authlogic 1.3.3 → 1.3.4

data/CHANGELOG.rdoc

@@ -1,3 +1,8 @@
+== 1.3.4 released 2008-11-24
+
+* Delegate human_attribute_name to the ActiveRecord class to take advantage of the I18n feature.
+* Fixed issue with passwords from older versions of restful_authentication, the passwords end with --
+
 == 1.3.3 released 2008-11-23
 
 * Updated :act_like_restful_authentication for those using the older version where no site wide key is preset (REST_AUTH_SITE_KEY), Authlogic will adjust automatically based on the presence of this constant.

data/README.rdoc

@@ -199,13 +199,19 @@ For more information on ids checkout Authlogic::Session::Base#id
 
 == Encryption methods
 
-Authlogic is designed so you can use *any* encryption method you want. It delegates this task to a class of your choice. By default Authlogic uses salted Sha512 with 20 stretches. It also comes preloaded with some other common encryption algorithms so that you can choose. For example, if you wanted to use the BCrypt algorithm just do the following:
+Authlogic is designed so you can use *any* encryption method you want. It delegates this task to a class of your choice. Here are you choices:
+
+1. Authlogic::CryptoProviders::Sha1 (used mainly for migrating from restful_authentication)
+2. Authlogic::CryptoProviders::Sha512
+3. Authlogic::CryptoProviders::BCrypt
+
+By default Authlogic uses salted Sha512 with 20 stretches, but you can easily change this. For example, if you wanted to use the BCrypt algorithm just do the following:
 
   acts_as_authentic :crypto_provider => Authlogic::CryptoProviders::BCrypt
 
 For more information on BCrypt checkout my blog post on it: http://www.binarylogic.com/2008/11/22/storing-nuclear-launch-codes-in-your-app-enter-bcrypt-for-authlogic
 
-Also, check out the Authlogic::CryptoProviders module and sublcasses to get an idea of how to write your own crypto provider. It's extremely easy, all that you have to do is make a class with a class level encrypt and matches? method. That's it, the sky is the limit.
+Also, check out the Authlogic::CryptoProviders module and subclasses to get an idea of how to write your own crypto provider. You don't have to use the provided classes, you can easily write your own. All that you have to do is make a class with a class level encrypt and matches? method. That's it, the sky is the limit.
 
 == Switching to a new encryption method
 

data/authlogic.gemspec

@@ -2,11 +2,11 @@
 
 Gem::Specification.new do |s|
   s.name = %q{authlogic}
-  s.version = "1.3.3"
+  s.version = "1.3.4"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 1.2") if s.respond_to? :required_rubygems_version=
   s.authors = ["Ben Johnson of Binary Logic"]
-  s.date = %q{2008-11-23}
+  s.date = %q{2008-11-24}
   s.description = %q{A clean, simple, and unobtrusive ruby authentication solution.}
   s.email = %q{bjohnson@binarylogic.com}
   s.extra_rdoc_files = ["CHANGELOG.rdoc", "lib/authlogic/controller_adapters/abstract_adapter.rb", "lib/authlogic/controller_adapters/merb_adapter.rb", "lib/authlogic/controller_adapters/rails_adapter.rb", "lib/authlogic/crypto_providers/bcrypt.rb", "lib/authlogic/crypto_providers/sha1.rb", "lib/authlogic/crypto_providers/sha512.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/config.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/credentials.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/logged_in.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/perishability.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/persistence.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/session_maintenance.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/single_access.rb", "lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic.rb", "lib/authlogic/orm_adapters/active_record_adapter/authenticates_many.rb", "lib/authlogic/session/active_record_trickery.rb", "lib/authlogic/session/authenticates_many_association.rb", "lib/authlogic/session/base.rb", "lib/authlogic/session/callbacks.rb", "lib/authlogic/session/config.rb", "lib/authlogic/session/cookies.rb", "lib/authlogic/session/errors.rb", "lib/authlogic/session/params.rb", "lib/authlogic/session/perishability.rb", "lib/authlogic/session/scopes.rb", "lib/authlogic/session/session.rb", "lib/authlogic/version.rb", "lib/authlogic.rb", "README.rdoc"]

data/lib/authlogic/crypto_providers/sha1.rb

@@ -23,7 +23,8 @@ module Authlogic
         def encrypt(*tokens)
           tokens = tokens.flatten
           digest = tokens.shift
-          stretches.times { digest = Digest::SHA1.hexdigest([digest, *tokens].compact.join(join_token)) }
+          stretches.times { digest = Digest::SHA1.hexdigest([digest, *tokens].join(join_token)) }
+          digest
         end
         
         # Does the crypted password match the tokens? Uses the same tokens that were used to encrypt.

data/lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/config.rb

@@ -207,7 +207,7 @@ module Authlogic
                 options[crypto_provider_key].stretches = 1
               end
             end
-          
+
             class_eval <<-"end_eval", __FILE__, __LINE__
               def self.acts_as_authentic_config
                 #{options.inspect}

data/lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/credentials.rb

@@ -53,7 +53,6 @@ module Authlogic
             end
             
             attr_reader options[:password_field]
-            attr_accessor :crypto_provider
             
             class_eval <<-"end_eval", __FILE__, __LINE__
               def self.friendly_unique_token
@@ -77,10 +76,11 @@ module Authlogic
                 [#{options[:crypto_provider]}, #{options[:transition_from_crypto_provider].inspect}].compact.each do |encryptor|
                   # The arguments_type of for the transitioning from restful_authentication
                   arguments_type = nil
-                  case encryptor
-                  when #{options[:crypto_provider]}
+                  
+                  case encryptor.name
+                  when "#{options[:crypto_provider]}"
                     arguments_type = :restful_authentication if #{options[:act_like_restful_authentication].inspect}
-                  when #{options[:transition_from_crypto_provider].inspect}
+                  when "#{options[:transition_from_crypto_provider].inspect}"
                     arguments_type = :restful_authentication if #{options[:transition_from_restful_authentication].inspect}
                   end
                   
