Using wrap_parameters to allow a non-ActiveRecord parameter

Rails 4 introduced strong parameters:

With strong parameters, Action Controller parameters are forbidden to be used in Active Model mass assignments until they have been whitelisted. This means that you’ll have to make a conscious decision about which attributes to allow for mass update. This is a better security practice to help prevent accidentally allowing users to update sensitive model attributes.

There are some caveats to using them, and I found this article helpful in understanding what’s going on behind the scenes:

One issue I have come across a couple of times now, which I would like to describe here, concerns explicitly permitting a parameter in addition to the attributes of an ActiveRecord model.

In one case, my model included a field, let’s call it code, composed of two parts: ABC.123. It was convenient to store this as one field in the database, but I wanted to separate it into two input fields in the UI, only one of which could be modified. So to handle this I wrote two readers and a setter on the model. Here’s what I mean (leaving out handling of edge cases):

def code_letters
  code.split('.').first()          # e.g. ABC

def code_numbers
  code.split('.').last()           # e.g. 123

def code_numbers=(value)
  write_attribute(:code, "#{code_letters}.#{value}")

Next, I added an entry to the parameter whitelisting in the controller:

def model_params
  params.require(:account).permit(:other_fields, :code_numbers)

This, however, was not enough. The value was POSTed fine, but was not available in the controller after calling model_params. There was no easy way of figuring out what to do, but I eventually came across a solution: wrap_parameters.

This takes the form of either an :include list, or an :exclude list; I couldn’t just specify one additional parameter to be let through. So I specified them all:

class AccountsController < ApplicationController
  wrap_parameters include: Account.attribute_names + [:code_numbers]

ParamsWrapper actually uses the model’s attribute_names method by default, so I simply specified the default and tacked on what I needed to add.

Of course, there are always better solutions, and if this type of abstraction becomes more common I would introduce a layer around the model which would be the subject of the form’s POST, then translate each attribute onto the model as needed.

Posted in Technology | Leave a comment

Using a period in YAML tokens

While working on an internationalized Rails application, I came across a case where the names of countries were being translated through the YAML locale configuration files. While a valid short-term measure, I would prefer using a gem like Globalize and storing the translations in a Country model, for example.

But in the meanwhile, I was asked to update some of the translations, and quickly discovered that you can’t use a period (a.k.a full-stop) in the token names. I tried surrounding them with quotes: "St. Lucia": St. Lucia, escaping them with a slash "St\. Lucia": St. Lucia, looking up the documentation, to no avail. I finally realized I could just break them into parent and child level tokens, like a period is meant to do:


Horrible, but works. If you use t("St. Lucia") in your code you get a valid result!

Posted in Technology | Leave a comment

How to clear the Clipboard when exiting Microsoft Word

This week a colleague approached me to consult about a problem he had encountered, where it was necessary to ensure that the Clipboard was empty when Microsoft Word exits. It was part of a legacy Word automation solution that he wasn’t in a position to change just yet, and it would crash if there was anything left on the clipboard.

Two approaches came to mind, one using a Word VBA Macro, the other using a VSTO add-in. Here is an attempt at a solution for the first approach – let’s hope it fixes the problem.

You can hook into events using Word VBA quite easily, either by creating a macro with a special name (reference:, or by setting up event handlers. In this case, we will use a macro called AutoExit which is invoked “when you exit Word or unload a global template”. We’ll save the macro in a template file and have it loaded as a global template, so this event should be ideal for our purposes.

The first step is to load Word and get to the Visual Basic editor (press Alt-F11). Here, double-click on the ThisDocument entry in the project explorer to open up a code window:

Then, copy and paste the following code (which I will explain soon) into the code window you just opened:

Sub AutoExit()
End Sub

Sub ClearClipboard()
    Dim MyData As Object
    ' source:
    Set MyData = CreateObject(&quot;new:{1C3B4210-F441-11CE-B9EA-00AA006B1A69}&quot;)
    MyData.SetText &quot;&quot;
    Set MyData = Nothing
End Sub

Now save the document as a Word Macro-Enabled Document Template (.dotm) with a name such as ClearClipboardOnWordExit.dotm:

Place this document in the Word Startup folder. By default, it should be %appdata%\Microsoft\Word\Startup, but you can find out where it really is by going to Word Options, Advanced, scrolling to the bottom and clicking on File Locations:

Word will load any templates in this folder as global templates when it starts.

