >> >> Where is Facebooker's wrapper of the FB API Users.getInfo ?
> >> >>
> >> >> (http://wiki.developers.facebook.com/index.php/Users.getInfo)
> >> >>
> >> >> Thanks!
> >> >> _______________________________________________
> >> >> Facebooker-talk mailing list
> >> >> Facebooker-talk at rubyforge.org
> >> >> http://rubyforge.org/mailman/listinfo/facebooker-talk
> >> >
> >> >
> >
> >
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090221/a5dd36d1/attachment-0001.html>

From herdrick at gmail.com  Sun Feb 22 04:12:57 2009
From: herdrick at gmail.com (Ethan Herdrick)
Date: Sun, 22 Feb 2009 01:12:57 -0800
Subject: [Facebooker-talk] Is Session.users weird or is it me?
Message-ID: <91f48dbf0902220112j6526970ft7891f79e74898b4a@mail.gmail.com>

Here's my problem: I'm trying to use Facebooker::Session.users but it
seems to be broken, or more likely, my use of it is broken.  What I'm
seeing is that when I call it it just returns the user ids array I
pass it.

(For the following code, assume this:
  user_ids = [3201111, 556161111, 501411111, 687861111]
  fields = [:uid, :first_name, :last_name, :name, :timezone,
:birthday, :sex, :affiliations, :locale, :profile_url, :proxied_email]
  fields_string = fields.join ","
)

 with_users_method = session.users(user_ids, fields)
 puts "with_users_method = " + with_users_method.join(" *** ")

Which gave me:
with_users_method = 3201111 *** 556161111 *** 501411111 *** 687861111

Odd, eh?  So I looked at the source of Session.users and tried making
some changes and it works now, kinda.  What I did was simply adapt
that code by omiting the block that is passed to session.post, like
so:

  with_getInfo_no_block =
session.post("facebook.users.getInfo",:uids=>user_ids.join(","),:fields=>fields_string)
  puts "with_getInfo_no_block = "  + with_getInfo_no_block.join(" *** ")

Which gives:
with_getInfo_no_block = nameDaniel
SmithaffiliationsnameDISQUStypeworkyear0statusnid504602nameUC
Davistypecollegeyear0statusUndergradnid16777249nameVTbare,
Inc.typeworkyear0statusnid50432nameSan Francisco,
CAtyperegionyear0statusnid67108894timezoneuid3205241proxied_emailsexprofile_urlhttp://www.facebook.com/profile.php?id=32052birthdaylast_nameSmithlocaleen_USfirst_nameDaniel
*** nameKendra JonesaffiliationsnameNew York,
NYtyperegionyear0statusnid671086nameColumbiatypecollegeyear2003statusAlumnus/Alumnanid16777219timezone-5uid556167404proxied_emailsexfemaleprofile_urlhttp://www.facebook.com/profile.php?id=5561birthdayAugust
25last_nameJoneslocaleen_USfirst_nameKendra *** nameNatalie
HanesaffiliationsnameUniversity of
Michigantypecollegeyear2001statusGrad Studentnid167058nameBrighton and
Hovetyperegionyear0statusnid67914timezoneuid501410355proxied_emailsexprofile_urlhttp://www.facebook.com/s.php?k=100000080&amp;id=5012222birthdaylast_nameHaneslocaleen_GBfirst_nameNatalie
*** nameAllen EthanaffiliationsnameSpokane,
WAtyperegionyear0statusnid67109timezoneuid687869280proxied_emailapps+55035481363.687869280.38074720380e9a5306b7e5c2910b070b at proxymail.facebook.comsexprofile_urlhttp://www.facebook.com/s.php?k=100000080&amp;id=687861111birthdaylast_nameEthanlocaleen_USfirst_nameAllen

All the info I want is there, if a bit smashed together.  What am I
doing wrong?

Lee Connell has mentioned that I should use an auth token.  What is
this?  Is it related to this problem I'm having?  I have a live app
doing offline API calls that seem to work fine without setting an auth
token, btw.

Thanks in advance.





On Fri, Feb 20, 2009 at 9:52 PM, Ethan Herdrick <herdrick at gmail.com> wrote:
> Thanks, Lee!
>
> But Facebooker::Session doesn't have a populate method.  I've tried
> Facebooker::Session.users, but it breaks, claiming my session key is
> invalid.  Not sure what's going on there.
>
> -Ethan
>
> On Fri, Feb 20, 2009 at 7:35 AM, Lee Connell <lee.a.connell at gmail.com> wrote:
>> you get it through calling the method populate on your facebook session,
>> passing it arguments of what fields you want, lilke :name, :last_name, :uid
>> etc... then you access it through the user object, "session.user.name,
>> session.user.last_name" I don't have the code i was working on in front of
>> me but that should get you started.
>>
>> On Thu, Feb 19, 2009 at 3:46 AM, Ethan Herdrick <herdrick at gmail.com> wrote:
>>>
>>> Where is Facebooker's wrapper of the FB API Users.getInfo ?
>>>
>>> (http://wiki.developers.facebook.com/index.php/Users.getInfo)
>>>
>>> Thanks!
>>> _______________________________________________
>>> Facebooker-talk mailing list
>>> Facebooker-talk at rubyforge.org
>>> http://rubyforge.org/mailman/listinfo/facebooker-talk
>>
>>
>

From alan.larkin at gmail.com  Sun Feb 22 06:03:29 2009
From: alan.larkin at gmail.com (Alan Larkin)
Date: Sun, 22 Feb 2009 11:03:29 +0000
Subject: [Facebooker-talk] Is Session.users weird or is it me?
In-Reply-To: <91f48dbf0902220112j6526970ft7891f79e74898b4a@mail.gmail.com>
References: <91f48dbf0902220112j6526970ft7891f79e74898b4a@mail.gmail.com>
Message-ID: <49A13101.70704@gmail.com>

You will kick yourself ...

Session#get_users returns an array of Facebooker::User. Facebooker::User#to_s 
just returns the id as a string. Try

p session.users(user_ids, fields).inspect

Alan.

Ethan Herdrick wrote:
> Here's my problem: I'm trying to use Facebooker::Session.users but it
> seems to be broken, or more likely, my use of it is broken.  What I'm
> seeing is that when I call it it just returns the user ids array I
> pass it.
> 
> (For the following code, assume this:
>   user_ids = [3201111, 556161111, 501411111, 687861111]
>   fields = [:uid, :first_name, :last_name, :name, :timezone,
> :birthday, :sex, :affiliations, :locale, :profile_url, :proxied_email]
>   fields_string = fields.join ","
> )
> 
>  with_users_method = session.users(user_ids, fields)
>  puts "with_users_method = " + with_users_method.join(" *** ")
> 
> Which gave me:
> with_users_method = 3201111 *** 556161111 *** 501411111 *** 687861111
> 
> Odd, eh?  So I looked at the source of Session.users and tried making
> some changes and it works now, kinda.  What I did was simply adapt
> that code by omiting the block that is passed to session.post, like
> so:
> 
>   with_getInfo_no_block =
> session.post("facebook.users.getInfo",:uids=>user_ids.join(","),:fields=>fields_string)
>   puts "with_getInfo_no_block = "  + with_getInfo_no_block.join(" *** ")
> 
> Which gives:
> with_getInfo_no_block = nameDaniel
> SmithaffiliationsnameDISQUStypeworkyear0statusnid504602nameUC
> Davistypecollegeyear0statusUndergradnid16777249nameVTbare,
> Inc.typeworkyear0statusnid50432nameSan Francisco,
> CAtyperegionyear0statusnid67108894timezoneuid3205241proxied_emailsexprofile_urlhttp://www.facebook.com/profile.php?id=32052birthdaylast_nameSmithlocaleen_USfirst_nameDaniel
> *** nameKendra JonesaffiliationsnameNew York,
> NYtyperegionyear0statusnid671086nameColumbiatypecollegeyear2003statusAlumnus/Alumnanid16777219timezone-5uid556167404proxied_emailsexfemaleprofile_urlhttp://www.facebook.com/profile.php?id=5561birthdayAugust
> 25last_nameJoneslocaleen_USfirst_nameKendra *** nameNatalie
> HanesaffiliationsnameUniversity of
> Michigantypecollegeyear2001statusGrad Studentnid167058nameBrighton and
> Hovetyperegionyear0statusnid67914timezoneuid501410355proxied_emailsexprofile_urlhttp://www.facebook.com/s.php?k=100000080&amp;id=5012222birthdaylast_nameHaneslocaleen_GBfirst_nameNatalie
> *** nameAllen EthanaffiliationsnameSpokane,
> WAtyperegionyear0statusnid67109timezoneuid687869280proxied_emailapps+55035481363.687869280.38074720380e9a5306b7e5c2910b070b at proxymail.facebook.comsexprofile_urlhttp://www.facebook.com/s.php?k=100000080&amp;id=687861111birthdaylast_nameEthanlocaleen_USfirst_nameAllen
> 
> All the info I want is there, if a bit smashed together.  What am I
> doing wrong?
> 
> Lee Connell has mentioned that I should use an auth token.  What is
> this?  Is it related to this problem I'm having?  I have a live app
> doing offline API calls that seem to work fine without setting an auth
> token, btw.
> 
> Thanks in advance.
> 
> 
> 
> 
> 
> On Fri, Feb 20, 2009 at 9:52 PM, Ethan Herdrick <herdrick at gmail.com> wrote:
>> Thanks, Lee!
>>
>> But Facebooker::Session doesn't have a populate method.  I've tried
>> Facebooker::Session.users, but it breaks, claiming my session key is
>> invalid.  Not sure what's going on there.
>>
>> -Ethan
>>
>> On Fri, Feb 20, 2009 at 7:35 AM, Lee Connell <lee.a.connell at gmail.com> wrote:
>>> you get it through calling the method populate on your facebook session,
>>> passing it arguments of what fields you want, lilke :name, :last_name, :uid
>>> etc... then you access it through the user object, "session.user.name,
>>> session.user.last_name" I don't have the code i was working on in front of
>>> me but that should get you started.
>>>
>>> On Thu, Feb 19, 2009 at 3:46 AM, Ethan Herdrick <herdrick at gmail.com> wrote:
>>>> Where is Facebooker's wrapper of the FB API Users.getInfo ?
>>>>
>>>> (http://wiki.developers.facebook.com/index.php/Users.getInfo)
>>>>
>>>> Thanks!
>>>> _______________________________________________
>>>> Facebooker-talk mailing list
>>>> Facebooker-talk at rubyforge.org
>>>> http://rubyforge.org/mailman/listinfo/facebooker-talk
>>>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk
> 


From herdrick at gmail.com  Sun Feb 22 17:06:22 2009
From: herdrick at gmail.com (Ethan Herdrick)
Date: Sun, 22 Feb 2009 14:06:22 -0800
Subject: [Facebooker-talk] Is Session.users weird or is it me?
In-Reply-To: <49A13101.70704@gmail.com>
References: <91f48dbf0902220112j6526970ft7891f79e74898b4a@mail.gmail.com>
	<49A13101.70704@gmail.com>
Message-ID: <91f48dbf0902221406s44c17000k4a4af1a3ad6f2195@mail.gmail.com>

Thank you Alan.


On Sun, Feb 22, 2009 at 3:03 AM, Alan Larkin <alan.larkin at gmail.com> wrote:
> You will kick yourself ...
>
> Session#get_users returns an array of Facebooker::User.
> Facebooker::User#to_s just returns the id as a string. Try
>
> p session.users(user_ids, fields).inspect
>
> Alan.
>
> Ethan Herdrick wrote:
>>
>> Here's my problem: I'm trying to use Facebooker::Session.users but it
>> seems to be broken, or more likely, my use of it is broken.  What I'm
>> seeing is that when I call it it just returns the user ids array I
>> pass it.
>>
>> (For the following code, assume this:
>>  user_ids = [3201111, 556161111, 501411111, 687861111]
>>  fields = [:uid, :first_name, :last_name, :name, :timezone,
>> :birthday, :sex, :affiliations, :locale, :profile_url, :proxied_email]
>>  fields_string = fields.join ","
>> )
>>
>>  with_users_method = session.users(user_ids, fields)
>>  puts "with_users_method = " + with_users_method.join(" *** ")
>>
>> Which gave me:
>> with_users_method = 3201111 *** 556161111 *** 501411111 *** 687861111
>>
>> Odd, eh?  So I looked at the source of Session.users and tried making
>> some changes and it works now, kinda.  What I did was simply adapt
>> that code by omiting the block that is passed to session.post, like
>> so:
>>
>>  with_getInfo_no_block =
>>
>> session.post("facebook.users.getInfo",:uids=>user_ids.join(","),:fields=>fields_string)
>>  puts "with_getInfo_no_block = "  + with_getInfo_no_block.join(" *** ")
>>
>> Which gives:
>> with_getInfo_no_block = nameDaniel
>> SmithaffiliationsnameDISQUStypeworkyear0statusnid504602nameUC
>> Davistypecollegeyear0statusUndergradnid16777249nameVTbare,
>> Inc.typeworkyear0statusnid50432nameSan Francisco,
>>
>> CAtyperegionyear0statusnid67108894timezoneuid3205241proxied_emailsexprofile_urlhttp://www.facebook.com/profile.php?id=32052birthdaylast_nameSmithlocaleen_USfirst_nameDaniel
>> *** nameKendra JonesaffiliationsnameNew York,
>>
>> NYtyperegionyear0statusnid671086nameColumbiatypecollegeyear2003statusAlumnus/Alumnanid16777219timezone-5uid556167404proxied_emailsexfemaleprofile_urlhttp://www.facebook.com/profile.php?id=5561birthdayAugust
>> 25last_nameJoneslocaleen_USfirst_nameKendra *** nameNatalie
>> HanesaffiliationsnameUniversity of
>> Michigantypecollegeyear2001statusGrad Studentnid167058nameBrighton and
>>
>> Hovetyperegionyear0statusnid67914timezoneuid501410355proxied_emailsexprofile_urlhttp://www.facebook.com/s.php?k=100000080&amp;id=5012222birthdaylast_nameHaneslocaleen_GBfirst_nameNatalie
>> *** nameAllen EthanaffiliationsnameSpokane,
>>
>> WAtyperegionyear0statusnid67109timezoneuid687869280proxied_emailapps+55035481363.687869280.38074720380e9a5306b7e5c2910b070b at proxymail.facebook.comsexprofile_urlhttp://www.facebook.com/s.php?k=100000080&amp;id=687861111birthdaylast_nameEthanlocaleen_USfirst_nameAllen
>>
>> All the info I want is there, if a bit smashed together.  What am I
>> doing wrong?
>>
>> Lee Connell has mentioned that I should use an auth token.  What is
>> this?  Is it related to this problem I'm having?  I have a live app
>> doing offline API calls that seem to work fine without setting an auth
>> token, btw.
>>
>> Thanks in advance.
>>
>>
>>
>>
>>
>> On Fri, Feb 20, 2009 at 9:52 PM, Ethan Herdrick <herdrick at gmail.com>
>> wrote:
>>>
>>> Thanks, Lee!
>>>
>>> But Facebooker::Session doesn't have a populate method.  I've tried
>>> Facebooker::Session.users, but it breaks, claiming my session key is
>>> invalid.  Not sure what's going on there.
>>>
>>> -Ethan
>>>
>>> On Fri, Feb 20, 2009 at 7:35 AM, Lee Connell <lee.a.connell at gmail.com>
>>> wrote:
>>>>
>>>> you get it through calling the method populate on your facebook session,
>>>> passing it arguments of what fields you want, lilke :name, :last_name,
>>>> :uid
>>>> etc... then you access it through the user object, "session.user.name,
>>>> session.user.last_name" I don't have the code i was working on in front
>>>> of
>>>> me but that should get you started.
>>>>
>>>> On Thu, Feb 19, 2009 at 3:46 AM, Ethan Herdrick <herdrick at gmail.com>
>>>> wrote:
>>>>>
>>>>> Where is Facebooker's wrapper of the FB API Users.getInfo ?
>>>>>
>>>>> (http://wiki.developers.facebook.com/index.php/Users.getInfo)
>>>>>
>>>>> Thanks!
>>>>> _______________________________________________
>>>>> Facebooker-talk mailing list
>>>>> Facebooker-talk at rubyforge.org
>>>>> http://rubyforge.org/mailman/listinfo/facebooker-talk
>>>>
>> _______________________________________________
>> Facebooker-talk mailing list
>> Facebooker-talk at rubyforge.org
>> http://rubyforge.org/mailman/listinfo/facebooker-talk
>>
>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk
>

From herdrick at gmail.com  Sun Feb 22 17:07:20 2009
From: herdrick at gmail.com (Ethan Herdrick)
Date: Sun, 22 Feb 2009 14:07:20 -0800
Subject: [Facebooker-talk] auth_token?
Message-ID: <91f48dbf0902221407k7396392bp84a5d3f697a1254a@mail.gmail.com>

In another thread, Lee Connell has mentioned that I should use an auth
token.  What is this?  I have a live app doing offline API calls that
seem to work fine without setting an auth token, btw.

From herdrick at gmail.com  Mon Feb 23 04:13:44 2009
From: herdrick at gmail.com (Ethan Herdrick)
Date: Mon, 23 Feb 2009 01:13:44 -0800
Subject: [Facebooker-talk] auth_token?
In-Reply-To: <91f48dbf0902221407k7396392bp84a5d3f697a1254a@mail.gmail.com>
References: <91f48dbf0902221407k7396392bp84a5d3f697a1254a@mail.gmail.com>
Message-ID: <91f48dbf0902230113i20db13fftf68cd8ead4af7285@mail.gmail.com>

Correction: Lee wasn't convinced that auth token was necessarily
either.   But I'm having intermittent problems when using infinite
session keys.  Is my non-use of the auth token the reason?

Thanks in advance.


On Sun, Feb 22, 2009 at 2:07 PM, Ethan Herdrick <herdrick at gmail.com> wrote:
> In another thread, Lee Connell has mentioned that I should use an auth
> token.  What is this?  I have a live app doing offline API calls that
> seem to work fine without setting an auth token, btw.
>

From digidigo at gmail.com  Mon Feb 23 13:41:21 2009
From: digidigo at gmail.com (David Clements)
Date: Mon, 23 Feb 2009 11:41:21 -0700
Subject: [Facebooker-talk] Facebook Connect and Logging out of my app
Message-ID: <ea9161c50902231041t30dc4a60t4bbdda6a0d4789af@mail.gmail.com>

I am trying to figure out how to successfully end a Facebook connect session
in my application.


User logs in with Facebook Connect
Does stuff
Hits my Logout button
All looks good
Hits refresh and they are logged back in.  I assume this is because Facebook
connect has set the cookie for me again.


I looked at FB.Connect.Logout but this logs the user out of Facebook as well
and that doesn't seem right.

I am hoping that I am missing something simple here.

Any thoughts?

Thanks,
Dave
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090223/3113000a/attachment.html>

From klochner at gmail.com  Mon Feb 23 14:08:08 2009
From: klochner at gmail.com (kevin lochner)
Date: Mon, 23 Feb 2009 14:08:08 -0500
Subject: [Facebooker-talk] Facebook Connect and Logging out of my app
In-Reply-To: <ea9161c50902231041t30dc4a60t4bbdda6a0d4789af@mail.gmail.com>
References: <ea9161c50902231041t30dc4a60t4bbdda6a0d4789af@mail.gmail.com>
Message-ID: <24494A19-E983-4DDD-98B9-87F7FAE03E7D@gmail.com>


On Feb 23, 2009, at 1:41 PM, David Clements wrote:

> I am trying to figure out how to successfully end a Facebook connect  
> session in my application.
>
> I looked at FB.Connect.Logout but this logs the user out of Facebook  
> as well and that doesn't seem right.
>

That is right.  FB Connect policy is that if the user is logged into  
facebook they are also logged into all authorized fb connect apps.



From digidigo at gmail.com  Mon Feb 23 14:11:57 2009
From: digidigo at gmail.com (David Clements)
Date: Mon, 23 Feb 2009 12:11:57 -0700
Subject: [Facebooker-talk] Facebook Connect and Logging out of my app
In-Reply-To: <24494A19-E983-4DDD-98B9-87F7FAE03E7D@gmail.com>
References: <ea9161c50902231041t30dc4a60t4bbdda6a0d4789af@mail.gmail.com>
	<24494A19-E983-4DDD-98B9-87F7FAE03E7D@gmail.com>
Message-ID: <ea9161c50902231111i264d29f9ne49e5760efde55c6@mail.gmail.com>

Interesting.

So I guess I don't allow users who are logged in via connect to logout?

Or I send them to logout of Facebook?

Or is there a way to kill the session?

Dave


On Mon, Feb 23, 2009 at 12:08 PM, kevin lochner <klochner at gmail.com> wrote:

>
> On Feb 23, 2009, at 1:41 PM, David Clements wrote:
>
>  I am trying to figure out how to successfully end a Facebook connect
>> session in my application.
>>
>> I looked at FB.Connect.Logout but this logs the user out of Facebook as
>> well and that doesn't seem right.
>>
>>
> That is right.  FB Connect policy is that if the user is logged into
> facebook they are also logged into all authorized fb connect apps.
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090223/e17de1a6/attachment.html>

From klochner at gmail.com  Mon Feb 23 14:18:28 2009
From: klochner at gmail.com (kevin lochner)
Date: Mon, 23 Feb 2009 14:18:28 -0500
Subject: [Facebooker-talk] Facebook Connect and Logging out of my app
In-Reply-To: <ea9161c50902231111i264d29f9ne49e5760efde55c6@mail.gmail.com>
References: <ea9161c50902231041t30dc4a60t4bbdda6a0d4789af@mail.gmail.com>
	<24494A19-E983-4DDD-98B9-87F7FAE03E7D@gmail.com>
	<ea9161c50902231111i264d29f9ne49e5760efde55c6@mail.gmail.com>
Message-ID: <ACB5554F-B0A1-41ED-8531-8D077EB13987@gmail.com>

you log them out of facebook and your site with:
FB.Connect.Logout_and_redirect(<%= your_logout_url %>);

or just log them out of facebook without the redirect if you don't  
store any information.


