clearance 0.16.2 → 0.16.3

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    clearance (0.16.2)
+    clearance (0.16.3)
       diesel (~> 0.1.5)
       rails (>= 3.0)
 

data/NEWS.md

@@ -1,3 +1,8 @@
+New for 0.17.0:
+
+* Handle the security issue found in Rails by Ben Murphy. Some details
+can be found on the Rails commit: https://github.com/rails/rails/commit/5f91ea3dc1ed3fa1c6be2cff7de1d1663990b0c3
+
 New for 0.16.2:
 
 * Change default email sender to deploy@example.com .

data/app/controllers/clearance/passwords_controller.rb

@@ -23,13 +23,13 @@ class Clearance::PasswordsController < ApplicationController
 
   def edit
     @user = Clearance.configuration.user_model.find_by_id_and_confirmation_token(
-                   params[:user_id], params[:token])
+                   params[:user_id], params[:token].to_s)
     render :template => 'passwords/edit'
   end
 
   def update
     @user = Clearance.configuration.user_model.find_by_id_and_confirmation_token(
-                   params[:user_id], params[:token])
+                   params[:user_id], params[:token].to_s)
 
     if @user.update_password(params[:user][:password])
       sign_in(@user)
@@ -43,7 +43,7 @@ class Clearance::PasswordsController < ApplicationController
   private
 
   def forbid_missing_token
-    if params[:token].blank?
+    if params[:token].to_s.blank?
       flash_failure_when_forbidden
       render :template => 'passwords/new'
     end
@@ -51,7 +51,7 @@ class Clearance::PasswordsController < ApplicationController
 
   def forbid_non_existent_user
     unless Clearance.configuration.user_model.find_by_id_and_confirmation_token(
-                  params[:user_id], params[:token])
+                  params[:user_id], params[:token].to_s)
       flash_failure_when_forbidden
       render :template => 'passwords/new'
     end

data/db/schema.rb

@@ -1,3 +1,4 @@
+# encoding: UTF-8
 # This file is auto-generated from the current state of the database. Instead
 # of editing this file, please use the migrations feature of Active Record to
 # incrementally modify your database, and then regenerate this schema definition.
@@ -18,8 +19,8 @@ ActiveRecord::Schema.define(:version => 20110111224543) do
     t.string   "salt",               :limit => 128
     t.string   "confirmation_token", :limit => 128
     t.string   "remember_token",     :limit => 128
-    t.datetime "created_at"
-    t.datetime "updated_at"
+    t.datetime "created_at",                        :null => false
+    t.datetime "updated_at",                        :null => false
   end
 
   add_index "users", ["email"], :name => "index_users_on_email"

data/gemfiles/3.0.12.gemfile.lock

@@ -1,5 +1,5 @@
 PATH
-  remote: /home/mike/lib/clearance
+  remote: /home/mike/clearance
   specs:
     clearance (0.16.2)
       diesel (~> 0.1.5)

data/gemfiles/3.1.4.gemfile.lock

@@ -1,5 +1,5 @@
 PATH
-  remote: /home/mike/lib/clearance
+  remote: /home/mike/clearance
   specs:
     clearance (0.16.2)
       diesel (~> 0.1.5)

data/gemfiles/3.2.3.gemfile.lock

@@ -1,5 +1,5 @@
 PATH
-  remote: /home/mike/lib/clearance
+  remote: /home/mike/clearance
   specs:
     clearance (0.16.2)
       diesel (~> 0.1.5)

data/lib/clearance/version.rb

@@ -1,3 +1,3 @@
 module Clearance
-  VERSION = '0.16.2'
+  VERSION = '0.16.3'
 end

data/spec/controllers/passwords_controller_spec.rb

@@ -153,6 +153,22 @@ describe Clearance::PasswordsController do
       it { should respond_with(:success) }
       it { should render_template(:edit) }
     end
+
+    describe "on PUT to #update with an empty token after the user sets a password" do
+      before do
+        put :update,
+            :user_id => @user.to_param,
+            :token   => @user.confirmation_token,
+            :user    => { :password => 'good password' }
+        put :update,
+            :user_id => @user.to_param,
+            :token   => [nil],
+            :user    => { :password => 'new password' }
+      end
+
+      it { should set_the_flash.to(/double check the URL/i).now }
+      it { should render_template(:new) }
+    end
   end
 