That’s about it! Now to test it, open Word afresh, type something and copy it to the clipboard. Then exit Word and check to confirm that the clipboard no longer has the text you just copied.

Explanation of the code

  • The name of the macro, AutoExit, makes it get called when Word is closing:
    Sub AutoExit()
    End Sub
  • Then we create a DataObject, which is part of the Microsoft Forms 2.0 Object Library. However, instead of adding a reference to it, I prefer using late binding so I found this page that describes how to do it using the clsid:

        Dim MyData As Object
        Set MyData = CreateObject(&quot;new:{1C3B4210-F441-11CE-B9EA-00AA006B1A69}&quot;)
  • Using this object, we set a blank string to the clipboard, effectively clearing it:
        MyData.SetText &quot;&quot;
Posted in Technology | Tagged , , , | 1 Response

Get email Headers from an Outlook MailItem

While working on a VSTO add-in for Microsoft Outlook, I came across the need to access the headers of an email, to parse out X-CustomProperty tags that were put in by an application that sent the emails. However, I couldn’t find a Headers property in the Outlook object model, so below is an attempt to create one.

The Regex used is courtesy of John Gietzen’s answer on this stackoverflow question.

using System.Collections.Generic;
using System.Linq;
using System.Text.RegularExpressions;
using Microsoft.Office.Interop.Outlook;

public static class MailItemExtensions
    private const string HeaderRegex =
        @"^(?<header_key>[-A-Za-z0-9]+)(?<seperator>:[ \t]*)" +
            "(?<header_value>([^\r\n]|\r\n[ \t]+)*)(?<terminator>\r\n)";
    private const string TransportMessageHeadersSchema =

    public static string[] Headers(this MailItem mailItem, string name)
        var headers = mailItem.HeaderLookup();
        if (headers.Contains(name))
            return headers[name].ToArray();
        return new string[0];

    public static ILookup<string, string> HeaderLookup(this MailItem mailItem)
        var headerString = mailItem.HeaderString();
        var headerMatches = Regex.Matches
            (headerString, HeaderRegex, RegexOptions.Multiline).Cast<Match>();
        return headerMatches.ToLookup(
            h => h.Groups["header_key"].Value,
            h => h.Groups["header_value"].Value);

    public static string HeaderString(this MailItem mailItem)
        return (string)mailItem.PropertyAccessor

Sample usage:

string[] preparedByArray = mailItem.Headers("X-PreparedBy");
string preparedBy;
if (preparedByArray.Length == 1)
    preparedBy = preparedByArray[0];
    preparedBy = "";

string allHeaders = mailItem.HeaderString();

Edit 2011/08/05:
Thanks to Rob for the heads-up. I updated the code to return a Lookup instead of a Dictionary – this handles the case of multiple headers with the same name.

Posted in Technology | Tagged , , , , , , | 4 Responses

How to filter select list options

Here’s a jQuery extension method to filter the elements of a select list (option tags). It binds to a textbox, and as you type in the textbox the select list gets filtered to match what you are typing.

jQuery.fn.filterByText = function(textbox, selectSingleMatch) {
  return this.each(function() {
    var select = this;
    var options = [];
    $(select).find('option').each(function() {
      options.push({value: $(this).val(), text: $(this).text()});
    $(select).data('options', options);
    $(textbox).bind('change keyup', function() {
      var options = $(select).empty().scrollTop(0).data('options');
      var search = $.trim($(this).val());
      var regex = new RegExp(search,'gi');

      $.each(options, function(i) {
        var option = options[i];
        if(option.text.match(regex) !== null) {
      if (selectSingleMatch === true && 
          $(select).children().length === 1) {
        $(select).children().get(0).selected = true;


  • textbox
    This could be a jQuery selector, a jQuery object, or a DOM object.
  • selectSingleMatch
    This is optional, if you set it to true, when the filtered list includes only one item, that item will be automatically selected.

For example:

$(function() {
  $('#select').filterByText($('#textbox'), true);

Live example (or in a new window):

You can play around with it on jsbin:

What it does:

When you invoke the function on a select object, it finds all child option tags and saves their text and values into an array. This array is saved to the select object itself as a HTML5 custom data attribute, called data-options. Then, when a change or keyup event fires on the associated textbox, the select list is emptied, and for any entries in the array that match the search text a new option element is created.

Edit 2012-10-15: Added ScrollTop(0) to improve the way it works with long lists, thanks to a comment by xarel below.

Posted in Technology | Tagged | 55 Responses

Using Open XML SDK to get Custom Properties from a Word document

I stumbled across a library that I didn’t realize was out there, for working with Microsoft Office documents. It only works with the newer Office 2007 and 2010 files (and 2003 with a compatibility pack), i.e. those using the Open XML standard.

Download and install the Open XML SDK 2.0 for Microsoft Office:

I got the second, smaller file:

Open XML SDK 2.0 for Microsoft Office

Add a reference to DocumentFormat.OpenXml and WindowsBase to your project:

You can now programmatically access Office documents, without the need to have Microsoft Office installed or any Interop DLLs. This works with Word, Excel and PowerPoint (using the OpenXML WordprocessingML, SpreadsheetML and PresentationML).

For example, to get the custom properties of a Word document:

public static Dictionary<string, string> GetCustomPropertiesOfWordDocument
                                                  (string filename)
    using (var package = WordprocessingDocument.Open(filename, false))
        var properties = new Dictionary<string, string>();
        foreach (var property in package.CustomFilePropertiesPart
            properties.Add(property.Name, property.VTLPWSTR.Text);
        return properties;

In this example, you would need to add some error handling around line 9 (property.VTLPWSTR.Text) as your property may be a different type or null.

When deploying your solution, you need to include DocumentFormat.OpenXml.dll with your application. You can set Copy Local to True in the properties for the reference, and it will be copied to your output folder when you compile the project:

Download a sample project here.

Posted in Technology | Tagged , , | Leave a comment

How to hide the dotted border outline on focused elements in HTML, using CSS

While working on a web application for data entry, I had to scour the net for a way to hide the dotted border that appears when an element is focused on a web page. Here are my findings.

First, the obligatory disclaimer – I do understand that the dotted border is for accessibility purposes and should be left in place under normal circumstances. However, in this case we already had a replacement in place – when an element receives focus it is styled differently, using a very distinct background color. And this applies to all elements, regardless of whether they were selected by mouse or keyboard. So the dotted border is redundant, and somewhat distracting.

To further clarify the question, these are the dotted borders I refer to:
save-outline and cancel-outline

While the solution needed to be usable across browsers, the target browsers where well defined – modern versions of Firefox and Chrome, and IE 7 or newer. I first came across this question on which pointed me to using outline:none. Then this one helped with Firefox compatibility. And then I saw this post which provides a number of different techniques.

I ended up using the following CSS, which seems to cover most bases. As I didn’t see this combination on other sites I thought I would post it myself. It doesn’t apply to the select element in Firefox and IE7. Testing was done on Windows XP.

/* hide the dotted lines around an element when it receives focus */
* { _noFocusLine: expression(this.hideFocus=true); } /* ie7 */
::-moz-focus-inner {border:0;}	                     /* firefox */
:focus {outline:none;}                               /* ie8, chrome, etc */
Posted in Technology | Tagged , , , | 4 Responses

Context is Hindi when printing line numbers in Word 2007

[This post accompanies a question posted here:]

I’m trying to print a Word 2007 document with Line Numbering turned on, and in Word the document looks fine but when I print the document, the line numbers appear in Hindi script.

On screen:

I tried deleting my Normal template and allowing Word to create a new one, and testing using that, with no change. I also tried different printers.

The problem goes away if I choose Arabic instead of Context under Word Options -> Advanced -> Show Document Content / Numeral:

However, I would like to keep the setting as Context. The question is, why is the default context of my document Hindi script?

Posted in Technology | Tagged , , | 2 Responses

Registry settings to add Uninstall as a shell option for VSTO manifest files

vsto logo

Visual Studio Tools for the Microsoft Office System (VSTO)

I have been working on some VSTO add-ins and on deploying them, and have something to share that I didn’t find anywhere else.