On Feb 23, 2009, at 2:11 PM, David Clements wrote:

> Interesting.
>
> So I guess I don't allow users who are logged in via connect to  
> logout?
>
> Or I send them to logout of Facebook?
>
> Or is there a way to kill the session?
>
> Dave
>
>
> On Mon, Feb 23, 2009 at 12:08 PM, kevin lochner <klochner at gmail.com>  
> wrote:
>
> On Feb 23, 2009, at 1:41 PM, David Clements wrote:
>
> I am trying to figure out how to successfully end a Facebook connect  
> session in my application.
>
> I looked at FB.Connect.Logout but this logs the user out of Facebook  
> as well and that doesn't seem right.
>
>
> That is right.  FB Connect policy is that if the user is logged into  
> facebook they are also logged into all authorized fb connect apps.
>
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090223/31a37bbf/attachment.html>

From digidigo at gmail.com  Mon Feb 23 14:19:18 2009
From: digidigo at gmail.com (David Clements)
Date: Mon, 23 Feb 2009 12:19:18 -0700
Subject: [Facebooker-talk] Facebook Connect and Logging out of my app
In-Reply-To: <ACB5554F-B0A1-41ED-8531-8D077EB13987@gmail.com>
References: <ea9161c50902231041t30dc4a60t4bbdda6a0d4789af@mail.gmail.com>
	<24494A19-E983-4DDD-98B9-87F7FAE03E7D@gmail.com>
	<ea9161c50902231111i264d29f9ne49e5760efde55c6@mail.gmail.com>
	<ACB5554F-B0A1-41ED-8531-8D077EB13987@gmail.com>
Message-ID: <ea9161c50902231119p6c104c12v7a2262ea0802dc90@mail.gmail.com>

Cool thanks.. Let me give that a try.

Dave

On Mon, Feb 23, 2009 at 12:18 PM, kevin lochner <klochner at gmail.com> wrote:

> you log them out of facebook and your site with:FB.Connect.Logout_and_redirect(<%=
> your_logout_url %>);
>
> or just log them out of facebook without the redirect if you don't store
> any information.
>
>
>
> On Feb 23, 2009, at 2:11 PM, David Clements wrote:
>
> Interesting.
>
> So I guess I don't allow users who are logged in via connect to logout?
>
> Or I send them to logout of Facebook?
>
> Or is there a way to kill the session?
>
> Dave
>
>
> On Mon, Feb 23, 2009 at 12:08 PM, kevin lochner <klochner at gmail.com>wrote:
>
>>
>> On Feb 23, 2009, at 1:41 PM, David Clements wrote:
>>
>>  I am trying to figure out how to successfully end a Facebook connect
>>> session in my application.
>>>
>>> I looked at FB.Connect.Logout but this logs the user out of Facebook as
>>> well and that doesn't seem right.
>>>
>>>
>> That is right.  FB Connect policy is that if the user is logged into
>> facebook they are also logged into all authorized fb connect apps.
>>
>>
>>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090223/c5127e6a/attachment.html>

From digidigo at gmail.com  Mon Feb 23 19:04:46 2009
From: digidigo at gmail.com (David Clements)
Date: Mon, 23 Feb 2009 17:04:46 -0700
Subject: [Facebooker-talk] Facebook Connect and Logging out of my app
In-Reply-To: <ea9161c50902231119p6c104c12v7a2262ea0802dc90@mail.gmail.com>
References: <ea9161c50902231041t30dc4a60t4bbdda6a0d4789af@mail.gmail.com>
	<24494A19-E983-4DDD-98B9-87F7FAE03E7D@gmail.com>
	<ea9161c50902231111i264d29f9ne49e5760efde55c6@mail.gmail.com>
	<ACB5554F-B0A1-41ED-8531-8D077EB13987@gmail.com>
	<ea9161c50902231119p6c104c12v7a2262ea0802dc90@mail.gmail.com>
Message-ID: <ea9161c50902231604x383efd3fr2407f72a85478cbf@mail.gmail.com>

This worked great.

I ended up calling this javascript method on my logout button

 function logoutWithFacebook(url){
        logoutURL = url;
        FB.Connect.ifUserConnected(logoutFacebook, logoutNormal);
 };

function logoutFacebook(){
      FB.Connect.logoutAndRedirect(logoutURL);
  };

  function logoutNormal(){
       window.location.href = logoutURL;
   };

Dave

On Mon, Feb 23, 2009 at 12:19 PM, David Clements <digidigo at gmail.com> wrote:

> Cool thanks.. Let me give that a try.
>
> Dave
>
>
> On Mon, Feb 23, 2009 at 12:18 PM, kevin lochner <klochner at gmail.com>wrote:
>
>> you log them out of facebook and your site with:FB.Connect.Logout_and_redirect(<%=
>> your_logout_url %>);
>>
>> or just log them out of facebook without the redirect if you don't store
>> any information.
>>
>>
>>
>> On Feb 23, 2009, at 2:11 PM, David Clements wrote:
>>
>> Interesting.
>>
>> So I guess I don't allow users who are logged in via connect to logout?
>>
>> Or I send them to logout of Facebook?
>>
>> Or is there a way to kill the session?
>>
>> Dave
>>
>>
>> On Mon, Feb 23, 2009 at 12:08 PM, kevin lochner <klochner at gmail.com>wrote:
>>
>>>
>>> On Feb 23, 2009, at 1:41 PM, David Clements wrote:
>>>
>>>  I am trying to figure out how to successfully end a Facebook connect
>>>> session in my application.
>>>>
>>>> I looked at FB.Connect.Logout but this logs the user out of Facebook as
>>>> well and that doesn't seem right.
>>>>
>>>>
>>> That is right.  FB Connect policy is that if the user is logged into
>>> facebook they are also logged into all authorized fb connect apps.
>>>
>>>
>>>
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090223/7d9b1ea0/attachment.html>

From joe at pinkpucker.net  Mon Feb 23 19:27:11 2009
From: joe at pinkpucker.net (Joe Van Dyk)
Date: Mon, 23 Feb 2009 16:27:11 -0800
Subject: [Facebooker-talk] Starting new facebook rails app...
Message-ID: <c715e640902231627k4026b101o76864a42eb740a86@mail.gmail.com>

What version of Rails and Facebooker is currently recommended?

Joe

From akshay at mugasha.com  Mon Feb 23 20:07:15 2009
From: akshay at mugasha.com (Akshay Dodeja)
Date: Mon, 23 Feb 2009 17:07:15 -0800
Subject: [Facebooker-talk] Starting new facebook rails app...
In-Reply-To: <c715e640902231627k4026b101o76864a42eb740a86@mail.gmail.com>
References: <c715e640902231627k4026b101o76864a42eb740a86@mail.gmail.com>
Message-ID: <7E9F00F3-0294-4213-8DFF-652625FD0991@mugasha.com>

Rails 2.2.2 and latest build on github. I think the docs are for .9.9?



On Feb 23, 2009, at 4:27 PM, Joe Van Dyk wrote:

> What version of Rails and Facebooker is currently recommended?
>
> Joe
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk

Akshay Dodeja
CEO , Mugasha.com
E. akshay at mugasha.com
P. 408-203-7971

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090223/4ed72d12/attachment-0001.html>

From cjohnson at socialvibe.com  Mon Feb 23 21:42:12 2009
From: cjohnson at socialvibe.com (Chris Johnson)
Date: Mon, 23 Feb 2009 18:42:12 -0800
Subject: [Facebooker-talk] Retrieving an array of users given an array of
	uid's
Message-ID: <4632D257-8C6B-4C75-A43A-49B803CD7EC3@socialvibe.com>

Hi there.

Let's say I have a list of 20 uids (call it "cool_friends").  These  
are friends of the current user, and I'd like to retrieve User objects  
for each friend (so that I can access first_name and last_name).

I know I could do something like:
facebook_session.user.friends!(:uid, :first_name, :last_name)

With that full friend list, I can iterate over it and match users to  
the list of "cool_friends", but that seems cumbersome and pulls back  
more users (all friends) than I need.

Can I request an array of users based on a list of UIDs?

Cheers,
Chris

From cjohnson at socialvibe.com  Mon Feb 23 21:43:50 2009
From: cjohnson at socialvibe.com (Chris Johnson)
Date: Mon, 23 Feb 2009 18:43:50 -0800
Subject: [Facebooker-talk] Flex, facebooker,
	and sessions not being maintained
In-Reply-To: <613417.87205.qm@web33006.mail.mud.yahoo.com>
References: <a1d56cfe0902090847x6346531fw45edcc4376464b13@mail.gmail.com>
	<613417.87205.qm@web33006.mail.mud.yahoo.com>
Message-ID: <99E2C32A-E96D-45D2-982E-8182DF088263@socialvibe.com>

Aaron, I'd appreciate any pointers you might have on sessions in this  
case.

Cheers.


On Feb 9, 2009, at 1:12 PM, Aaron Nemoyten wrote:

> Brian,
>
> Chances are that the problem is a little weirder than you think.
>
> All calls that Flex makes should seem to originate from the same  
> page the app is embedded in.  So if you're talking about the session  
> being stored in the cookies, then you're relying on the browser's  
> cookie policy to get it right for you.
>
> Is this what you mean by 'session' - the Rails cookie-based session  
> data?
>
> I can give you some pointers on how to make it work correctly if  
> that's what's happening.  (Hint:  Don't rely on cookies at all.)
>
> -Aaron
>
>
> From: Brian Culler <brian at brianculler.com>
> To: facebooker-talk at rubyforge.org
> Sent: Monday, February 9, 2009 8:47:38 AM
> Subject: [Facebooker-talk] Flex, facebooker, and sessions not being  
> maintained
>
> I have a Flex based SWF being loaded with FBML into my facebook  
> application.   When the application is initially loaded and the SWF  
> is served up, a rails session is created.  At that request, I have a  
> full facebooker session object and everything is fine.
>
> However, on any subsequent *flex* requests back to our API (using  
> httpservice), it doesn't maintain that initial session setup when  
> the application first loaded.  It creates a new session, and the  
> fb_sig parameters are no where to be found.
>
> If I do a full browser refresh of the page though, it goes back and  
> uses that initial session that was created when the app first  
> loaded.  It would appear that the browser is working with rails  
> correctly to maintain the session, but since Flex doesn't send http  
> calls through the browser that way, it gets a new session any time  
> it makes a call by itself.
>
> Any ideas on how to go about making the Flex app be able to talk  
> back to the rails app and use the same initial session that was  
> created upon loading the app?
>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090223/14b3cbba/attachment.html>

From klochner at gmail.com  Mon Feb 23 22:51:48 2009
From: klochner at gmail.com (kevin lochner)
Date: Mon, 23 Feb 2009 22:51:48 -0500
Subject: [Facebooker-talk] Retrieving an array of users given an array
	of uid's
In-Reply-To: <4632D257-8C6B-4C75-A43A-49B803CD7EC3@socialvibe.com>
References: <4632D257-8C6B-4C75-A43A-49B803CD7EC3@socialvibe.com>
Message-ID: <AA96D4AC-D87D-42C9-998B-037CFD673E08@gmail.com>

facebook_session.users(ids, fields)


On Feb 23, 2009, at 9:42 PM, Chris Johnson wrote:

> Hi there.
>
> Let's say I have a list of 20 uids (call it "cool_friends").  These  
> are friends of the current user, and I'd like to retrieve User  
> objects for each friend (so that I can access first_name and  
> last_name).
>
> I know I could do something like:
> facebook_session.user.friends!(:uid, :first_name, :last_name)
>
> With that full friend list, I can iterate over it and match users to  
> the list of "cool_friends", but that seems cumbersome and pulls back  
> more users (all friends) than I need.
>
> Can I request an array of users based on a list of UIDs?
>
> Cheers,
> Chris
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk


From lee.a.connell at gmail.com  Tue Feb 24 11:14:06 2009
From: lee.a.connell at gmail.com (Lee Connell)
Date: Tue, 24 Feb 2009 11:14:06 -0500
Subject: [Facebooker-talk] Notifications
Message-ID: <c2bc197b0902240814k5cb930bcw9632782d8e986be0@mail.gmail.com>

 I would like to grab all notifications from facebook, but it doesn't seem
to support wall notifications, at least that's what it looks like in
documentation, is messages what you find in your inbox or is it considered a
wall message?

Attributes event_invites  [RW]
 friend_requests  [RW]
 group_invites  [RW]
 messages  [RW]
 pokes  [RW]
 shares  [RW]
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090224/8b6ee6a9/attachment.html>

From lee.a.connell at gmail.com  Tue Feb 24 11:46:49 2009
From: lee.a.connell at gmail.com (Lee Connell)
Date: Tue, 24 Feb 2009 11:46:49 -0500
Subject: [Facebooker-talk] Comments and Wall Messages
Message-ID: <c2bc197b0902240846vcdface2p27798b934e71e50@mail.gmail.com>

I don't see any options for retrieving either of these using facebooker, i
see that the php api allows you to retrieve comments, but I don't see wall
messages.  Is it recommended to get wall messages by subscribing to the RSS
feed?  Even then you wouldn't be able to get the actual message sent. Anyone
have any insight to this?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090224/0357ea0d/attachment.html>

From mjfreshyfresh at gmail.com  Tue Feb 24 15:04:59 2009
From: mjfreshyfresh at gmail.com (mjfreshyfresh)
Date: Tue, 24 Feb 2009 13:04:59 -0700
Subject: [Facebooker-talk] Comments and Wall Messages
In-Reply-To: <c2bc197b0902240846vcdface2p27798b934e71e50@mail.gmail.com>
References: <c2bc197b0902240846vcdface2p27798b934e71e50@mail.gmail.com>
Message-ID: <710447b70902241204t239dc30cy995fd5cf9e1c4195@mail.gmail.com>

Facebooker didn?t have the isFan method I needed so I added it and
sent a pull request.

If it?s missing something write tests, add it and send a pull request.

Goodluck-
MJ


On Tue, Feb 24, 2009 at 9:46 AM, Lee Connell <lee.a.connell at gmail.com> wrote:
> I don't see any options for retrieving either of these using facebooker, i
> see that the php api allows you to retrieve comments, but I don't see wall
> messages.  Is it recommended to get wall messages by subscribing to the RSS
> feed?  Even then you wouldn't be able to get the actual message sent. Anyone
> have any insight to this?
>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk
>
>

From chrisnolan.ca+rubyforge at gmail.com  Tue Feb 24 15:22:38 2009
From: chrisnolan.ca+rubyforge at gmail.com (Chris Nolan.ca)
Date: Tue, 24 Feb 2009 15:22:38 -0500
Subject: [Facebooker-talk] Comments and Wall Messages
In-Reply-To: <c2bc197b0902240846vcdface2p27798b934e71e50@mail.gmail.com>
References: <c2bc197b0902240846vcdface2p27798b934e71e50@mail.gmail.com>
Message-ID: <4f6b19c0902241222i519e1f7ft425bd393aaeb9cee@mail.gmail.com>

The Comments.get was just recently added to the api and hasn't really been
discussed yet (see the facebook platform fan page for a video showing you
how to use fb:comments, comments.get and Connect), so, as the other poster
said add it in for all to enjoy.

Wall posts are something else entirerly and you probably need to re-think
what you're trying to acommplish.

Eliminating layers between fan and creator, publisher and retailer
http://PullBot.com/
http://Kekova.ca/
http://ChrisNolan.ca/


On Tue, Feb 24, 2009 at 11:46, Lee Connell <lee.a.connell at gmail.com> wrote:

> I don't see any options for retrieving either of these using facebooker, i
> see that the php api allows you to retrieve comments, but I don't see wall
> messages.  Is it recommended to get wall messages by subscribing to the RSS
> feed?  Even then you wouldn't be able to get the actual message sent. Anyone
> have any insight to this?
>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090224/b234be31/attachment-0001.html>

From vincentchu at gmail.com  Tue Feb 24 20:06:55 2009
From: vincentchu at gmail.com (vincent chu)
Date: Tue, 24 Feb 2009 17:06:55 -0800
Subject: [Facebooker-talk] Possible Security Hole in Facebooker -- Please
	Update!
Message-ID: <ddc18b3e0902241706h67eca91ev25fee51f699665fe@mail.gmail.com>

Hi all ---

In the course of developing our Facebook connect app, we realized that there
was a  security hole in Facebooker that allows any malicious user to change
the state of the Facebooker module and crash any controller/view that uses
Facebooker to capture a Facebook session. For Facebook connect apps, this
could potentially be in any view that uses the "set_facebook_session"
before_filter.

All the malicious user has to do is send a malformed HTTP request similar
to:

http://my.rails.app.com/some_controller/?fb_sig_api_key=you_are_pwned

The problem comes in the 'set_adapter' method of
'facebooker/lib/facebooker/rails/controller.rb' where Facebooker will
attempt to load an adapter from the params hash if fb_sig_api_key is in the
request (ignoring the configuration found in the facebooker.yml file). In
this case, Facebooker would dutifully set the api_key to "you_are_pwned" and
any subsequent call to Facebooker would try and use "you_are_pwned" as the
api_key, causing it to crash the site.

Kevin Lochner's already pushed an update to github, so update to the latest
commit:

6a954874369354324d87b2fe09c24db4bd485faf
http://github.com/mmangino/facebooker/commit/6a954874369354324d87b2fe09c24db4bd485faf

Cheers,

Vince

----
Vincent Chu
Department of Applied Physics
Geballe Laboratory of Advanced Materials
McCullough Bldg. 318
476 Lomita Mall
Stanford, CA, 94305

Consider this:
"The smallest positive integer not definable in under eleven words."
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090224/97f76ad6/attachment.html>

From digidigo at gmail.com  Tue Feb 24 22:32:42 2009
From: digidigo at gmail.com (David Clements)
Date: Tue, 24 Feb 2009 20:32:42 -0700
Subject: [Facebooker-talk] Possible Security Hole in Facebooker --
	Please Update!
In-Reply-To: <ddc18b3e0902241706h67eca91ev25fee51f699665fe@mail.gmail.com>
References: <ddc18b3e0902241706h67eca91ev25fee51f699665fe@mail.gmail.com>
Message-ID: <ea9161c50902241932k5c402d2bg1bdd3329da6f6860@mail.gmail.com>

Does this change simply remove support for multiple adapters?

Dave



On Tue, Feb 24, 2009 at 6:06 PM, vincent chu <vincentchu at gmail.com> wrote:

> Hi all ---
>
> In the course of developing our Facebook connect app, we realized that
> there was a  security hole in Facebooker that allows any malicious user to
> change the state of the Facebooker module and crash any controller/view that
> uses Facebooker to capture a Facebook session. For Facebook connect apps,
> this could potentially be in any view that uses the "set_facebook_session"
> before_filter.
>
> All the malicious user has to do is send a malformed HTTP request similar
> to:
>
> http://my.rails.app.com/some_controller/?fb_sig_api_key=you_are_pwned
>
> The problem comes in the 'set_adapter' method of
> 'facebooker/lib/facebooker/rails/controller.rb' where Facebooker will
> attempt to load an adapter from the params hash if fb_sig_api_key is in the
> request (ignoring the configuration found in the facebooker.yml file). In
> this case, Facebooker would dutifully set the api_key to "you_are_pwned" and
> any subsequent call to Facebooker would try and use "you_are_pwned" as the
> api_key, causing it to crash the site.
>
> Kevin Lochner's already pushed an update to github, so update to the latest
> commit:
>
> 6a954874369354324d87b2fe09c24db4bd485faf
>
> http://github.com/mmangino/facebooker/commit/6a954874369354324d87b2fe09c24db4bd485faf
>
> Cheers,
>
> Vince
>
> ----
> Vincent Chu
> Department of Applied Physics
> Geballe Laboratory of Advanced Materials
> McCullough Bldg. 318
> 476 Lomita Mall
> Stanford, CA, 94305
>
> Consider this:
> "The smallest positive integer not definable in under eleven words."
>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090224/4a96e022/attachment.html>

From digidigo at gmail.com  Wed Feb 25 00:31:42 2009
From: digidigo at gmail.com (David Clements)
Date: Tue, 24 Feb 2009 22:31:42 -0700
Subject: [Facebooker-talk] Possible Security Hole in Facebooker --
	Please Update!
In-Reply-To: <ea9161c50902241932k5c402d2bg1bdd3329da6f6860@mail.gmail.com>
References: <ddc18b3e0902241706h67eca91ev25fee51f699665fe@mail.gmail.com>
	<ea9161c50902241932k5c402d2bg1bdd3329da6f6860@mail.gmail.com>
Message-ID: <ea9161c50902242131v5c67f618qf4f9a418fe3e568c@mail.gmail.com>

I forked the repo and fixed this issue without removing the functionality.

I sent a pull request from

http://github.com/digidigo/facebooker/tree/master

In the future I would appreciate a little more discretion around security
issues.  Publicizing it in this way required me to fix it immediately on my
production environment rather than being able to wait for morning.

Dave

On 2/24/09, David Clements <digidigo at gmail.com> wrote:
>
> Does this change simply remove support for multiple adapters?
>
> Dave
>
>
>
> On Tue, Feb 24, 2009 at 6:06 PM, vincent chu <vincentchu at gmail.com> wrote:
>
>> Hi all ---
>>
>> In the course of developing our Facebook connect app, we realized that
>> there was a  security hole in Facebooker that allows any malicious user to
>> change the state of the Facebooker module and crash any controller/view that
>> uses Facebooker to capture a Facebook session. For Facebook connect apps,
>> this could potentially be in any view that uses the "set_facebook_session"
>> before_filter.
>>
>> All the malicious user has to do is send a malformed HTTP request similar
>> to:
>>
>> http://my.rails.app.com/some_controller/?fb_sig_api_key=you_are_pwned
>>
>> The problem comes in the 'set_adapter' method of
>> 'facebooker/lib/facebooker/rails/controller.rb' where Facebooker will
>> attempt to load an adapter from the params hash if fb_sig_api_key is in the
>> request (ignoring the configuration found in the facebooker.yml file). In
>> this case, Facebooker would dutifully set the api_key to "you_are_pwned" and
>> any subsequent call to Facebooker would try and use "you_are_pwned" as the
>> api_key, causing it to crash the site.
>>
>> Kevin Lochner's already pushed an update to github, so update to the
>> latest commit:
>>
>> 6a954874369354324d87b2fe09c24db4bd485faf
>>
>> http://github.com/mmangino/facebooker/commit/6a954874369354324d87b2fe09c24db4bd485faf
>>
>> Cheers,
>>
>> Vince
>>
>> ----
>> Vincent Chu
>> Department of Applied Physics
>> Geballe Laboratory of Advanced Materials
>> McCullough Bldg. 318
>> 476 Lomita Mall
>> Stanford, CA, 94305
>>
>> Consider this:
>> "The smallest positive integer not definable in under eleven words."
>>
>> _______________________________________________
>> Facebooker-talk mailing list
>> Facebooker-talk at rubyforge.org
>> http://rubyforge.org/mailman/listinfo/facebooker-talk
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090224/c29ddd6f/attachment.html>

From mmangino at elevatedrails.com  Wed Feb 25 08:05:36 2009
From: mmangino at elevatedrails.com (Mike Mangino)
Date: Wed, 25 Feb 2009 08:05:36 -0500
Subject: [Facebooker-talk] Possible Security Hole in Facebooker --
	Please Update!
In-Reply-To: <ea9161c50902242131v5c67f618qf4f9a418fe3e568c@mail.gmail.com>
References: <ddc18b3e0902241706h67eca91ev25fee51f699665fe@mail.gmail.com>
	<ea9161c50902241932k5c402d2bg1bdd3329da6f6860@mail.gmail.com>
	<ea9161c50902242131v5c67f618qf4f9a418fe3e568c@mail.gmail.com>
Message-ID: <1C200E55-73DD-4DDA-82C3-39C6FA9E6BCC@elevatedrails.com>

How would you recommend this be handled? Vincent reported the issue  
privately last week and waited to publicly report it until a fix was  
in the main branch. It was my call to report it publicly now. Is there  
some way we can do this better?

