authlogic 4.1.0 → 4.1.1
Sign up to get free protection for your applications and to get access to all the features.
- checksums.yaml +4 -4
- data/.gitignore +1 -0
- data/.rubocop.yml +0 -4
- data/.rubocop_todo.yml +32 -33
- data/CHANGELOG.md +15 -0
- data/Rakefile +2 -4
- data/authlogic.gemspec +2 -1
- data/lib/authlogic/acts_as_authentic/base.rb +13 -13
- data/lib/authlogic/acts_as_authentic/logged_in_status.rb +3 -3
- data/lib/authlogic/acts_as_authentic/login.rb +4 -4
- data/lib/authlogic/acts_as_authentic/password.rb +99 -98
- data/lib/authlogic/acts_as_authentic/persistence_token.rb +3 -3
- data/lib/authlogic/acts_as_authentic/queries/find_with_case.rb +32 -32
- data/lib/authlogic/acts_as_authentic/restful_authentication.rb +14 -14
- data/lib/authlogic/acts_as_authentic/session_maintenance.rb +60 -60
- data/lib/authlogic/acts_as_authentic/single_access_token.rb +6 -6
- data/lib/authlogic/authenticates_many/association.rb +3 -3
- data/lib/authlogic/config.rb +9 -9
- data/lib/authlogic/controller_adapters/abstract_adapter.rb +28 -8
- data/lib/authlogic/controller_adapters/rails_adapter.rb +3 -3
- data/lib/authlogic/crypto_providers/aes256.rb +20 -20
- data/lib/authlogic/crypto_providers/bcrypt.rb +8 -8
- data/lib/authlogic/crypto_providers/scrypt.rb +8 -8
- data/lib/authlogic/session/activation.rb +3 -3
- data/lib/authlogic/session/brute_force_protection.rb +32 -32
- data/lib/authlogic/session/callbacks.rb +49 -35
- data/lib/authlogic/session/cookies.rb +58 -49
- data/lib/authlogic/session/foundation.rb +3 -3
- data/lib/authlogic/session/id.rb +9 -4
- data/lib/authlogic/session/klass.rb +6 -6
- data/lib/authlogic/session/magic_columns.rb +5 -17
- data/lib/authlogic/session/params.rb +3 -0
- data/lib/authlogic/session/password.rb +105 -104
- data/lib/authlogic/session/perishable_token.rb +5 -5
- data/lib/authlogic/session/persistence.rb +5 -4
- data/lib/authlogic/session/priority_record.rb +8 -8
- data/lib/authlogic/session/scopes.rb +23 -23
- data/lib/authlogic/session/timeout.rb +11 -11
- data/lib/authlogic/session/unauthorized_record.rb +6 -6
- data/lib/authlogic/session/validation.rb +9 -9
- data/lib/authlogic/test_case.rb +5 -0
- data/lib/authlogic/test_case/mock_request.rb +2 -2
- data/lib/authlogic/version.rb +4 -3
- data/test/acts_as_authentic_test/password_test.rb +23 -23
- data/test/test_helper.rb +96 -93
- metadata +18 -4
checksums.yaml
CHANGED
@@ -1,7 +1,7 @@
|
|
1
1
|
---
|
2
2
|
SHA256:
|
3
|
-
metadata.gz:
|
4
|
-
data.tar.gz:
|
3
|
+
metadata.gz: c0ca1b9d96dbb4d00cf0cad78c6a10bfbc8f893c931834eb560e2fa1a2db10b5
|
4
|
+
data.tar.gz: 274d571aafec37f865edd29222343e88545877ef79caade6f87bfca9b27f50da
|
5
5
|
SHA512:
|
6
|
-
metadata.gz:
|
7
|
-
data.tar.gz:
|
6
|
+
metadata.gz: 96c6ea47f5a5b6f98e4fadc427d0e1bbfa6b86f2d4a250757270fa375e0cda5a22a5e4fb7704a14e74a63ba87ef617a2adc489ea7ced107864635f98fa736c35
|
7
|
+
data.tar.gz: 7c3905f05ebb0c4e2694a57ef5e5c04a8cb2c2de97f8b4af965bbf5b41f71aba63646c9fcedc44d3e2916b178855ff56296ca97ecdd151a24d1abb72cc3133df
|
data/.gitignore
CHANGED
data/.rubocop.yml
CHANGED
@@ -28,10 +28,6 @@ AllCops:
|
|
28
28
|
Layout/AlignParameters:
