devise-pwned_password 0.1.2 → 0.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 9ef262f2244c9c92bd96259982b7fdcdf9b69118
-  data.tar.gz: c409c259481057b56aea0773b49cbe4b192a8847
+  metadata.gz: 33a24728b4d0e4bd0f038f228419b1be59ed1f37
+  data.tar.gz: 48256086d719c039ebe89b0015b3eb5ef0c7e2d6
 SHA512:
-  metadata.gz: 927ccc527b90c8b04e84e4a0d727a83a06ac97b715390c80a12cd511fd9d3645be3aec4ddc7dcc8c2507503a0a9cef60ae9871cd5a4d408727bcc30eb41d7760
-  data.tar.gz: 4eafd2132c7ceb6727e0efd5d059ceb3640988749e11fc471490f4c97efb8bfea4951b2b04dada6c1734e3d1dc7e54790c647d78838fbea0c91df92880fb1e24
+  metadata.gz: e59fdefbc4f327c4cc93bb84532b67e57af8c59bb78270d3c9ec805bdd8319cb19b4a8241506c84daa04413abc5387c0e1ce2de78ee4a986f10fce1b889d1718
+  data.tar.gz: a9731a85f5d23f3c4ba0d67b6928719daa72623d51ae79fee1bd88c895bd638e18247c570e9ff2fcdffc601bb2bc15a985b8f80cb42c91250e921a20b3ff79b5

data/README.md

@@ -20,7 +20,17 @@ Users will receive the following error message if they use a password from the
 PwnedPasswords dataset:
 
 ```
-This password has previously appeared in a data breach and should never be used. Please choose something harder to guess.
+Password has previously appeared in a data breach and should never be used. Please choose something harder to guess.
+```
+
+You can customize this error message by modifying the `devise` YAML file.
+
+```yml
+# config/locales/devise.en.yml
+en:
+  errors:
+    messages:
+      pwned_password: "has previously appeared in a data breach and should never be used. If you've ever used it anywhere before, change it immediately!"
 ```
 
 By default passwords are rejected if they appear at all in the data set.
@@ -34,6 +44,16 @@ a certain number of times in the data set:
 config.min_password_matches = 10
 ```
 
+By default responses from the PwnedPasswords API are timed out after 5 seconds
+to reduce potential latency problems.
+Optionally, you can add the following snippet to `config/initializers/devise.rb`
+to control the timeout settings:
+
+```ruby
+config.pwned_password_open_timeout = 1
+config.pwned_password_read_timeout = 2
+```
+
 ## Installation
 Add this line to your application's Gemfile:
 

data/Rakefile

@@ -2,7 +2,7 @@
 
 begin
   require "bundler/setup"
-  require 'bundler/gem_tasks'
+  require "bundler/gem_tasks"
 rescue LoadError
   puts "You must `gem install bundler` and `bundle install` to run rake tasks"
 end

data/lib/devise/pwned_password/locales/en.yml

@@ -0,0 +1,4 @@
+en:
+  errors:
+    messages:
+      pwned_password: "has previously appeared in a data breach and should never be used. Please choose something harder to guess."

data/lib/devise/pwned_password/model.rb

@@ -13,11 +13,13 @@ module Devise
       extend ActiveSupport::Concern
 
       included do
-        validate :not_pwned_password
+        validate :not_pwned_password, if: :password_required?
       end
 
       module ClassMethods
         Devise::Models.config(self, :min_password_matches)
+        Devise::Models.config(self, :pwned_password_open_timeout)
+        Devise::Models.config(self, :pwned_password_read_timeout)
       end
 
       private
@@ -43,10 +45,15 @@ module Devise
 
           uri = URI.parse("https://api.pwnedpasswords.com/range/#{prefix}")
 
-          Net::HTTP.start(uri.host, uri.port, use_ssl: true) do |http|
-            request = Net::HTTP::Get.new(uri.request_uri, "User-Agent" => userAgent)
-            response = http.request request
-            return usage_count(response.read_body, suffix) >= self.class.min_password_matches
+          begin
+            Net::HTTP.start(uri.host, uri.port, use_ssl: true, open_timeout: self.class.pwned_password_open_timeout, read_timeout: self.class.pwned_password_read_timeout) do |http|
+              request = Net::HTTP::Get.new(uri.request_uri, "User-Agent" => userAgent)
+              response = http.request request
+              return false unless response.is_a?(Net::HTTPSuccess)
+              return usage_count(response.read_body, suffix) >= self.class.min_password_matches
+            end
+          rescue StandardError
+            return false
           end
 
           false
@@ -55,8 +62,7 @@ module Devise
         def not_pwned_password
           # This deliberately fails silently on 500's etc. Most apps wont want to tie the ability to sign up customers to the availability of a third party API
           if password_pwned?(password)
-            # Error message taken from https://haveibeenpwned.com/Passwords
-            errors.add(:password, "This password has previously appeared in a data breach and should never be used. Please choose something harder to guess.")
+            errors.add(:password, :pwned_password)
           end
         end
     end

data/lib/devise/pwned_password/version.rb

@@ -2,6 +2,6 @@
 
 module Devise
   module PwnedPassword
-    VERSION = "0.1.2"
+    VERSION = "0.1.3"
   end
 end

data/lib/devise/pwned_password.rb

@@ -4,11 +4,17 @@ require "devise"
 require "devise/pwned_password/model"
 
 module Devise
-  mattr_accessor :min_password_matches
+  mattr_accessor :min_password_matches, :pwned_password_open_timeout, :pwned_password_read_timeout
   @@min_password_matches = 1
+  @@pwned_password_open_timeout = 5
+  @@pwned_password_read_timeout = 5
 
   module PwnedPassword
   end
 end
 
+# Load default I18n
+#
+I18n.load_path.unshift File.join(File.dirname(__FILE__), *%w[pwned_password locales en.yml])
+
 Devise.add_module :pwned_password, model: "devise_pwned_password/model"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: devise-pwned_password
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.1.3
 platform: ruby
 authors:
 - Michael Banfield
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-02-25 00:00:00.000000000 Z
+date: 2018-03-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -78,6 +78,7 @@ files:
 - README.md
 - Rakefile
 - lib/devise/pwned_password.rb
+- lib/devise/pwned_password/locales/en.yml
 - lib/devise/pwned_password/model.rb
 - lib/devise/pwned_password/version.rb
 - lib/tasks/devise/pwned_password_tasks.rake