authlogic 4.0.1 → 4.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/.rubocop.yml +43 -1
- data/.rubocop_todo.yml +23 -132
- data/CHANGELOG.md +12 -0
- data/CONTRIBUTING.md +10 -3
- data/Gemfile +2 -2
- data/Rakefile +6 -6
- data/authlogic.gemspec +13 -12
- data/lib/authlogic/acts_as_authentic/base.rb +12 -7
- data/lib/authlogic/acts_as_authentic/email.rb +16 -6
- data/lib/authlogic/acts_as_authentic/logged_in_status.rb +10 -5
- data/lib/authlogic/acts_as_authentic/login.rb +11 -5
- data/lib/authlogic/acts_as_authentic/password.rb +111 -57
- data/lib/authlogic/acts_as_authentic/perishable_token.rb +6 -2
- data/lib/authlogic/acts_as_authentic/persistence_token.rb +1 -1
- data/lib/authlogic/acts_as_authentic/queries/find_with_case.rb +2 -2
- data/lib/authlogic/acts_as_authentic/restful_authentication.rb +31 -3
- data/lib/authlogic/acts_as_authentic/session_maintenance.rb +11 -3
- data/lib/authlogic/acts_as_authentic/single_access_token.rb +14 -2
- data/lib/authlogic/acts_as_authentic/validations_scope.rb +6 -6
- data/lib/authlogic/authenticates_many/association.rb +2 -2
- data/lib/authlogic/authenticates_many/base.rb +27 -19
- data/lib/authlogic/controller_adapters/rack_adapter.rb +1 -1
- data/lib/authlogic/controller_adapters/rails_adapter.rb +6 -3
- data/lib/authlogic/controller_adapters/sinatra_adapter.rb +2 -2
- data/lib/authlogic/crypto_providers.rb +2 -0
- data/lib/authlogic/crypto_providers/bcrypt.rb +15 -9
- data/lib/authlogic/crypto_providers/md5.rb +2 -1
- data/lib/authlogic/crypto_providers/scrypt.rb +12 -7
- data/lib/authlogic/crypto_providers/sha256.rb +2 -1
- data/lib/authlogic/crypto_providers/wordpress.rb +31 -2
- data/lib/authlogic/i18n.rb +22 -17
- data/lib/authlogic/regex.rb +57 -29
- data/lib/authlogic/session/activation.rb +1 -1
- data/lib/authlogic/session/brute_force_protection.rb +2 -2
- data/lib/authlogic/session/callbacks.rb +43 -36
- data/lib/authlogic/session/cookies.rb +4 -2
- data/lib/authlogic/session/existence.rb +1 -1
- data/lib/authlogic/session/foundation.rb +5 -1
- data/lib/authlogic/session/http_auth.rb +2 -2
- data/lib/authlogic/session/klass.rb +2 -1
- data/lib/authlogic/session/magic_columns.rb +4 -2
- data/lib/authlogic/session/magic_states.rb +9 -10
- data/lib/authlogic/session/params.rb +11 -4
- data/lib/authlogic/session/password.rb +72 -38
- data/lib/authlogic/session/perishable_token.rb +2 -1
- data/lib/authlogic/session/persistence.rb +2 -1
- data/lib/authlogic/session/scopes.rb +26 -16
- data/lib/authlogic/session/unauthorized_record.rb +12 -7
- data/lib/authlogic/session/validation.rb +1 -1
- data/lib/authlogic/test_case/mock_controller.rb +1 -1
- data/lib/authlogic/test_case/mock_cookie_jar.rb +1 -1
- data/lib/authlogic/test_case/mock_request.rb +1 -1
- data/lib/authlogic/version.rb +1 -1
- data/test/acts_as_authentic_test/base_test.rb +1 -1
- data/test/acts_as_authentic_test/email_test.rb +11 -11
- data/test/acts_as_authentic_test/logged_in_status_test.rb +4 -4
- data/test/acts_as_authentic_test/login_test.rb +2 -2
- data/test/acts_as_authentic_test/magic_columns_test.rb +1 -1
- data/test/acts_as_authentic_test/password_test.rb +1 -1
- data/test/acts_as_authentic_test/perishable_token_test.rb +2 -2
- data/test/acts_as_authentic_test/persistence_token_test.rb +1 -1
- data/test/acts_as_authentic_test/restful_authentication_test.rb +12 -3