|
29
29
|
EnforcedStyle: with_fixed_indentation
|
30
30
|
|
31
|
-
# This project uses rails-style method indentation, ie. indent after `private`.
|
32
|
-
Layout/IndentationConsistency:
|
33
|
-
EnforcedStyle: rails
|
34
|
-
|
35
31
|
Layout/MultilineMethodCallIndentation:
|
36
32
|
EnforcedStyle: indented
|
37
33
|
|
data/.rubocop_todo.yml
CHANGED
@@ -1,25 +1,18 @@
|
|
1
1
|
# This configuration was generated by
|
2
2
|
# `rubocop --auto-gen-config`
|
3
|
-
# on
|
3
|
+
# on 2018-05-22 23:50:03 -0400 using RuboCop version 0.56.0.
|
4
4
|
# The point is for the user to remove these configuration records
|
5
5
|
# one by one as the offenses are removed from the code base.
|
6
6
|
# Note that changes in the inspected code, or installation of new
|
7
7
|
# versions of RuboCop, may require this file to be generated again.
|
8
8
|
|
9
|
-
# Offense count:
|
9
|
+
# Offense count: 10
|
10
10
|
Metrics/AbcSize:
|
11
|
-
Max:
|
11
|
+
Max: 18.5
|
12
12
|
|
13
|
-
# Offense count:
|
14
|
-
Metrics/PerceivedComplexity:
|
15
|
-
Max: 8
|
16
|
-
|
17
|
-
Naming/MemoizedInstanceVariableName:
|
18
|
-
Enabled: false
|
19
|
-
|
20
|
-
# Offense count: 60
|
13
|
+
# Offense count: 59
|
21
14
|
# Cop supports --auto-correct.
|
22
|
-
# Configuration parameters: EnforcedStyle
|
15
|
+
# Configuration parameters: EnforcedStyle.
|
23
16
|
# SupportedStyles: prefer_alias, prefer_alias_method
|
24
17
|
Style/Alias:
|
25
18
|
Enabled: false
|
@@ -29,38 +22,44 @@ Style/ClassVars:
|
|
29
22
|
Exclude:
|
30
23
|
- 'lib/authlogic/i18n.rb'
|
31
24
|
|
32
|
-
# Offense count:
|
25
|
+
# Offense count: 22
|
33
26
|
Style/Documentation:
|
34
27
|
Exclude:
|
35
|
-
# Permanent
|
36
|
-
- test/**/*
|
28
|
+
# Permanent
|
29
|
+
- 'test/**/*'
|
37
30
|
|
38
|
-
#
|
39
|
-
- lib/authlogic/config.rb
|
40
|
-
- lib/authlogic/controller_adapters/sinatra_adapter.rb
|
41
|
-
- lib/authlogic/crypto_providers.rb
|
42
|
-
- lib/authlogic/i18n/translator.rb
|
43
|
-
- lib/authlogic/session/activation.rb
|
44
|
-
- lib/authlogic/session/active_record_trickery.rb
|
45
|
-
- lib/authlogic/session/existence.rb
|
46
|
-
- lib/authlogic/session/foundation.rb
|
47
|
-
- lib/authlogic/session/klass.rb
|
48
|
-
- lib/authlogic/session/persistence.rb
|
49
|
-
- lib/authlogic/session/scopes.rb
|
50
|
-
- lib/authlogic/test_case.rb
|
51
|
-
- lib/authlogic/test_case/mock_cookie_jar.rb
|
52
|
-
- lib/authlogic/version.rb
|
31
|
+
# TODO
|
32
|
+
- 'lib/authlogic/config.rb'
|
33
|
+
- 'lib/authlogic/controller_adapters/sinatra_adapter.rb'
|
34
|
+
- 'lib/authlogic/crypto_providers.rb'
|
35
|
+
- 'lib/authlogic/i18n/translator.rb'
|
36
|
+
- 'lib/authlogic/session/activation.rb'
|
37
|
+
- 'lib/authlogic/session/active_record_trickery.rb'
|
38
|
+
- 'lib/authlogic/session/existence.rb'
|
39
|
+
- 'lib/authlogic/session/foundation.rb'
|
40
|
+
- 'lib/authlogic/session/klass.rb'
|
41
|
+
- 'lib/authlogic/session/persistence.rb'
|
42
|
+
- 'lib/authlogic/session/scopes.rb'
|
43
|
+
- 'lib/authlogic/test_case.rb'
|
44
|
+
- 'lib/authlogic/test_case/mock_cookie_jar.rb'
|
45
|
+
- 'lib/authlogic/version.rb'
|
53
46
|
|
54
47
|
# Offense count: 4
|
55
|
-
Style/
|
48
|
+
Style/MethodMissingSuper:
|
56
49
|
Exclude:
|
57
50
|
- 'lib/authlogic/controller_adapters/abstract_adapter.rb'
|
58
51
|
- 'lib/authlogic/controller_adapters/sinatra_adapter.rb'
|
59
52
|
- 'lib/authlogic/test_case/mock_request.rb'
|
60
53
|
|
61
|
-
# Offense count:
|
54
|
+
# Offense count: 3
|
55
|
+
Style/MissingRespondToMissing:
|
56
|
+
Exclude:
|
57
|
+
- 'lib/authlogic/controller_adapters/sinatra_adapter.rb'
|
58
|
+
- 'lib/authlogic/test_case/mock_request.rb'
