authlogic 4.0.1 → 4.1.0
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.rubocop.yml +43 -1
- data/.rubocop_todo.yml +23 -132
- data/CHANGELOG.md +12 -0
- data/CONTRIBUTING.md +10 -3
- data/Gemfile +2 -2
- data/Rakefile +6 -6
- data/authlogic.gemspec +13 -12
- data/lib/authlogic/acts_as_authentic/base.rb +12 -7
- data/lib/authlogic/acts_as_authentic/email.rb +16 -6
- data/lib/authlogic/acts_as_authentic/logged_in_status.rb +10 -5
- data/lib/authlogic/acts_as_authentic/login.rb +11 -5
- data/lib/authlogic/acts_as_authentic/password.rb +111 -57
- data/lib/authlogic/acts_as_authentic/perishable_token.rb +6 -2
- data/lib/authlogic/acts_as_authentic/persistence_token.rb +1 -1
- data/lib/authlogic/acts_as_authentic/queries/find_with_case.rb +2 -2
- data/lib/authlogic/acts_as_authentic/restful_authentication.rb +31 -3
- data/lib/authlogic/acts_as_authentic/session_maintenance.rb +11 -3
- data/lib/authlogic/acts_as_authentic/single_access_token.rb +14 -2
- data/lib/authlogic/acts_as_authentic/validations_scope.rb +6 -6
- data/lib/authlogic/authenticates_many/association.rb +2 -2
- data/lib/authlogic/authenticates_many/base.rb +27 -19
- data/lib/authlogic/controller_adapters/rack_adapter.rb +1 -1
- data/lib/authlogic/controller_adapters/rails_adapter.rb +6 -3
- data/lib/authlogic/controller_adapters/sinatra_adapter.rb +2 -2
- data/lib/authlogic/crypto_providers.rb +2 -0
- data/lib/authlogic/crypto_providers/bcrypt.rb +15 -9
- data/lib/authlogic/crypto_providers/md5.rb +2 -1
- data/lib/authlogic/crypto_providers/scrypt.rb +12 -7
- data/lib/authlogic/crypto_providers/sha256.rb +2 -1
- data/lib/authlogic/crypto_providers/wordpress.rb +31 -2
- data/lib/authlogic/i18n.rb +22 -17
- data/lib/authlogic/regex.rb +57 -29
- data/lib/authlogic/session/activation.rb +1 -1
- data/lib/authlogic/session/brute_force_protection.rb +2 -2
- data/lib/authlogic/session/callbacks.rb +43 -36
- data/lib/authlogic/session/cookies.rb +4 -2
- data/lib/authlogic/session/existence.rb +1 -1
- data/lib/authlogic/session/foundation.rb +5 -1
- data/lib/authlogic/session/http_auth.rb +2 -2
- data/lib/authlogic/session/klass.rb +2 -1
- data/lib/authlogic/session/magic_columns.rb +4 -2
- data/lib/authlogic/session/magic_states.rb +9 -10
- data/lib/authlogic/session/params.rb +11 -4
- data/lib/authlogic/session/password.rb +72 -38
- data/lib/authlogic/session/perishable_token.rb +2 -1
- data/lib/authlogic/session/persistence.rb +2 -1
- data/lib/authlogic/session/scopes.rb +26 -16
- data/lib/authlogic/session/unauthorized_record.rb +12 -7
- data/lib/authlogic/session/validation.rb +1 -1
- data/lib/authlogic/test_case/mock_controller.rb +1 -1
- data/lib/authlogic/test_case/mock_cookie_jar.rb +1 -1
- data/lib/authlogic/test_case/mock_request.rb +1 -1
- data/lib/authlogic/version.rb +1 -1
- data/test/acts_as_authentic_test/base_test.rb +1 -1
- data/test/acts_as_authentic_test/email_test.rb +11 -11
- data/test/acts_as_authentic_test/logged_in_status_test.rb +4 -4
- data/test/acts_as_authentic_test/login_test.rb +2 -2
- data/test/acts_as_authentic_test/magic_columns_test.rb +1 -1
- data/test/acts_as_authentic_test/password_test.rb +1 -1
- data/test/acts_as_authentic_test/perishable_token_test.rb +2 -2
- data/test/acts_as_authentic_test/persistence_token_test.rb +1 -1
- data/test/acts_as_authentic_test/restful_authentication_test.rb +12 -3
- data/test/acts_as_authentic_test/session_maintenance_test.rb +1 -1
- data/test/acts_as_authentic_test/single_access_test.rb +1 -1
- data/test/adapter_test.rb +3 -3
- data/test/authenticates_many_test.rb +1 -1
- data/test/config_test.rb +9 -9
- data/test/crypto_provider_test/aes256_test.rb +1 -1
- data/test/crypto_provider_test/bcrypt_test.rb +1 -1
- data/test/crypto_provider_test/scrypt_test.rb +1 -1
- data/test/crypto_provider_test/sha1_test.rb +1 -1
- data/test/crypto_provider_test/sha256_test.rb +1 -1
- data/test/crypto_provider_test/sha512_test.rb +1 -1
- data/test/crypto_provider_test/wordpress_test.rb +24 -0
- data/test/i18n_test.rb +3 -3
- data/test/libs/user_session.rb +2 -2
- data/test/random_test.rb +1 -1
- data/test/session_test/activation_test.rb +1 -1
- data/test/session_test/active_record_trickery_test.rb +3 -3
- data/test/session_test/brute_force_protection_test.rb +1 -1
- data/test/session_test/callbacks_test.rb +9 -3
- data/test/session_test/cookies_test.rb +11 -11
- data/test/session_test/existence_test.rb +1 -1
- data/test/session_test/foundation_test.rb +1 -1
- data/test/session_test/http_auth_test.rb +6 -6
- data/test/session_test/id_test.rb +1 -1
- data/test/session_test/klass_test.rb +1 -1
- data/test/session_test/magic_columns_test.rb +1 -1
- data/test/session_test/magic_states_test.rb +1 -1
- data/test/session_test/params_test.rb +7 -4
- data/test/session_test/password_test.rb +1 -1
- data/test/session_test/perishability_test.rb +1 -1
- data/test/session_test/persistence_test.rb +1 -1
- data/test/session_test/scopes_test.rb +9 -3
- data/test/session_test/session_test.rb +2 -2
- data/test/session_test/timeout_test.rb +1 -1
- data/test/session_test/unauthorized_record_test.rb +1 -1
- data/test/session_test/validation_test.rb +1 -1
- data/test/test_helper.rb +34 -14
- metadata +6 -4
@@ -0,0 +1,24 @@
|
|
1
|
+
require "test_helper"
|
2
|
+
|
3
|
+
::ActiveSupport::Deprecation.silence do
|
4
|
+
require "authlogic/crypto_providers/wordpress"
|
5
|
+
end
|
6
|
+
|
7
|
+
module CryptoProviderTest
|
8
|
+
class WordpressTest < ActiveSupport::TestCase
|
9
|
+
def test_matches
|
10
|
+
plain = "banana"
|
11
|
+
salt = "aaa"
|
12
|
+
crypted = "xxx0nope"
|
13
|
+
# I couldn't figure out how to even execute this method without it
|
14
|
+
# crashing. Maybe, when Jeffry wrote it in 2009, `Digest::MD5.digest`
|
15
|
+
# worked differently. He was probably using ruby 1.9 back then.
|
16
|
+
# Given that I can't even figure out how to run it, and for all the other
|
17
|
+
# reasons I've given in `wordpress.rb`, I'm just going to deprecate
|
18
|
+
# the whole file. -Jared 2018-04-09
|
19
|
+
assert_raises(NoMethodError) {
|
20
|
+
Authlogic::CryptoProviders::Wordpress.matches?(crypted, plain, salt)
|
21
|
+
}
|
22
|
+
end
|
23
|
+
end
|
24
|
+
end
|
data/test/i18n_test.rb
CHANGED
@@ -1,4 +1,4 @@
|
|
1
|
-
require
|
1
|
+
require "test_helper"
|
2
2
|
|
3
3
|
class I18nTest < ActiveSupport::TestCase
|
4
4
|
def test_uses_authlogic_as_scope_by_default
|
@@ -6,8 +6,8 @@ class I18nTest < ActiveSupport::TestCase
|
|
6
6
|
end
|
7
7
|
|
8
8
|
def test_can_set_scope
|
9
|
-
assert_nothing_raised { Authlogic::I18n.scope = [
|
10
|
-
assert_equal [
|
9
|
+
assert_nothing_raised { Authlogic::I18n.scope = %i[a b] }
|
10
|