- data/test/acts_as_authentic_test/session_maintenance_test.rb +1 -1
- data/test/acts_as_authentic_test/single_access_test.rb +1 -1
- data/test/adapter_test.rb +3 -3
- data/test/authenticates_many_test.rb +1 -1
- data/test/config_test.rb +9 -9
- data/test/crypto_provider_test/aes256_test.rb +1 -1
- data/test/crypto_provider_test/bcrypt_test.rb +1 -1
- data/test/crypto_provider_test/scrypt_test.rb +1 -1
- data/test/crypto_provider_test/sha1_test.rb +1 -1
- data/test/crypto_provider_test/sha256_test.rb +1 -1
- data/test/crypto_provider_test/sha512_test.rb +1 -1
- data/test/crypto_provider_test/wordpress_test.rb +24 -0
- data/test/i18n_test.rb +3 -3
- data/test/libs/user_session.rb +2 -2
- data/test/random_test.rb +1 -1
- data/test/session_test/activation_test.rb +1 -1
- data/test/session_test/active_record_trickery_test.rb +3 -3
- data/test/session_test/brute_force_protection_test.rb +1 -1
- data/test/session_test/callbacks_test.rb +9 -3
- data/test/session_test/cookies_test.rb +11 -11
- data/test/session_test/existence_test.rb +1 -1
- data/test/session_test/foundation_test.rb +1 -1
- data/test/session_test/http_auth_test.rb +6 -6
- data/test/session_test/id_test.rb +1 -1
- data/test/session_test/klass_test.rb +1 -1
- data/test/session_test/magic_columns_test.rb +1 -1
- data/test/session_test/magic_states_test.rb +1 -1
- data/test/session_test/params_test.rb +7 -4
- data/test/session_test/password_test.rb +1 -1
- data/test/session_test/perishability_test.rb +1 -1
- data/test/session_test/persistence_test.rb +1 -1
- data/test/session_test/scopes_test.rb +9 -3
- data/test/session_test/session_test.rb +2 -2
- data/test/session_test/timeout_test.rb +1 -1
- data/test/session_test/unauthorized_record_test.rb +1 -1
- data/test/session_test/validation_test.rb +1 -1
- data/test/test_helper.rb +34 -14
- metadata +6 -4
@@ -0,0 +1,24 @@
|
|
1
|
+
require "test_helper"
|
2
|
+
|
3
|
+
::ActiveSupport::Deprecation.silence do
|
4
|
+
require "authlogic/crypto_providers/wordpress"
|
5
|
+
end
|
6
|
+
|
7
|
+
module CryptoProviderTest
|
8
|
+
class WordpressTest < ActiveSupport::TestCase
|
9
|
+
def test_matches
|
10
|
+
plain = "banana"
|
11
|
+
salt = "aaa"
|
12
|
+
crypted = "xxx0nope"
|
13
|
+
# I couldn't figure out how to even execute this method without it
|
14
|
+
# crashing. Maybe, when Jeffry wrote it in 2009, `Digest::MD5.digest`
|
15
|
+
# worked differently. He was probably using ruby 1.9 back then.
|
16
|
+
# Given that I can't even figure out how to run it, and for all the other
|
17
|
+
# reasons I've given in `wordpress.rb`, I'm just going to deprecate
|
18
|
+
# the whole file. -Jared 2018-04-09
|
19
|
+
assert_raises(NoMethodError) {
|
20
|
+
Authlogic::CryptoProviders::Wordpress.matches?(crypted, plain, salt)
|
21
|
+
}
|
22
|
+
end
|
23
|
+
end
|
24
|
+
end
|
data/test/i18n_test.rb
CHANGED
@@ -1,4 +1,4 @@
|
|
1
|
-
require
|
1
|
+
require "test_helper"
|
2
2
|
|
3
3
|
class I18nTest < ActiveSupport::TestCase
|
4
4
|
def test_uses_authlogic_as_scope_by_default
|
@@ -6,8 +6,8 @@ class I18nTest < ActiveSupport::TestCase
|
|
6
6
|
end
|
7
7
|
|
8
8
|
def test_can_set_scope
|
9
|
-
assert_nothing_raised { Authlogic::I18n.scope = [
|
10
|
-
assert_equal [
|
9
|
+
assert_nothing_raised { Authlogic::I18n.scope = %i[a b] }
|
10
|
+