|
59
|
+
|
60
|
+
# Offense count: 10
|
62
61
|
# Cop supports --auto-correct.
|
63
|
-
# Configuration parameters:
|
62
|
+
# Configuration parameters: .
|
64
63
|
# SupportedStyles: compact, exploded
|
65
64
|
Style/RaiseArgs:
|
66
65
|
EnforcedStyle: compact
|
data/CHANGELOG.md
CHANGED
@@ -1,5 +1,10 @@
|
|
1
1
|
# Changelog
|
2
2
|
|
3
|
+
All notable changes to this project will be documented in this file.
|
4
|
+
|
5
|
+
The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
|
6
|
+
and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
|
7
|
+
|
3
8
|
## Unreleased
|
4
9
|
|
5
10
|
* Breaking Changes
|
@@ -9,6 +14,16 @@
|
|
9
14
|
* Fixed
|
10
15
|
* None
|
11
16
|
|
17
|
+
## 4.1.1 (2018-05-23)
|
18
|
+
|
19
|
+
* Breaking Changes
|
20
|
+
* None
|
21
|
+
* Added
|
22
|
+
* None
|
23
|
+
* Fixed
|
24
|
+
* [#606](https://github.com/binarylogic/authlogic/pull/606) - Interpreter
|
25
|
+
warnings about undefined instance variables
|
26
|
+
|
12
27
|
## 4.1.0 (2018-04-24)
|
13
28
|
|
14
29
|
* Breaking Changes
|
data/Rakefile
CHANGED
@@ -9,10 +9,8 @@ Rake::TestTask.new(:test) do |test|
|
|
9
9
|
test.pattern = "test/**/*_test.rb"
|
10
10
|
test.verbose = false
|
11
11
|
|
12
|
-
# Set interpreter warning level to
|
13
|
-
|
14
|
-
# TODO: Find a good way to deal with the level 2 warnings.
|
15
|
-
test.ruby_opts += ["-W1"]
|
12
|
+
# Set interpreter warning level to 2 (verbose)
|
13
|
+
test.ruby_opts += ["-W2"]
|
16
14
|
end
|
17
15
|
|
18
16
|
require "rubocop/rake_task"
|
data/authlogic.gemspec
CHANGED
@@ -27,7 +27,8 @@ require "authlogic/version"
|
|
27
27
|
s.add_dependency "scrypt", ">= 1.2", "< 4.0"
|
28
28
|
s.add_development_dependency "bcrypt", "~> 3.1"
|
29
29
|
s.add_development_dependency "byebug", "~> 10.0"
|
30
|
-
s.add_development_dependency "
|
30
|
+
s.add_development_dependency "minitest-reporters", "~> 1.2"
|
31
|
+
s.add_development_dependency "rubocop", "~> 0.56.0"
|
31
32
|
s.add_development_dependency "timecop", "~> 0.7"
|
32
33
|
|
33
34
|
s.files = `git ls-files`.split("\n")
|
@@ -76,23 +76,23 @@ module Authlogic
|
|
76
76
|
|
77
77
|
private
|
78
78
|
|
79
|
-
|
80
|
-
|
81
|
-
|
82
|
-
|
83
|
-
|
84
|
-
|
79
|
+
def db_setup?
|
80
|
+
column_names
|
81
|
+
true
|
82
|
+
rescue StandardError
|
83
|
+
false
|
84
|
+
end
|
85
85
|
|
86
|
-
|
87
|
-
|
88
|
-
|
89
|
-
|
90
|
-
|
91
|
-
end
|
86
|
+
def first_column_to_exist(*columns_to_check)
|
87
|
+
if db_setup?