Mike

On Feb 25, 2009, at 12:31 AM, David Clements wrote:

> I forked the repo and fixed this issue without removing the  
> functionality.
>
> I sent a pull request from
>
> http://github.com/digidigo/facebooker/tree/master
>
> In the future I would appreciate a little more discretion around  
> security issues.  Publicizing it in this way required me to fix it  
> immediately on my production environment rather than being able to  
> wait for morning.
>
> Dave
>
> On 2/24/09, David Clements <digidigo at gmail.com> wrote:
> Does this change simply remove support for multiple adapters?
>
> Dave
>
>
>
> On Tue, Feb 24, 2009 at 6:06 PM, vincent chu <vincentchu at gmail.com>  
> wrote:
> Hi all ---
>
> In the course of developing our Facebook connect app, we realized  
> that there was a  security hole in Facebooker that allows any  
> malicious user to change the state of the Facebooker module and  
> crash any controller/view that uses Facebooker to capture a Facebook  
> session. For Facebook connect apps, this could potentially be in any  
> view that uses the "set_facebook_session" before_filter.
>
> All the malicious user has to do is send a malformed HTTP request  
> similar to:
>
> http://my.rails.app.com/some_controller/?fb_sig_api_key=you_are_pwned
>
> The problem comes in the 'set_adapter' method of 'facebooker/lib/ 
> facebooker/rails/controller.rb' where Facebooker will attempt to  
> load an adapter from the params hash if fb_sig_api_key is in the  
> request (ignoring the configuration found in the facebooker.yml  
> file). In this case, Facebooker would dutifully set the api_key to  
> "you_are_pwned" and any subsequent call to Facebooker would try and  
> use "you_are_pwned" as the api_key, causing it to crash the site.
>
> Kevin Lochner's already pushed an update to github, so update to the  
> latest commit:
>
> 6a954874369354324d87b2fe09c24db4bd485faf
> http://github.com/mmangino/facebooker/commit/6a954874369354324d87b2fe09c24db4bd485faf
>
> Cheers,
>
> Vince
>
> ----
> Vincent Chu
> Department of Applied Physics
> Geballe Laboratory of Advanced Materials
> McCullough Bldg. 318
> 476 Lomita Mall
> Stanford, CA, 94305
>
> Consider this:
> "The smallest positive integer not definable in under eleven words."
>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk
>
>
>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk

--
Mike Mangino
http://www.elevatedrails.com



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090225/2917dba5/attachment-0001.html>

From digidigo at gmail.com  Wed Feb 25 10:55:42 2009
From: digidigo at gmail.com (David Clements)
Date: Wed, 25 Feb 2009 08:55:42 -0700
Subject: [Facebooker-talk] Possible Security Hole in Facebooker --
	Please Update!
In-Reply-To: <1C200E55-73DD-4DDA-82C3-39C6FA9E6BCC@elevatedrails.com>
References: <ddc18b3e0902241706h67eca91ev25fee51f699665fe@mail.gmail.com>
	<ea9161c50902241932k5c402d2bg1bdd3329da6f6860@mail.gmail.com>
	<ea9161c50902242131v5c67f618qf4f9a418fe3e568c@mail.gmail.com>
	<1C200E55-73DD-4DDA-82C3-39C6FA9E6BCC@elevatedrails.com>
Message-ID: <ea9161c50902250755s7856fc28xfe147d51afad514b@mail.gmail.com>

Sorry I was a little grumpy last night,  probably since I created the
security issue in the first place.

Not sure if I missed something like this but it would have helped me get on
top of it sooner if there was an email simply stating that there was a
security fix in the main branch.  Getting the email with the steps to
reproduce made it feel much more urgent to me.

This kinda hand holding is probably more important to me since I am
maintaining Facebook sites and not as active in development currently.  So I
am not watching what is going on in the branch.


What I should have said was,   Thanks for finding this and fixing it.  Sorry
about that.

Dave


On 2/25/09, Mike Mangino <mmangino at elevatedrails.com> wrote:
>
> How would you recommend this be handled? Vincent reported the issue
> privately last week and waited to publicly report it until a fix was in the
> main branch. It was my call to report it publicly now. Is there some way we
> can do this better?
> Mike
>
> On Feb 25, 2009, at 12:31 AM, David Clements wrote:
>
> I forked the repo and fixed this issue without removing the functionality.
>
> I sent a pull request from
>
> http://github.com/digidigo/facebooker/tree/master
>
> In the future I would appreciate a little more discretion around security
> issues.  Publicizing it in this way required me to fix it immediately on my
> production environment rather than being able to wait for morning.
>
> Dave
>
> On 2/24/09, David Clements <digidigo at gmail.com> wrote:
>>
>> Does this change simply remove support for multiple adapters?
>>
>> Dave
>>
>>
>>
>> On Tue, Feb 24, 2009 at 6:06 PM, vincent chu <vincentchu at gmail.com>wrote:
>>
>>> Hi all ---
>>>
>>> In the course of developing our Facebook connect app, we realized that
>>> there was a  security hole in Facebooker that allows any malicious user to
>>> change the state of the Facebooker module and crash any controller/view that
>>> uses Facebooker to capture a Facebook session. For Facebook connect apps,
>>> this could potentially be in any view that uses the "set_facebook_session"
>>> before_filter.
>>>
>>> All the malicious user has to do is send a malformed HTTP request similar
>>> to:
>>>
>>> http://my.rails.app.com/some_controller/?fb_sig_api_key=you_are_pwned
>>>
>>> The problem comes in the 'set_adapter' method of
>>> 'facebooker/lib/facebooker/rails/controller.rb' where Facebooker will
>>> attempt to load an adapter from the params hash if fb_sig_api_key is in the
>>> request (ignoring the configuration found in the facebooker.yml file). In
>>> this case, Facebooker would dutifully set the api_key to "you_are_pwned" and
>>> any subsequent call to Facebooker would try and use "you_are_pwned" as the
>>> api_key, causing it to crash the site.
>>>
>>> Kevin Lochner's already pushed an update to github, so update to the
>>> latest commit:
>>>
>>> 6a954874369354324d87b2fe09c24db4bd485faf
>>>
>>> http://github.com/mmangino/facebooker/commit/6a954874369354324d87b2fe09c24db4bd485faf
>>>
>>> Cheers,
>>>
>>> Vince
>>>
>>> ----
>>> Vincent Chu
>>> Department of Applied Physics
>>> Geballe Laboratory of Advanced Materials
>>> McCullough Bldg. 318
>>> 476 Lomita Mall
>>> Stanford, CA, 94305
>>>
>>> Consider this:
>>> "The smallest positive integer not definable in under eleven words."
>>>
>>> _______________________________________________
>>> Facebooker-talk mailing list
>>> Facebooker-talk at rubyforge.org
>>> http://rubyforge.org/mailman/listinfo/facebooker-talk
>>>
>>>
>>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk
>
>
>  --
> Mike Mangino
> http://www.elevatedrails.com
>
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090225/497ce083/attachment.html>

From digidigo at gmail.com  Wed Feb 25 11:00:40 2009
From: digidigo at gmail.com (David Clements)
Date: Wed, 25 Feb 2009 09:00:40 -0700
Subject: [Facebooker-talk] Possible Security Hole in Facebooker --
	Please Update!
In-Reply-To: <ddc18b3e0902241706h67eca91ev25fee51f699665fe@mail.gmail.com>
References: <ddc18b3e0902241706h67eca91ev25fee51f699665fe@mail.gmail.com>
Message-ID: <ea9161c50902250800y62fb1844hbc4384f089445b42@mail.gmail.com>

In case it got lost in my grumpiness last night.

The patch to fix this issue simply turned off adapter support.  Is that
correct?

I sent a pull request from my fork
http://github.com/digidigo/facebooker/tree/master  which should fix the
issue and preserve the behavior.  If anyone is using Facebooker to run
multiple apps or Bebo it would be great if you could check it out and make
sure that it didn't break.

Thanks,

Dave

On 2/24/09, vincent chu <vincentchu at gmail.com> wrote:
>
> Hi all ---
>
> In the course of developing our Facebook connect app, we realized that
> there was a  security hole in Facebooker that allows any malicious user to
> change the state of the Facebooker module and crash any controller/view that
> uses Facebooker to capture a Facebook session. For Facebook connect apps,
> this could potentially be in any view that uses the "set_facebook_session"
> before_filter.
>
> All the malicious user has to do is send a malformed HTTP request similar
> to:
>
> http://my.rails.app.com/some_controller/?fb_sig_api_key=you_are_pwned
>
> The problem comes in the 'set_adapter' method of
> 'facebooker/lib/facebooker/rails/controller.rb' where Facebooker will
> attempt to load an adapter from the params hash if fb_sig_api_key is in the
> request (ignoring the configuration found in the facebooker.yml file). In
> this case, Facebooker would dutifully set the api_key to "you_are_pwned" and
> any subsequent call to Facebooker would try and use "you_are_pwned" as the
> api_key, causing it to crash the site.
>
> Kevin Lochner's already pushed an update to github, so update to the latest
> commit:
>
> 6a954874369354324d87b2fe09c24db4bd485faf
>
> http://github.com/mmangino/facebooker/commit/6a954874369354324d87b2fe09c24db4bd485faf
>
> Cheers,
>
> Vince
>
> ----
> Vincent Chu
> Department of Applied Physics
> Geballe Laboratory of Advanced Materials
> McCullough Bldg. 318
> 476 Lomita Mall
> Stanford, CA, 94305
>
> Consider this:
> "The smallest positive integer not definable in under eleven words."
>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090225/7762bd70/attachment.html>

From hairxxx at gmail.com  Wed Feb 25 10:57:39 2009
From: hairxxx at gmail.com (Pesho)
Date: Wed, 25 Feb 2009 16:57:39 +0100
Subject: [Facebooker-talk] passing an object to Ajax callback functions
Message-ID: <380578110902250757w4382284al98e3c1762863ce23@mail.gmail.com>

Hello guys,

As far as I understood, any Ajax calls we want to make should be addressed
directly to the callback server, and not to a canvas page.
This means that we cannot use any facebook-specific data (like the id of the
current user) in the function, which handles the Ajax call. I would
appreciate if you could tell me a convenient way to pass the facebook_user
object to the function, which handles the Ajax call...
I am a bit new to Ruby on Rails, so I'll be grateful if you can also write a
small example.

THANKS!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090225/da6fd585/attachment.html>

From klochner at gmail.com  Wed Feb 25 12:02:44 2009
From: klochner at gmail.com (kevin lochner)
Date: Wed, 25 Feb 2009 12:02:44 -0500
Subject: [Facebooker-talk] Possible Security Hole in Facebooker --
	Please Update!
In-Reply-To: <ea9161c50902250800y62fb1844hbc4384f089445b42@mail.gmail.com>
References: <ddc18b3e0902241706h67eca91ev25fee51f699665fe@mail.gmail.com>
	<ea9161c50902250800y62fb1844hbc4384f089445b42@mail.gmail.com>
Message-ID: <37333E54-76B8-4D9D-BFFE-95E78289FCA1@gmail.com>

I was short on time and unfamiliar with the code when I put the fix  
in, which is why I went with the nuclear option of removing the before  
filter.   I was a little surprised to see all tests passing with the  
before filter removed.

In addition to user-verification of the fix, we could use a test  
breaking the old version and working under david's new patch.   
Unfortunately I'm low on spare cycles . . .

  - kevin

On Feb 25, 2009, at 11:00 AM, David Clements wrote:

> In case it got lost in my grumpiness last night.
>
> The patch to fix this issue simply turned off adapter support.  Is  
> that correct?
>
> I sent a pull request from my fork http://github.com/digidigo/facebooker/tree/master 
>   which should fix the issue and preserve the behavior.  If anyone  
> is using Facebooker to run multiple apps or Bebo it would be great  
> if you could check it out and make sure that it didn't break.
>
> Thanks,
>
> Dave
>
> On 2/24/09, vincent chu <vincentchu at gmail.com> wrote:
> Hi all ---
>
> In the course of developing our Facebook connect app, we realized  
> that there was a  security hole in Facebooker that allows any  
> malicious user to change the state of the Facebooker module and  
> crash any controller/view that uses Facebooker to capture a Facebook  
> session. For Facebook connect apps, this could potentially be in any  
> view that uses the "set_facebook_session" before_filter.
>
> All the malicious user has to do is send a malformed HTTP request  
> similar to:
>
> http://my.rails.app.com/some_controller/?fb_sig_api_key=you_are_pwned
>
> The problem comes in the 'set_adapter' method of 'facebooker/lib/ 
> facebooker/rails/controller.rb' where Facebooker will attempt to  
> load an adapter from the params hash if fb_sig_api_key is in the  
> request (ignoring the configuration found in the facebooker.yml  
> file). In this case, Facebooker would dutifully set the api_key to  
> "you_are_pwned" and any subsequent call to Facebooker would try and  
> use "you_are_pwned" as the api_key, causing it to crash the site.
>
> Kevin Lochner's already pushed an update to github, so update to the  
> latest commit:
>
> 6a954874369354324d87b2fe09c24db4bd485faf
> http://github.com/mmangino/facebooker/commit/6a954874369354324d87b2fe09c24db4bd485faf
>
> Cheers,
>
> Vince
>
> ----
> Vincent Chu
> Department of Applied Physics
> Geballe Laboratory of Advanced Materials
> McCullough Bldg. 318
> 476 Lomita Mall
> Stanford, CA, 94305
>
> Consider this:
> "The smallest positive integer not definable in under eleven words."
>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk
>
>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090225/f19d7831/attachment-0001.html>

From vincentchu at gmail.com  Wed Feb 25 12:53:57 2009
From: vincentchu at gmail.com (vincent chu)
Date: Wed, 25 Feb 2009 09:53:57 -0800
Subject: [Facebooker-talk] Possible Security Hole in Facebooker --
	Please Update!
In-Reply-To: <37333E54-76B8-4D9D-BFFE-95E78289FCA1@gmail.com>
References: <ddc18b3e0902241706h67eca91ev25fee51f699665fe@mail.gmail.com>
	<ea9161c50902250800y62fb1844hbc4384f089445b42@mail.gmail.com>
	<37333E54-76B8-4D9D-BFFE-95E78289FCA1@gmail.com>
Message-ID: <ddc18b3e0902250953i29d57220v5ce89be6278a45a3@mail.gmail.com>

Hi David ---

I took a look at your fix. Though I'm somewhat unfamiliar with exactly what
you want to do, I think it would be prudent to validate that the incoming
params hash actually originates from facebook before using the parameters to
reset the adapter. This way, you never touch the adapter until you're sure
that it's Facebook sending the request, and not some malicious actor.

Cheers,

Vince
----
Vincent Chu
Department of Applied Physics
Geballe Laboratory of Advanced Materials
McCullough Bldg. 318
476 Lomita Mall
Stanford, CA, 94305


Consider this:
"The smallest positive integer not definable in under eleven words."


On Wed, Feb 25, 2009 at 9:02 AM, kevin lochner <klochner at gmail.com> wrote:

> I was short on time and unfamiliar with the code when I put the fix in,
> which is why I went with the nuclear option of removing the before filter.
> I was a little surprised to see all tests passing with the before filter
> removed.
> In addition to user-verification of the fix, we could use a test breaking
> the old version and working under david's new patch.  Unfortunately I'm low
> on spare cycles . . .
>
>  - kevin
>
>
> On Feb 25, 2009, at 11:00 AM, David Clements wrote:
>
> In case it got lost in my grumpiness last night.
>
> The patch to fix this issue simply turned off adapter support.  Is that
> correct?
>
> I sent a pull request from my fork
> http://github.com/digidigo/facebooker/tree/master  which should fix the
> issue and preserve the behavior.  If anyone is using Facebooker to run
> multiple apps or Bebo it would be great if you could check it out and make
> sure that it didn't break.
>
> Thanks,
>
> Dave
>
> On 2/24/09, vincent chu <vincentchu at gmail.com> wrote:
>>
>> Hi all ---
>>
>> In the course of developing our Facebook connect app, we realized that
>> there was a  security hole in Facebooker that allows any malicious user to
>> change the state of the Facebooker module and crash any controller/view that
>> uses Facebooker to capture a Facebook session. For Facebook connect apps,
>> this could potentially be in any view that uses the "set_facebook_session"
>> before_filter.
>>
>> All the malicious user has to do is send a malformed HTTP request similar
>> to:
>>
>> http://my.rails.app.com/some_controller/?fb_sig_api_key=you_are_pwned
>>
>> The problem comes in the 'set_adapter' method of
>> 'facebooker/lib/facebooker/rails/controller.rb' where Facebooker will
>> attempt to load an adapter from the params hash if fb_sig_api_key is in the
>> request (ignoring the configuration found in the facebooker.yml file). In
>> this case, Facebooker would dutifully set the api_key to "you_are_pwned" and
>> any subsequent call to Facebooker would try and use "you_are_pwned" as the
>> api_key, causing it to crash the site.
>>
>> Kevin Lochner's already pushed an update to github, so update to the
>> latest commit:
>>
>> 6a954874369354324d87b2fe09c24db4bd485faf
>>
>> http://github.com/mmangino/facebooker/commit/6a954874369354324d87b2fe09c24db4bd485faf
>>
>> Cheers,
>>
>> Vince
>>
>> ----
>> Vincent Chu
>> Department of Applied Physics
>> Geballe Laboratory of Advanced Materials
>> McCullough Bldg. 318
>> 476 Lomita Mall
>> Stanford, CA, 94305
>>
>> Consider this:
>> "The smallest positive integer not definable in under eleven words."
>>
>> _______________________________________________
>> Facebooker-talk mailing list
>> Facebooker-talk at rubyforge.org
>> http://rubyforge.org/mailman/listinfo/facebooker-talk
>>
>>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk
>
>
>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090225/97334731/attachment.html>

From digidigo at gmail.com  Wed Feb 25 13:10:39 2009
From: digidigo at gmail.com (David Clements)
Date: Wed, 25 Feb 2009 11:10:39 -0700
Subject: [Facebooker-talk] Possible Security Hole in Facebooker --
	Please Update!
In-Reply-To: <ddc18b3e0902250953i29d57220v5ce89be6278a45a3@mail.gmail.com>
References: <ddc18b3e0902241706h67eca91ev25fee51f699665fe@mail.gmail.com>
	<ea9161c50902250800y62fb1844hbc4384f089445b42@mail.gmail.com>
	<37333E54-76B8-4D9D-BFFE-95E78289FCA1@gmail.com>
	<ddc18b3e0902250953i29d57220v5ce89be6278a45a3@mail.gmail.com>
Message-ID: <ea9161c50902251010k3c8c0046s6e70a25df523e3b@mail.gmail.com>

Cool thanks for taking a look.  Looks like I can just add a condition to
that call

if request_comes_from_facebook?

I'll try to get to it later today.

Dave

On 2/25/09, vincent chu <vincentchu at gmail.com> wrote:
>
> Hi David ---
>
> I took a look at your fix. Though I'm somewhat unfamiliar with exactly what
> you want to do, I think it would be prudent to validate that the incoming
> params hash actually originates from facebook before using the parameters to
> reset the adapter. This way, you never touch the adapter until you're sure
> that it's Facebook sending the request, and not some malicious actor.
>
> Cheers,
>
> Vince
> ----
> Vincent Chu
> Department of Applied Physics
> Geballe Laboratory of Advanced Materials
> McCullough Bldg. 318
> 476 Lomita Mall
> Stanford, CA, 94305
>
>
> Consider this:
> "The smallest positive integer not definable in under eleven words."
>
>
> On Wed, Feb 25, 2009 at 9:02 AM, kevin lochner <klochner at gmail.com> wrote:
>
>> I was short on time and unfamiliar with the code when I put the fix in,
>> which is why I went with the nuclear option of removing the before filter.
>> I was a little surprised to see all tests passing with the before filter
>> removed.
>> In addition to user-verification of the fix, we could use a test breaking
>> the old version and working under david's new patch.  Unfortunately I'm low
>> on spare cycles . . .
>>
>>  - kevin
>>
>>
>> On Feb 25, 2009, at 11:00 AM, David Clements wrote:
>>
>> In case it got lost in my grumpiness last night.
>>
>> The patch to fix this issue simply turned off adapter support.  Is that
>> correct?
>>
>> I sent a pull request from my fork
>> http://github.com/digidigo/facebooker/tree/master  which should fix the
>> issue and preserve the behavior.  If anyone is using Facebooker to run
>> multiple apps or Bebo it would be great if you could check it out and make
>> sure that it didn't break.
>>
>> Thanks,
>>
>> Dave
>>
>> On 2/24/09, vincent chu <vincentchu at gmail.com> wrote:
>>>
>>> Hi all ---
>>>
>>> In the course of developing our Facebook connect app, we realized that
>>> there was a  security hole in Facebooker that allows any malicious user to
>>> change the state of the Facebooker module and crash any controller/view that
>>> uses Facebooker to capture a Facebook session. For Facebook connect apps,
>>> this could potentially be in any view that uses the "set_facebook_session"
>>> before_filter.
>>>
>>> All the malicious user has to do is send a malformed HTTP request similar
>>> to:
>>>
>>> http://my.rails.app.com/some_controller/?fb_sig_api_key=you_are_pwned
>>>
>>> The problem comes in the 'set_adapter' method of
>>> 'facebooker/lib/facebooker/rails/controller.rb' where Facebooker will
>>> attempt to load an adapter from the params hash if fb_sig_api_key is in the
>>> request (ignoring the configuration found in the facebooker.yml file). In
>>> this case, Facebooker would dutifully set the api_key to "you_are_pwned" and
>>> any subsequent call to Facebooker would try and use "you_are_pwned" as the
>>> api_key, causing it to crash the site.
>>>
>>> Kevin Lochner's already pushed an update to github, so update to the
>>> latest commit:
>>>
>>> 6a954874369354324d87b2fe09c24db4bd485faf
>>>
>>> http://github.com/mmangino/facebooker/commit/6a954874369354324d87b2fe09c24db4bd485faf
>>>
>>> Cheers,
>>>
>>> Vince
>>>
>>> ----
>>> Vincent Chu
>>> Department of Applied Physics
>>> Geballe Laboratory of Advanced Materials
>>> McCullough Bldg. 318
>>> 476 Lomita Mall
>>> Stanford, CA, 94305
>>>
>>> Consider this:
>>> "The smallest positive integer not definable in under eleven words."
>>>
>>> _______________________________________________
>>> Facebooker-talk mailing list
>>> Facebooker-talk at rubyforge.org
>>> http://rubyforge.org/mailman/listinfo/facebooker-talk
>>>
>>>
>> _______________________________________________
>> Facebooker-talk mailing list
>> Facebooker-talk at rubyforge.org
>> http://rubyforge.org/mailman/listinfo/facebooker-talk
>>
>>
>>
>> _______________________________________________
>> Facebooker-talk mailing list
>> Facebooker-talk at rubyforge.org
>> http://rubyforge.org/mailman/listinfo/facebooker-talk
>>
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090225/178641f7/attachment.html>

From klochner at gmail.com  Wed Feb 25 13:32:28 2009
From: klochner at gmail.com (kevin lochner)
Date: Wed, 25 Feb 2009 13:32:28 -0500
Subject: [Facebooker-talk] Possible Security Hole in Facebooker --
	Please Update!
In-Reply-To: <ea9161c50902251010k3c8c0046s6e70a25df523e3b@mail.gmail.com>
References: <ddc18b3e0902241706h67eca91ev25fee51f699665fe@mail.gmail.com>
	<ea9161c50902250800y62fb1844hbc4384f089445b42@mail.gmail.com>
	<37333E54-76B8-4D9D-BFFE-95E78289FCA1@gmail.com>
	<ddc18b3e0902250953i29d57220v5ce89be6278a45a3@mail.gmail.com>
	<ea9161c50902251010k3c8c0046s6e70a25df523e3b@mail.gmail.com>
Message-ID: <D844E2FD-8A9F-4630-B7AF-C7483C584A90@gmail.com>

I'm not convinced we have a good solution yet.  here's the relevant  
code:

>       def request_comes_from_facebook?
>         request_is_for_a_facebook_canvas? ||  
> request_is_facebook_ajax? || request_is_fb_ping?
>       end
>
>       def request_is_fb_ping?
>         !params['fb_sig'].blank?
>       end
>
>       def request_is_for_a_facebook_canvas?
>         !params['fb_sig_in_canvas'].blank?
>       end
>
>       def request_is_facebook_ajax?
>         params["fb_sig_is_mockajax"]=="1" ||  
> params["fb_sig_is_ajax"]=="1"
>       end
>

So calling request_comes_from_facebook isn't really a security  
feature, and doesn't change the behavior w.r.t. the test case that  
vince outlined, since they could just as easily fake params["fb_sig"]

>>
>> All the malicious user has to do is send a malformed HTTP request  
>> similar to:
>>
>> http://my.rails.app.com/some_controller/?fb_sig_api_key=you_are_pwned

I think the before filter should be:

       def set_adapter
         Facebooker.load_adapter(facebook_params)  
if(params[:fb_sig_api_key])
       end

since facebook_params calls verify_signature & ensures the request  
comes from facebook.

Alternatively, we could be verify the params signature in  
request_comes_from_facebook.  That may be a better solution since the  
request_comes_from_facebook method is a little misleading (as david  
has just demonstrated).

Also, we throw an exception on a bad signature, so we should have a  
catch somewhere in the process.

- kevin




On Feb 25, 2009, at 1:10 PM, David Clements wrote:

> Cool thanks for taking a look.  Looks like I can just add a  
> condition to that call
>
> if request_comes_from_facebook?
>
> I'll try to get to it later today.
>
> Dave
>
> On 2/25/09, vincent chu <vincentchu at gmail.com> wrote:
> Hi David ---
>
> I took a look at your fix. Though I'm somewhat unfamiliar with  
> exactly what you want to do, I think it would be prudent to validate  
> that the incoming params hash actually originates from facebook  
> before using the parameters to reset the adapter. This way, you  
> never touch the adapter until you're sure that it's Facebook sending  
> the request, and not some malicious actor.
>
> Cheers,
>
> Vince
> ----
>
>
>>
>>
>> On 2/24/09, vincent chu <vincentchu at gmail.com> wrote:
>> Hi all ---
>>
>> In the course of developing our Facebook connect app, we realized  
>> that there was a  security hole in Facebooker that allows any  
>> malicious user to change the state of the Facebooker module and  
>> crash any controller/view that uses Facebooker to capture a  
>> Facebook session. For Facebook connect apps, this could potentially  
>> be in any view that uses the "set_facebook_session" before_filter.
>>
>> All the malicious user has to do is send a malformed HTTP request  
>> similar to:
>>
>> http://my.rails.app.com/some_controller/?fb_sig_api_key=you_are_pwned
>>
>> The problem comes in the 'set_adapter' method of 'facebooker/lib/ 
>> facebooker/rails/controller.rb' where Facebooker will attempt to  
>> load an adapter from the params hash if fb_sig_api_key is in the  
>> request (ignoring the configuration found in the facebooker.yml  
>> file). In this case, Facebooker would dutifully set the api_key to  
>> "you_are_pwned" and any subsequent call to Facebooker would try and  
>> use "you_are_pwned" as the api_key, causing it to crash the site.
>
>
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090225/4b9e5275/attachment-0001.html>

From mmangino at elevatedrails.com  Wed Feb 25 14:07:52 2009
From: mmangino at elevatedrails.com (Mike Mangino)
Date: Wed, 25 Feb 2009 14:07:52 -0500
Subject: [Facebooker-talk] Possible Security Hole in Facebooker --
	Please Update!
In-Reply-To: <D844E2FD-8A9F-4630-B7AF-C7483C584A90@gmail.com>
References: <ddc18b3e0902241706h67eca91ev25fee51f699665fe@mail.gmail.com>
	<ea9161c50902250800y62fb1844hbc4384f089445b42@mail.gmail.com>
	<37333E54-76B8-4D9D-BFFE-95E78289FCA1@gmail.com>
	<ddc18b3e0902250953i29d57220v5ce89be6278a45a3@mail.gmail.com>
	<ea9161c50902251010k3c8c0046s6e70a25df523e3b@mail.gmail.com>
	<D844E2FD-8A9F-4630-B7AF-C7483C584A90@gmail.com>
Message-ID: <33798715-9515-4777-8261-C12F737AB0F9@elevatedrails.com>

Do we need to know which adapter to use before we can verify the  
params? Don't other implementation use different params?

Maybe we could require each adapter to verify that the request is  
valid. Would that fix this issue?

Mike


On Feb 25, 2009, at 1:32 PM, kevin lochner wrote:

> I'm not convinced we have a good solution yet.  here's the relevant  
> code:
>
>>       def request_comes_from_facebook?
>>         request_is_for_a_facebook_canvas? ||  
>> request_is_facebook_ajax? || request_is_fb_ping?
>>       end
>>
>>       def request_is_fb_ping?
>>         !params['fb_sig'].blank?
>>       end
>>
>>       def request_is_for_a_facebook_canvas?
>>         !params['fb_sig_in_canvas'].blank?
>>       end
>>
>>       def request_is_facebook_ajax?
>>         params["fb_sig_is_mockajax"]=="1" ||  
>> params["fb_sig_is_ajax"]=="1"
>>       end
>>
>
> So calling request_comes_from_facebook isn't really a security  
> feature, and doesn't change the behavior w.r.t. the test case that  
> vince outlined, since they could just as easily fake params["fb_sig"]
>
>>>
>>> All the malicious user has to do is send a malformed HTTP request  
>>> similar to:
>>>
>>> http://my.rails.app.com/some_controller/? 
>>> fb_sig_api_key=you_are_pwned
>
> I think the before filter should be:
>
>       def set_adapter
>         Facebooker.load_adapter(facebook_params)  
> if(params[:fb_sig_api_key])
>       end
>
> since facebook_params calls verify_signature & ensures the request  
> comes from facebook.
>
> Alternatively, we could be verify the params signature in  
> request_comes_from_facebook.  That may be a better solution since  
> the request_comes_from_facebook method is a little misleading (as  
> david has just demonstrated).
>
> Also, we throw an exception on a bad signature, so we should have a  
> catch somewhere in the process.
>
> - kevin
>
>
>
>
> On Feb 25, 2009, at 1:10 PM, David Clements wrote:
>
>> Cool thanks for taking a look.  Looks like I can just add a  
>> condition to that call
>>
>> if request_comes_from_facebook?
>>
>> I'll try to get to it later today.
>>
>> Dave
>>
>> On 2/25/09, vincent chu <vincentchu at gmail.com> wrote:
>> Hi David ---
>>
>> I took a look at your fix. Though I'm somewhat unfamiliar with  
>> exactly what you want to do, I think it would be prudent to  
>> validate that the incoming params hash actually originates from  
>> facebook before using the parameters to reset the adapter. This  
>> way, you never touch the adapter until you're sure that it's  
>> Facebook sending the request, and not some malicious actor.
>>
>> Cheers,
>>
>> Vince
>> ----
>>
>>
>>>
>>>
>>> On 2/24/09, vincent chu <vincentchu at gmail.com> wrote:
>>> Hi all ---
>>>
>>> In the course of developing our Facebook connect app, we realized  
>>> that there was a  security hole in Facebooker that allows any  
>>> malicious user to change the state of the Facebooker module and  
>>> crash any controller/view that uses Facebooker to capture a  
>>> Facebook session. For Facebook connect apps, this could  
>>> potentially be in any view that uses the "set_facebook_session"  
>>> before_filter.
>>>
>>> All the malicious user has to do is send a malformed HTTP request  
>>> similar to:
>>>
>>> http://my.rails.app.com/some_controller/? 
>>> fb_sig_api_key=you_are_pwned
>>>
>>> The problem comes in the 'set_adapter' method of 'facebooker/lib/ 
>>> facebooker/rails/controller.rb' where Facebooker will attempt to  
>>> load an adapter from the params hash if fb_sig_api_key is in the  
>>> request (ignoring the configuration found in the facebooker.yml  
>>> file). In this case, Facebooker would dutifully set the api_key to  
>>> "you_are_pwned" and any subsequent call to Facebooker would try  
>>> and use "you_are_pwned" as the api_key, causing it to crash the  
>>> site.
>>
>>
>>
>>
>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk

--
Mike Mangino
http://www.elevatedrails.com



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090225/f472b09c/attachment.html>

From digidigo at gmail.com  Wed Feb 25 14:13:46 2009
From: digidigo at gmail.com (David Clements)
Date: Wed, 25 Feb 2009 12:13:46 -0700
Subject: [Facebooker-talk] Possible Security Hole in Facebooker --
	Please Update!
In-Reply-To: <33798715-9515-4777-8261-C12F737AB0F9@elevatedrails.com>
References: <ddc18b3e0902241706h67eca91ev25fee51f699665fe@mail.gmail.com>
	<ea9161c50902250800y62fb1844hbc4384f089445b42@mail.gmail.com>
	<37333E54-76B8-4D9D-BFFE-95E78289FCA1@gmail.com>
	<ddc18b3e0902250953i29d57220v5ce89be6278a45a3@mail.gmail.com>
	<ea9161c50902251010k3c8c0046s6e70a25df523e3b@mail.gmail.com>
	<D844E2FD-8A9F-4630-B7AF-C7483C584A90@gmail.com>
	<33798715-9515-4777-8261-C12F737AB0F9@elevatedrails.com>
Message-ID: <ea9161c50902251113k56339268nfe499940234edad4@mail.gmail.com>

I don't think I am clear anymore what the risk is of loading an adapter from
some malicious attack?   Before adapters there was simply one config.  All
the adapter does is allow for multiple configs.

What are we trying to protect against?


Dave

On Wed, Feb 25, 2009 at 12:07 PM, Mike Mangino
<mmangino at elevatedrails.com>wrote:

> Do we need to know which adapter to use before we can verify the params?
> Don't other implementation use different params?
> Maybe we could require each adapter to verify that the request is valid.
> Would that fix this issue?
>
> Mike
>
>
> On Feb 25, 2009, at 1:32 PM, kevin lochner wrote:
>
> I'm not convinced we have a good solution yet.  here's the relevant code:
>
>       def request_comes_from_facebook?
>         request_is_for_a_facebook_canvas? || request_is_facebook_ajax? ||
> request_is_fb_ping?
>       end
>
>       def request_is_fb_ping?
>         !params['fb_sig'].blank?
>       end
>
>       def request_is_for_a_facebook_canvas?
>         !params['fb_sig_in_canvas'].blank?
>       end
>
>       def request_is_facebook_ajax?
>         params["fb_sig_is_mockajax"]=="1" || params["fb_sig_is_ajax"]=="1"
>       end
>
>
> So calling request_comes_from_facebook isn't really a security feature, and
> doesn't change the behavior w.r.t. the test case that vince outlined, since
> they could just as easily fake params["fb_sig"]
>
>
> All the malicious user has to do is send a malformed HTTP request similar
> to:
>
> http://my.rails.app.com/some_controller/?fb_sig_api_key=you_are_pwned
>
>
> I think the before filter should be:
>
> *      def set_adapter*
> *        Facebooker.load_adapter(facebook_params)
> if(params[:fb_sig_api_key])*
> *      end*
>
> since facebook_params calls verify_signature & ensures the request comes
> from facebook.
>
> Alternatively, we could be verify the params signature in
> request_comes_from_facebook.  That may be a better solution since the
> request_comes_from_facebook method is a little misleading (as david has just
> demonstrated).
>
> Also, we throw an exception on a bad signature, so we should have a catch
> somewhere in the process.
>
> - kevin
>
>
>
>
> On Feb 25, 2009, at 1:10 PM, David Clements wrote:
>
> Cool thanks for taking a look.  Looks like I can just add a condition to
> that call
>
> if request_comes_from_facebook?
>
> I'll try to get to it later today.
>
> Dave
>
> On 2/25/09, vincent chu <vincentchu at gmail.com> wrote:
>>
>> Hi David ---
>>
>> I took a look at your fix. Though I'm somewhat unfamiliar with exactly
>> what you want to do, I think it would be prudent to validate that the
>> incoming params hash actually originates from facebook before using the
>> parameters to reset the adapter. This way, you never touch the adapter until
>> you're sure that it's Facebook sending the request, and not some malicious
>> actor.
>>
>> Cheers,
>>
>> Vince
>> ----
>>
>>
>>>
>>>
>>> On 2/24/09, vincent chu <vincentchu at gmail.com> wrote:
>>>>
>>>> Hi all ---
>>>>
>>>> In the course of developing our Facebook connect app, we realized that
>>>> there was a  security hole in Facebooker that allows any malicious user to
>>>> change the state of the Facebooker module and crash any controller/view that
>>>> uses Facebooker to capture a Facebook session. For Facebook connect apps,
>>>> this could potentially be in any view that uses the "set_facebook_session"
>>>> before_filter.
>>>>
>>>> All the malicious user has to do is send a malformed HTTP request
>>>> similar to:
>>>>
>>>> http://my.rails.app.com/some_controller/?fb_sig_api_key=you_are_pwned
>>>>
>>>> The problem comes in the 'set_adapter' method of
>>>> 'facebooker/lib/facebooker/rails/controller.rb' where Facebooker will
>>>> attempt to load an adapter from the params hash if fb_sig_api_key is in the
>>>> request (ignoring the configuration found in the facebooker.yml file). In
>>>> this case, Facebooker would dutifully set the api_key to "you_are_pwned" and
>>>> any subsequent call to Facebooker would try and use "you_are_pwned" as the
>>>> api_key, causing it to crash the site.
>>>>
>>>
>>>
>>>
>>
>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk
>
>
> --
> Mike Mangino
> http://www.elevatedrails.com
>
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090225/580dd842/attachment.html>

From mixonic at synitech.com  Wed Feb 25 14:19:41 2009
From: mixonic at synitech.com (Matthew Beale)
Date: Wed, 25 Feb 2009 14:19:41 -0500
Subject: [Facebooker-talk] Possible Security Hole in Facebooker
	--	Please Update!
In-Reply-To: <ea9161c50902251113k56339268nfe499940234edad4@mail.gmail.com>
References: <ddc18b3e0902241706h67eca91ev25fee51f699665fe@mail.gmail.com>
	<ea9161c50902250800y62fb1844hbc4384f089445b42@mail.gmail.com>
	<37333E54-76B8-4D9D-BFFE-95E78289FCA1@gmail.com>
	<ddc18b3e0902250953i29d57220v5ce89be6278a45a3@mail.gmail.com>
	<ea9161c50902251010k3c8c0046s6e70a25df523e3b@mail.gmail.com>
	<D844E2FD-8A9F-4630-B7AF-C7483C584A90@gmail.com>
	<33798715-9515-4777-8261-C12F737AB0F9@elevatedrails.com>
	<ea9161c50902251113k56339268nfe499940234edad4@mail.gmail.com>
Message-ID: <1235589581.8745.10.camel@localhost>

B/c of the way facebooker stores loaded configs the attack will crash
all requests until a good config is set again (yes?).

A better question is why one would need to change configs via GET
params.  Multiple facebook apps?  Does that really need to be supported?

-- 
Matthew Beale :: 607 227 0871
Resume & Portfolio @ http://madhatted.com

On Wed, 2009-02-25 at 12:13 -0700, David Clements wrote:
> I don't think I am clear anymore what the risk is of loading an
> adapter from some malicious attack?   Before adapters there was simply
> one config.  All the adapter does is allow for multiple configs.
> 
> What are we trying to protect against? 
> 
> 
> Dave
> 
> On Wed, Feb 25, 2009 at 12:07 PM, Mike Mangino
> <mmangino at elevatedrails.com> wrote:
>         Do we need to know which adapter to use before we can verify
>         the params? Don't other implementation use different params?
>         
>         
>         Maybe we could require each adapter to verify that the request
>         is valid. Would that fix this issue?
>         
>         
>         Mike
>         
>         
>         
>         
>         On Feb 25, 2009, at 1:32 PM, kevin lochner wrote:
>         
>         
>         > 
>         > I'm not convinced we have a good solution yet.  here's the
>         > relevant code:
>         > 
>         > 
>         > 
>         > >       def request_comes_from_facebook?
>         > >         request_is_for_a_facebook_canvas? ||
>         > > request_is_facebook_ajax? || request_is_fb_ping?
>         > >       end
>         > > 
>         > > 
>         > >       def request_is_fb_ping?
>         > >         !params['fb_sig'].blank?
>         > >       end
>         > >       
>         > >       def request_is_for_a_facebook_canvas?
>         > >         !params['fb_sig_in_canvas'].blank?
>         > >       end
>         > >       
>         > >       def request_is_facebook_ajax?
>         > >         params["fb_sig_is_mockajax"]=="1" ||
>         > > params["fb_sig_is_ajax"]=="1"
>         > >       end
>         > > 
>         > > 
>         > 
>         > 
>         > So calling request_comes_from_facebook isn't really a
>         > security feature, and doesn't change the behavior w.r.t. the
>         > test case that vince outlined, since they could just as
>         > easily fake params["fb_sig"]
>         > 
>         > 
>         > > > 
>         > > > All the malicious user has to do is send a malformed
>         > > > HTTP request similar to:
>         > > > 
>         > > > http://my.rails.app.com/some_controller/?fb_sig_api_key=you_are_pwned
>         > 
>         > 
>         > I think the before filter should be:
>         >  
>         >       def set_adapter
>         >         Facebooker.load_adapter(facebook_params)
>         > if(params[:fb_sig_api_key])
>         >       end
>         > 
>         > 
>         > since facebook_params calls verify_signature & ensures the
>         > request comes from facebook. 
>         > 
>         > 
>         > Alternatively, we could be verify the params signature in
>         > request_comes_from_facebook.  That may be a better solution
>         > since the request_comes_from_facebook method is a little
>         > misleading (as david has just demonstrated).
>         > 
>         > 
>         > Also, we throw an exception on a bad signature, so we should
>         > have a catch somewhere in the process.
>         > 
>         > 
>         > - kevin
>         > 
>         > 
>         > 
>         > 
>         > 
>         > 
>         > 
>         > On Feb 25, 2009, at 1:10 PM, David Clements wrote:
>         > 
>         > > Cool thanks for taking a look.  Looks like I can just add
>         > > a condition to that call
>         > > 
>         > > if request_comes_from_facebook?
>         > > 
>         > > I'll try to get to it later today.
>         > > 
>         > > Dave
>         > > 
>         > > On 2/25/09, vincent chu <vincentchu at gmail.com> wrote:
>         > >         Hi David ---
>         > >         
>         > >         I took a look at your fix. Though I'm somewhat
>         > >         unfamiliar with exactly what you want to do, I
>         > >         think it would be prudent to validate that the
>         > >         incoming params hash actually originates from
>         > >         facebook before using the parameters to reset the
>         > >         adapter. This way, you never touch the adapter
>         > >         until you're sure that it's Facebook sending the
>         > >         request, and not some malicious actor.
>         > >         
>         > >         Cheers,
>         > >         
>         > >         Vince
>         > >         ----
>         > >         
>         > >                 
>         > >                 > 
>         > >                 > 
>         > >                 > On 2/24/09, vincent chu
>         > >                 > <vincentchu at gmail.com> wrote:
>         > >                 >         Hi all ---
>         > >                 >         
>         > >                 >         In the course of developing our
>         > >                 >         Facebook connect app, we
>         > >                 >         realized that there was a
>         > >                 >         security hole in Facebooker that
>         > >                 >         allows any malicious user to
>         > >                 >         change the state of the
>         > >                 >         Facebooker module and crash any
>         > >                 >         controller/view that uses
>         > >                 >         Facebooker to capture a Facebook
>         > >                 >         session. For Facebook connect
>         > >                 >         apps, this could potentially be
>         > >                 >         in any view that uses the
>         > >                 >         "set_facebook_session"
>         > >                 >         before_filter.
>         > >                 >         
>         > >                 >         All the malicious user has to do
>         > >                 >         is send a malformed HTTP request
>         > >                 >         similar to:
>         > >                 >         
>         > >                 >         http://my.rails.app.com/some_controller/?fb_sig_api_key=you_are_pwned
>         > >                 >         
>         > >                 >         The problem comes in the
>         > >                 >         'set_adapter' method of
>         > >                 >         'facebooker/lib/facebooker/rails/controller.rb' where Facebooker will attempt to load an adapter from the params hash if fb_sig_api_key is in the request (ignoring the configuration found in the facebooker.yml file). In this case, Facebooker would dutifully set the api_key to "you_are_pwned" and any subsequent call to Facebooker would try and use "you_are_pwned" as the api_key, causing it to crash the site. 
>         > >                 
>         > >                 
>         > >         
>         > >         
>         > > 
>         > 
>         > 
>         > _______________________________________________
>         > Facebooker-talk mailing list
>         > Facebooker-talk at rubyforge.org
>         > http://rubyforge.org/mailman/listinfo/facebooker-talk
>         > 
>         
>         --
>         Mike Mangino
>         http://www.elevatedrails.com
>         
>         
>         
>         
>         
>         
> 
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk



From digidigo at gmail.com  Wed Feb 25 14:25:02 2009
From: digidigo at gmail.com (David Clements)
Date: Wed, 25 Feb 2009 12:25:02 -0700
Subject: [Facebooker-talk] Possible Security Hole in Facebooker --
	Please Update!
In-Reply-To: <1235589581.8745.10.camel@localhost>
References: <ddc18b3e0902241706h67eca91ev25fee51f699665fe@mail.gmail.com>
	<ea9161c50902250800y62fb1844hbc4384f089445b42@mail.gmail.com>
	<37333E54-76B8-4D9D-BFFE-95E78289FCA1@gmail.com>
	<ddc18b3e0902250953i29d57220v5ce89be6278a45a3@mail.gmail.com>
	<ea9161c50902251010k3c8c0046s6e70a25df523e3b@mail.gmail.com>
	<D844E2FD-8A9F-4630-B7AF-C7483C584A90@gmail.com>
	<33798715-9515-4777-8261-C12F737AB0F9@elevatedrails.com>
	<ea9161c50902251113k56339268nfe499940234edad4@mail.gmail.com>
	<1235589581.8745.10.camel@localhost>
Message-ID: <ea9161c50902251125g2d253a39sbeac5b8ac5738969@mail.gmail.com>

The new code doesn't allow the loading of a bad config.  It returns the
default config if it can't find the passed in one.   The bug was a simple
one of ruby returning the last value.