   describe "given two users and user one signs in" do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: clearance
 version: !ruby/object:Gem::Version
-  version: 0.16.2
+  version: 0.16.3
   prerelease: 
 platform: ruby
 authors:
@@ -18,11 +18,11 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-05-11 00:00:00.000000000Z
+date: 2012-06-01 00:00:00.000000000Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
-  requirement: &21019700 !ruby/object:Gem::Requirement
+  requirement: &26263740 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -30,10 +30,10 @@ dependencies:
         version: '3.0'
   type: :runtime
   prerelease: false
-  version_requirements: *21019700
+  version_requirements: *26263740
 - !ruby/object:Gem::Dependency
   name: diesel
-  requirement: &21019200 !ruby/object:Gem::Requirement
+  requirement: &26263200 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -41,10 +41,10 @@ dependencies:
         version: 0.1.5
   type: :runtime
   prerelease: false
-  version_requirements: *21019200
+  version_requirements: *26263200
 - !ruby/object:Gem::Dependency
   name: bundler
-  requirement: &21018740 !ruby/object:Gem::Requirement
+  requirement: &26262720 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -52,10 +52,10 @@ dependencies:
         version: 1.1.0
   type: :development
   prerelease: false
-  version_requirements: *21018740
+  version_requirements: *26262720
 - !ruby/object:Gem::Dependency
   name: appraisal
-  requirement: &21018280 !ruby/object:Gem::Requirement
+  requirement: &26262240 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -63,10 +63,10 @@ dependencies:
         version: 0.4.1
   type: :development
   prerelease: false
-  version_requirements: *21018280
+  version_requirements: *26262240
 - !ruby/object:Gem::Dependency
   name: cucumber-rails
-  requirement: &21017820 !ruby/object:Gem::Requirement
+  requirement: &26254940 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -74,10 +74,10 @@ dependencies:
         version: 1.1.1
   type: :development
   prerelease: false
-  version_requirements: *21017820
+  version_requirements: *26254940
 - !ruby/object:Gem::Dependency
   name: rspec-rails
-  requirement: &21017360 !ruby/object:Gem::Requirement
+  requirement: &26254480 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -85,10 +85,10 @@ dependencies:
         version: 2.9.0
   type: :development
   prerelease: false
-  version_requirements: *21017360
+  version_requirements: *26254480
 - !ruby/object:Gem::Dependency
   name: sqlite3
-  requirement: &21016880 !ruby/object:Gem::Requirement
+  requirement: &26254100 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -96,10 +96,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *21016880
+  version_requirements: *26254100
 - !ruby/object:Gem::Dependency
   name: bourne
-  requirement: &21016280 !ruby/object:Gem::Requirement
+  requirement: &26253520 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -107,10 +107,10 @@ dependencies:
         version: 1.1.2
   type: :development
   prerelease: false
-  version_requirements: *21016280
+  version_requirements: *26253520
 - !ruby/object:Gem::Dependency
   name: timecop
-  requirement: &21015800 !ruby/object:Gem::Requirement
+  requirement: &26253100 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -118,10 +118,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *21015800
+  version_requirements: *26253100
 - !ruby/object:Gem::Dependency
   name: capybara
-  requirement: &21015160 !ruby/object:Gem::Requirement
+  requirement: &26252540 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -129,10 +129,10 @@ dependencies:
         version: 1.1.2
   type: :development
   prerelease: false
-  version_requirements: *21015160
+  version_requirements: *26252540
 - !ruby/object:Gem::Dependency
   name: factory_girl_rails
-  requirement: &21014660 !ruby/object:Gem::Requirement
+  requirement: &26252040 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -140,10 +140,10 @@ dependencies:
         version: 3.1.0
   type: :development
   prerelease: false
-  version_requirements: *21014660
+  version_requirements: *26252040
 - !ruby/object:Gem::Dependency
   name: shoulda-matchers
-  requirement: &21014200 !ruby/object:Gem::Requirement
+  requirement: &26251580 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -151,10 +151,10 @@ dependencies:
         version: 1.1.0
   type: :development
   prerelease: false
-  version_requirements: *21014200
+  version_requirements: *26251580
 - !ruby/object:Gem::Dependency
   name: database_cleaner
-  requirement: &21013820 !ruby/object:Gem::Requirement
+  requirement: &26251200 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -162,10 +162,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *21013820
+  version_requirements: *26251200
 - !ruby/object:Gem::Dependency
   name: launchy
-  requirement: &21013360 !ruby/object:Gem::Requirement
+  requirement: &26250740 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ! '>='
@@ -173,10 +173,10 @@ dependencies:
         version: '0'
   type: :development
   prerelease: false
-  version_requirements: *21013360
+  version_requirements: *26250740
 - !ruby/object:Gem::Dependency
   name: aruba
-  requirement: &21012860 !ruby/object:Gem::Requirement
+  requirement: &26250240 !ruby/object:Gem::Requirement
     none: false
     requirements:
     - - ~>
@@ -184,7 +184,7 @@ dependencies:
         version: 0.4.11
   type: :development
   prerelease: false
-  version_requirements: *21012860
+  version_requirements: *26250240
 description: Rails authentication & authorization with email & password.
 email: support@thoughtbot.com
 executables: []
@@ -294,7 +294,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: 3073685298569405851
+      hash: 1832581337987577676
 required_rubygems_version: !ruby/object:Gem::Requirement
   none: false
   requirements:
@@ -303,10 +303,10 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
       segments:
       - 0
-      hash: 3073685298569405851
+      hash: 1832581337987577676
 requirements: []
 rubyforge_project: 
-rubygems_version: 1.8.11
+rubygems_version: 1.8.10
 signing_key: 
 specification_version: 3
 summary: Rails authentication & authorization with email & password.