assert_equal %i[a b], Authlogic::I18n.scope
|
11
11
|
Authlogic::I18n.scope = :authlogic
|
12
12
|
end
|
13
13
|
|
data/test/libs/user_session.rb
CHANGED
data/test/random_test.rb
CHANGED
@@ -1,4 +1,4 @@
|
|
1
|
-
require
|
1
|
+
require "test_helper"
|
2
2
|
|
3
3
|
module SessionTest
|
4
4
|
module ActiveRecordTrickeryTest
|
@@ -16,12 +16,12 @@ module SessionTest
|
|
16
16
|
end
|
17
17
|
|
18
18
|
def test_i18n_of_human_name
|
19
|
-
I18n.backend.store_translations
|
19
|
+
I18n.backend.store_translations "en", authlogic: { models: { user_session: "MySession" } }
|
20
20
|
assert_equal "MySession", UserSession.human_name
|
21
21
|
end
|
22
22
|
|
23
23
|
def test_i18n_of_model_name_human
|
24
|
-
I18n.backend.store_translations
|
24
|
+
I18n.backend.store_translations "en", authlogic: { models: { user_session: "MySession" } }
|
25
25
|
assert_equal "MySession", UserSession.model_name.human
|
26
26
|
end
|
27
27
|
|
@@ -1,4 +1,4 @@
|
|
1
|
-
require
|
1
|
+
require "test_helper"
|
2
2
|
|
3
3
|
module SessionTest
|
4
4
|
class CallbacksTest < ActiveSupport::TestCase
|
@@ -15,7 +15,10 @@ module SessionTest
|
|
15
15
|
|
16
16
|
def test_true_callback_cancelling_later_callbacks
|
17
17
|
WackyUserSession.persist :persist_by_true, :persist_by_false
|
18
|
-
assert_equal
|
18
|
+
assert_equal(
|
19
|
+
%i[persist_by_true persist_by_false],
|
20
|
+
WackyUserSession._persist_callbacks.map(&:filter)
|
21
|
+
)
|
19
22
|
|
20
23
|
session = WackyUserSession.new
|
21
24
|
session.send(:persist)
|
@@ -24,7 +27,10 @@ module SessionTest
|
|
24
27
|
|
25
28
|
def test_false_callback_continuing_to_later_callbacks
|
26
29
|
WackyUserSession.persist :persist_by_false, :persist_by_true
|
27
|
-
assert_equal
|
30
|
+
assert_equal(
|
31
|
+
%i[persist_by_false persist_by_true],
|
32
|
+
WackyUserSession._persist_callbacks.map(&:filter)
|
33
|
+
)
|
28
34
|
|
29
35
|
session = WackyUserSession.new
|
30
36
|
session.send(:persist)
|
@@ -1,4 +1,4 @@
|
|
1
|
-
require
|
1
|
+
require "test_helper"
|
2
2
|
|
3
3
|
module SessionTest
|
4
4
|
module CookiesTest
|
@@ -68,15 +68,15 @@ module SessionTest
|
|
68
68
|
assert_nil UserSession.same_site
|
69
69
|
assert_nil UserSession.new.same_site
|
70
70
|
|
71
|
-
UserSession.same_site
|
72
|
-
assert_equal
|
71
|
+
UserSession.same_site "Strict"
|
72
|
+
assert_equal "Strict", UserSession.same_site
|
73
73
|
session = UserSession.new
|
74
|
-
assert_equal
|
75
|
-
session.same_site =
|
76
|
-
assert_equal
|
74
|
+
assert_equal "Strict", session.same_site
|
75
|
+
session.same_site = "Lax"
|
76
|
+
assert_equal "Lax", session.same_site
|
77
77
|
|
78
|
-
assert_raise(ArgumentError) { UserSession.same_site
|
79
|
-
assert_raise(ArgumentError) { UserSession.new.same_site
|
78
|
+
assert_raise(ArgumentError) { UserSession.same_site "foo" }
|
79
|
+
assert_raise(ArgumentError) { UserSession.new.same_site "foo" }
|
80
80
|
end
|
81
81
|
|
82
82
|
def test_sign_cookie
|
@@ -203,11 +203,11 @@ module SessionTest
|
|
203
203
|
|
204
204
|
def test_after_save_save_cookie_with_same_site
|
205
205
|
session = UserSession.new(users(:ben))
|
206
|
-
session.same_site =
|
206
|
+
session.same_site = "Strict"
|
207
207
|
assert session.save
|
208
208
|
assert_equal(
|
209
|
-
|
210
|
-
controller.cookies.set_cookies[
|
209
|
+
"Strict",
|
210
|
+