We can change it to use Post params only, doesn't really solve any security
concerns though.

The initial implementation was to support Bebo it was augmented to allow
multiple Facebook applications.  I think it is a useful feature to have.   I
believe some are using it.

Dave


On 2/25/09, Matthew Beale <mixonic at synitech.com> wrote:
>
> B/c of the way facebooker stores loaded configs the attack will crash
> all requests until a good config is set again (yes?).
>
> A better question is why one would need to change configs via GET
> params.  Multiple facebook apps?  Does that really need to be supported?
>
>
> --
> Matthew Beale :: 607 227 0871
> Resume & Portfolio @ http://madhatted.com
>
>
> On Wed, 2009-02-25 at 12:13 -0700, David Clements wrote:
> > I don't think I am clear anymore what the risk is of loading an
> > adapter from some malicious attack?   Before adapters there was simply
> > one config.  All the adapter does is allow for multiple configs.
> >
> > What are we trying to protect against?
> >
> >
> > Dave
> >
> > On Wed, Feb 25, 2009 at 12:07 PM, Mike Mangino
> > <mmangino at elevatedrails.com> wrote:
> >         Do we need to know which adapter to use before we can verify
> >         the params? Don't other implementation use different params?
> >
> >
> >         Maybe we could require each adapter to verify that the request
> >         is valid. Would that fix this issue?
> >
> >
> >         Mike
> >
> >
> >
> >
> >         On Feb 25, 2009, at 1:32 PM, kevin lochner wrote:
> >
> >
> >         >
> >         > I'm not convinced we have a good solution yet.  here's the
> >         > relevant code:
> >         >
> >         >
> >         >
> >         > >       def request_comes_from_facebook?
> >         > >         request_is_for_a_facebook_canvas? ||
> >         > > request_is_facebook_ajax? || request_is_fb_ping?
> >         > >       end
> >         > >
> >         > >
> >         > >       def request_is_fb_ping?
> >         > >         !params['fb_sig'].blank?
> >         > >       end
> >         > >
> >         > >       def request_is_for_a_facebook_canvas?
> >         > >         !params['fb_sig_in_canvas'].blank?
> >         > >       end
> >         > >
> >         > >       def request_is_facebook_ajax?
> >         > >         params["fb_sig_is_mockajax"]=="1" ||
> >         > > params["fb_sig_is_ajax"]=="1"
> >         > >       end
> >         > >
> >         > >
> >         >
> >         >
> >         > So calling request_comes_from_facebook isn't really a
> >         > security feature, and doesn't change the behavior w.r.t. the
> >         > test case that vince outlined, since they could just as
> >         > easily fake params["fb_sig"]
> >         >
> >         >
> >         > > >
> >         > > > All the malicious user has to do is send a malformed
> >         > > > HTTP request similar to:
> >         > > >
> >         > > >
> http://my.rails.app.com/some_controller/?fb_sig_api_key=you_are_pwned
> >         >
> >         >
> >         > I think the before filter should be:
> >         >
> >         >       def set_adapter
> >         >         Facebooker.load_adapter(facebook_params)
> >         > if(params[:fb_sig_api_key])
> >         >       end
> >         >
> >         >
> >         > since facebook_params calls verify_signature & ensures the
> >         > request comes from facebook.
> >         >
> >         >
> >         > Alternatively, we could be verify the params signature in
> >         > request_comes_from_facebook.  That may be a better solution
> >         > since the request_comes_from_facebook method is a little
> >         > misleading (as david has just demonstrated).
> >         >
> >         >
> >         > Also, we throw an exception on a bad signature, so we should
> >         > have a catch somewhere in the process.
> >         >
> >         >
> >         > - kevin
> >         >
> >         >
> >         >
> >         >
> >         >
> >         >
> >         >
> >         > On Feb 25, 2009, at 1:10 PM, David Clements wrote:
> >         >
> >         > > Cool thanks for taking a look.  Looks like I can just add
> >         > > a condition to that call
> >         > >
> >         > > if request_comes_from_facebook?
> >         > >
> >         > > I'll try to get to it later today.
> >         > >
> >         > > Dave
> >         > >
> >         > > On 2/25/09, vincent chu <vincentchu at gmail.com> wrote:
> >         > >         Hi David ---
> >         > >
> >         > >         I took a look at your fix. Though I'm somewhat
> >         > >         unfamiliar with exactly what you want to do, I
> >         > >         think it would be prudent to validate that the
> >         > >         incoming params hash actually originates from
> >         > >         facebook before using the parameters to reset the
> >         > >         adapter. This way, you never touch the adapter
> >         > >         until you're sure that it's Facebook sending the
> >         > >         request, and not some malicious actor.
> >         > >
> >         > >         Cheers,
> >         > >
> >         > >         Vince
> >         > >         ----
> >         > >
> >         > >
> >         > >                 >
> >         > >                 >
> >         > >                 > On 2/24/09, vincent chu
> >         > >                 > <vincentchu at gmail.com> wrote:
> >         > >                 >         Hi all ---
> >         > >                 >
> >         > >                 >         In the course of developing our
> >         > >                 >         Facebook connect app, we
> >         > >                 >         realized that there was a
> >         > >                 >         security hole in Facebooker that
> >         > >                 >         allows any malicious user to
> >         > >                 >         change the state of the
> >         > >                 >         Facebooker module and crash any
> >         > >                 >         controller/view that uses
> >         > >                 >         Facebooker to capture a Facebook
> >         > >                 >         session. For Facebook connect
> >         > >                 >         apps, this could potentially be
> >         > >                 >         in any view that uses the
> >         > >                 >         "set_facebook_session"
> >         > >                 >         before_filter.
> >         > >                 >
> >         > >                 >         All the malicious user has to do
> >         > >                 >         is send a malformed HTTP request
> >         > >                 >         similar to:
> >         > >                 >
> >         > >                 >
> http://my.rails.app.com/some_controller/?fb_sig_api_key=you_are_pwned
> >         > >                 >
> >         > >                 >         The problem comes in the
> >         > >                 >         'set_adapter' method of
> >         > >                 >
> 'facebooker/lib/facebooker/rails/controller.rb' where Facebooker will
> attempt to load an adapter from the params hash if fb_sig_api_key is in the
> request (ignoring the configuration found in the facebooker.yml file). In
> this case, Facebooker would dutifully set the api_key to "you_are_pwned" and
> any subsequent call to Facebooker would try and use "you_are_pwned" as the
> api_key, causing it to crash the site.
> >         > >
> >         > >
> >         > >
> >         > >
> >         > >
> >         >
> >         >
> >         > _______________________________________________
> >         > Facebooker-talk mailing list
> >         > Facebooker-talk at rubyforge.org
> >         > http://rubyforge.org/mailman/listinfo/facebooker-talk
> >         >
> >
> >         --
> >         Mike Mangino
> >         http://www.elevatedrails.com
> >
> >
> >
> >
> >
> >
> >
> > _______________________________________________
> > Facebooker-talk mailing list
> > Facebooker-talk at rubyforge.org
> > http://rubyforge.org/mailman/listinfo/facebooker-talk
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090225/49f0f6c4/attachment.html>

From cjohnson at socialvibe.com  Wed Feb 25 14:42:01 2009
From: cjohnson at socialvibe.com (Chris Johnson)
Date: Wed, 25 Feb 2009 11:42:01 -0800
Subject: [Facebooker-talk] Possible Security Hole in Facebooker --
	Please Update!
In-Reply-To: <ea9161c50902251125g2d253a39sbeac5b8ac5738969@mail.gmail.com>
References: <ddc18b3e0902241706h67eca91ev25fee51f699665fe@mail.gmail.com>
	<ea9161c50902250800y62fb1844hbc4384f089445b42@mail.gmail.com>
	<37333E54-76B8-4D9D-BFFE-95E78289FCA1@gmail.com>
	<ddc18b3e0902250953i29d57220v5ce89be6278a45a3@mail.gmail.com>
	<ea9161c50902251010k3c8c0046s6e70a25df523e3b@mail.gmail.com>
	<D844E2FD-8A9F-4630-B7AF-C7483C584A90@gmail.com>
	<33798715-9515-4777-8261-C12F737AB0F9@elevatedrails.com>
	<ea9161c50902251113k56339268nfe499940234edad4@mail.gmail.com>
	<1235589581.8745.10.camel@localhost>
	<ea9161c50902251125g2d253a39sbeac5b8ac5738969@mail.gmail.com>
Message-ID: <97900030-B7C1-42C9-AB46-F46A1F7A6BB7@socialvibe.com>

Support for both multiple Facebook apps and for Bebo apps is certainly  
a feature in use in production, and it's a great perk of facebooker.
As Dave said, is the issue not fixed when a default config is now  
returned if the passed key isn't found?

Cheers.

On Feb 25, 2009, at 11:25 AM, David Clements wrote:

> The new code doesn't allow the loading of a bad config.  It returns  
> the default config if it can't find the passed in one.   The bug was  
> a simple one of ruby returning the last value.
>
> We can change it to use Post params only, doesn't really solve any  
> security concerns though.
>
> The initial implementation was to support Bebo it was augmented to  
> allow multiple Facebook applications.  I think it is a useful  
> feature to have.   I believe some are using it.
>
> Dave
>
>
> On 2/25/09, Matthew Beale <mixonic at synitech.com> wrote:
> B/c of the way facebooker stores loaded configs the attack will crash
> all requests until a good config is set again (yes?).
>
> A better question is why one would need to change configs via GET
> params.  Multiple facebook apps?  Does that really need to be  
> supported?
>
>
> --
> Matthew Beale :: 607 227 0871
> Resume & Portfolio @ http://madhatted.com
>
>
> On Wed, 2009-02-25 at 12:13 -0700, David Clements wrote:
> > I don't think I am clear anymore what the risk is of loading an
> > adapter from some malicious attack?   Before adapters there was  
> simply
> > one config.  All the adapter does is allow for multiple configs.
> >
> > What are we trying to protect against?
> >
> >
> > Dave
> >
> > On Wed, Feb 25, 2009 at 12:07 PM, Mike Mangino
> > <mmangino at elevatedrails.com> wrote:
> >         Do we need to know which adapter to use before we can verify
> >         the params? Don't other implementation use different params?
> >
> >
> >         Maybe we could require each adapter to verify that the  
> request
> >         is valid. Would that fix this issue?
> >
> >
> >         Mike
> >
> >
> >
> >
> >         On Feb 25, 2009, at 1:32 PM, kevin lochner wrote:
> >
> >
> >         >
> >         > I'm not convinced we have a good solution yet.  here's the
> >         > relevant code:
> >         >
> >         >
> >         >
> >         > >       def request_comes_from_facebook?
> >         > >         request_is_for_a_facebook_canvas? ||
> >         > > request_is_facebook_ajax? || request_is_fb_ping?
> >         > >       end
> >         > >
> >         > >
> >         > >       def request_is_fb_ping?
> >         > >         !params['fb_sig'].blank?
> >         > >       end
> >         > >
> >         > >       def request_is_for_a_facebook_canvas?
> >         > >         !params['fb_sig_in_canvas'].blank?
> >         > >       end
> >         > >
> >         > >       def request_is_facebook_ajax?
> >         > >         params["fb_sig_is_mockajax"]=="1" ||
> >         > > params["fb_sig_is_ajax"]=="1"
> >         > >       end
> >         > >
> >         > >
> >         >
> >         >
> >         > So calling request_comes_from_facebook isn't really a
> >         > security feature, and doesn't change the behavior w.r.t.  
> the
> >         > test case that vince outlined, since they could just as
> >         > easily fake params["fb_sig"]
> >         >
> >         >
> >         > > >
> >         > > > All the malicious user has to do is send a malformed
> >         > > > HTTP request similar to:
> >         > > >
> >         > > > http://my.rails.app.com/some_controller/?fb_sig_api_key=you_are_pwned
> >         >
> >         >
> >         > I think the before filter should be:
> >         >
> >         >       def set_adapter
> >         >         Facebooker.load_adapter(facebook_params)
> >         > if(params[:fb_sig_api_key])
> >         >       end
> >         >
> >         >
> >         > since facebook_params calls verify_signature & ensures the
> >         > request comes from facebook.
> >         >
> >         >
> >         > Alternatively, we could be verify the params signature in
> >         > request_comes_from_facebook.  That may be a better  
> solution
> >         > since the request_comes_from_facebook method is a little
> >         > misleading (as david has just demonstrated).
> >         >
> >         >
> >         > Also, we throw an exception on a bad signature, so we  
> should
> >         > have a catch somewhere in the process.
> >         >
> >         >
> >         > - kevin
> >         >
> >         >
> >         >
> >         >
> >         >
> >         >
> >         >
> >         > On Feb 25, 2009, at 1:10 PM, David Clements wrote:
> >         >
> >         > > Cool thanks for taking a look.  Looks like I can just  
> add
> >         > > a condition to that call
> >         > >
> >         > > if request_comes_from_facebook?
> >         > >
> >         > > I'll try to get to it later today.
> >         > >
> >         > > Dave
> >         > >
> >         > > On 2/25/09, vincent chu <vincentchu at gmail.com> wrote:
> >         > >         Hi David ---
> >         > >
> >         > >         I took a look at your fix. Though I'm somewhat
> >         > >         unfamiliar with exactly what you want to do, I
> >         > >         think it would be prudent to validate that the
> >         > >         incoming params hash actually originates from
> >         > >         facebook before using the parameters to reset  
> the
> >         > >         adapter. This way, you never touch the adapter
> >         > >         until you're sure that it's Facebook sending the
> >         > >         request, and not some malicious actor.
> >         > >
> >         > >         Cheers,
> >         > >
> >         > >         Vince
> >         > >         ----
> >         > >
> >         > >
> >         > >                 >
> >         > >                 >
> >         > >                 > On 2/24/09, vincent chu
> >         > >                 > <vincentchu at gmail.com> wrote:
> >         > >                 >         Hi all ---
> >         > >                 >
> >         > >                 >         In the course of developing  
> our
> >         > >                 >         Facebook connect app, we
> >         > >                 >         realized that there was a
> >         > >                 >         security hole in Facebooker  
> that
> >         > >                 >         allows any malicious user to
> >         > >                 >         change the state of the
> >         > >                 >         Facebooker module and crash  
> any
> >         > >                 >         controller/view that uses
> >         > >                 >         Facebooker to capture a  
> Facebook
> >         > >                 >         session. For Facebook connect
> >         > >                 >         apps, this could potentially  
> be
> >         > >                 >         in any view that uses the
> >         > >                 >         "set_facebook_session"
> >         > >                 >         before_filter.
> >         > >                 >
> >         > >                 >         All the malicious user has  
> to do
> >         > >                 >         is send a malformed HTTP  
> request
> >         > >                 >         similar to:
> >         > >                 >
> >         > >                 >         http://my.rails.app.com/some_controller/?fb_sig_api_key=you_are_pwned
> >         > >                 >
> >         > >                 >         The problem comes in the
> >         > >                 >         'set_adapter' method of
> >         > >                 >         'facebooker/lib/facebooker/ 
> rails/controller.rb' where Facebooker will attempt to load an  
> adapter from the params hash if fb_sig_api_key is in the request  
> (ignoring the configuration found in the facebooker.yml file). In  
> this case, Facebooker would dutifully set the api_key to  
> "you_are_pwned" and any subsequent call to Facebooker would try and  
> use "you_are_pwned" as the api_key, causing it to crash the site.
> >         > >
> >         > >
> >         > >
> >         > >
> >         > >
> >         >
> >         >
> >         > _______________________________________________
> >         > Facebooker-talk mailing list
> >         > Facebooker-talk at rubyforge.org
> >         > http://rubyforge.org/mailman/listinfo/facebooker-talk
> >         >
> >
> >         --
> >         Mike Mangino
> >         http://www.elevatedrails.com
> >
> >
> >
> >
> >
> >
> >
> > _______________________________________________
> > Facebooker-talk mailing list
> > Facebooker-talk at rubyforge.org
> > http://rubyforge.org/mailman/listinfo/facebooker-talk
>
>
>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090225/3ec398ae/attachment-0001.html>

From klochner at gmail.com  Wed Feb 25 14:54:49 2009
From: klochner at gmail.com (kevin lochner)
Date: Wed, 25 Feb 2009 14:54:49 -0500
Subject: [Facebooker-talk] Possible Security Hole in Facebooker --
	Please Update!
In-Reply-To: <ea9161c50902251125g2d253a39sbeac5b8ac5738969@mail.gmail.com>
References: <ddc18b3e0902241706h67eca91ev25fee51f699665fe@mail.gmail.com>
	<ea9161c50902250800y62fb1844hbc4384f089445b42@mail.gmail.com>
	<37333E54-76B8-4D9D-BFFE-95E78289FCA1@gmail.com>
	<ddc18b3e0902250953i29d57220v5ce89be6278a45a3@mail.gmail.com>
	<ea9161c50902251010k3c8c0046s6e70a25df523e3b@mail.gmail.com>
	<D844E2FD-8A9F-4630-B7AF-C7483C584A90@gmail.com>
	<33798715-9515-4777-8261-C12F737AB0F9@elevatedrails.com>
	<ea9161c50902251113k56339268nfe499940234edad4@mail.gmail.com>
	<1235589581.8745.10.camel@localhost>
	<ea9161c50902251125g2d253a39sbeac5b8ac5738969@mail.gmail.com>
Message-ID: <B167984A-5287-45E2-9F71-605D18796DFD@gmail.com>

I'm still not convinced.   Here's the basic logic:

def load_adapter(params)

   api_key = params[:fb_sig_api_key]      #paraphrasing, but we know  
fb_sig_api_key was in the params

  facebooker_config.each do |key,value|
         next unless value == api_key

	. . .  #sets up new adapter_config

         return adapter_class.new(adapter_config)
   end
   return self.default_adapter(params)
end

That looks to me like it returns the default adapter only if there is  
no value in facebooker_config matching the passed in api_key.  The  
cookies set by facebook connect all have names of "foo_#{api_key}", so  
the api key isn't exactly a security feature.

- kevin

On Feb 25, 2009, at 2:25 PM, David Clements wrote:

>  It returns the default config if it can't find the passed in one.
>
> Dave


From klochner at gmail.com  Wed Feb 25 15:03:58 2009
From: klochner at gmail.com (kevin lochner)
Date: Wed, 25 Feb 2009 15:03:58 -0500
Subject: [Facebooker-talk] Possible Security Hole in Facebooker --
	Please Update!
In-Reply-To: <ea9161c50902251125g2d253a39sbeac5b8ac5738969@mail.gmail.com>
References: <ddc18b3e0902241706h67eca91ev25fee51f699665fe@mail.gmail.com>
	<ea9161c50902250800y62fb1844hbc4384f089445b42@mail.gmail.com>
	<37333E54-76B8-4D9D-BFFE-95E78289FCA1@gmail.com>
	<ddc18b3e0902250953i29d57220v5ce89be6278a45a3@mail.gmail.com>
	<ea9161c50902251010k3c8c0046s6e70a25df523e3b@mail.gmail.com>
	<D844E2FD-8A9F-4630-B7AF-C7483C584A90@gmail.com>
	<33798715-9515-4777-8261-C12F737AB0F9@elevatedrails.com>
	<ea9161c50902251113k56339268nfe499940234edad4@mail.gmail.com>
	<1235589581.8745.10.camel@localhost>
	<ea9161c50902251125g2d253a39sbeac5b8ac5738969@mail.gmail.com>
Message-ID: <9EC2206A-9D3E-4865-BBE0-25535AEDC3D7@gmail.com>

I think i'm with you now -

If they go through the trouble of sending in your api key, that just  
loads the appropriate adapter.

If they send a bogus api_key, it returns the default.

  right?

