eastmedia/onebigchatroom — pull request #6 by jcoglan (2012-09-05 17:06:08+00:00)
Title: Prevent XSS attacks

You're using Faye to publish JavaScript from the server to the client. I *strongly* discourage this, but it's safe as long as you only let your server publish such messages. If you let anyone publish, then you have an open XSS hole where anyone can inject JavaScript into your pages.

I've added code to `faye.ru` and `application_helper.rb` to make it so that a password (stored in `application.rb` is required to publish messages.