|
88
|
+
columns_to_check.each do |column_name|
|
89
|
+
if column_names.include?(column_name.to_s)
|
90
|
+
return column_name.to_sym
|
92
91
|
end
|
93
92
|
end
|
94
|
-
columns_to_check.first && columns_to_check.first.to_sym
|
95
93
|
end
|
94
|
+
columns_to_check.first && columns_to_check.first.to_sym
|
95
|
+
end
|
96
96
|
end
|
97
97
|
end
|
98
98
|
end
|
@@ -186,10 +186,10 @@ module Authlogic
|
|
186
186
|
|
187
187
|
private
|
188
188
|
|
189
|
-
|
190
|
-
|
191
|
-
|
192
|
-
|
189
|
+
# @api private
|
190
|
+
def find_with_case(field, value, sensitive)
|
191
|
+
Queries::FindWithCase.new(self, field, value, sensitive).execute
|
192
|
+
end
|
193
193
|
end
|
194
194
|
|
195
195
|
# All methods relating to the login field
|
@@ -303,6 +303,7 @@ module Authlogic
|
|
303
303
|
module InstanceMethods
|
304
304
|
# The password
|
305
305
|
def password
|
306
|
+
return nil unless defined?(@password)
|
306
307
|
@password
|
307
308
|
end
|
308
309
|
|
@@ -376,124 +377,124 @@ module Authlogic
|
|
376
377
|
|
377
378
|
private
|
378
379
|
|
379
|
-
|
380
|
-
|
381
|
-
|
382
|
-
|
383
|
-
|
384
|
-
end
|
380
|
+
def crypted_password_to_validate_against(check_against_database)
|
381
|
+
if check_against_database && send("#{crypted_password_field}_changed?")
|
382
|
+
send("#{crypted_password_field}_was")
|
383
|
+
else
|
384
|
+
send(crypted_password_field)
|
385
385
|
end
|
386
|
+
end
|
386
387
|
|
387
|
-
|
388
|
-
|
389
|
-
|
388
|
+
def check_passwords_against_database?
|
389
|
+
self.class.check_passwords_against_database == true
|
390
|
+
end
|
390
391
|
|
391
|
-
|
392
|
-
|
393
|
-
|
392
|
+
def crypto_providers
|
393
|
+
[crypto_provider] + transition_from_crypto_providers
|
394
|
+
end
|
394
395
|
|
395
|
-
|
396
|
-
|
397
|
-
|
398
|
-
|
399
|
-
|
400
|
-
|
401
|
-
|
402
|
-
|
403
|
-
|
404
|
-
|
405
|
-
|
406
|
-
|
396
|
+
# Returns an array of arguments to be passed to a crypto provider, either its
|
397
|
+
# `matches?` or its `encrypt` method.
|
398
|
+
def encrypt_arguments(raw_password, check_against_database, arguments_type = nil)
|
399
|
+
salt = nil
|
400
|
+
if password_salt_field
|
401
|
+
salt =
|
402
|
+
if check_against_database && send("#{password_salt_field}_changed?")
|
403
|
+
send("#{password_salt_field}_was")
|
404
|
+
else
|
405
|
+
send(password_salt_field)
|
406
|
+
end
|
407
|
+
end
|
407
408
|
|
408
|
-
|
409
|
-
|
410
|
-
|
411
|
-
|
412
|
-
|
413
|
-
|
414
|
-
|
415
|
-
end
|
409
|
+
case arguments_type
|
410
|
+
when :restful_authentication
|
411
|
+
[REST_AUTH_SITE_KEY, salt, raw_password, REST_AUTH_SITE_KEY].compact
|
412
|
+
when nil
|
413
|
+
[raw_password, salt].compact
|
414
|
+
else
|
415
|
+
raise "Invalid encryptor arguments_type: #{arguments_type}"
|
416
416
|
end
|
417
|
+
end
|
417
418
|
|
418
|
-
|
419
|
-
|
420
|
-
|
421
|
-
|
422
|
-
|
419
|
+
# Given `encryptor`, does `attempted_password` match the `crypted` password?
|
420
|
+
def encryptor_matches?(
|
421
|
+
crypted,
|
422
|
+
encryptor,
|
423
|
+
index,
|
424
|
+
attempted_password,
|
425
|
+
check_against_database
|
426
|
+
)
|
427
|
+
# The arguments_type for the transitioning from restful_authentication
|
428
|
+
acting_restful = act_like_restful_authentication? && index.zero?
|
429
|
+
transitioning = transition_from_restful_authentication? &&
|
430
|
+
index > 0 &&
|
431
|
+
encryptor == Authlogic::CryptoProviders::Sha1
|
432
|
+
restful = acting_restful || transitioning
|
433
|
+
arguments_type = restful ? :restful_authentication : nil
|
434
|
+
encryptor_args = encrypt_arguments(
|
423
435
|
attempted_password,
|
424
|
-
check_against_database
|
436
|
+
check_against_database,
|
437
|
+
arguments_type
|
425
438
|
)
|
426
|
-
|
427
|
-
|
428
|
-
transitioning = transition_from_restful_authentication? &&
|
429
|
-
index > 0 &&
|
430
|
-
encryptor == Authlogic::CryptoProviders::Sha1
|
431
|
-
restful = acting_restful || transitioning
|
432
|
-
arguments_type = restful ? :restful_authentication : nil
|
433
|
-
encryptor_args = encrypt_arguments(
|
434
|
-
attempted_password,
|
435
|
-
check_against_database,
|
436
|
-
arguments_type
|
437
|
-
)
|
438
|
-
encryptor.matches?(crypted, *encryptor_args)
|
439
|
-
end
|
439
|
+
encryptor.matches?(crypted, *encryptor_args)
|
440
|
+
end
|
440
441
|
|
441
|
-
|
442
|
-
|
443
|
-
|
444
|
-
|
445
|
-
|
446
|
-
|
447
|
-
|
448
|
-
|
449
|
-
|
442
|
+
# Determines if we need to transition the password.
|
443
|
+
#
|
444
|
+
# - If the index > 0 then we are using an "transition from" crypto
|
445
|
+
# provider.
|
446
|
+
# - If the encryptor has a cost and the cost it outdated.
|
447
|
+
# - If we aren't using database values
|
448
|
+
# - If we are using database values, only if the password hasn't
|
449
|
+
# changed so we don't overwrite any changes
|
450
|
+
def transition_password?(index, encryptor, check_against_database)
|
451
|
+
(
|
452
|
+
index > 0 ||
|
453
|
+
(encryptor.respond_to?(:cost_matches?) &&
|
454
|
+
!encryptor.cost_matches?(send(crypted_password_field)))
|
455
|
+
) &&
|
450
456
|
(
|
451
|
-
|
452
|
-
(
|
453
|
-
|
454
|
-
|
455
|
-
(
|
456
|
-
!check_against_database ||
|
457
|
-
!send("#{crypted_password_field}_changed?")
|
458
|
-
)
|
459
|
-
end
|
457
|
+
!check_against_database ||
|
458
|
+
!send("#{crypted_password_field}_changed?")
|
459
|
+
)
|
460
|
+
end
|
460
461
|
|
461
|
-
|
462
|
-
|
463
|
-
|
464
|
-
|
462
|
+
def transition_password(attempted_password)
|
463
|
+
self.password = attempted_password
|
464
|
+
save(validate: false)
|
465
|
+
end
|
465
466
|
|
466
|
-
|
467
|
-
|
468
|
-
|
467
|
+
def require_password?
|
468
|
+
new_record? || password_changed? || send(crypted_password_field).blank?
|
469
|
+
end
|
469
470
|
|
470
|
-
|
471
|
-
|
472
|
-
|
471
|
+
def ignore_blank_passwords?
|
472
|
+
self.class.ignore_blank_passwords == true
|
473
|
+
end
|
473
474
|
|
474
|
-
|
475
|
-
|
476
|
-
|
475
|
+
def password_changed?
|
476
|
+
defined?(@password_changed) && @password_changed == true
|
477
|
+
end
|
477
478
|
|
478
|
-
|
479
|
-
|
480
|
-
|
479
|
+
def reset_password_changed
|
480
|
+
@password_changed = nil
|
481
|
+
end
|
481
482
|
|
482
|
-
|
483
|
-
|
484
|
-
|
483
|
+
def crypted_password_field
|
484
|
+
self.class.crypted_password_field
|
485
|
+
end
|
485
486
|
|
486
|
-
|
487
|
-
|
488
|
-
|
487
|
+
def password_salt_field
|
488
|
+
self.class.password_salt_field
|
489
|
+
end
|
489
490
|
|
490
|
-
|
491
|
-
|
492
|
-
|
491
|
+
def crypto_provider
|
492
|
+
self.class.crypto_provider
|
493
|
+
end
|
493
494
|
|
494
|
-
|
495
|
-
|
496
|
-
|
495
|
+
def transition_from_crypto_providers
|
496
|
+
self.class.transition_from_crypto_providers
|
497
|
+
end
|
497
498
|
end
|
498
499
|
end
|
499
500
|
end
|