controller.cookies.set_cookies["user_credentials"][:same_site]
|
211
211
|
)
|
212
212
|
end
|
213
213
|
|
@@ -1,4 +1,4 @@
|
|
1
|
-
require
|
1
|
+
require "test_helper"
|
2
2
|
|
3
3
|
module SessionTest
|
4
4
|
class HttpAuthTest < ActiveSupport::TestCase
|
@@ -20,9 +20,9 @@ module SessionTest
|
|
20
20
|
end
|
21
21
|
|
22
22
|
def test_http_basic_auth_realm
|
23
|
-
assert_equal
|
24
|
-
UserSession.http_basic_auth_realm =
|
25
|
-
assert_equal
|
23
|
+
assert_equal "Application", UserSession.http_basic_auth_realm
|
24
|
+
UserSession.http_basic_auth_realm = "TestRealm"
|
25
|
+
assert_equal "TestRealm", UserSession.http_basic_auth_realm
|
26
26
|
end
|
27
27
|
end
|
28
28
|
|
@@ -43,13 +43,13 @@ module SessionTest
|
|
43
43
|
end
|
44
44
|
unset_session
|
45
45
|
UserSession.request_http_basic_auth = true
|
46
|
-
UserSession.http_basic_auth_realm =
|
46
|
+
UserSession.http_basic_auth_realm = "PersistTestRealm"
|
47
47
|
http_basic_auth_for(aaron) do
|
48
48
|
assert session = UserSession.find
|
49
49
|
assert_equal aaron, session.record
|
50
50
|
assert_equal aaron.login, session.login
|
51
51
|
assert_equal "aaronrocks", session.send(:protected_password)
|
52
|
-
assert_equal
|
52
|
+
assert_equal "PersistTestRealm", controller.realm
|
53
53
|
assert controller.http_auth_requested?
|
54
54
|
end
|
55
55
|
end
|
@@ -1,4 +1,4 @@
|
|
1
|
-
require
|
1
|
+
require "test_helper"
|
2
2
|
|
3
3
|
module SessionTest
|
4
4
|
module ParamsTest
|
@@ -14,8 +14,9 @@ module SessionTest
|
|
14
14
|
def test_single_access_allowed_request_types
|
15
15
|
UserSession.single_access_allowed_request_types = ["my request type"]
|
16
16
|
assert_equal ["my request type"], UserSession.single_access_allowed_request_types
|
17
|
-
|
18
|
-
|
17
|
+
UserSession.single_access_allowed_request_types(
|
18
|
+
["application/rss+xml", "application/atom+xml"]
|
19
|
+
)
|
19
20
|
assert_equal(
|
20
21
|
["application/rss+xml", "application/atom+xml"],
|
21
22
|
UserSession.single_access_allowed_request_types
|
@@ -44,7 +45,9 @@ module SessionTest
|
|
44
45
|
set_request_content_type("application/atom+xml")
|
45
46
|
assert session.persisting?
|
46
47
|
assert_equal ben, session.record
|
47
|
-
|
48
|
+
|
49
|
+
# should not persist since this is single access
|
50
|
+
assert_nil controller.session["user_credentials"]
|
48
51
|
|
49
52
|
set_request_content_type("application/rss+xml")
|
50
53
|
assert session.persisting?
|
@@ -1,4 +1,4 @@
|
|
1
|
-
require
|
1
|
+
require "test_helper"
|
2
2
|
|
3
3
|
module SessionTest
|
4
4
|
class ScopesTest < ActiveSupport::TestCase
|
@@ -28,7 +28,10 @@ module SessionTest
|
|
28
28
|
assert_raise(ArgumentError) { UserSession.with_scope }
|
29
29
|
|
30
30
|
UserSession.with_scope(find_options: { conditions: "awesome = 1" }, id: "some_id") do
|
31
|
-
assert_equal(
|
31
|
+
assert_equal(
|
32
|
+
{ find_options: { conditions: "awesome = 1" }, id: "some_id" },
|
33
|
+
UserSession.scope
|
34
|
+
)
|
32
35
|
end
|
33
36
|
|
34
37
|
assert_nil UserSession.scope
|
@@ -37,7 +40,10 @@ module SessionTest
|
|
37
40
|
def test_initialize
|
38
41
|
UserSession.with_scope(find_options: { conditions: "awesome = 1" }, id: "some_id") do
|
39
42
|
session = UserSession.new
|
40
|
-
assert_equal(
|
43
|
+
assert_equal(
|
44
|
+
{ find_options: { conditions: "awesome = 1" }, id: "some_id" },