  - kevin


On Feb 25, 2009, at 2:25 PM, David Clements wrote:

> The new code doesn't allow the loading of a bad config.  It returns  
> the default config if it can't find the passed in one.   The bug was  
> a simple one of ruby returning the last value.
>
> We can change it to use Post params only, doesn't really solve any  
> security concerns though.
>
> The initial implementation was to support Bebo it was augmented to  
> allow multiple Facebook applications.  I think it is a useful  
> feature to have.   I believe some are using it.
>
> Dave
>
>
> On 2/25/09, Matthew Beale <mixonic at synitech.com> wrote:
> B/c of the way facebooker stores loaded configs the attack will crash
> all requests until a good config is set again (yes?).
>
> A better question is why one would need to change configs via GET
> params.  Multiple facebook apps?  Does that really need to be  
> supported?
>
>
> --
> Matthew Beale :: 607 227 0871
> Resume & Portfolio @ http://madhatted.com
>
>
> On Wed, 2009-02-25 at 12:13 -0700, David Clements wrote:
> > I don't think I am clear anymore what the risk is of loading an
> > adapter from some malicious attack?   Before adapters there was  
> simply
> > one config.  All the adapter does is allow for multiple configs.
> >
> > What are we trying to protect against?
> >
> >
> > Dave
> >
> > On Wed, Feb 25, 2009 at 12:07 PM, Mike Mangino
> > <mmangino at elevatedrails.com> wrote:
> >         Do we need to know which adapter to use before we can verify
> >         the params? Don't other implementation use different params?
> >
> >
> >         Maybe we could require each adapter to verify that the  
> request
> >         is valid. Would that fix this issue?
> >
> >
> >         Mike
> >
> >
> >
> >
> >         On Feb 25, 2009, at 1:32 PM, kevin lochner wrote:
> >
> >
> >         >
> >         > I'm not convinced we have a good solution yet.  here's the
> >         > relevant code:
> >         >
> >         >
> >         >
> >         > >       def request_comes_from_facebook?
> >         > >         request_is_for_a_facebook_canvas? ||
> >         > > request_is_facebook_ajax? || request_is_fb_ping?
> >         > >       end
> >         > >
> >         > >
> >         > >       def request_is_fb_ping?
> >         > >         !params['fb_sig'].blank?
> >         > >       end
> >         > >
> >         > >       def request_is_for_a_facebook_canvas?
> >         > >         !params['fb_sig_in_canvas'].blank?
> >         > >       end
> >         > >
> >         > >       def request_is_facebook_ajax?
> >         > >         params["fb_sig_is_mockajax"]=="1" ||
> >         > > params["fb_sig_is_ajax"]=="1"
> >         > >       end
> >         > >
> >         > >
> >         >
> >         >
> >         > So calling request_comes_from_facebook isn't really a
> >         > security feature, and doesn't change the behavior w.r.t.  
> the
> >         > test case that vince outlined, since they could just as
> >         > easily fake params["fb_sig"]
> >         >
> >         >
> >         > > >
> >         > > > All the malicious user has to do is send a malformed
> >         > > > HTTP request similar to:
> >         > > >
> >         > > > http://my.rails.app.com/some_controller/?fb_sig_api_key=you_are_pwned
> >         >
> >         >
> >         > I think the before filter should be:
> >         >
> >         >       def set_adapter
> >         >         Facebooker.load_adapter(facebook_params)
> >         > if(params[:fb_sig_api_key])
> >         >       end
> >         >
> >         >
> >         > since facebook_params calls verify_signature & ensures the
> >         > request comes from facebook.
> >         >
> >         >
> >         > Alternatively, we could be verify the params signature in
> >         > request_comes_from_facebook.  That may be a better  
> solution
> >         > since the request_comes_from_facebook method is a little
> >         > misleading (as david has just demonstrated).
> >         >
> >         >
> >         > Also, we throw an exception on a bad signature, so we  
> should
> >         > have a catch somewhere in the process.
> >         >
> >         >
> >         > - kevin
> >         >
> >         >
> >         >
> >         >
> >         >
> >         >
> >         >
> >         > On Feb 25, 2009, at 1:10 PM, David Clements wrote:
> >         >
> >         > > Cool thanks for taking a look.  Looks like I can just  
> add
> >         > > a condition to that call
> >         > >
> >         > > if request_comes_from_facebook?
> >         > >
> >         > > I'll try to get to it later today.
> >         > >
> >         > > Dave
> >         > >
> >         > > On 2/25/09, vincent chu <vincentchu at gmail.com> wrote:
> >         > >         Hi David ---
> >         > >
> >         > >         I took a look at your fix. Though I'm somewhat
> >         > >         unfamiliar with exactly what you want to do, I
> >         > >         think it would be prudent to validate that the
> >         > >         incoming params hash actually originates from
> >         > >         facebook before using the parameters to reset  
> the
> >         > >         adapter. This way, you never touch the adapter
> >         > >         until you're sure that it's Facebook sending the
> >         > >         request, and not some malicious actor.
> >         > >
> >         > >         Cheers,
> >         > >
> >         > >         Vince
> >         > >         ----
> >         > >
> >         > >
> >         > >                 >
> >         > >                 >
> >         > >                 > On 2/24/09, vincent chu
> >         > >                 > <vincentchu at gmail.com> wrote:
> >         > >                 >         Hi all ---
> >         > >                 >
> >         > >                 >         In the course of developing  
> our
> >         > >                 >         Facebook connect app, we
> >         > >                 >         realized that there was a
> >         > >                 >         security hole in Facebooker  
> that
> >         > >                 >         allows any malicious user to
> >         > >                 >         change the state of the
> >         > >                 >         Facebooker module and crash  
> any
> >         > >                 >         controller/view that uses
> >         > >                 >         Facebooker to capture a  
> Facebook
> >         > >                 >         session. For Facebook connect
> >         > >                 >         apps, this could potentially  
> be
> >         > >                 >         in any view that uses the
> >         > >                 >         "set_facebook_session"
> >         > >                 >         before_filter.
> >         > >                 >
> >         > >                 >         All the malicious user has  
> to do
> >         > >                 >         is send a malformed HTTP  
> request
> >         > >                 >         similar to:
> >         > >                 >
> >         > >                 >         http://my.rails.app.com/some_controller/?fb_sig_api_key=you_are_pwned
> >         > >                 >
> >         > >                 >         The problem comes in the
> >         > >                 >         'set_adapter' method of
> >         > >                 >         'facebooker/lib/facebooker/ 
> rails/controller.rb' where Facebooker will attempt to load an  
> adapter from the params hash if fb_sig_api_key is in the request  
> (ignoring the configuration found in the facebooker.yml file). In  
> this case, Facebooker would dutifully set the api_key to  
> "you_are_pwned" and any subsequent call to Facebooker would try and  
> use "you_are_pwned" as the api_key, causing it to crash the site.
> >         > >
> >         > >
> >         > >
> >         > >
> >         > >
> >         >
> >         >
> >         > _______________________________________________
> >         > Facebooker-talk mailing list
> >         > Facebooker-talk at rubyforge.org
> >         > http://rubyforge.org/mailman/listinfo/facebooker-talk
> >         >
> >
> >         --
> >         Mike Mangino
> >         http://www.elevatedrails.com
> >
> >
> >
> >
> >
> >
> >
> > _______________________________________________
> > Facebooker-talk mailing list
> > Facebooker-talk at rubyforge.org
> > http://rubyforge.org/mailman/listinfo/facebooker-talk
>
>
>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090225/6aad698c/attachment-0001.html>

From mmangino at elevatedrails.com  Wed Feb 25 15:12:05 2009
From: mmangino at elevatedrails.com (Mike Mangino)
Date: Wed, 25 Feb 2009 15:12:05 -0500
Subject: [Facebooker-talk] Possible Security Hole in Facebooker --
	Please Update!
In-Reply-To: <97900030-B7C1-42C9-AB46-F46A1F7A6BB7@socialvibe.com>
References: <ddc18b3e0902241706h67eca91ev25fee51f699665fe@mail.gmail.com>
	<ea9161c50902250800y62fb1844hbc4384f089445b42@mail.gmail.com>
	<37333E54-76B8-4D9D-BFFE-95E78289FCA1@gmail.com>
	<ddc18b3e0902250953i29d57220v5ce89be6278a45a3@mail.gmail.com>
	<ea9161c50902251010k3c8c0046s6e70a25df523e3b@mail.gmail.com>
	<D844E2FD-8A9F-4630-B7AF-C7483C584A90@gmail.com>
	<33798715-9515-4777-8261-C12F737AB0F9@elevatedrails.com>
	<ea9161c50902251113k56339268nfe499940234edad4@mail.gmail.com>
	<1235589581.8745.10.camel@localhost>
	<ea9161c50902251125g2d253a39sbeac5b8ac5738969@mail.gmail.com>
	<97900030-B7C1-42C9-AB46-F46A1F7A6BB7@socialvibe.com>
Message-ID: <17AD09A9-AA64-42DD-8E0F-F0D66E18B71D@elevatedrails.com>


On Feb 25, 2009, at 2:42 PM, Chris Johnson wrote:

> Support for both multiple Facebook apps and for Bebo apps is  
> certainly a feature in use in production, and it's a great perk of  
> facebooker.
> As Dave said, is the issue not fixed when a default config is now  
> returned if the passed key isn't found?

Would this bug only affect the current request? If the next request  
loads the new adapter, it probably isn't a big deal.

Sorry about being late to the table. This came in while I was on  
vacation without internet access.

Mike


>
> Cheers.
>
> On Feb 25, 2009, at 11:25 AM, David Clements wrote:
>
>> The new code doesn't allow the loading of a bad config.  It returns  
>> the default config if it can't find the passed in one.   The bug  
>> was a simple one of ruby returning the last value.
>>
>> We can change it to use Post params only, doesn't really solve any  
>> security concerns though.
>>
>> The initial implementation was to support Bebo it was augmented to  
>> allow multiple Facebook applications.  I think it is a useful  
>> feature to have.   I believe some are using it.
>>
>> Dave
>>
>>
>> On 2/25/09, Matthew Beale <mixonic at synitech.com> wrote:
>> B/c of the way facebooker stores loaded configs the attack will crash
>> all requests until a good config is set again (yes?).
>>
>> A better question is why one would need to change configs via GET
>> params.  Multiple facebook apps?  Does that really need to be  
>> supported?
>>
>>
>> --
>> Matthew Beale :: 607 227 0871
>> Resume & Portfolio @ http://madhatted.com
>>
>>
>> On Wed, 2009-02-25 at 12:13 -0700, David Clements wrote:
>> > I don't think I am clear anymore what the risk is of loading an
>> > adapter from some malicious attack?   Before adapters there was  
>> simply
>> > one config.  All the adapter does is allow for multiple configs.
>> >
>> > What are we trying to protect against?
>> >
>> >
>> > Dave
>> >
>> > On Wed, Feb 25, 2009 at 12:07 PM, Mike Mangino
>> > <mmangino at elevatedrails.com> wrote:
>> >         Do we need to know which adapter to use before we can  
>> verify
>> >         the params? Don't other implementation use different  
>> params?
>> >
>> >
>> >         Maybe we could require each adapter to verify that the  
>> request
>> >         is valid. Would that fix this issue?
>> >
>> >
>> >         Mike
>> >
>> >
>> >
>> >
>> >         On Feb 25, 2009, at 1:32 PM, kevin lochner wrote:
>> >
>> >
>> >         >
>> >         > I'm not convinced we have a good solution yet.  here's  
>> the
>> >         > relevant code:
>> >         >
>> >         >
>> >         >
>> >         > >       def request_comes_from_facebook?
>> >         > >         request_is_for_a_facebook_canvas? ||
>> >         > > request_is_facebook_ajax? || request_is_fb_ping?
>> >         > >       end
>> >         > >
>> >         > >
>> >         > >       def request_is_fb_ping?
>> >         > >         !params['fb_sig'].blank?
>> >         > >       end
>> >         > >
>> >         > >       def request_is_for_a_facebook_canvas?
>> >         > >         !params['fb_sig_in_canvas'].blank?
>> >         > >       end
>> >         > >
>> >         > >       def request_is_facebook_ajax?
>> >         > >         params["fb_sig_is_mockajax"]=="1" ||
>> >         > > params["fb_sig_is_ajax"]=="1"
>> >         > >       end
>> >         > >
>> >         > >
>> >         >
>> >         >
>> >         > So calling request_comes_from_facebook isn't really a
>> >         > security feature, and doesn't change the behavior  
>> w.r.t. the
>> >         > test case that vince outlined, since they could just as
>> >         > easily fake params["fb_sig"]
>> >         >
>> >         >
>> >         > > >
>> >         > > > All the malicious user has to do is send a malformed
>> >         > > > HTTP request similar to:
>> >         > > >
>> >         > > > http://my.rails.app.com/some_controller/?fb_sig_api_key=you_are_pwned
>> >         >
>> >         >
>> >         > I think the before filter should be:
>> >         >
>> >         >       def set_adapter
>> >         >         Facebooker.load_adapter(facebook_params)
>> >         > if(params[:fb_sig_api_key])
>> >         >       end
>> >         >
>> >         >
>> >         > since facebook_params calls verify_signature & ensures  
>> the
>> >         > request comes from facebook.
>> >         >
>> >         >
>> >         > Alternatively, we could be verify the params signature in
>> >         > request_comes_from_facebook.  That may be a better  
>> solution
>> >         > since the request_comes_from_facebook method is a little
>> >         > misleading (as david has just demonstrated).
>> >         >
>> >         >
>> >         > Also, we throw an exception on a bad signature, so we  
>> should
>> >         > have a catch somewhere in the process.
>> >         >
>> >         >
>> >         > - kevin
>> >         >
>> >         >
>> >         >
>> >         >
>> >         >
>> >         >
>> >         >
>> >         > On Feb 25, 2009, at 1:10 PM, David Clements wrote:
>> >         >
>> >         > > Cool thanks for taking a look.  Looks like I can just  
>> add
>> >         > > a condition to that call
>> >         > >
>> >         > > if request_comes_from_facebook?
>> >         > >
>> >         > > I'll try to get to it later today.
>> >         > >
>> >         > > Dave
>> >         > >
>> >         > > On 2/25/09, vincent chu <vincentchu at gmail.com> wrote:
>> >         > >         Hi David ---
>> >         > >
>> >         > >         I took a look at your fix. Though I'm somewhat
>> >         > >         unfamiliar with exactly what you want to do, I
>> >         > >         think it would be prudent to validate that the
>> >         > >         incoming params hash actually originates from
>> >         > >         facebook before using the parameters to reset  
>> the
>> >         > >         adapter. This way, you never touch the adapter
>> >         > >         until you're sure that it's Facebook sending  
>> the
>> >         > >         request, and not some malicious actor.
>> >         > >
>> >         > >         Cheers,
>> >         > >
>> >         > >         Vince
>> >         > >         ----
>> >         > >
>> >         > >
>> >         > >                 >
>> >         > >                 >
>> >         > >                 > On 2/24/09, vincent chu
>> >         > >                 > <vincentchu at gmail.com> wrote:
>> >         > >                 >         Hi all ---
>> >         > >                 >
>> >         > >                 >         In the course of developing  
>> our
>> >         > >                 >         Facebook connect app, we
>> >         > >                 >         realized that there was a
>> >         > >                 >         security hole in Facebooker  
>> that
>> >         > >                 >         allows any malicious user to
>> >         > >                 >         change the state of the
>> >         > >                 >         Facebooker module and crash  
>> any
>> >         > >                 >         controller/view that uses
>> >         > >                 >         Facebooker to capture a  
>> Facebook
>> >         > >                 >         session. For Facebook connect
>> >         > >                 >         apps, this could  
>> potentially be
>> >         > >                 >         in any view that uses the
>> >         > >                 >         "set_facebook_session"
>> >         > >                 >         before_filter.
>> >         > >                 >
>> >         > >                 >         All the malicious user has  
>> to do
>> >         > >                 >         is send a malformed HTTP  
>> request
>> >         > >                 >         similar to:
>> >         > >                 >
>> >         > >                 >         http://my.rails.app.com/some_controller/?fb_sig_api_key=you_are_pwned
>> >         > >                 >
>> >         > >                 >         The problem comes in the
>> >         > >                 >         'set_adapter' method of
>> >         > >                 >         'facebooker/lib/facebooker/ 
>> rails/controller.rb' where Facebooker will attempt to load an  
>> adapter from the params hash if fb_sig_api_key is in the request  
>> (ignoring the configuration found in the facebooker.yml file). In  
>> this case, Facebooker would dutifully set the api_key to  
>> "you_are_pwned" and any subsequent call to Facebooker would try and  
>> use "you_are_pwned" as the api_key, causing it to crash the site.
>> >         > >
>> >         > >
>> >         > >
>> >         > >
>> >         > >
>> >         >
>> >         >
>> >         > _______________________________________________
>> >         > Facebooker-talk mailing list
>> >         > Facebooker-talk at rubyforge.org
>> >         > http://rubyforge.org/mailman/listinfo/facebooker-talk
>> >         >
>> >
>> >         --
>> >         Mike Mangino
>> >         http://www.elevatedrails.com
>> >
>> >
>> >
>> >
>> >
>> >
>> >
>> > _______________________________________________
>> > Facebooker-talk mailing list
>> > Facebooker-talk at rubyforge.org
>> > http://rubyforge.org/mailman/listinfo/facebooker-talk
>>
>>
>>
>> _______________________________________________
>> Facebooker-talk mailing list
>> Facebooker-talk at rubyforge.org
>> http://rubyforge.org/mailman/listinfo/facebooker-talk
>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk

--
Mike Mangino
http://www.elevatedrails.com



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090225/a5d52446/attachment-0001.html>

From klochner at gmail.com  Wed Feb 25 15:20:21 2009
From: klochner at gmail.com (kevin lochner)
Date: Wed, 25 Feb 2009 15:20:21 -0500
Subject: [Facebooker-talk] Possible Security Hole in Facebooker --
	Please Update!
In-Reply-To: <17AD09A9-AA64-42DD-8E0F-F0D66E18B71D@elevatedrails.com>
References: <ddc18b3e0902241706h67eca91ev25fee51f699665fe@mail.gmail.com>
	<ea9161c50902250800y62fb1844hbc4384f089445b42@mail.gmail.com>
	<37333E54-76B8-4D9D-BFFE-95E78289FCA1@gmail.com>
	<ddc18b3e0902250953i29d57220v5ce89be6278a45a3@mail.gmail.com>
	<ea9161c50902251010k3c8c0046s6e70a25df523e3b@mail.gmail.com>
	<D844E2FD-8A9F-4630-B7AF-C7483C584A90@gmail.com>
	<33798715-9515-4777-8261-C12F737AB0F9@elevatedrails.com>
	<ea9161c50902251113k56339268nfe499940234edad4@mail.gmail.com>
	<1235589581.8745.10.camel@localhost>
	<ea9161c50902251125g2d253a39sbeac5b8ac5738969@mail.gmail.com>
	<97900030-B7C1-42C9-AB46-F46A1F7A6BB7@socialvibe.com>
	<17AD09A9-AA64-42DD-8E0F-F0D66E18B71D@elevatedrails.com>
Message-ID: <B6AE8B35-779C-4281-88AD-EAEE35D235C0@gmail.com>

I'm ready to sign off on dave's updated patch.

- kevin

On Feb 25, 2009, at 3:12 PM, Mike Mangino wrote:

>
> On Feb 25, 2009, at 2:42 PM, Chris Johnson wrote:
>
>> Support for both multiple Facebook apps and for Bebo apps is  
>> certainly a feature in use in production, and it's a great perk of  
>> facebooker.
>> As Dave said, is the issue not fixed when a default config is now  
>> returned if the passed key isn't found?
>
> Would this bug only affect the current request? If the next request  
> loads the new adapter, it probably isn't a big deal.
>
> Sorry about being late to the table. This came in while I was on  
> vacation without internet access.
>
> Mike
>
>
>>
>> Cheers.
>>
>> On Feb 25, 2009, at 11:25 AM, David Clements wrote:
>>
>>> The new code doesn't allow the loading of a bad config.  It  
>>> returns the default config if it can't find the passed in one.    
>>> The bug was a simple one of ruby returning the last value.
>>>
>>> We can change it to use Post params only, doesn't really solve any  
>>> security concerns though.
>>>
>>> The initial implementation was to support Bebo it was augmented to  
>>> allow multiple Facebook applications.  I think it is a useful  
>>> feature to have.   I believe some are using it.
>>>
>>> Dave
>>>
>>>
>>> On 2/25/09, Matthew Beale <mixonic at synitech.com> wrote:
>>> B/c of the way facebooker stores loaded configs the attack will  
>>> crash
>>> all requests until a good config is set again (yes?).
>>>
>>> A better question is why one would need to change configs via GET
>>> params.  Multiple facebook apps?  Does that really need to be  
>>> supported?
>>>
>>>
>>> --
>>> Matthew Beale :: 607 227 0871
>>> Resume & Portfolio @ http://madhatted.com
>>>
>>>
>>> On Wed, 2009-02-25 at 12:13 -0700, David Clements wrote:
>>> > I don't think I am clear anymore what the risk is of loading an
>>> > adapter from some malicious attack?   Before adapters there was  
>>> simply
>>> > one config.  All the adapter does is allow for multiple configs.
>>> >
>>> > What are we trying to protect against?
>>> >
>>> >
>>> > Dave
>>> >
>>> > On Wed, Feb 25, 2009 at 12:07 PM, Mike Mangino
>>> > <mmangino at elevatedrails.com> wrote:
>>> >         Do we need to know which adapter to use before we can  
>>> verify
>>> >         the params? Don't other implementation use different  
>>> params?
>>> >
>>> >
>>> >         Maybe we could require each adapter to verify that the  
>>> request
>>> >         is valid. Would that fix this issue?
>>> >
>>> >
>>> >         Mike
>>> >
>>> >
>>> >
>>> >
>>> >         On Feb 25, 2009, at 1:32 PM, kevin lochner wrote:
>>> >
>>> >
>>> >         >
>>> >         > I'm not convinced we have a good solution yet.  here's  
>>> the
>>> >         > relevant code:
>>> >         >
>>> >         >
>>> >         >
>>> >         > >       def request_comes_from_facebook?
>>> >         > >         request_is_for_a_facebook_canvas? ||
>>> >         > > request_is_facebook_ajax? || request_is_fb_ping?
>>> >         > >       end
>>> >         > >
>>> >         > >
>>> >         > >       def request_is_fb_ping?
>>> >         > >         !params['fb_sig'].blank?
>>> >         > >       end
>>> >         > >
>>> >         > >       def request_is_for_a_facebook_canvas?
>>> >         > >         !params['fb_sig_in_canvas'].blank?
>>> >         > >       end
>>> >         > >
>>> >         > >       def request_is_facebook_ajax?
>>> >         > >         params["fb_sig_is_mockajax"]=="1" ||
>>> >         > > params["fb_sig_is_ajax"]=="1"
>>> >         > >       end
>>> >         > >
>>> >         > >
>>> >         >
>>> >         >
>>> >         > So calling request_comes_from_facebook isn't really a
>>> >         > security feature, and doesn't change the behavior  
>>> w.r.t. the
>>> >         > test case that vince outlined, since they could just as
>>> >         > easily fake params["fb_sig"]
>>> >         >
>>> >         >
>>> >         > > >
>>> >         > > > All the malicious user has to do is send a malformed
>>> >         > > > HTTP request similar to:
>>> >         > > >
>>> >         > > > http://my.rails.app.com/some_controller/?fb_sig_api_key=you_are_pwned
>>> >         >
>>> >         >
>>> >         > I think the before filter should be:
>>> >         >
>>> >         >       def set_adapter
>>> >         >         Facebooker.load_adapter(facebook_params)
>>> >         > if(params[:fb_sig_api_key])
>>> >         >       end
>>> >         >
>>> >         >
>>> >         > since facebook_params calls verify_signature & ensures  
>>> the
>>> >         > request comes from facebook.
>>> >         >
>>> >         >
>>> >         > Alternatively, we could be verify the params signature  
>>> in
>>> >         > request_comes_from_facebook.  That may be a better  
>>> solution
>>> >         > since the request_comes_from_facebook method is a little
>>> >         > misleading (as david has just demonstrated).
>>> >         >
>>> >         >
>>> >         > Also, we throw an exception on a bad signature, so we  
>>> should
>>> >         > have a catch somewhere in the process.
>>> >         >
>>> >         >
>>> >         > - kevin
>>> >         >
>>> >         >
>>> >         >
>>> >         >
>>> >         >
>>> >         >
>>> >         >
>>> >         > On Feb 25, 2009, at 1:10 PM, David Clements wrote:
>>> >         >
>>> >         > > Cool thanks for taking a look.  Looks like I can  
>>> just add
>>> >         > > a condition to that call
>>> >         > >
>>> >         > > if request_comes_from_facebook?
>>> >         > >
>>> >         > > I'll try to get to it later today.
>>> >         > >
>>> >         > > Dave
>>> >         > >
>>> >         > > On 2/25/09, vincent chu <vincentchu at gmail.com> wrote:
>>> >         > >         Hi David ---
>>> >         > >
>>> >         > >         I took a look at your fix. Though I'm somewhat
>>> >         > >         unfamiliar with exactly what you want to do, I
>>> >         > >         think it would be prudent to validate that the
>>> >         > >         incoming params hash actually originates from
>>> >         > >         facebook before using the parameters to  
>>> reset the
>>> >         > >         adapter. This way, you never touch the adapter
>>> >         > >         until you're sure that it's Facebook sending  
>>> the
>>> >         > >         request, and not some malicious actor.
>>> >         > >
>>> >         > >         Cheers,
>>> >         > >
>>> >         > >         Vince
>>> >         > >         ----
>>> >         > >
>>> >         > >
>>> >         > >                 >
>>> >         > >                 >
>>> >         > >                 > On 2/24/09, vincent chu
>>> >         > >                 > <vincentchu at gmail.com> wrote:
>>> >         > >                 >         Hi all ---
>>> >         > >                 >
>>> >         > >                 >         In the course of  
>>> developing our
>>> >         > >                 >         Facebook connect app, we
>>> >         > >                 >         realized that there was a
>>> >         > >                 >         security hole in  
>>> Facebooker that
>>> >         > >                 >         allows any malicious user to
>>> >         > >                 >         change the state of the
>>> >         > >                 >         Facebooker module and  
>>> crash any
>>> >         > >                 >         controller/view that uses
>>> >         > >                 >         Facebooker to capture a  
>>> Facebook
>>> >         > >                 >         session. For Facebook  
>>> connect
>>> >         > >                 >         apps, this could  
>>> potentially be
>>> >         > >                 >         in any view that uses the
>>> >         > >                 >         "set_facebook_session"
>>> >         > >                 >         before_filter.
>>> >         > >                 >
>>> >         > >                 >         All the malicious user has  
>>> to do
>>> >         > >                 >         is send a malformed HTTP  
>>> request
>>> >         > >                 >         similar to:
>>> >         > >                 >
>>> >         > >                 >         http://my.rails.app.com/some_controller/?fb_sig_api_key=you_are_pwned
>>> >         > >                 >
>>> >         > >                 >         The problem comes in the
>>> >         > >                 >         'set_adapter' method of
>>> >         > >                 >         'facebooker/lib/facebooker/ 
>>> rails/controller.rb' where Facebooker will attempt to load an  
>>> adapter from the params hash if fb_sig_api_key is in the request  
>>> (ignoring the configuration found in the facebooker.yml file). In  
>>> this case, Facebooker would dutifully set the api_key to  
>>> "you_are_pwned" and any subsequent call to Facebooker would try  
>>> and use "you_are_pwned" as the api_key, causing it to crash the  
>>> site.
>>> >         > >
>>> >         > >
>>> >         > >
>>> >         > >
>>> >         > >
>>> >         >
>>> >         >
>>> >         > _______________________________________________
>>> >         > Facebooker-talk mailing list
>>> >         > Facebooker-talk at rubyforge.org
>>> >         > http://rubyforge.org/mailman/listinfo/facebooker-talk
>>> >         >
>>> >
>>> >         --
>>> >         Mike Mangino
>>> >         http://www.elevatedrails.com
>>> >
>>> >
>>> >
>>> >
>>> >
>>> >
>>> >
>>> > _______________________________________________
>>> > Facebooker-talk mailing list
>>> > Facebooker-talk at rubyforge.org
>>> > http://rubyforge.org/mailman/listinfo/facebooker-talk
>>>
>>>
>>>
>>> _______________________________________________
>>> Facebooker-talk mailing list
>>> Facebooker-talk at rubyforge.org
>>> http://rubyforge.org/mailman/listinfo/facebooker-talk
>>
>> _______________________________________________
>> Facebooker-talk mailing list
>> Facebooker-talk at rubyforge.org
>> http://rubyforge.org/mailman/listinfo/facebooker-talk
>
> --
> Mike Mangino
> http://www.elevatedrails.com
>
>
>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090225/5c58eddd/attachment-0001.html>

From brandon at opensoul.org  Wed Feb 25 21:19:09 2009
From: brandon at opensoul.org (Brandon Keepers)
Date: Wed, 25 Feb 2009 21:19:09 -0500
Subject: [Facebooker-talk] JS API + canvas
Message-ID: <3EA4019F-A267-4C90-A890-FBA99D46E434@opensoul.org>

Has anyone used the Facebook JS Client Library in a canvas app?  I  
need to have access to the current user's info, as well as lookup some  
info about other users.  I'd like to avoid using FBML or server-side  
API calls for what I'm trying to accomplish.  It looks like it's  
possible with the JS client library, but I don't see a mention of it  
being used on a canvas app, only stand-alone or iframe apps.

Thoughts?

Brandon
-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 194 bytes
Desc: This is a digitally signed message part
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090225/08600e9c/attachment.bin>

From joe at pinkpucker.net  Wed Feb 25 22:29:46 2009
From: joe at pinkpucker.net (Joe Van Dyk)
Date: Wed, 25 Feb 2009 19:29:46 -0800
Subject: [Facebooker-talk] Facebooker::Session::IncorrectSignature error
Message-ID: <c715e640902251929k34aab01p2486b0a52857a123@mail.gmail.com>

I get the following exception when the user adds my app:

Facebooker::Session::IncorrectSignature
(Facebooker::Session::IncorrectSignature):
    /vendor/plugins/facebooker/lib/facebooker/rails/controller.rb:175:in
`verify_signature'
    /vendor/plugins/facebooker/lib/facebooker/rails/controller.rb:160:in
`verified_facebook_params'
    /vendor/plugins/facebooker/lib/facebooker/rails/controller.rb:35:in
`facebook_params'
    /vendor/plugins/facebooker/lib/facebooker/rails/controller.rb:222:in
`application_is_installed?'
    /vendor/plugins/facebooker/lib/facebooker/rails/controller.rb:249:in
`ensure_application_is_installed_by_facebook_user'

Using the edge version of facebooker and rails 2.2.2.  All my
controller has in it is
"ensure_application_is_installed_by_facebook_user".


Any ideas?

From kalpakliev at googlemail.com  Thu Feb 26 03:00:06 2009
From: kalpakliev at googlemail.com (Petar Kalpakliev)
Date: Thu, 26 Feb 2009 09:00:06 +0100
Subject: [Facebooker-talk] passing an object to Ajax callback functions
Message-ID: <380578110902260000i78c0a6f7q30b55b7fcb7adf7e@mail.gmail.com>

hey guys,

As far as I understood, any Ajax calls we want to make should be addressed
directly to the callback server, and not to a canvas page.
This means that we cannot use any facebook-specific data (like the id of the
current user) in the function, which handles the Ajax call. I would
appreciate if you could tell me a convenient way to pass an object to the
function, which handles the Ajax call...
I am a bit new to Ruby on Rails, so I'll be grateful if you can also write a
small example.

Thanks in advance!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090226/6fb5ac7b/attachment.html>

From mmangino at elevatedrails.com  Thu Feb 26 09:03:07 2009
From: mmangino at elevatedrails.com (Mike Mangino)
Date: Thu, 26 Feb 2009 09:03:07 -0500
Subject: [Facebooker-talk] JS API + canvas
In-Reply-To: <3EA4019F-A267-4C90-A890-FBA99D46E434@opensoul.org>
References: <3EA4019F-A267-4C90-A890-FBA99D46E434@opensoul.org>
Message-ID: <F7D94B6A-6DB5-471A-A17B-BF0EB13F5D38@elevatedrails.com>


On Feb 25, 2009, at 9:19 PM, Brandon Keepers wrote:

> Has anyone used the Facebook JS Client Library in a canvas app?  I  
> need to have access to the current user's info, as well as lookup  
> some info about other users.  I'd like to avoid using FBML or server- 
> side API calls for what I'm trying to accomplish.  It looks like  
> it's possible with the JS client library, but I don't see a mention  
> of it being used on a canvas app, only stand-alone or iframe apps.
>

I would use FBML if possible, it will be a whole lot easier. The JS  
library is a pain, and I doubt it works inside a canvas application.  
In fact, the old JS library has been deprecated for Facebook Connect.

Mike

> Thoughts?
>
> Brandon
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk

--
Mike Mangino
http://www.elevatedrails.com




From mmangino at elevatedrails.com  Thu Feb 26 09:03:25 2009
From: mmangino at elevatedrails.com (Mike Mangino)
Date: Thu, 26 Feb 2009 09:03:25 -0500
Subject: [Facebooker-talk] Facebooker::Session::IncorrectSignature error
In-Reply-To: <c715e640902251929k34aab01p2486b0a52857a123@mail.gmail.com>
References: <c715e640902251929k34aab01p2486b0a52857a123@mail.gmail.com>
Message-ID: <CB8FA643-C1D4-4DF0-9C3C-D2943E5A2ED2@elevatedrails.com>

What parameters are coming in to the request?

Mike

On Feb 25, 2009, at 10:29 PM, Joe Van Dyk wrote:

> I get the following exception when the user adds my app:
>
> Facebooker::Session::IncorrectSignature
> (Facebooker::Session::IncorrectSignature):
>    /vendor/plugins/facebooker/lib/facebooker/rails/controller.rb: 
> 175:in
> `verify_signature'
>    /vendor/plugins/facebooker/lib/facebooker/rails/controller.rb: 
> 160:in
> `verified_facebook_params'
>    /vendor/plugins/facebooker/lib/facebooker/rails/controller.rb:35:in
> `facebook_params'
>    /vendor/plugins/facebooker/lib/facebooker/rails/controller.rb: 
> 222:in
> `application_is_installed?'
>    /vendor/plugins/facebooker/lib/facebooker/rails/controller.rb: 
> 249:in
> `ensure_application_is_installed_by_facebook_user'
>
> Using the edge version of facebooker and rails 2.2.2.  All my
> controller has in it is
> "ensure_application_is_installed_by_facebook_user".
>
>
> Any ideas?
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk

--
Mike Mangino
http://www.elevatedrails.com




From mmangino at elevatedrails.com  Thu Feb 26 09:02:18 2009
From: mmangino at elevatedrails.com (Mike Mangino)
Date: Thu, 26 Feb 2009 09:02:18 -0500
Subject: [Facebooker-talk] passing an object to Ajax callback functions
In-Reply-To: <380578110902260000i78c0a6f7q30b55b7fcb7adf7e@mail.gmail.com>
References: <380578110902260000i78c0a6f7q30b55b7fcb7adf7e@mail.gmail.com>
Message-ID: <733D5BE9-BDFB-4F9F-9414-EC5E7AFC8E36@elevatedrails.com>

You should still be able to get user information, since Facebook adds  
parameters on ajax calls. I cover this with examples in my book:  http://www.pragprog.com/titles/mmfacer

Mike

On Feb 26, 2009, at 3:00 AM, Petar Kalpakliev wrote:

> hey guys,
>
> As far as I understood, any Ajax calls we want to make should be  
> addressed directly to the callback server, and not to a canvas page.
> This means that we cannot use any facebook-specific data (like the  
> id of the current user) in the function, which handles the Ajax  
> call. I would appreciate if you could tell me a convenient way to  
> pass an object to the function, which handles the Ajax call...
> I am a bit new to Ruby on Rails, so I'll be grateful if you can also  
> write a small example.
>
> Thanks in advance!
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk

--
Mike Mangino
http://www.elevatedrails.com




From brandon at opensoul.org  Thu Feb 26 09:33:24 2009
From: brandon at opensoul.org (Brandon Keepers)
Date: Thu, 26 Feb 2009 09:33:24 -0500
Subject: [Facebooker-talk] JS API + canvas
In-Reply-To: <F7D94B6A-6DB5-471A-A17B-BF0EB13F5D38@elevatedrails.com>
References: <3EA4019F-A267-4C90-A890-FBA99D46E434@opensoul.org>
	<F7D94B6A-6DB5-471A-A17B-BF0EB13F5D38@elevatedrails.com>
Message-ID: <418CF042-9CFB-4BDE-934A-2980CA77B872@opensoul.org>


On Feb 26, 2009, at 9:03 AM, Mike Mangino wrote:

>
> On Feb 25, 2009, at 9:19 PM, Brandon Keepers wrote:
>
>> Has anyone used the Facebook JS Client Library in a canvas app?  I  
>> need to have access to the current user's info, as well as lookup  
>> some info about other users.  I'd like to avoid using FBML or  
>> server-side API calls for what I'm trying to accomplish.  It looks  
>> like it's possible with the JS client library, but I don't see a  
>> mention of it being used on a canvas app, only stand-alone or  
>> iframe apps.
>>
>
> I would use FBML if possible, it will be a whole lot easier. The JS  
> library is a pain, and I doubt it works inside a canvas application.  
> In fact, the old JS library has been deprecated for Facebook Connect.
>
> Mike

I'd like to avoid using FBML if possible.  I'm writing a group chat  
app built on top of Facebook's LiveMessage.  Using FBML, every time a  
user sends a message I have to pass along their name and photo with  
each message.  Ideally, I'd just like to pass their user ID and each  
client can look up the name and photo.  I was hoping to use the JS  
client to keep the load off of my servers.  Any other ideas for  
accomplishing this?

I'll blog about the chat once it's done.  I've got it working now  
using some server-side API calls, but I'd like to push these to the  
client if possible.

Thanks,
Brandon
-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 194 bytes
Desc: This is a digitally signed message part
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090226/605dce1f/attachment.bin>

From jan at varwig.org  Thu Feb 26 14:58:59 2009
From: jan at varwig.org (Jan Varwig)
Date: Thu, 26 Feb 2009 20:58:59 +0100
Subject: [Facebooker-talk] Facebook connect and One-line stories
Message-ID: <E6DD4E44-CFDA-4849-95C6-E641455FBED2@varwig.org>

Hi,

I am developing a simple FBconnect app and I can't figure out how to
publish a one-line story to the users feed. I have templates for
the stories but I don't know which methods/classes in the Facebooker
API I have to use to actually access the Feed.publishUserAction API call
(http://wiki.developers.facebook.com/index.php/Feed.publishUserAction).

Could someone give me a hint?

thx and kind regards

Jan

From mmangino at elevatedrails.com  Thu Feb 26 16:52:02 2009
From: mmangino at elevatedrails.com (Mike Mangino)
Date: Thu, 26 Feb 2009 16:52:02 -0500
Subject: [Facebooker-talk] Facebook connect and One-line stories
In-Reply-To: <E6DD4E44-CFDA-4849-95C6-E641455FBED2@varwig.org>
References: <E6DD4E44-CFDA-4849-95C6-E641455FBED2@varwig.org>
Message-ID: <E27E1FFE-CA1C-499E-B333-356AF52146DA@elevatedrails.com>

Give me about a day. I'll be releasing a sample rails Facebook connect  
application and a bunch of enhancements to Facebooker.

Mike

On Feb 26, 2009, at 2:58 PM, Jan Varwig wrote:

> Hi,
>
> I am developing a simple FBconnect app and I can't figure out how to
> publish a one-line story to the users feed. I have templates for
> the stories but I don't know which methods/classes in the Facebooker
> API I have to use to actually access the Feed.publishUserAction API  
> call
> (http://wiki.developers.facebook.com/index.php/ 
> Feed.publishUserAction).
>
> Could someone give me a hint?
>
> thx and kind regards
>
> Jan
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk

--
Mike Mangino
http://www.elevatedrails.com




From matt at bustoutsolutions.com  Thu Feb 26 17:50:04 2009
From: matt at bustoutsolutions.com (Matt Carlson)
Date: Thu, 26 Feb 2009 14:50:04 -0800
Subject: [Facebooker-talk] javascript events and fb-editor elements
Message-ID: <a91186bf0902261450k2ba5ca59w77c646b326115ce2@mail.gmail.com>

This is probably a completely naive question given how straightforward the
documentation is (
http://wiki.developers.facebook.com/index.php/Fb:editor-textarea), but is
there any way to add FBJS events (onkeyup etc) to the fb-editor-textarea
element to do something like a live character count?

I've tried adding it, but it looks as though facebook ignores event
attributes.

Cheers,
Matt
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090226/1d5ec966/attachment-0001.html>

From alan.larkin at gmail.com  Thu Feb 26 18:37:58 2009
From: alan.larkin at gmail.com (Alan Larkin)
Date: Thu, 26 Feb 2009 23:37:58 +0000
Subject: [Facebooker-talk] Facebook connect and One-line stories
In-Reply-To: <E27E1FFE-CA1C-499E-B333-356AF52146DA@elevatedrails.com>
References: <E6DD4E44-CFDA-4849-95C6-E641455FBED2@varwig.org>
	<E27E1FFE-CA1C-499E-B333-356AF52146DA@elevatedrails.com>
Message-ID: <49A727D6.5020501@gmail.com>

A day? Is that your response time now Mike? That's a risky precedent you're 
setting there :D

Mike Mangino wrote:
> Give me about a day. I'll be releasing a sample rails Facebook connect 
> application and a bunch of enhancements to Facebooker.
> 
> Mike
> 
> On Feb 26, 2009, at 2:58 PM, Jan Varwig wrote:
> 
>> Hi,
>>
>> I am developing a simple FBconnect app and I can't figure out how to
>> publish a one-line story to the users feed. I have templates for
>> the stories but I don't know which methods/classes in the Facebooker
>> API I have to use to actually access the Feed.publishUserAction API call
>> (http://wiki.developers.facebook.com/index.php/Feed.publishUserAction).
>>
>> Could someone give me a hint?
>>
>> thx and kind regards
>>
>> Jan
>> _______________________________________________
>> Facebooker-talk mailing list
>> Facebooker-talk at rubyforge.org
>> http://rubyforge.org/mailman/listinfo/facebooker-talk
> 
> -- 
> Mike Mangino
> http://www.elevatedrails.com
> 
> 
> 
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk
> 


From mmangino at elevatedrails.com  Thu Feb 26 18:47:51 2009
From: mmangino at elevatedrails.com (Mike Mangino)
Date: Thu, 26 Feb 2009 18:47:51 -0500
Subject: [Facebooker-talk] Facebook connect and One-line stories
In-Reply-To: <49A727D6.5020501@gmail.com>
References: <E6DD4E44-CFDA-4849-95C6-E641455FBED2@varwig.org>
	<E27E1FFE-CA1C-499E-B333-356AF52146DA@elevatedrails.com>
	<49A727D6.5020501@gmail.com>
Message-ID: <E21F8E35-EE8A-4BD2-BC33-001D806163A1@elevatedrails.com>

I know :)

It would be much longer if I hadn't started working on it this  
morning. I have a spike working, so I just need to clean up the code  
and add tests.

Mike

On Feb 26, 2009, at 6:37 PM, Alan Larkin wrote:

> A day? Is that your response time now Mike? That's a risky precedent  
> you're setting there :D
>
> Mike Mangino wrote:
>> Give me about a day. I'll be releasing a sample rails Facebook  
>> connect application and a bunch of enhancements to Facebooker.
>> Mike
>> On Feb 26, 2009, at 2:58 PM, Jan Varwig wrote:
>>> Hi,
>>>
>>> I am developing a simple FBconnect app and I can't figure out how to
>>> publish a one-line story to the users feed. I have templates for
>>> the stories but I don't know which methods/classes in the Facebooker
>>> API I have to use to actually access the Feed.publishUserAction  
>>> API call
>>> (http://wiki.developers.facebook.com/index.php/Feed.publishUserAction 
>>> ).
>>>
>>> Could someone give me a hint?
>>>
>>> thx and kind regards
>>>
>>> Jan
>>> _______________________________________________
>>> Facebooker-talk mailing list
>>> Facebooker-talk at rubyforge.org
>>> http://rubyforge.org/mailman/listinfo/facebooker-talk
>> -- 
>> Mike Mangino
>> http://www.elevatedrails.com
>> _______________________________________________
>> Facebooker-talk mailing list
>> Facebooker-talk at rubyforge.org
>> http://rubyforge.org/mailman/listinfo/facebooker-talk
>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk

--
Mike Mangino
http://www.elevatedrails.com




From adeel at proletariandesign.com  Fri Feb 27 02:55:53 2009
From: adeel at proletariandesign.com (Adeel Ahmad)
Date: Thu, 26 Feb 2009 23:55:53 -0800
Subject: [Facebooker-talk] Facebook connect and One-line stories
Message-ID: <168ef1510902262355u14309db9qe299154f04519c72@mail.gmail.com>

This is going to be great... I'm looking for feed publishing for my FB
Connect app as well.
I ran into the issue that FB's policy for Connect apps is that they don't
let one-line stories get published automatically unless they are whitelisted
by Facebook first. And that policy is still under review.
The only other option is generating a feed dialog but I don't see feed
dialog's in Facebooker?

