Edit to add: You don't even need to click on the link, you just need to view an image whose src I can manipulate. Ugh. Seriously: do not install on any environment anywhere.
I should add though that even if this thing gets an XSRF token and it's secure, you might as well take the passwords off your SSH keys if you're running this, because you're coughing up an unprotected remote shell to anyone who can talk to a dev server once you turn this on.
CSRF.
The reason this is so dangerous is that it needs none of that. All it needs is for your development machine to have access to the internet.
I open up a project, enable this, and run rackup locally.
I then view your Twitter stream, where you've embedded a crafted link behind a URL shortener.
Because that link is executed by me, you've now remotely executed code on my machine. Assuming I'm anything like most Rails shops you can probably get to a number of other machines through my machine.
If anyone has used the Seaside framework, can you throw some light on how this compares to the in-page editing that Seaside provides (as per what I've heard).
One of your friends is named Firefox, and he does not take orders from you, he takes orders from me.
In fact, when using it with Rails, it is loaded only in development environment. With other frameworks you should take care of what middlewares you use in which environment.