|
45
|
+
session.scope
|
46
|
+
)
|
41
47
|
session.id = :another_id
|
42
48
|
assert_equal "another_id_some_id_test", session.send(:build_key, "test")
|
43
49
|
end
|
@@ -1,4 +1,4 @@
|
|
1
|
-
require
|
1
|
+
require "test_helper"
|
2
2
|
|
3
3
|
module SessionTest
|
4
4
|
module SessionTest
|
@@ -23,7 +23,7 @@ module SessionTest
|
|
23
23
|
|
24
24
|
def test_persist_persist_by_session_with_session_fixation_attack
|
25
25
|
ben = users(:ben)
|
26
|
-
controller.session["user_credentials"] =
|
26
|
+
controller.session["user_credentials"] = "neo"
|
27
27
|
controller.session["user_credentials_id"] = {
|
28
28
|
select: " *,'neo' AS persistence_token FROM users WHERE id = #{ben.id} limit 1 -- "
|
29
29
|
}
|
data/test/test_helper.rb
CHANGED
@@ -6,7 +6,7 @@ require "active_record/fixtures"
|
|
6
6
|
require "timecop"
|
7
7
|
require "i18n"
|
8
8
|
|
9
|
-
I18n.load_path << File.dirname(__FILE__) +
|
9
|
+
I18n.load_path << File.dirname(__FILE__) + "/i18n/lol.yml"
|
10
10
|
|
11
11
|
# ActiveRecord::Schema.verbose = false
|
12
12
|
ActiveRecord::Base.establish_connection(adapter: "sqlite3", database: ":memory:")
|
@@ -14,7 +14,7 @@ logger = Logger.new(STDOUT)
|
|
14
14
|
logger.level = Logger::FATAL
|
15
15
|
ActiveRecord::Base.logger = logger
|
16
16
|
|
17
|
-
if
|
17
|
+
if ActiveRecord::VERSION::STRING < "4.1"
|
18
18
|
ActiveRecord::Base.configurations = true
|
19
19
|
end
|
20
20
|
|
@@ -104,16 +104,18 @@ ActiveRecord::Schema.define(version: 1) do
|
|
104
104
|
end
|
105
105
|
end
|
106
106
|
|
107
|
-
|
108
|
-
|
109
|
-
|
110
|
-
|
111
|
-
|
112
|
-
|
113
|
-
|
114
|
-
|
115
|
-
|
116
|
-
|
107
|
+
require "English"
|
108
|
+
$LOAD_PATH.unshift(File.expand_path("../lib", __dir__))
|
109
|
+
require "authlogic"
|
110
|
+
require "authlogic/test_case"
|
111
|
+
require "libs/project"
|
112
|
+
require "libs/affiliate"
|
113
|
+
require "libs/employee"
|
114
|
+
require "libs/employee_session"
|
115
|
+
require "libs/ldaper"
|
116
|
+
require "libs/user"
|
117
|
+
require "libs/user_session"
|
118
|
+
require "libs/company"
|
117
119
|
|
118
120
|
# Recent change, 2017-10-23: We had used a 54-letter string here. In the default
|
119
121
|
# encoding, UTF-8, that's 54 bytes, which is clearly incorrect for an algorithm
|
@@ -149,7 +151,16 @@ module ActiveSupport
|
|
149
151
|
# tests until Rails 4.1 was added for testing. This ensures that all the
|
150
152
|
# models start tests with their original config.
|
151
153
|
def config_setup
|
152
|
-
[
|
154
|
+
[
|
155
|
+
Project,
|
156
|
+
Affiliate,
|
157
|
+
Employee,
|
158
|
+
EmployeeSession,
|
159
|
+
Ldaper,
|
160
|
+
User,
|
161
|
+
UserSession,
|
162
|
+
Company
|
163
|
+
].each do |model|
|
153
164
|
unless model.respond_to?(:original_acts_as_authentic_config)
|
154
165
|
model.class_attribute :original_acts_as_authentic_config
|
155
166
|
end
|
@@ -158,7 +169,16 @@ module ActiveSupport
|
|
158
169
|
end
|
159
170
|
|
160
171
|
def config_teardown
|
161
|
-
[
|
172
|
+
[
|
173
|
+
Project,
|
174
|
+
Affiliate,
|
175
|
+
Employee,
|
176
|
+
EmployeeSession,
|
177
|
+
Ldaper,
|
178
|
+
User,
|
179
|
+
UserSession,
|
180
|
+
Company
|
181
|
+
].each do |model|
|
162
182
|
model.acts_as_authentic_config = model.original_acts_as_authentic_config
|
163
183
|
end
|
164
184
|
end
|