-- 
- Adeel
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090226/19939161/attachment.html>

From mmangino at elevatedrails.com  Fri Feb 27 11:38:14 2009
From: mmangino at elevatedrails.com (Mike Mangino)
Date: Fri, 27 Feb 2009 11:38:14 -0500
Subject: [Facebooker-talk] Facebook connect and One-line stories
In-Reply-To: <168ef1510902262355u14309db9qe299154f04519c72@mail.gmail.com>
References: <168ef1510902262355u14309db9qe299154f04519c72@mail.gmail.com>
Message-ID: <55094DF3-B8F9-4306-80DF-9BF7D08C4231@elevatedrails.com>

I finished a first version of the application:

http://github.com/mmangino/fb_connect_example/tree/master

The version of facebooker in the application is slightly different  
than the current public version. I'm going to work on merging these  
changes back in today. I'll send another email when they are ready.

Mike

On Feb 27, 2009, at 2:55 AM, Adeel Ahmad wrote:

> This is going to be great... I'm looking for feed publishing for my  
> FB Connect app as well.
> I ran into the issue that FB's policy for Connect apps is that they  
> don't let one-line stories get published automatically unless they  
> are whitelisted by Facebook first. And that policy is still under  
> review.
> The only other option is generating a feed dialog but I don't see  
> feed dialog's in Facebooker?
>
> -- 
> - Adeel
>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk

--
Mike Mangino
http://www.elevatedrails.com




From swivelmaster at yahoo.com  Fri Feb 27 12:58:24 2009
From: swivelmaster at yahoo.com (Aaron Nemoyten)
Date: Fri, 27 Feb 2009 09:58:24 -0800 (PST)
Subject: [Facebooker-talk] JS API + canvas
Message-ID: <559300.81219.qm@web33003.mail.mud.yahoo.com>


I'm on vacation and writing from my iphone but I feel it's important to chime in on this. The iframe app I'm working on uses the JS library and most of time it works pretty well. We haven't used a ton of features though, so your results may vary.  For what you've mentioned though, which sounds like you just want to call Users.getInfo, you should be fine.  I'll try to get into this more when I get back on Monday. 

-Aaron

Sent from my iPhone

On Feb 26, 2009, at 6:33 AM, Brandon Keepers <brandon at opensoul.org> wrote:


On Feb 26, 2009, at 9:03 AM, Mike Mangino wrote:


On Feb 25, 2009, at 9:19 PM, Brandon Keepers wrote:

Has anyone used the Facebook JS Client Library in a canvas app? I need to have access to the current user's info, as well as lookup some info about other users.  I'd like to avoid using FBML or server-side API calls for what I'm trying to accomplish.  It looks like it's possible with the JS client library, but I don't see a mention of it being used on a canvas app, only stand-alone or iframe apps.


I would use FBML if possible, it will be a whole lot easier. The JS library is a pain, and I doubt it works inside a canvas application. In fact, the old JS library has been deprecated for Facebook Connect.

Mike

I'd like to avoid using FBML if possible.  I'm writing a group chat app built on top of Facebook's LiveMessage.  Using FBML, every time a user sends a message I have to pass along their name and photo with each message.  Ideally, I'd just like to pass their user ID and each client can look up the name and photo.  I was hoping to use the JS client to keep the load off of my servers.  Any other ideas for accomplishing this?

I'll blog about the chat once it's done.  I've got it working now using some server-side API calls, but I'd like to push these to the client if possible.

Thanks,
Brandon
_______________________________________________
Facebooker-talk mailing list
Facebooker-talk at rubyforge.org
http://rubyforge.org/mailman/listinfo/facebooker-talk



      

From mmangino at elevatedrails.com  Fri Feb 27 16:27:19 2009
From: mmangino at elevatedrails.com (Mike Mangino)
Date: Fri, 27 Feb 2009 16:27:19 -0500
Subject: [Facebooker-talk] Facebook connect and One-line stories
In-Reply-To: <168ef1510902262355u14309db9qe299154f04519c72@mail.gmail.com>
References: <168ef1510902262355u14309db9qe299154f04519c72@mail.gmail.com>
Message-ID: <B90E7E55-01F5-4474-B816-9AEF282F845F@elevatedrails.com>

I just updated facebooker and my sample application.

To get a facebook session for the current user, you can use:

   before_filter :create_facebook_session

This is like the old :set_facebook_session, but it doesn't store the  
session in a cookie.

To actually publish notifications, I use the following code in my  
controller:
   def create
     @note = current_user.sent_notes.create!(params[:note])
     flash[:notice] = "Note sent to #{@note.recipient.email}"
     if facebook_session
       flash[:user_action_to_publish] =  
UserPublisher.create_note_sent(@note,facebook_session)
     end
     redirect_to notes_path
   end

That stores a new user action in the flash. If I wasn't redirecting, I  
could assign it to @ user_action_to_publish

Then, in my controller, I grab the object from the flash after a  
redirect:

   before_filter :load_actions_to_publish
   def load_actions_to_publish
     @user_action_to_publish = flash[:user_action_to_publish]
     flash[:user_action_to_publish]=nil
   end

Finally, I have a bit in my view that calls these. This means that on  
the page after an action would create a notification, the user is  
prompted to allow the notification


in application.html.erb

     <% init_fb_connect "XFBML","Api" do %>
       <%= fb_user_action(@user_action_to_publish) if  
@user_action_to_publish%>
       <%= yield :fb_connect%>
     <% end %>


Mike



On Feb 27, 2009, at 2:55 AM, Adeel Ahmad wrote:

> This is going to be great... I'm looking for feed publishing for my  
> FB Connect app as well.
> I ran into the issue that FB's policy for Connect apps is that they  
> don't let one-line stories get published automatically unless they  
> are whitelisted by Facebook first. And that policy is still under  
> review.
> The only other option is generating a feed dialog but I don't see  
> feed dialog's in Facebooker?
>
> -- 
> - Adeel
>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk

--
Mike Mangino
http://www.elevatedrails.com




From mmangino at elevatedrails.com  Fri Feb 27 16:43:51 2009
From: mmangino at elevatedrails.com (Mike Mangino)
Date: Fri, 27 Feb 2009 16:43:51 -0500
Subject: [Facebooker-talk] Facebook connect and One-line stories
In-Reply-To: <168ef1510902271335h72f47b33je961d02abc631b1d@mail.gmail.com>
References: <168ef1510902262355u14309db9qe299154f04519c72@mail.gmail.com>
	<B90E7E55-01F5-4474-B816-9AEF282F845F@elevatedrails.com>
	<168ef1510902271335h72f47b33je961d02abc631b1d@mail.gmail.com>
Message-ID: <83D54185-CD28-48DF-89BF-EC0B504B165E@elevatedrails.com>

Yep!

The code pops up a window that lets the user pick what size story to  
show. It defaults to short story.

Mike

On Feb 27, 2009, at 4:35 PM, Adeel Ahmad wrote:

> Thanks, I'll dig into this tonight. This will be very useful.
> At the end, when you list code to prompt the user if they want to  
> allow the notification, will this work for one-line stories as  
> well?  Since FB doesn't let us send these automatically I'm hoping a  
> simple confirmation prompt will work.
>
>
> - Adeel
>
> Founder/President
> Proletarian Design LLC
> 1066 47th Ave., Suite 19
> Oakland, CA 94601
> t: 415.205.0274
> f: 415.871.2200
> skype: a2ahmad
> twitter: _adeel
> www.proletariandesign.com
>
>
> On Fri, Feb 27, 2009 at 1:27 PM, Mike Mangino <mmangino at elevatedrails.com 
> > wrote:
> I just updated facebooker and my sample application.
>
> To get a facebook session for the current user, you can use:
>
>  before_filter :create_facebook_session
>
> This is like the old :set_facebook_session, but it doesn't store the  
> session in a cookie.
>
> To actually publish notifications, I use the following code in my  
> controller:
>  def create
>    @note = current_user.sent_notes.create!(params[:note])
>    flash[:notice] = "Note sent to #{@note.recipient.email}"
>    if facebook_session
>      flash[:user_action_to_publish] =  
> UserPublisher.create_note_sent(@note,facebook_session)
>    end
>    redirect_to notes_path
>  end
>
> That stores a new user action in the flash. If I wasn't redirecting,  
> I could assign it to @ user_action_to_publish
>
> Then, in my controller, I grab the object from the flash after a  
> redirect:
>
>  before_filter :load_actions_to_publish
>  def load_actions_to_publish
>    @user_action_to_publish = flash[:user_action_to_publish]
>    flash[:user_action_to_publish]=nil
>  end
>
> Finally, I have a bit in my view that calls these. This means that  
> on the page after an action would create a notification, the user is  
> prompted to allow the notification
>
>
> in application.html.erb
>
>    <% init_fb_connect "XFBML","Api" do %>
>      <%= fb_user_action(@user_action_to_publish) if  
> @user_action_to_publish%>
>      <%= yield :fb_connect%>
>    <% end %>
>
>
>
> Mike
>
>
>
> On Feb 27, 2009, at 2:55 AM, Adeel Ahmad wrote:
>
> This is going to be great... I'm looking for feed publishing for my  
> FB Connect app as well.
> I ran into the issue that FB's policy for Connect apps is that they  
> don't let one-line stories get published automatically unless they  
> are whitelisted by Facebook first. And that policy is still under  
> review.
> The only other option is generating a feed dialog but I don't see  
> feed dialog's in Facebooker?
>
> -- 
> - Adeel
>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk
>
> --
> Mike Mangino
> http://www.elevatedrails.com
>
>
>
>

--
Mike Mangino
http://www.elevatedrails.com



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090227/8dfc8b6e/attachment-0001.html>

From adeel at proletariandesign.com  Fri Feb 27 16:35:23 2009
From: adeel at proletariandesign.com (Adeel Ahmad)
Date: Fri, 27 Feb 2009 13:35:23 -0800
Subject: [Facebooker-talk] Facebook connect and One-line stories
In-Reply-To: <B90E7E55-01F5-4474-B816-9AEF282F845F@elevatedrails.com>
References: <168ef1510902262355u14309db9qe299154f04519c72@mail.gmail.com>
	<B90E7E55-01F5-4474-B816-9AEF282F845F@elevatedrails.com>
Message-ID: <168ef1510902271335h72f47b33je961d02abc631b1d@mail.gmail.com>

Thanks, I'll dig into this tonight. This will be very useful.At the end,
when you list code to prompt the user if they want to allow the
notification, will this work for one-line stories as well?  Since FB doesn't
let us send these automatically I'm hoping a simple confirmation prompt will
work.


- Adeel

Founder/President
Proletarian Design LLC
1066 47th Ave., Suite 19
Oakland, CA 94601
t: 415.205.0274
f: 415.871.2200
skype: a2ahmad
twitter: _adeel
www.proletariandesign.com


On Fri, Feb 27, 2009 at 1:27 PM, Mike Mangino <mmangino at elevatedrails.com>wrote:

> I just updated facebooker and my sample application.
>
> To get a facebook session for the current user, you can use:
>
>  before_filter :create_facebook_session
>
> This is like the old :set_facebook_session, but it doesn't store the
> session in a cookie.
>
> To actually publish notifications, I use the following code in my
> controller:
>  def create
>    @note = current_user.sent_notes.create!(params[:note])
>    flash[:notice] = "Note sent to #{@note.recipient.email}"
>    if facebook_session
>      flash[:user_action_to_publish] =
> UserPublisher.create_note_sent(@note,facebook_session)
>    end
>    redirect_to notes_path
>  end
>
> That stores a new user action in the flash. If I wasn't redirecting, I
> could assign it to @ user_action_to_publish
>
> Then, in my controller, I grab the object from the flash after a redirect:
>
>  before_filter :load_actions_to_publish
>  def load_actions_to_publish
>    @user_action_to_publish = flash[:user_action_to_publish]
>    flash[:user_action_to_publish]=nil
>  end
>
> Finally, I have a bit in my view that calls these. This means that on the
> page after an action would create a notification, the user is prompted to
> allow the notification
>
>
> in application.html.erb
>
>    <% init_fb_connect "XFBML","Api" do %>
>      <%= fb_user_action(@user_action_to_publish) if
> @user_action_to_publish%>
>      <%= yield :fb_connect%>
>    <% end %>
>
>
> Mike
>
>
>
> On Feb 27, 2009, at 2:55 AM, Adeel Ahmad wrote:
>
>  This is going to be great... I'm looking for feed publishing for my FB
>> Connect app as well.
>> I ran into the issue that FB's policy for Connect apps is that they don't
>> let one-line stories get published automatically unless they are whitelisted
>> by Facebook first. And that policy is still under review.
>> The only other option is generating a feed dialog but I don't see feed
>> dialog's in Facebooker?
>>
>> --
>> - Adeel
>>
>> _______________________________________________
>> Facebooker-talk mailing list
>> Facebooker-talk at rubyforge.org
>> http://rubyforge.org/mailman/listinfo/facebooker-talk
>>
>
> --
> Mike Mangino
> http://www.elevatedrails.com
>
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090227/35f3ff22/attachment.html>

From klochner at gmail.com  Fri Feb 27 22:23:04 2009
From: klochner at gmail.com (kevin lochner)
Date: Fri, 27 Feb 2009 22:23:04 -0500
Subject: [Facebooker-talk] Facebook connect and One-line stories
In-Reply-To: <B90E7E55-01F5-4474-B816-9AEF282F845F@elevatedrails.com>
References: <168ef1510902262355u14309db9qe299154f04519c72@mail.gmail.com>
	<B90E7E55-01F5-4474-B816-9AEF282F845F@elevatedrails.com>
Message-ID: <4F4BB692-9D41-40A9-B2A9-0BED38953400@gmail.com>

hey mike -

Can you explain what you're doing here:?

>      <%= yield :fb_connect%>

  - kevin

On Feb 27, 2009, at 4:27 PM, Mike Mangino wrote:

> I just updated facebooker and my sample application.
>
> To get a facebook session for the current user, you can use:
>
>  before_filter :create_facebook_session
>
> This is like the old :set_facebook_session, but it doesn't store the  
> session in a cookie.
>
> To actually publish notifications, I use the following code in my  
> controller:
>  def create
>    @note = current_user.sent_notes.create!(params[:note])
>    flash[:notice] = "Note sent to #{@note.recipient.email}"
>    if facebook_session
>      flash[:user_action_to_publish] =  
> UserPublisher.create_note_sent(@note,facebook_session)
>    end
>    redirect_to notes_path
>  end
>
> That stores a new user action in the flash. If I wasn't redirecting,  
> I could assign it to @ user_action_to_publish
>
> Then, in my controller, I grab the object from the flash after a  
> redirect:
>
>  before_filter :load_actions_to_publish
>  def load_actions_to_publish
>    @user_action_to_publish = flash[:user_action_to_publish]
>    flash[:user_action_to_publish]=nil
>  end
>
> Finally, I have a bit in my view that calls these. This means that  
> on the page after an action would create a notification, the user is  
> prompted to allow the notification
>
>
> in application.html.erb
>
>    <% init_fb_connect "XFBML","Api" do %>
>      <%= fb_user_action(@user_action_to_publish) if  
> @user_action_to_publish%>
>      <%= yield :fb_connect%>
>    <% end %>
>
>
> Mike
>
>
>
> On Feb 27, 2009, at 2:55 AM, Adeel Ahmad wrote:
>
>> This is going to be great... I'm looking for feed publishing for my  
>> FB Connect app as well.
>> I ran into the issue that FB's policy for Connect apps is that they  
>> don't let one-line stories get published automatically unless they  
>> are whitelisted by Facebook first. And that policy is still under  
>> review.
>> The only other option is generating a feed dialog but I don't see  
>> feed dialog's in Facebooker?
>>
>> -- 
>> - Adeel
>>
>> _______________________________________________
>> Facebooker-talk mailing list
>> Facebooker-talk at rubyforge.org
>> http://rubyforge.org/mailman/listinfo/facebooker-talk
>
> --
> Mike Mangino
> http://www.elevatedrails.com
>
>
>
> _______________________________________________
> Facebooker-talk mailing list
> Facebooker-talk at rubyforge.org
> http://rubyforge.org/mailman/listinfo/facebooker-talk


From cjohnson at socialvibe.com  Fri Feb 27 22:30:24 2009
From: cjohnson at socialvibe.com (Chris Johnson)
Date: Fri, 27 Feb 2009 19:30:24 -0800
Subject: [Facebooker-talk] Retrieving an array of users given an array
	of uid's
In-Reply-To: <AA96D4AC-D87D-42C9-998B-037CFD673E08@gmail.com>
References: <4632D257-8C6B-4C75-A43A-49B803CD7EC3@socialvibe.com>
	<AA96D4AC-D87D-42C9-998B-037CFD673E08@gmail.com>
Message-ID: <05515BDD-B10A-44D2-B4B1-06DE52ABB7F6@socialvibe.com>

That worked perfectly.
Thanks Kevin for your reply.

-Chris

On Feb 23, 2009, at 7:51 PM, kevin lochner wrote:

> facebook_session.users(ids, fields)
>
>
> On Feb 23, 2009, at 9:42 PM, Chris Johnson wrote:
>
>> Hi there.
>>
>> Let's say I have a list of 20 uids (call it "cool_friends").  These  
>> are friends of the current user, and I'd like to retrieve User  
>> objects for each friend (so that I can access first_name and  
>> last_name).
>>
>> I know I could do something like:
>> facebook_session.user.friends!(:uid, :first_name, :last_name)
>>
>> With that full friend list, I can iterate over it and match users  
>> to the list of "cool_friends", but that seems cumbersome and pulls  
>> back more users (all friends) than I need.
>>
>> Can I request an array of users based on a list of UIDs?
>>
>> Cheers,
>> Chris
>> _______________________________________________
>> Facebooker-talk mailing list
>> Facebooker-talk at rubyforge.org
>> http://rubyforge.org/mailman/listinfo/facebooker-talk
>


From adeel at proletariandesign.com  Sat Feb 28 02:49:50 2009
From: adeel at proletariandesign.com (Adeel Ahmad)
Date: Fri, 27 Feb 2009 23:49:50 -0800
Subject: [Facebooker-talk] Facebook connect and One-line stories
In-Reply-To: <83D54185-CD28-48DF-89BF-EC0B504B165E@elevatedrails.com>
References: <168ef1510902262355u14309db9qe299154f04519c72@mail.gmail.com>
	<B90E7E55-01F5-4474-B816-9AEF282F845F@elevatedrails.com>
	<168ef1510902271335h72f47b33je961d02abc631b1d@mail.gmail.com>
	<83D54185-CD28-48DF-89BF-EC0B504B165E@elevatedrails.com>
Message-ID: <168ef1510902272349g6275ee29g74b02e67c7611007@mail.gmail.com>

Unfortunately I haven't been able to get very far integrating this into my
app. I get the "wrong number of arguments (1 for 2)" error on the line: <%
init_fb_connect "XFBML","Api" do %>in the application layout file and can't
seem to get away from it so my app never gets to the its main page. I am
able to get Mike's example app somewhat working. I'm on Rails 2.1.1 and the
example app is 2.2.2. Don't know if there is a dependency there.
However even with Mike's app, while I'm able to see the login button and
click it to get the Connect prompt, it always tells me I'm unable to login.
I did update the facebooker.yml file with my dev app keys.
Any ideas?


- Adeel

Founder/President
Proletarian Design LLC
1066 47th Ave., Suite 19
Oakland, CA 94601
t: 415.205.0274
f: 415.871.2200
skype: a2ahmad
twitter: _adeel
www.proletariandesign.com


On Fri, Feb 27, 2009 at 1:43 PM, Mike Mangino <mmangino at elevatedrails.com>wrote:

> Yep!
> The code pops up a window that lets the user pick what size story to show.
> It defaults to short story.
>
> Mike
>
> On Feb 27, 2009, at 4:35 PM, Adeel Ahmad wrote:
>
> Thanks, I'll dig into this tonight. This will be very useful.At the end,
> when you list code to prompt the user if they want to allow the
> notification, will this work for one-line stories as well?  Since FB doesn't
> let us send these automatically I'm hoping a simple confirmation prompt will
> work.
>
>
> - Adeel
>
> Founder/President
> Proletarian Design LLC
> 1066 47th Ave., Suite 19
> Oakland, CA 94601
> t: 415.205.0274
> f: 415.871.2200
> skype: a2ahmad
> twitter: _adeel
> www.proletariandesign.com
>
>
> On Fri, Feb 27, 2009 at 1:27 PM, Mike Mangino <mmangino at elevatedrails.com>wrote:
>
>> I just updated facebooker and my sample application.
>>
>> To get a facebook session for the current user, you can use:
>>
>>  before_filter :create_facebook_session
>>
>> This is like the old :set_facebook_session, but it doesn't store the
>> session in a cookie.
>>
>> To actually publish notifications, I use the following code in my
>> controller:
>>  def create
>>    @note = current_user.sent_notes.create!(params[:note])
>>    flash[:notice] = "Note sent to #{@note.recipient.email<%23%7B at note.recipient.email>
>> }"
>>    if facebook_session
>>      flash[:user_action_to_publish] =
>> UserPublisher.create_note_sent(@note,facebook_session)
>>    end
>>    redirect_to notes_path
>>  end
>>
>> That stores a new user action in the flash. If I wasn't redirecting, I
>> could assign it to @ user_action_to_publish
>>
>> Then, in my controller, I grab the object from the flash after a redirect:
>>
>>  before_filter :load_actions_to_publish
>>  def load_actions_to_publish
>>    @user_action_to_publish = flash[:user_action_to_publish]
>>    flash[:user_action_to_publish]=nil
>>  end
>>
>> Finally, I have a bit in my view that calls these. This means that on the
>> page after an action would create a notification, the user is prompted to
>> allow the notification
>>
>>
>> in application.html.erb
>>
>>    <% init_fb_connect "XFBML","Api" do %>
>>      <%= fb_user_action(@user_action_to_publish) if
>> @user_action_to_publish%>
>>      <%= yield :fb_connect%>
>>    <% end %>
>>
>>
>> Mike
>>
>>
>>
>> On Feb 27, 2009, at 2:55 AM, Adeel Ahmad wrote:
>>
>>  This is going to be great... I'm looking for feed publishing for my FB
>>> Connect app as well.
>>> I ran into the issue that FB's policy for Connect apps is that they don't
>>> let one-line stories get published automatically unless they are whitelisted
>>> by Facebook first. And that policy is still under review.
>>> The only other option is generating a feed dialog but I don't see feed
>>> dialog's in Facebooker?
>>>
>>> --
>>> - Adeel
>>>
>>> _______________________________________________
>>> Facebooker-talk mailing list
>>> Facebooker-talk at rubyforge.org
>>> http://rubyforge.org/mailman/listinfo/facebooker-talk
>>>
>>
>> --
>> Mike Mangino
>> http://www.elevatedrails.com
>>
>>
>>
>>
>
> --
> Mike Mangino
> http://www.elevatedrails.com
>
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://rubyforge.org/pipermail/facebooker-talk/attachments/20090227/d245e189/attachment.html>