+
assert_equal %i[a b], Authlogic::I18n.scope
|
11
11
|
Authlogic::I18n.scope = :authlogic
|
12
12
|
end
|
13
13
|
|
data/test/libs/user_session.rb
CHANGED
data/test/random_test.rb
CHANGED
@@ -1,4 +1,4 @@
|
|
1
|
-
require
|
1
|
+
require "test_helper"
|
2
2
|
|
3
3
|
module SessionTest
|
4
4
|
module ActiveRecordTrickeryTest
|
@@ -16,12 +16,12 @@ module SessionTest
|
|
16
16
|
end
|
17
17
|
|
18
18
|
def test_i18n_of_human_name
|
19
|
-
I18n.backend.store_translations
|
19
|
+
I18n.backend.store_translations "en", authlogic: { models: { user_session: "MySession" } }
|
20
20
|
assert_equal "MySession", UserSession.human_name
|
21
21
|
end
|
22
22
|
|
23
23
|
def test_i18n_of_model_name_human
|
24
|
-
I18n.backend.store_translations
|
24
|
+
I18n.backend.store_translations "en", authlogic: { models: { user_session: "MySession" } }
|
25
25
|
assert_equal "MySession", UserSession.model_name.human
|
26
26
|
end
|
27
27
|
|
@@ -1,4 +1,4 @@
|
|
1
|
-
require
|
1
|
+
require "test_helper"
|
2
2
|
|
3
3
|
module SessionTest
|
4
4
|
class CallbacksTest < ActiveSupport::TestCase
|
@@ -15,7 +15,10 @@ module SessionTest
|
|
15
15
|
|
16
16
|
def test_true_callback_cancelling_later_callbacks
|
17
17
|
WackyUserSession.persist :persist_by_true, :persist_by_false
|
18
|
-
assert_equal
|
18
|
+
assert_equal(
|
19
|
+
%i[persist_by_true persist_by_false],
|
20
|
+
WackyUserSession._persist_callbacks.map(&:filter)
|
21
|
+
)
|
19
22
|
|
20
23
|
session = WackyUserSession.new
|
21
24
|
session.send(:persist)
|
@@ -24,7 +27,10 @@ module SessionTest
|
|
24
27
|
|
25
28
|
def test_false_callback_continuing_to_later_callbacks
|
26
29
|
WackyUserSession.persist :persist_by_false, :persist_by_true
|
27
|
-
assert_equal
|
30
|
+
assert_equal(
|
31
|
+
%i[persist_by_false persist_by_true],
|
32
|
+
WackyUserSession._persist_callbacks.map(&:filter)
|
33
|
+
)
|
28
34
|
|
29
35
|
session = WackyUserSession.new
|
30
36
|
session.send(:persist)
|
@@ -1,4 +1,4 @@
|
|
1
|
-
require
|
1
|
+
require "test_helper"
|
2
2
|
|
3
3
|
module SessionTest
|
4
4
|
module CookiesTest
|
@@ -68,15 +68,15 @@ module SessionTest
|
|
68
68
|
assert_nil UserSession.same_site
|
69
69
|
assert_nil UserSession.new.same_site
|
70
70
|
|
71
|
-
UserSession.same_site
|
72
|
-
assert_equal
|
71
|
+
UserSession.same_site "Strict"
|
72
|
+
assert_equal "Strict", UserSession.same_site
|
73
73
|
session = UserSession.new
|
74
|
-
assert_equal
|
75
|
-
session.same_site =
|
76
|
-
assert_equal
|
74
|
+
assert_equal "Strict", session.same_site
|
75
|
+
session.same_site = "Lax"
|
76
|
+
assert_equal "Lax", session.same_site
|
77
77
|
|
78
|
-
assert_raise(ArgumentError) { UserSession.same_site
|
79
|
-
assert_raise(ArgumentError) { UserSession.new.same_site
|
78
|
+
assert_raise(ArgumentError) { UserSession.same_site "foo" }
|
79
|
+
assert_raise(ArgumentError) { UserSession.new.same_site "foo" }
|
80
80
|
end
|
81
81
|
|
82
82
|
def test_sign_cookie
|
@@ -203,11 +203,11 @@ module SessionTest
|
|
203
203
|
|
204
204
|
def test_after_save_save_cookie_with_same_site
|
205
205
|
session = UserSession.new(users(:ben))
|
206
|
-
session.same_site =
|
206
|
+
session.same_site = "Strict"
|
207
207
|
assert session.save
|
208
208
|
assert_equal(
|
209
|
-
|
210
|
-
controller.cookies.set_cookies[
|
209
|
+
"Strict",
|
210
|
+