First of all, let me just say that despite certain hurdles, deploying using ClickOnce has been a very pleasant experience. After following some tutorials on making an MSI, we eventually ended up simply deploying the few needed registry entries to all users, which take care of installing and trusting each add-in. Then, once the add-in is installed, it takes care of updating itself every so often.

Unfortunately, during the period of figuring this out a few users got an older version then a newer version with a new signing certificate, which is I suspect the reason why they get the following error message:

Specified argument was out of the range of valid values.
Parameter name: entryValue

Exception Text
System.ArgumentOutOfRangeException: Specified argument was out of the range of valid values.
Parameter name: entryValue
  at Microsoft.VisualStudio.Tools.Applications.Deployment.RegistryStore.Retrieve(String entryName, Object entryValue, CompareDelegate compareMethod)
  at Microsoft.VisualStudio.Tools.Applications.Deployment.MetadataStore.UpdateLastCheckedTime(String subscriptionID, DateTime newLastCheckedTime)
  at Microsoft.VisualStudio.Tools.Applications.Deployment.ClickOnceAddInDeploymentManager.InstallAddIn()

There is some discussion of this error here.

Anyway, I tried removing the folder: C:\Documents and Settings\%username%\Local Settings\Apps\2.0 which causes the add-ins to re-install themselves, but that didn’t fix the problem.

The second solution I tried worked, which was to uninstall the add-in and then re-install it again. One way to uninstall is to do so via Add/Remove programs (still using XP lingo), but I came across another way from this blog post at ChristophDotNet: simply run this command:

C:\Program Files\Common Files\Microsoft Shared\VSTO\9.0\VSTOinstaller.exe
     /uninstall &lt;name-of-manifest-file.vsto&gt;

I find this way much easier than waiting for the Add/Remove dialog to populate (takes a while on my bloated box). You can read more about the VSTOInstaller on MSDN.

After using this technique for a while, I realized one thing – to install an MSI file, you right-click on it and choose Install, and you can also right-click to Uninstall. However, with .vsto files, you can only install. Why not add the uninstall capability right there using a shell command? And now that I knew what the command was, it was trivial. First, to find out where in the registry the open command is defined, I came across this post on Nikhil’s blog. Then, I simply added an uninstall component to it:

Windows Registry Editor Version 5.00


@="\"C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\9.0\\VSTOInstaller.exe\" /uninstall \"%1\""

Put that in a .reg file and run it, and you’ll be able to uninstall VSTO add-ins with ease!

This post applies to VSTO version 3.0.

Posted in Technology | Tagged , , , , | 6 Responses

Recursive Active Directory group membership using System.DirectoryServices in .NET 3.5

When coding for an organization that uses Active Directory, you will eventually come across the business case for using groups within groups, i.e. a  user is part of say, the HR-Administration group, and that group is itself a member of the HR-Department group. You may then need to secure your application to only allow members of HR-Department to access certain functionality within it,  and so you need an IsUserInGroup function, but one that looks recursively at groups that are members of the requested group.

Over the years I’ve had to come up with such a function in various technologies: VB6 using ADSI, PHP using the php_ldap extension, and System.DirectoryServices in .NET 2.0 with a custom function for recursing.

A few weeks ago I was using .NET 3.5 and decided to look around again to see if there was an easy alternative. It seems the 3.5 release comes with a revamped System.DirectoryServices which makes things much easier for common use cases. And although there is no function to achieve what we need, there is one that helps us do it: group.GetMembers(true).  The parameter when set to true triggers a recursive search of all groups that are members of the current group, and grabs their members too. So it becomes trivial to achieve an IsUserInGroup function:

using System.DirectoryServices.AccountManagement;


public static bool IsUserInGroup(string username, string groupname)
    var foundUser = false;
    using (var context = new PrincipalContext(ContextType.Domain, ""))
    using (var group = GroupPrincipal.FindByIdentity(context, groupname))
        if (group == null)
            throw new ArgumentException("Group could not be found: " + groupname);

        // GetMembers(true) is recursive (groups-within-groups)
        foreach (var member in group.GetMembers(true))
            if (member.SamAccountName.Equals(username))
                foundUser = true;
    return foundUser;
Posted in Technology | Comments closed