@@ -122,7 +122,7 @@ module Authlogic
                 def encrypt_arguments(raw_password, arguments_type = nil)
                   case arguments_type
                   when :restful_authentication
-                    [REST_AUTH_SITE_KEY, raw_password, #{options[:password_salt_field]}, REST_AUTH_SITE_KEY]
+                    [REST_AUTH_SITE_KEY, #{options[:password_salt_field]}, raw_password, REST_AUTH_SITE_KEY]
                   else
                     [raw_password, #{options[:password_salt_field]}]
                   end

data/lib/authlogic/orm_adapters/active_record_adapter/acts_as_authentic/logged_in.rb

@@ -18,16 +18,14 @@ module Authlogic
         module LoggedIn
           def acts_as_authentic_with_logged_in(options = {})
             acts_as_authentic_without_logged_in(options)
-          
+            
             validates_numericality_of :login_count, :only_integer => :true, :greater_than_or_equal_to => 0, :allow_nil => true if column_names.include?("login_count")
-        
-            if column_names.include?("last_request_at")
-              named_scope :logged_in, lambda { {:conditions => ["last_request_at > ?", options[:logged_in_timeout].seconds.ago]} }
-              named_scope :logged_out, lambda { {:conditions => ["last_request_at is NULL or last_request_at <= ?", options[:logged_in_timeout].seconds.ago]} }
-            end
-        
+            
             if column_names.include?("last_request_at")
               class_eval <<-"end_eval", __FILE__, __LINE__
+                named_scope :logged_in, lambda { {:conditions => ["last_request_at > ?", #{options[:logged_in_timeout]}.seconds.ago]} }
+                named_scope :logged_out, lambda { {:conditions => ["last_request_at is NULL or last_request_at <= ?", #{options[:logged_in_timeout]}.seconds.ago]} }
+                
                 def logged_in?
                   !last_request_at.nil? && last_request_at > #{options[:logged_in_timeout]}.seconds.ago
                 end

data/lib/authlogic/session/active_record_trickery.rb

@@ -11,8 +11,8 @@ module Authlogic
       end
       
       module ClassMethods # :nodoc:
-        def human_attribute_name(attribute_key_name, options = {})
-          attribute_key_name.humanize
+        def human_attribute_name(*args)
+          klass.human_attribute_name(*args)
         end
       end
       

data/lib/authlogic/version.rb

@@ -44,7 +44,7 @@ module Authlogic # :nodoc:
 
     MAJOR = 1
     MINOR = 3
-    TINY  = 3
+    TINY  = 4
 
     # The current version as a Version instance
     CURRENT = new(MAJOR, MINOR, TINY)

data/test/crypto_provider_tests/sha1_test.rb

@@ -10,5 +10,14 @@ module CryptoProviderTests
       hash = Authlogic::CryptoProviders::Sha1.encrypt("mypass")
       assert Authlogic::CryptoProviders::Sha1.matches?(hash, "mypass")
     end
+    
+    def test_old_restful_authentication_passwords
+      password = "test"
+      salt = "7e3041ebc2fc05a40c60028e2c4901a81035d3cd"
+      digest = "00742970dc9e6319f8019fd54864d3ea740f04b1"
+      Authlogic::CryptoProviders::Sha1.stretches = 1
+      assert Authlogic::CryptoProviders::Sha1.matches?(digest, nil, salt, password, nil)
+      Authlogic::CryptoProviders::Sha1.stretches = 10
+    end
   end
 end

data/test/orm_adapters_tests/active_record_adapter_tests/acts_as_authentic_tests/config_test.rb

@@ -84,6 +84,14 @@ module ORMAdaptersTests
           User.acts_as_authentic(:act_like_restful_authentication => true)
           set_session_for(ben)
           assert UserSession.find
+          
+          # Let's try a brute force approach
+          salt = "7e3041ebc2fc05a40c60028e2c4901a81035d3cd"
+          digest = "00742970dc9e6319f8019fd54864d3ea740f04b1"
+          assert ben.class.connection.execute("update users set crypted_password = '#{digest}', password_salt = '#{salt}' where id = '#{ben.id}';")
+          ben.reload
+          assert_equal 1, Authlogic::CryptoProviders::Sha1.stretches
+          assert ben.valid_password?("test")
         end
         
         def test_transition_from_restful_authentication

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification 
 name: authlogic
 version: !ruby/object:Gem::Version 
-  version: 1.3.3
+  version: 1.3.4
 platform: ruby
 authors: 
 - Ben Johnson of Binary Logic
@@ -9,7 +9,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2008-11-23 00:00:00 -05:00
+date: 2008-11-24 00:00:00 -05:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency