authpwn_rails 0.16.1 → 0.16.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 55e00431fac95ebeaa4bffd96d5f03a788bc0340
-  data.tar.gz: 80a15431b638ed0798dd0b22735f8ced99770b4c
+  metadata.gz: 38257de1d56ba7c5ea75d7e055fbe62d5a8cf579
+  data.tar.gz: 70b9271b0f567bf5c358530371ea9f06bd9f93e0
 SHA512:
-  metadata.gz: 4bb61cd308147854a0712247e38678c8d311d9ef145973138218e2b4cae76af334597333e79616f517c9b02fcbfc7bfcaf71d9a6dcc87f3a4a8a3c1a18bce1a8
-  data.tar.gz: b9b35f7de8f897de9674242e7311f10e1faa57f8ce7c429388aca357cf9ee0c78fece76711579385f2b0e6a2574f008f61e26c104187093ca0edbca16d0d9408
+  metadata.gz: 4b89f3ff51230ef53e527075a8fb898e63de72c4276e4d3b3dd5e48dd6aa83312cb16bbfcf629cdb82e5981e24a43bf767f2851d84b2cedf24c65caaaf378017
+  data.tar.gz: 86d7b0f0f9a05826fc61d1b41461a20b1a8a65e0bc189b47cb9fbb70bce8cf091104f613d20eb76a8a35e0a65d1541756756a7a0c29ebb6dda0451e997fb3b95

data/Rakefile

@@ -16,7 +16,7 @@ Jeweler::Tasks.new do |gem|
   gem.name = "authpwn_rails"
   gem.homepage = "http://github.com/pwnall/authpwn_rails"
   gem.license = "MIT"
-  gem.summary = %Q{User authentication for Rails 3 applications.}
+  gem.summary = %Q{User authentication for Rails 3 and 4 applications.}
   gem.description = %Q{Works with Facebook.}
   gem.email = "victor@costan.us"
   gem.authors = ["Victor Costan"]

data/VERSION

@@ -1 +1 @@
-0.16.1
+0.16.2

data/app/models/credentials/password.rb

@@ -11,6 +11,14 @@ class Password < ::Credential
   # Virtual attribute: confirmation for the user's password.
   attr_accessor :password_confirmation
 
+  # Virtual attribute that lets us have an old_password field on forms.
+  def old_password
+    nil
+  end
+  def old_password=(new_old_password)
+    new_old_password
+  end
+
   # A user can have a single password.
   validates :user_id, uniqueness: true
 
@@ -75,7 +83,7 @@ class Password < ::Credential
 
   if ActiveRecord::Base.respond_to? :mass_assignment_sanitizer=
     # Forms can only change the plain-text password fields.
-    attr_accessible :password, :password_confirmation
+    attr_accessible :old_password, :password, :password_confirmation
   end
 end  # class Credentials::Password
 

data/authpwn_rails.gemspec

@@ -5,7 +5,7 @@
 
 Gem::Specification.new do |s|
   s.name = "authpwn_rails"
-  s.version = "0.16.1"
+  s.version = "0.16.2"
 
   s.required_rubygems_version = Gem::Requirement.new(">= 0") if s.respond_to? :required_rubygems_version=
   s.authors = ["Victor Costan"]
@@ -122,7 +122,7 @@ Gem::Specification.new do |s|
   s.licenses = ["MIT"]
   s.require_paths = ["lib"]
   s.rubygems_version = "2.0.14"
-  s.summary = "User authentication for Rails 3 applications."
+  s.summary = "User authentication for Rails 3 and 4 applications."
 
   if s.respond_to? :specification_version then
     s.specification_version = 4

data/lib/authpwn_rails/generators/templates/session/password_change.html.erb

@@ -21,9 +21,9 @@
   <section class="fields">
   <% unless @credential.new_record? %>
   <div class="field">
-    <%= label_tag :old_password, 'Current Password' %><br />
+    <%= f.label :old_password, 'Current Password' %><br />
     <span class="value">
-      <%= password_field_tag :old_password %>
+      <%= f.password_field :old_password %>
     </span>
   </div>
   <% end %>

data/lib/authpwn_rails/generators/templates/session_controller_test.rb

@@ -83,7 +83,7 @@ class SessionControllerTest < ActionController::TestCase
     assert_select 'span[class="password_age"]'
     assert_select 'form[action=?][method="post"]',
                   change_password_session_path do
-      assert_select 'input[name="old_password"]'
+      assert_select 'input[name=?]', 'credential[old_password]'
       assert_select 'input[name=?]', 'credential[password]'
       assert_select 'input[name=?]', 'credential[password_confirmation]'
       assert_select 'button[type="submit"]'
@@ -98,7 +98,7 @@ class SessionControllerTest < ActionController::TestCase
     assert_select 'span[class="password_age"]', count: 0
     assert_select 'form[action=?][method="post"]',
                   change_password_session_path do
-      assert_select 'input[name="old_password"]', count: 0
+      assert_select 'input[name=?]', 'credential[old_password]', count: 0
       assert_select 'input[name=?]', 'credential[password]'
       assert_select 'input[name=?]', 'credential[password_confirmation]'
       assert_select 'button[type="submit"]'