controller.cookies.set_cookies["user_credentials"][:same_site]
|
211
211
|
)
|
212
212
|
end
|
213
213
|
|
@@ -1,4 +1,4 @@
|
|
1
|
-
require
|
1
|
+
require "test_helper"
|
2
2
|
|
3
3
|
module SessionTest
|
4
4
|
class HttpAuthTest < ActiveSupport::TestCase
|
@@ -20,9 +20,9 @@ module SessionTest
|
|
20
20
|
end
|
21
21
|
|
22
22
|
def test_http_basic_auth_realm
|
23
|
-
assert_equal
|
24
|
-
UserSession.http_basic_auth_realm =
|
25
|
-
assert_equal
|
23
|
+
assert_equal "Application", UserSession.http_basic_auth_realm
|
24
|
+
UserSession.http_basic_auth_realm = "TestRealm"
|
25
|
+
assert_equal "TestRealm", UserSession.http_basic_auth_realm
|
26
26
|
end
|
27
27
|
end
|
28
28
|
|
@@ -43,13 +43,13 @@ module SessionTest
|
|
43
43
|
end
|
44
44
|
unset_session
|
45
45
|
UserSession.request_http_basic_auth = true
|
46
|
-
UserSession.http_basic_auth_realm =
|
46
|
+
UserSession.http_basic_auth_realm = "PersistTestRealm"
|
47
47
|
http_basic_auth_for(aaron) do
|
48
48
|
assert session = UserSession.find
|
49
49
|
assert_equal aaron, session.record
|
50
50
|
assert_equal aaron.login, session.login
|
51
51
|
assert_equal "aaronrocks", session.send(:protected_password)
|
52
|
-
assert_equal
|
52
|
+
assert_equal "PersistTestRealm", controller.realm
|
53
53
|
assert controller.http_auth_requested?
|
54
54
|
end
|
55
55
|
end
|
@@ -1,4 +1,4 @@
|
|
1
|
-
require
|
1
|
+
require "test_helper"
|
2
2
|
|
3
3
|
module SessionTest
|
4
4
|
module ParamsTest
|
@@ -14,8 +14,9 @@ module SessionTest
|
|
14
14
|
def test_single_access_allowed_request_types
|
15
15
|
UserSession.single_access_allowed_request_types = ["my request type"]
|
16
16
|
assert_equal ["my request type"], UserSession.single_access_allowed_request_types
|
17
|
-
|
18
|
-
|
17
|
+
UserSession.single_access_allowed_request_types(
|
18
|
+
["application/rss+xml", "application/atom+xml"]
|
19
|
+
)
|
19
20
|
assert_equal(
|
20
21
|
["application/rss+xml", "application/atom+xml"],
|
21
22
|
UserSession.single_access_allowed_request_types
|
@@ -44,7 +45,9 @@ module SessionTest
|
|
44
45
|
set_request_content_type("application/atom+xml")
|
45
46
|
assert session.persisting?
|
46
47
|
assert_equal ben, session.record
|
47
|
-
|
48
|
+
|
49
|
+
# should not persist since this is single access
|
50
|
+
assert_nil controller.session["user_credentials"]
|
48
51
|
|
49
52
|
set_request_content_type("application/rss+xml")
|
50
53
|
assert session.persisting?
|
@@ -1,4 +1,4 @@
|
|
1
|
-
require
|
1
|
+
require "test_helper"
|
2
2
|
|
3
3
|
module SessionTest
|
4
4
|
class ScopesTest < ActiveSupport::TestCase
|
@@ -28,7 +28,10 @@ module SessionTest
|
|
28
28
|
assert_raise(ArgumentError) { UserSession.with_scope }
|
29
29
|
|
30
30
|
UserSession.with_scope(find_options: { conditions: "awesome = 1" }, id: "some_id") do
|
31
|
-
assert_equal(
|
31
|
+
assert_equal(
|
32
|
+
{ find_options: { conditions: "awesome = 1" }, id: "some_id" },
|
33
|
+
UserSession.scope
|
34
|
+
)
|
32
35
|
end
|
33
36
|
|
34
37
|
assert_nil UserSession.scope
|
@@ -37,7 +40,10 @@ module SessionTest
|
|
37
40
|
def test_initialize
|
38
41
|
UserSession.with_scope(find_options: { conditions: "awesome = 1" }, id: "some_id") do
|
39
42
|
session = UserSession.new
|
40
|
-
assert_equal(
|
43
|
+
assert_equal(
|
44
|
+
{ find_options: { conditions: "awesome = 1" }, id: "some_id" },
|
45
|
+
session.scope
|
46
|
+
)
|
41
47
|
session.id = :another_id
|
42
48
|
assert_equal "another_id_some_id_test", session.send(:build_key, "test")
|
43
49
|
end
|
@@ -1,4 +1,4 @@
|
|
1
|
-
require
|
1
|
+
require "test_helper"
|
2
2
|
|
3
3
|
module SessionTest
|
4
4
|
module SessionTest
|
@@ -23,7 +23,7 @@ module SessionTest
|
|
23
23
|
|
24
24
|
def test_persist_persist_by_session_with_session_fixation_attack
|
25
25
|
ben = users(:ben)
|
26
|
-
controller.session["user_credentials"] =
|
26
|
+
controller.session["user_credentials"] = "neo"
|
27
27
|
controller.session["user_credentials_id"] = {
|
28
28
|
select: " *,'neo' AS persistence_token FROM users WHERE id = #{ben.id} limit 1 -- "
|
29
29
|
}
|
data/test/test_helper.rb
CHANGED
@@ -6,7 +6,7 @@ require "active_record/fixtures"
|
|
6
6
|
require "timecop"
|
7
7
|
require "i18n"
|
8
8
|
|
9
|
-
I18n.load_path << File.dirname(__FILE__) +
|
9
|
+
I18n.load_path << File.dirname(__FILE__) + "/i18n/lol.yml"
|
10
10
|
|
11
11
|
# ActiveRecord::Schema.verbose = false
|
12
12
|
ActiveRecord::Base.establish_connection(adapter: "sqlite3", database: ":memory:")
|
@@ -14,7 +14,7 @@ logger = Logger.new(STDOUT)
|
|
14
14
|
logger.level = Logger::FATAL
|
15
15
|
ActiveRecord::Base.logger = logger
|
16
16
|
|
17
|
-
if
|
17
|
+
if ActiveRecord::VERSION::STRING < "4.1"
|
18
18
|
ActiveRecord::Base.configurations = true
|
19
19
|
end
|
20
20
|
|
@@ -104,16 +104,18 @@ ActiveRecord::Schema.define(version: 1) do
|
|
104
104
|
end
|
105
105
|
end
|
106
106
|
|
107
|
-
|
108
|
-
|
109
|
-
|
110
|
-
|
111
|
-
|
112
|
-
|
113
|
-
|
114
|
-
|
115
|
-
|
116
|
-
|
107
|
+
require "English"
|
108
|
+
$LOAD_PATH.unshift(File.expand_path("../lib", __dir__))
|
109
|
+
require "authlogic"
|
110
|
+
require "authlogic/test_case"
|
111
|
+
require "libs/project"
|
112
|
+
require "libs/affiliate"
|
113
|
+
require "libs/employee"
|
114
|
+
require "libs/employee_session"
|
115
|
+
require "libs/ldaper"
|
116
|
+
require "libs/user"
|
117
|
+
require "libs/user_session"
|
118
|
+
require "libs/company"
|
117
119
|
|
118
120
|
# Recent change, 2017-10-23: We had used a 54-letter string here. In the default
|
119
121
|
# encoding, UTF-8, that's 54 bytes, which is clearly incorrect for an algorithm
|
@@ -149,7 +151,16 @@ module ActiveSupport
|
|
149
151
|
# tests until Rails 4.1 was added for testing. This ensures that all the
|
150
152
|
# models start tests with their original config.
|
151
153
|
def config_setup
|
152
|
-
[
|
154
|
+
[
|
155
|
+
Project,
|
156
|
+
Affiliate,
|
157
|
+
Employee,
|
158
|
+
EmployeeSession,
|
159
|
+
Ldaper,
|
160
|
+
User,
|
161
|
+
UserSession,
|
162
|
+
Company
|
163
|
+
].each do |model|
|
153
164
|
unless model.respond_to?(:original_acts_as_authentic_config)
|
154
165
|
model.class_attribute :original_acts_as_authentic_config
|
155
166
|
end
|
@@ -158,7 +169,16 @@ module ActiveSupport
|
|
158
169
|
end
|
159
170
|
|
160
171
|
def config_teardown
|
161
|
-
[
|
172
|
+
[
|
173
|
+
Project,
|
174
|
+
Affiliate,
|
175
|
+
Employee,
|
176
|
+
EmployeeSession,
|
177
|
+
Ldaper,
|
178
|
+
User,
|
179
|
+
UserSession,
|
180
|
+
Company
|
181
|
+
].each do |model|
|
162
182
|
model.acts_as_authentic_config = model.original_acts_as_authentic_config
|
163
183
|
end
|
164
184
|
end
|