data/lib/authpwn_rails/session_controller.rb

@@ -194,7 +194,7 @@ module SessionController
                                find { |c| c.is_a? Credentials::Password }
     if @credential
       # An old password is set, must verify it.
-      if @credential.check_password params[:old_password]
+      if @credential.check_password params[:credential][:old_password]
         success = @credential.update_attributes change_password_params
       else
         success = false
@@ -223,7 +223,8 @@ module SessionController
 
     # Parameters used to change the user's password.
     def change_password_params
-      params.require(:credential).permit :password, :password_confirmation
+      params.require(:credential).permit :old_password, :password,
+                                         :password_confirmation
     end
   else
     # Rails 3.

data/test/credentials/password_credential_test.rb

@@ -42,6 +42,12 @@ class PasswordCredentialTest < ActiveSupport::TestCase
     assert !@credential.valid?
   end
 
+  test 'old_password always returns nil' do
+    assert_equal @credential.old_password, nil
+    @credential.old_password = 'old password'
+    assert_equal @credential.old_password, nil
+  end
+
   test 'check_password' do
     assert_equal true, @credential.check_password('awesome')
     assert_equal false, @credential.check_password('not awesome'),

data/test/fixtures/bare_session/password_change.html.erb

@@ -21,9 +21,9 @@
   <section class="fields">
   <% unless @credential.new_record? %>
   <div class="field">
-    <%= label_tag :old_password, 'Current Password' %><br />
+    <%= f.label :old_password, 'Current Password' %><br />
     <span class="value">
-      <%= password_field_tag :old_password %>
+      <%= f.password_field :old_password %>
     </span>
   </div>
   <% end %>
@@ -44,6 +44,6 @@
   </section>
 
   <div class="actions">
-    <%= f.submit 'Change Password' %>
+    <%= f.button 'Change Password', type: 'submit' %>
   </div>
 <% end %>

data/test/session_controller_api_test.rb

@@ -365,16 +365,15 @@ class SessionControllerApiTest < ActionController::TestCase
   end
 
   test "change_password bounces without logged in user" do
-    post :change_password, old_password: 'pa55w0rd',
-         credential: { password: 'hacks',
-                       password_confirmation: 'hacks'}
+    post :change_password, credential: { old_password: 'pa55w0rd',
+        password: 'hacks', password_confirmation: 'hacks' }
     assert_response :forbidden
   end
 
   test "change_password works with correct input" do
     set_session_current_user @user
-    post :change_password, old_password: 'pa55w0rd',
-         credential: { password: 'hacks', password_confirmation: 'hacks'}
+    post :change_password, credential: { old_password: 'pa55w0rd',
+        password: 'hacks', password_confirmation: 'hacks'}
     assert_redirected_to session_url
     assert_equal @password_credential, assigns(:credential)
     assert_equal @user, User.authenticate_signin(@email_credential.email,
@@ -383,9 +382,9 @@ class SessionControllerApiTest < ActionController::TestCase
 
   test "change_password works with correct input and extra form input" do
     set_session_current_user @user
-    post :change_password, old_password: 'pa55w0rd',
-         credential: { password: 'hacks', password_confirmation: 'hacks'},
-         utf8: "\u2713", commit: 'Change password'
+    post :change_password, credential: { old_password: 'pa55w0rd',
+        password: 'hacks', password_confirmation: 'hacks' }, utf8: "\u2713",
+        commit: 'Change Password'
     assert_redirected_to session_url
     assert_equal @password_credential, assigns(:credential)
     assert_equal @user, User.authenticate_signin(@email_credential.email,
@@ -394,8 +393,8 @@ class SessionControllerApiTest < ActionController::TestCase
 
   test "change_password rejects bad old password" do
     set_session_current_user @user
-    post :change_password, old_password: '_pa55w0rd',
-         credential: { password: 'hacks', password_confirmation: 'hacks'}
+    post :change_password, credential: { old_password: '_pa55w0rd',
+        password: 'hacks', password_confirmation: 'hacks' }
     assert_response :ok
     assert_template :password_change
     assert_equal @password_credential, assigns(:credential)
@@ -405,8 +404,8 @@ class SessionControllerApiTest < ActionController::TestCase
 
   test "change_password rejects un-confirmed password" do
     set_session_current_user @user
-    post :change_password, old_password: 'pa55w0rd',
-         credential: { password: 'hacks', password_confirmation: 'hacks_'}
+    post :change_password, credential: { old_password: 'pa55w0rd',
+        password: 'hacks', password_confirmation: 'hacks_' }
     assert_response :ok
     assert_template :password_change
     assert_equal @password_credential, assigns(:credential)
@@ -417,9 +416,8 @@ class SessionControllerApiTest < ActionController::TestCase
   test "change_password works for password recovery" do
     set_session_current_user @user
     @password_credential.destroy
-    post :change_password,
-         credential: { password: 'hacks',
-                          password_confirmation: 'hacks'}
+    post :change_password, credential: { password: 'hacks',
+                                         password_confirmation: 'hacks' }
     assert_redirected_to session_url
     assert_equal @user, User.authenticate_signin(@email_credential.email,
         'hacks'), 'password not changed'
@@ -429,17 +427,17 @@ class SessionControllerApiTest < ActionController::TestCase
     set_session_current_user @user
     @password_credential.destroy
     assert_no_difference 'Credential.count' do
-      post :change_password,
-           credential: { password: 'hacks',
-                            password_confirmation: 'hacks_'}
+      post :change_password, credential: { password: 'hacks',
+                                           password_confirmation: 'hacks_' }
     end
     assert_response :ok
     assert_template :password_change
   end
 
   test "change_password by json bounces without logged in user" do
-    post :change_password, format: 'json', old_password: 'pa55w0rd',
-         credential: { password: 'hacks', password_confirmation: 'hacks'}
+    post :change_password, format: 'json',
+        credential: { old_password: 'pa55w0rd', password: 'hacks',
+                      password_confirmation: 'hacks' }
     assert_response :ok
     data = ActiveSupport::JSON.decode response.body
     assert_equal 'Please sign in', data['error']
@@ -447,9 +445,9 @@ class SessionControllerApiTest < ActionController::TestCase
 
   test "change_password by json works with correct input" do
     set_session_current_user @user
-    post :change_password, format: 'json', old_password: 'pa55w0rd',
-         credential: { password: 'hacks',
-                          password_confirmation: 'hacks'}
+    post :change_password, format: 'json',
+        credential: { old_password: 'pa55w0rd', password: 'hacks',
+                      password_confirmation: 'hacks' }
     assert_response :ok
     assert_equal @user, User.authenticate_signin(@email_credential.email,
         'hacks'), 'password not changed'
@@ -457,8 +455,9 @@ class SessionControllerApiTest < ActionController::TestCase
 
   test "change_password by json rejects bad old password" do
     set_session_current_user @user
-    post :change_password, format: 'json', old_password: '_pa55w0rd',
-         credential: { password: 'hacks', password_confirmation: 'hacks'}
+    post :change_password, format: 'json',
+        credential: { old_password: '_pa55w0rd', password: 'hacks',
+                      password_confirmation: 'hacks' }
     assert_response :ok
     data = ActiveSupport::JSON.decode response.body
     assert_equal 'invalid', data['error']
@@ -469,8 +468,9 @@ class SessionControllerApiTest < ActionController::TestCase
 
   test "change_password by json rejects un-confirmed password" do
     set_session_current_user @user
-    post :change_password, format: 'json', old_password: 'pa55w0rd',
-         credential: { password: 'hacks', password_confirmation: 'hacks_'}
+    post :change_password, format: 'json',
+         credential: { old_password: 'pa55w0rd', password: 'hacks',
+                       password_confirmation: 'hacks_' }
     assert_response :ok
     data = ActiveSupport::JSON.decode response.body
     assert_equal 'invalid', data['error']
@@ -482,7 +482,7 @@ class SessionControllerApiTest < ActionController::TestCase
     set_session_current_user @user
     @password_credential.destroy
     post :change_password, format: 'json',
-         credential: { password: 'hacks', password_confirmation: 'hacks'}
+         credential: { password: 'hacks', password_confirmation: 'hacks' }
     assert_response :ok
     assert_equal @user, User.authenticate_signin(
          @email_credential.email, 'hacks'), 'password not changed'
@@ -493,8 +493,7 @@ class SessionControllerApiTest < ActionController::TestCase
     @password_credential.destroy
     assert_no_difference 'Credential.count' do
       post :change_password, format: 'json',
-           credential: { password: 'hacks',
-                            password_confirmation: 'hacks_'}
+           credential: { password: 'hacks', password_confirmation: 'hacks_' }
     end
     assert_response :ok
     data = ActiveSupport::JSON.decode response.body

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: authpwn_rails
 version: !ruby/object:Gem::Version
-  version: 0.16.1
+  version: 0.16.2
 platform: ruby
 authors:
 - Victor Costan
@@ -309,5 +309,5 @@ rubyforge_project:
 rubygems_version: 2.0.14
 signing_key: 
 specification_version: 4
-summary: User authentication for Rails 3 applications.
+summary: User authentication for Rails 3 and 4 applications.
 test_files: []